Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInvalid pointer in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2014549
Fix commitd019676b9c39 (firefox) +29/-22
CISA KEVNot listed
CreditedEvyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
dom/html/HTMLDialogElement.cpp
modified

Files Changed

  • dom/html/HTMLDialogElement.cpp
  • dom/html/HTMLDialogElement.h
diff --git a/dom/html/HTMLDialogElement.cpp b/dom/html/HTMLDialogElement.cpp
index a0e7cf681f6..a202ad2e700 100644
--- a/dom/html/HTMLDialogElement.cpp
+++ b/dom/html/HTMLDialogElement.cpp
@@ -71,7 +71,7 @@ class DialogCloseWatcherListener : public nsIDOMEventListener {
         // 3. - closeAction being to close the dialog given dialog, dialog's
         // request close return value, and dialog's request close source
         // element.
-        Optional<nsAString> retValue;
+        Maybe<nsAutoString> retValue;
         dialog->GetRequestCloseReturnValue(retValue);
         RefPtr<Element> source = dialog->GetRequestCloseSourceElement();
         dialog->Close(source, retValue);
@@ -144,8 +144,8 @@ bool HTMLDialogElement::ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
 
 // https://html.spec.whatwg.org/#dom-dialog-close
 // https://html.spec.whatwg.org/#close-the-dialog
-void HTMLDialogElement::Close(
-    Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue) {
+void HTMLDialogElement::Close(Element* aSource,
+                              const Maybe<nsAutoString>& aReturnValue) {
   // 1. If subject does not have an open attribute, then return.
   if (!Open()) {
     return;
@@ -176,8 +176,8 @@ void HTMLDialogElement::Close(
 
   // 9. If result is not null, then set subject's returnValue attribute to
   // result.
-  if (aReturnValue.WasPassed()) {
-    SetReturnValue(aReturnValue.Value());
+  if (aReturnValue.isSome()) {
+    SetReturnValue(aReturnValue.ref());
   }
 
   // 10. Set subject's request close return value to null.
@@ -217,8 +217,8 @@ void HTMLDialogElement::Close(
 
 // https://html.spec.whatwg.org/#dom-dialog-requestclose
 // https://html.spec.whatwg.org/#dialog-request-close
-void HTMLDialogElement::RequestClose(
-    Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue) {
+void HTMLDialogElement::RequestClose(Element* aSource,
+                                     const Maybe<nsAutoString>& aReturnValue) {
   RefPtr closeWatcher = mCloseWatcher;
   // 1. If subject does not have an open attribute, then return.
   if (!Open()) {
@@ -245,8 +245,8 @@ void HTMLDialogElement::RequestClose(
   }
 
   // 5. Set subject's request close return value to returnValue.
-  if (aReturnValue.WasPassed()) {
-    SetRequestCloseReturnValue(aReturnValue.Value());
+  if (aReturnValue.isSome()) {
+    SetRequestCloseReturnValue(aReturnValue.ref());
   }
 
   // 6. Set subject's request close source element to source.
@@ -624,7 +624,7 @@ void HTMLDialogElement::RunCancelDialogSteps() {
   // the spec, over CloseWatcher though, so one day this code will need to be
   // refactored when the CloseWatcher specifications settle.
   if (defaultAction) {
-    Optional<nsAString> retValue;
+    Maybe<nsAutoString> retValue;
     GetRequestCloseReturnValue(retValue);
     RefPtr<Element> source = GetRequestCloseSourceElement();
     Close(source, retValue);
@@ -648,19 +648,18 @@ bool HTMLDialogElement::HandleCommandInternal(Element* aSource,
 
   if ((aCommand == Command::Close || aCommand == Command::RequestClose) &&
       Open()) {
-    Optional<nsAString> retValueOpt;
-    nsString retValue;
+    Maybe<nsAutoString> retValue;
     if (aSource->HasAttr(nsGkAtoms::value)) {
       if (auto* button = HTMLButtonElement::FromNodeOrNull(aSource)) {
-        button->GetValue(retValue);
-        retValueOpt = &retValue;
+        retValue.emplace();
+        button->GetValue(retValue.ref());
       }
     }
     if (aCommand == Command::Close) {
-      Close(aSource, retValueOpt);
+      Close(aSource, retValue);
     } else {
       MOZ_ASSERT(aCommand == Command::RequestClose);
-      RequestClose(aSource, retValueOpt);
+      RequestClose(aSource, retValue);
     }
     return true;
   }
diff --git a/dom/html/HTMLDialogElement.h b/dom/html/HTMLDialogElement.h
index a45dbf9b191..d265f5a287b 100644
--- a/dom/html/HTMLDialogElement.h
+++ b/dom/html/HTMLDialogElement.h
@@ -59,9 +59,9 @@ class HTMLDialogElement final : public nsGenericHTMLElement {
     mReturnValue = aReturnValue;
   }
 
-  void GetRequestCloseReturnValue(Optional<nsAString>& aReturnValue) {
+  void GetRequestCloseReturnValue(Maybe<nsAutoString>& aReturnValue) {
     if (mRequestCloseReturnValue.isSome()) {
-      aReturnValue = &mRequestCloseReturnValue.ref();
+      aReturnValue.emplace(mRequestCloseReturnValue.ref());
     }
   }
   void ClearRequestCloseReturnValue() { mRequestCloseReturnValue.reset(); }
@@ -74,16 +74,24 @@ class HTMLDialogElement final : public nsGenericHTMLElement {
 
   MOZ_CAN_RUN_SCRIPT_BOUNDARY void Close(
       const mozilla::dom::Optional<nsAString>& aReturnValue) {
-    return Close(nullptr, aReturnValue);
+    Maybe<nsAutoString> retValueCopy;
+    if (aReturnValue.WasPassed()) {
+      retValueCopy.emplace(aReturnValue.Value());
+    }
+    return Close(nullptr, retValueCopy);
   }
   MOZ_CAN_RUN_SCRIPT_BOUNDARY void Close(
-      Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue);
+      Element* aSource, const Maybe<nsAutoString>& aReturnValue);
   MOZ_CAN_RUN_SCRIPT void RequestClose(
       const mozilla::dom::Optional<nsAString>& aReturnValue) {
-    RequestClose(nullptr, aReturnValue);
+    Maybe<nsAutoString> retValueCopy;
+    if (aReturnValue.WasPassed()) {
+      retValueCopy.emplace(aReturnValue.Value());
+    }
+    RequestClose(nullptr, retValueCopy);
   }
   MOZ_CAN_RUN_SCRIPT_BOUNDARY void RequestClose(
-      Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue);
+      Element* aSource, const Maybe<nsAutoString>& aReturnValue);
 
   RefPtr<Element> GetRequestCloseSourceElement();
 
Loading diff…