Firefox · Layout
CVE-2026-84126
Logic Error in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forlayout/generic/nsGridContainerFrame.cpp |
modified | |
iflayout/generic/nsGridContainerFrame.cpp |
modified |
Files Changed
layout/generic/nsGridContainerFrame.cpp
Patch
diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index 848d138e09c..15c011ea0d2 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -8307,14 +8307,16 @@ nscoord nsGridContainerFrame::ReflowInFragmentainer(
// Set |endRow| to the first row that doesn't fit.
uint32_t endRow = numRows;
- for (uint32_t row = startRow; row < numRows; ++row) {
- auto& sz = aGridRI.mRows.mSizes[row];
- const nscoord bEnd = sz.mPosition + sz.mBase;
- nscoord remainingAvailableSize = childAvailableSize - bEnd;
- if (remainingAvailableSize < 0 ||
- (isBDBClone && remainingAvailableSize < bpBEnd)) {
- endRow = row;
- break;
+ if (childAvailableSize != NS_UNCONSTRAINEDSIZE) {
+ for (uint32_t row = startRow; row < numRows; ++row) {
+ auto& sz = aGridRI.mRows.mSizes[row];
+ const nscoord bEnd = sz.mPosition + sz.mBase;
+ nscoord remainingAvailableSize = childAvailableSize - bEnd;
+ if (remainingAvailableSize < 0 ||
+ (isBDBClone && remainingAvailableSize < bpBEnd)) {
+ endRow = row;
+ break;
+ }
}
}
@@ -8405,8 +8407,10 @@ nscoord nsGridContainerFrame::ReflowInFragmentainer(
aGridRI.mReflowInput->ComputedBSize());
}
- // Check for overflow and set aStatus INCOMPLETE if so.
- bool overflow = bSize + bpBEnd > childAvailableSize;
+ // Check for overflow and set aStatus INCOMPLETE if so. Note that we should
+ // not overflow an unconstrained available block-size.
+ const bool overflow = childAvailableSize != NS_UNCONSTRAINEDSIZE &&
+ bSize + bpBEnd > childAvailableSize;
if (overflow) {
if (avoidBreakInside) {
aStatus.SetInlineLineBreakBeforeAndReset();
@@ -8467,7 +8471,7 @@ nscoord nsGridContainerFrame::ReflowInFragmentainer(
aStatus.SetOverflowIncomplete();
aStatus.SetNextInFlowNeedsReflow();
}
- } else {
+ } else if (childAvailableSize != NS_UNCONSTRAINEDSIZE) {
// Children always have the full size of the rows in this fragment.
childAvailableSize = std::max(childAvailableSize, bEndRow);
}
Loading diff…
References
On This Page