Firefox · DOM
CVE-2026-8947
UAF in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
fordom/base/DocumentOrShadowRoot.cpp |
modified |
Files Changed
dom/base/Document.cppdom/base/DocumentOrShadowRoot.cppdom/base/ShadowRoot.cpp
Patch
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index 8c2980c6f7f..e9e0f16a8bc 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -2415,6 +2415,8 @@ Document::~Document() {
mDocGroup->GetBrowsingContextGroup()->RemoveDocument(this, mDocGroup);
}
+ DocumentOrShadowRoot::Unlink(this);
+
UnlinkOriginalDocumentIfStatic();
UnregisterFromMemoryReportingForDataDocument();
diff --git a/dom/base/DocumentOrShadowRoot.cpp b/dom/base/DocumentOrShadowRoot.cpp
index 865007ce49f..a4c5cd10314 100644
--- a/dom/base/DocumentOrShadowRoot.cpp
+++ b/dom/base/DocumentOrShadowRoot.cpp
@@ -62,9 +62,7 @@ void DocumentOrShadowRoot::AddSizeOfExcludingThis(nsWindowSizes& aSizes) const {
}
DocumentOrShadowRoot::~DocumentOrShadowRoot() {
- for (StyleSheet* sheet : mStyleSheets) {
- sheet->ClearAssociatedDocumentOrShadowRoot();
- }
+ MOZ_ASSERT(mStyleSheets.IsEmpty());
}
StyleSheetList* DocumentOrShadowRoot::StyleSheets() {
diff --git a/dom/base/ShadowRoot.cpp b/dom/base/ShadowRoot.cpp
index f44f8c56217..076277292c2 100644
--- a/dom/base/ShadowRoot.cpp
+++ b/dom/base/ShadowRoot.cpp
@@ -119,6 +119,8 @@ ShadowRoot::~ShadowRoot() {
GetCustomElementRegistryState() == CustomElementRegistryState::Scoped) {
CustomElementRegistry::RemoveScopedRegistry(*this);
}
+
+ DocumentOrShadowRoot::Unlink(this);
}
MOZ_DEFINE_MALLOC_SIZE_OF(ShadowRootAuthorStylesMallocSizeOf)
Loading diff…
References
On This Page