Firefox · Layout
CVE-2026-92024
Logic Error in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/svg/SVGObserverUtils.cpp |
modified |
Files Changed
layout/svg/SVGObserverUtils.cpplayout/svg/SVGTextFrame.cpp
Patch
diff --git a/layout/svg/SVGObserverUtils.cpp b/layout/svg/SVGObserverUtils.cpp
index eaa76970897..cab63a80839 100644
--- a/layout/svg/SVGObserverUtils.cpp
+++ b/layout/svg/SVGObserverUtils.cpp
@@ -589,6 +589,10 @@ void SVGTextPathObserver::OnRenderingChange() {
if (text) {
text->AddStateBits(NS_STATE_SVG_POSITIONING_DIRTY);
+ if (text->HasAnyStateBits(NS_STATE_SVG_TEXT_IN_REFLOW)) {
+ return;
+ }
+
if (SVGUtils::AnyOuterSVGIsCallingReflowSVG(text)) {
text->AddStateBits(NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN);
if (text->HasAnyStateBits(NS_FRAME_IS_NONDISPLAY)) {
diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
index 9742f75d847..9dbac9dac6a 100644
--- a/layout/svg/SVGTextFrame.cpp
+++ b/layout/svg/SVGTextFrame.cpp
@@ -2915,7 +2915,7 @@ void SVGTextFrame::ReflowSVGNonDisplayText() {
// We had a style change, so we mark this frame as dirty so that the next
// time it is painted, we reflow the anonymous block frame.
- this->MarkSubtreeDirty();
+ MarkSubtreeDirty();
// Finally, we need to actually reflow the anonymous block frame and update
// mPositions, in case we are being reflowed immediately after a DOM
@@ -5161,8 +5161,8 @@ void SVGTextFrame::MaybeReflowAnonymousBlockChild() {
return;
}
- NS_ASSERTION(!kid->HasAnyStateBits(NS_FRAME_IN_REFLOW),
- "should not be in reflow when about to reflow again");
+ MOZ_ASSERT(!kid->HasAnyStateBits(NS_FRAME_IN_REFLOW),
+ "should not be in reflow when about to reflow again");
if (IsSubtreeDirty()) {
if (HasAnyStateBits(NS_FRAME_IS_DIRTY)) {
Loading diff…
References
On This Page