High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSite isolation issue in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2060295
Fix commitdfc601359983 (firefox) +6/-0
CISA KEVNot listed
CreditedSteven Julian
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
if
gfx/layers/opengl/TextureHostOGL.cpp
modified

Files Changed

  • gfx/layers/composite/TextureHost.cpp
  • gfx/layers/opengl/TextureHostOGL.cpp
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 0b5d738d331..48394a9475b 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -995,6 +995,7 @@ bool TextureParent::Init(const SurfaceDescriptor& aSharedData,
                          ReadLockDescriptor&& aReadLock,
                          const LayersBackend& aBackend,
                          const TextureFlags& aFlags) {
+  MOZ_ASSERT(mSurfaceAllocator);
   mTextureHost =
       TextureHost::Create(aSharedData, std::move(aReadLock), mSurfaceAllocator,
                           aBackend, aFlags, mExternalImageId);
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index c0717f67c4d..ef42d34d4a1 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -74,6 +74,11 @@ already_AddRefed<TextureHost> CreateTextureHostOGL(
       break;
     }
     case SurfaceDescriptor::TSurfaceDescriptorAndroidHardwareBuffer: {
+      if (aDeallocator) {
+        gfxCriticalError() << "SurfaceDescriptorAndroidHardwareBuffer is used "
+                              "only for remote texture";
+        return nullptr;
+      }
       const SurfaceDescriptorAndroidHardwareBuffer& desc =
           aDesc.get_SurfaceDescriptorAndroidHardwareBuffer();
       result = AndroidHardwareBufferTextureHost::Create(aFlags, desc);
Loading diff…