wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-04 06:48:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2765 - Follow-up: Fix UAF when returning the non-NAC style context from a frameless node

Browse source
This commit is contained in:
Francis Dominic Fajardo 2025-06-27 23:43:23 +08:00 • committed by roytam1
commit 6e358f1039
6 changed files with 8 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
layout/base/nsLayoutUtils.cpp
View file

@ -9338,7 +9338,7 @@ nsLayoutUtils::ComputeGeometryBox(nsIFrame* aFrame,
return r;
}
/* static */ nsStyleContext*
/* static */ already_AddRefed<nsStyleContext>
nsLayoutUtils::GetNonAnonymousStyleContext(nsIFrame* aFrame)
{
nsIContent* node = aFrame->GetContent();
@ -9348,7 +9348,7 @@ nsLayoutUtils::GetNonAnonymousStyleContext(nsIFrame* aFrame)
}
MOZ_ASSERT(node, "Native anonymous element with no originating node?");
if (nsIFrame* primaryFrame = node->GetPrimaryFrame()) {
return primaryFrame->StyleContext();
return RefPtr<nsStyleContext>(primaryFrame->StyleContext()).forget();
}
// If the element doesn't have primary frame, get the computed style
// from the element directly.
@ -9356,9 +9356,5 @@ nsLayoutUtils::GetNonAnonymousStyleContext(nsIFrame* aFrame)
MOZ_ASSERT(node == pc->Document()->GetRootElement(),
"Root element is the only case for this fallback "
"path to be triggered");
RefPtr<nsStyleContext> styleContext =
pc->StyleSet()->ResolveStyleFor(node->AsElement(), nullptr);
// Dropping the strong reference is fine because the style should be
// held strongly by the element.
return styleContext.get();
return pc->StyleSet()->ResolveStyleFor(node->AsElement(), nullptr);
}