Issue #2765 - Follow-up: Fix UAF when returning the non-NAC style context from a frameless node

This commit is contained in:
Francis Dominic Fajardo 2025-06-27 23:43:23 +08:00 committed by roytam1
commit 6e358f1039
6 changed files with 8 additions and 12 deletions

View file

@ -1058,7 +1058,7 @@ nsHTMLScrollFrame::Reflow(nsPresContext* aPresContext,
// This is only needed for root element because scrollbars of non-
// root elements with "scrollbar-width: none" is already suppressed
// in ScrollFrameHelper::CreateAnonymousContent.
nsStyleContext* scrollbarStyle = nsLayoutUtils::GetNonAnonymousStyleContext(this);
RefPtr<nsStyleContext> scrollbarStyle = nsLayoutUtils::GetNonAnonymousStyleContext(this);
auto scrollbarWidth = scrollbarStyle->StyleUIReset()->mScrollbarWidth;
if (scrollbarWidth == StyleScrollbarWidth::None) {
state.mVScrollbar = ShowScrollbar::Never;