tor-browser

commit 36b64769782b9fb16d0a29a638752d3f809be426
parent 892291a2d2ede3da5a9bc7546337c422cb57f8db
Author: Emilio Cobos Álvarez <emilio@crisal.io>
Date:   Fri,  3 Oct 2025 12:28:05 +0000

Bug 1992195 - Add missing null-check to screen logging code. r=stransky

This missing null-check is causing the optimizer to remove the array
bounds check in SafeElementAt(), returning an out of bounds element
which is potentially already freed to the caller.

Differential Revision: https://phabricator.services.mozilla.com/D267392

Diffstat:
M
widget/gtk/ScreenHelperGTK.cpp
 | 
13
++++++++-----

1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/widget/gtk/ScreenHelperGTK.cpp b/widget/gtk/ScreenHelperGTK.cpp
@@ -586,11 +586,14 @@ RefPtr<Screen> ScreenHelperGTK::GetScreenForWindow(nsWindow* aWindow) {
       RefPtr<Screen> screen =
           ScreenManager::GetSingleton().CurrentScreenList().SafeElementAt(
               index);
-#ifdef MOZ_LOGGING
-      auto rect = screen->GetRect();
-      LOG_SCREEN("GetScreenForWindow() [%p] [%d] screen [%d, %d] -> [%d x %d]",
-                 aWindow, index, rect.x, rect.y, rect.width, rect.height);
-#endif
+      if (!screen) {
+        LOG_SCREEN(
+            "GetScreenForWindow() [%p] [%d] found monitor %p but no screen",
+            aWindow, index, monitor);
+        return nullptr;
+      }
+      LOG_SCREEN("GetScreenForWindow() [%p] [%d] screen %s", aWindow, index,
+                 ToString(screen->GetRect()).c_str());
       return screen.forget();
     }
   }