Firefox · SpiderMonkey
CVE-2024-8381
Type Confusion in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/vm/Interpreter-inl.h
Patch
diff --git a/js/src/vm/Interpreter-inl.h b/js/src/vm/Interpreter-inl.h
index b70fced9d14..f77d9118477 100644
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -128,7 +128,8 @@ inline bool FetchName(JSContext* cx, HandleObject receiver, HandleObject holder,
}
/* Take the slow path if shape was not found in a native object. */
- if (!receiver->is<NativeObject>() || !holder->is<NativeObject>()) {
+ if (!receiver->is<NativeObject>() || !holder->is<NativeObject>() ||
+ receiver->is<WithEnvironmentObject>()) {
Rooted<jsid> id(cx, NameToId(name));
if (!GetProperty(cx, receiver, receiver, id, vp)) {
return false;
@@ -139,11 +140,8 @@ inline bool FetchName(JSContext* cx, HandleObject receiver, HandleObject holder,
/* Fast path for Object instance properties. */
vp.set(holder->as<NativeObject>().getSlot(propInfo.slot()));
} else {
- // Unwrap 'with' environments for reasons given in
- // GetNameBoundInEnvironment.
- RootedObject normalized(cx, MaybeUnwrapWithEnvironment(receiver));
RootedId id(cx, NameToId(name));
- if (!NativeGetExistingProperty(cx, normalized, holder.as<NativeObject>(),
+ if (!NativeGetExistingProperty(cx, receiver, holder.as<NativeObject>(),
id, propInfo, vp)) {
return false;
}
Loading diff…
References
On This Page