Firefox · SpiderMonkey
CVE-2025-0241
Logic Error in SpiderMonkey
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/builtin/intl/Segmenter.cppjs/src/builtin/intl/Segmenter.h
Patch
diff --git a/js/src/builtin/intl/Segmenter.cpp b/js/src/builtin/intl/Segmenter.cpp
index 437a2f1a5d6..ab1f09a87be 100644
--- a/js/src/builtin/intl/Segmenter.cpp
+++ b/js/src/builtin/intl/Segmenter.cpp
@@ -574,7 +574,7 @@ static void DestroyBreakIterator(const T* segments) {
void* brk = segments->getBreakIterator();
MOZ_ASSERT(brk);
- bool isLatin1 = segments->getString()->hasLatin1Chars();
+ bool isLatin1 = segments->hasLatin1StringChars();
switch (segments->getGranularity()) {
case SegmenterGranularity::Grapheme: {
@@ -660,7 +660,7 @@ static Boundaries FindBoundaryFrom(Handle<T*> segments, int32_t index) {
template <typename T>
static Boundaries GraphemeBoundaries(Handle<T*> segments, int32_t index) {
#if defined(MOZ_ICU4X)
- if (segments->getString()->hasLatin1Chars()) {
+ if (segments->hasLatin1StringChars()) {
return FindBoundaryFrom<GraphemeClusterSegmenter::BreakIteratorLatin1>(
segments, index);
}
@@ -674,7 +674,7 @@ static Boundaries GraphemeBoundaries(Handle<T*> segments, int32_t index) {
template <typename T>
static Boundaries WordBoundaries(Handle<T*> segments, int32_t index) {
#if defined(MOZ_ICU4X)
- if (segments->getString()->hasLatin1Chars()) {
+ if (segments->hasLatin1StringChars()) {
return FindBoundaryFrom<WordSegmenter::BreakIteratorLatin1>(segments,
index);
}
@@ -687,7 +687,7 @@ static Boundaries WordBoundaries(Handle<T*> segments, int32_t index) {
template <typename T>
static Boundaries SentenceBoundaries(Handle<T*> segments, int32_t index) {
#if defined(MOZ_ICU4X)
- if (segments->getString()->hasLatin1Chars()) {
+ if (segments->hasLatin1StringChars()) {
return FindBoundaryFrom<SentenceSegmenter::BreakIteratorLatin1>(segments,
index);
}
@@ -782,7 +782,7 @@ static bool EnsureBreakIterator(JSContext* cx, Handle<T*> segments,
}
#if defined(MOZ_ICU4X)
- bool isLatin1 = segments->getString()->hasLatin1Chars();
+ bool isLatin1 = segments->hasLatin1StringChars();
// Create a new break iterator based on the granularity and character type.
void* brk;
diff --git a/js/src/builtin/intl/Segmenter.h b/js/src/builtin/intl/Segmenter.h
index 3b204578b45..2b75b864882 100644
--- a/js/src/builtin/intl/Segmenter.h
+++ b/js/src/builtin/intl/Segmenter.h
@@ -198,6 +198,11 @@ class SegmentsObject : public NativeObject {
setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars.tagged()));
}
+ bool hasLatin1StringChars() const {
+ MOZ_ASSERT(hasStringChars());
+ return getStringChars().has<JS::Latin1Char>();
+ }
+
int32_t getIndex() const {
const auto& slot = getFixedSlot(INDEX_SLOT);
if (slot.isUndefined()) {
@@ -295,6 +300,11 @@ class SegmentIteratorObject : public NativeObject {
setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars.tagged()));
}
+ bool hasLatin1StringChars() const {
+ MOZ_ASSERT(hasStringChars());
+ return getStringChars().has<JS::Latin1Char>();
+ }
+
int32_t getIndex() const {
const auto& slot = getFixedSlot(INDEX_SLOT);
if (slot.isUndefined()) {
Loading diff…
References
On This Page