High firefox Race 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionRace condition in the Graphics component
ComponentGraphics
Bug ClassRace
Tracker1991458
Fix commite416ceb191fa (firefox) +13/-4
CISA KEVNot listed
CreditedIrvan Kurniawan
Disclosed2025-11-11

Changed Functions

FunctionChangeNotes
if
gfx/thebes/gfxPlatform.cpp
modified

Files Changed

  • gfx/thebes/gfxPlatform.cpp
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index ea53a98cceb..7b0522442f2 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -198,7 +198,9 @@ class CrashStatsLogForwarder : public mozilla::gfx::LogForwarder {
 
  private:
   // Helper for the Log()
-  void UpdateCrashReport();
+  void UpdateCrashReport(const MutexAutoLock& aProofOfLock);
+  bool UpdateStringsVectorInternal(const std::string& aString,
+                                   const MutexAutoLock& aProofOfLock);
 
  private:
   LoggingRecord mBuffer;
@@ -227,6 +229,12 @@ LoggingRecord CrashStatsLogForwarder::LoggingRecordCopy() {
 }
 
 bool CrashStatsLogForwarder::UpdateStringsVector(const std::string& aString) {
+  MutexAutoLock lock(mMutex);
+  return UpdateStringsVectorInternal(aString, lock);
+}
+
+bool CrashStatsLogForwarder::UpdateStringsVectorInternal(
+    const std::string& aString, const MutexAutoLock& aProofOfLock) {
   // We want at least the first one and the last one.  Otherwise, no point.
   if (mMaxCapacity < 2) {
     return false;
@@ -254,7 +262,8 @@ bool CrashStatsLogForwarder::UpdateStringsVector(const std::string& aString) {
   return true;
 }
 
-void CrashStatsLogForwarder::UpdateCrashReport() {
+void CrashStatsLogForwarder::UpdateCrashReport(
+    const MutexAutoLock& aProofOfLock) {
   std::stringstream message;
   std::string logAnnotation;
 
@@ -321,8 +330,8 @@ void CrashStatsLogForwarder::Log(const std::string& aString) {
   PROFILER_MARKER_TEXT("gfx::CriticalError", GRAPHICS, {},
                        nsDependentCString(aString.c_str()));
 
-  if (UpdateStringsVector(aString)) {
-    UpdateCrashReport();
+  if (UpdateStringsVectorInternal(aString, lock)) {
+    UpdateCrashReport(lock);
   }
 
   // Add it to the parent strings
Loading diff…