Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionThe JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref.
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker1973990
Fix commitf639eb380aad (firefox) +3/-3
CISA KEVNot listed
CreditedShaheen Fazim
Disclosed2025-07-22

Files Changed

  • js/src/vm/AsyncIteration.cpp
diff --git a/js/src/vm/AsyncIteration.cpp b/js/src/vm/AsyncIteration.cpp
index d7529d333b9..178b5028211 100644
--- a/js/src/vm/AsyncIteration.cpp
+++ b/js/src/vm/AsyncIteration.cpp
@@ -313,9 +313,6 @@ AsyncGeneratorRequest* AsyncGeneratorRequest::create(
 // Stesp 10-13.
 [[nodiscard]] static bool AsyncGeneratorYield(
     JSContext* cx, Handle<AsyncGeneratorObject*> generator, HandleValue value) {
-  // Step 13.a.
-  generator->setSuspendedYield();
-
   // Step 10. Perform
   //          ! AsyncGeneratorCompleteStep(generator, completion, false,
   //                                       previousRealm).
@@ -323,6 +320,9 @@ AsyncGeneratorRequest* AsyncGeneratorRequest::create(
     return false;
   }
 
+  // Step 13.a.
+  generator->setSuspendedYield();
+
   // Steps 11-13.
   return AsyncGeneratorDrainQueue(cx, generator);
 }
Loading diff…