Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionThe JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref.
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker1973990
Fix commitf639eb380aad (firefox) +3/-3
CISA KEVNot listed
CreditedShaheen Fazim
Disclosed2025-07-22

Files Changed

  • js/src/vm/AsyncIteration.cpp
diff --git a/js/src/vm/AsyncIteration.cpp b/js/src/vm/AsyncIteration.cpp
index d7529d333b9..178b5028211 100644
--- a/js/src/vm/AsyncIteration.cpp
+++ b/js/src/vm/AsyncIteration.cpp
@@ -313,9 +313,6 @@ AsyncGeneratorRequest* AsyncGeneratorRequest::create(
 // Stesp 10-13.
 [[nodiscard]] static bool AsyncGeneratorYield(
     JSContext* cx, Handle<AsyncGeneratorObject*> generator, HandleValue value) {
-  // Step 13.a.
-  generator->setSuspendedYield();
-
   // Step 10. Perform
   //          ! AsyncGeneratorCompleteStep(generator, completion, false,
   //                                       previousRealm).
@@ -323,6 +320,9 @@ AsyncGeneratorRequest* AsyncGeneratorRequest::create(
     return false;
   }
 
+  // Step 13.a.
+  generator->setSuspendedYield();
+
   // Steps 11-13.
   return AsyncGeneratorDrainQueue(cx, generator);
 }
Loading diff…