Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the JavaScript: GC component
ComponentSpiderMonkey
Bug ClassUAF
Tracker2003607
Fix commit1682fec657a9 (firefox) +7/-0
CISA KEVNot listed
CreditedIrvan Kurniawan
Disclosed2026-01-13

Changed Functions

FunctionChangeNotes
if
js/src/gc/BufferAllocator.cpp
modified

Files Changed

  • js/src/gc/BufferAllocator.cpp
diff --git a/js/src/gc/BufferAllocator.cpp b/js/src/gc/BufferAllocator.cpp
index 66a5a9537ed..95de28d06dd 100644
--- a/js/src/gc/BufferAllocator.cpp
+++ b/js/src/gc/BufferAllocator.cpp
@@ -1375,6 +1375,13 @@ void BufferAllocator::abortMajorSweeping(const AutoLock& lock) {
 
   clearAllocatedDuringCollectionState(lock);
 
+  if (minorState == State::Sweeping) {
+    // If we are minor sweeping then chunks with allocatedDuringCollection set
+    // may be present in |mixedChunksToSweep|. Set a flag so these are cleared
+    // when they are merged later.
+    majorFinishedWhileMinorSweeping = true;
+  }
+
   for (BufferChunk* chunk : tenuredChunksToSweep.ref()) {
     MOZ_ASSERT(chunk->ownsFreeLists);
 
Loading diff…