Firefox · Networking
CVE-2026-100767
Logic Error in Networking
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
DeleteCacheIndexRecordWrappernetwerk/cache2/CacheIndex.cpp |
modified | |
mWrappernetwerk/cache2/CacheIndex.cpp |
modified | |
ifnetwerk/cache2/CacheIndex.cpp |
modified | |
CacheIndexRecordWrappernetwerk/cache2/CacheIndex.h |
modified | |
CacheIndexEntrynetwerk/cache2/CacheIndex.h |
modified |
Files Changed
netwerk/cache2/CacheIndex.cppnetwerk/cache2/CacheIndex.h
Patch
diff --git a/netwerk/cache2/CacheIndex.cpp b/netwerk/cache2/CacheIndex.cpp
index a73f057ac2d..c2125c815ce 100644
--- a/netwerk/cache2/CacheIndex.cpp
+++ b/netwerk/cache2/CacheIndex.cpp
@@ -72,52 +72,6 @@ class FrecencyComparator {
} // namespace
-// used to dispatch a wrapper deletion the caller's thread
-// cannot be used on IOThread after shutdown begins
-class DeleteCacheIndexRecordWrapper : public Runnable {
- CacheIndexRecordWrapper* mWrapper;
-
- public:
- explicit DeleteCacheIndexRecordWrapper(CacheIndexRecordWrapper* wrapper)
- : Runnable("net::CacheIndex::DeleteCacheIndexRecordWrapper"),
- mWrapper(wrapper) {}
- NS_IMETHOD Run() override {
- StaticMutexAutoLock lock(CacheIndex::sLock);
-
- // if somehow the item is still in the frecency storage, remove it
- RefPtr<CacheIndex> index = CacheIndex::gInstance;
- if (index) {
- bool found = index->mFrecencyStorage.RecordExistedUnlocked(mWrapper);
- if (found) {
- LOG(
- ("DeleteCacheIndexRecordWrapper::Run() - \
- record wrapper found in frecency storage during deletion"));
- index->mFrecencyStorage.RemoveRecord(mWrapper, lock);
- }
- }
-
- delete mWrapper;
- return NS_OK;
- }
-};
-
-void CacheIndexRecordWrapper::DispatchDeleteSelfToCurrentThread() {
- // Dispatch during shutdown will not trigger DeleteCacheIndexRecordWrapper
- nsCOMPtr<nsIRunnable> event = new DeleteCacheIndexRecordWrapper(this);
- MOZ_ALWAYS_SUCCEEDS(NS_DispatchToCurrentThread(event));
-}
-
-CacheIndexRecordWrapper::~CacheIndexRecordWrapper() {
-#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
- CacheIndex::sLock.AssertCurrentThreadOwns();
- RefPtr<CacheIndex> index = CacheIndex::gInstance;
- if (index) {
- bool found = index->mFrecencyStorage.RecordExistedUnlocked(this);
- MOZ_DIAGNOSTIC_ASSERT(!found);
- }
-#endif
-}
-
/**
* This helper class is responsible for keeping CacheIndex::mIndexStats and
* CacheIndex::mFrecencyStorage up to date.
@@ -3487,7 +3441,8 @@ void CacheIndex::FrecencyStorage::AppendRecord(
"hash=%08x%08x%08x"
"%08x%08x]",
aRecord, LOGSHA1(aRecord->Get()->mHash)));
- MOZ_DIAGNOSTIC_ASSERT(!mRecs.Contains(aRecord));
+ MOZ_RELEASE_ASSERT(!mRecs.Contains(aRecord),
+ "Record is already in the frecency storage");
mRecs.PutEntry(aRecord);
}
diff --git a/netwerk/cache2/CacheIndex.h b/netwerk/cache2/CacheIndex.h
index d313cc8c6ac..6458b684700 100644
--- a/netwerk/cache2/CacheIndex.h
+++ b/netwerk/cache2/CacheIndex.h
@@ -127,17 +127,14 @@ static_assert(sizeof(CacheIndexRecord::mHash) +
class CacheIndexRecordWrapper final {
public:
- NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_DESTROY(
- CacheIndexRecordWrapper, DispatchDeleteSelfToCurrentThread());
+ NS_INLINE_DECL_THREADSAFE_REFCOUNTING(CacheIndexRecordWrapper)
CacheIndexRecordWrapper() : mRec(MakeUnique<CacheIndexRecord>()) {}
CacheIndexRecord* Get() { return mRec.get(); }
private:
- ~CacheIndexRecordWrapper();
- void DispatchDeleteSelfToCurrentThread();
+ ~CacheIndexRecordWrapper() = default;
UniquePtr<CacheIndexRecord> mRec;
- friend class DeleteCacheIndexRecordWrapper;
};
class CacheIndexEntry : public PLDHashEntryHdr {
@@ -873,7 +870,6 @@ class CacheIndex final : public CacheFileIOListener, public nsIRunnable {
friend class FileOpenHelper;
friend class CacheIndexIterator;
friend class CacheIndexRecordWrapper;
- friend class DeleteCacheIndexRecordWrapper;
virtual ~CacheIndex();
Loading diff…
References
On This Page