Firefox · DOM
CVE-2026-100771
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/streams/QueueWithSizes.hdom/streams/ReadableByteStreamController.cppdom/streams/ReadableStream.cppdom/streams/WritableStream.cpp
Patch
diff --git a/dom/streams/QueueWithSizes.h b/dom/streams/QueueWithSizes.h
index 59b662eff98..1a4a1adfc94 100644
--- a/dom/streams/QueueWithSizes.h
+++ b/dom/streams/QueueWithSizes.h
@@ -86,7 +86,7 @@ inline void DequeueValue(JSContext* aCx, QueueContainingClass aContainer,
ErrorResult& aRv) {
// Step 1. Implicit via template instantiation.
// Step 2.
- MOZ_ASSERT(!aContainer->Queue().isEmpty());
+ MOZ_RELEASE_ASSERT(!aContainer->Queue().isEmpty());
// Step 3+4
// UniquePtr to ensure memory is freed.
@@ -117,7 +117,7 @@ inline void PeekQueueValue(JSContext* aCx, QueueContainingClass aContainer,
// Step 1. Assert: container has [[queue]] and [[queueTotalSize]] internal
// slots.
// Step 2. Assert: container.[[queue]] is not empty.
- MOZ_ASSERT(!aContainer->Queue().isEmpty());
+ MOZ_RELEASE_ASSERT(!aContainer->Queue().isEmpty());
// Step 3. Let valueWithSize be container.[[queue]][0].
ValueWithSize* valueWithSize = aContainer->Queue().getFirst();
diff --git a/dom/streams/ReadableByteStreamController.cpp b/dom/streams/ReadableByteStreamController.cpp
index 232bf7c5367..dc204c34c3d 100644
--- a/dom/streams/ReadableByteStreamController.cpp
+++ b/dom/streams/ReadableByteStreamController.cpp
@@ -679,7 +679,7 @@ void ReadableStreamFulfillReadIntoRequest(JSContext* aCx,
ReadableStreamBYOBReader* reader = aStream->GetReader()->AsBYOB();
// Step 3. Assert: reader.[[readIntoRequests]] is not empty.
- MOZ_ASSERT(!reader->ReadIntoRequests().isEmpty());
+ MOZ_RELEASE_ASSERT(!reader->ReadIntoRequests().isEmpty());
// Step 4. Let readIntoRequest be reader.[[readIntoRequests]][0].
// Step 5. Remove readIntoRequest from reader.[[readIntoRequests]].
@@ -1600,7 +1600,7 @@ void ReadableByteStreamControllerRespond(
JSContext* aCx, ReadableByteStreamController* aController,
uint64_t aBytesWritten, ErrorResult& aRv) {
// Step 1.
- MOZ_ASSERT(!aController->PendingPullIntos().isEmpty());
+ MOZ_RELEASE_ASSERT(!aController->PendingPullIntos().isEmpty());
// Step 2.
PullIntoDescriptor* firstDescriptor =
@@ -1657,7 +1657,7 @@ void ReadableByteStreamControllerRespondWithNewView(
aRv.MightThrowJSException();
// Step 1.
- MOZ_ASSERT(!aController->PendingPullIntos().isEmpty());
+ MOZ_RELEASE_ASSERT(!aController->PendingPullIntos().isEmpty());
// Step 2.
bool isSharedMemory;
diff --git a/dom/streams/ReadableStream.cpp b/dom/streams/ReadableStream.cpp
index 577c8e20f3f..16fa580a06a 100644
--- a/dom/streams/ReadableStream.cpp
+++ b/dom/streams/ReadableStream.cpp
@@ -850,7 +850,7 @@ void ReadableStreamFulfillReadRequest(JSContext* aCx, ReadableStream* aStream,
ReadableStreamDefaultReader* reader = aStream->GetDefaultReader();
// Step 3.
- MOZ_ASSERT(!reader->ReadRequests().isEmpty());
+ MOZ_RELEASE_ASSERT(!reader->ReadRequests().isEmpty());
// Step 4+5.
RefPtr<ReadRequest> readRequest = reader->ReadRequests().popFirst();
diff --git a/dom/streams/WritableStream.cpp b/dom/streams/WritableStream.cpp
index da4f1188206..fd4ebe28953 100644
--- a/dom/streams/WritableStream.cpp
+++ b/dom/streams/WritableStream.cpp
@@ -333,7 +333,7 @@ void WritableStream::MarkFirstWriteRequestInFlight() {
MOZ_ASSERT(!mInFlightWriteRequest);
// Step 2. Assert: stream.[[writeRequests]] is not empty.
- MOZ_ASSERT(!mWriteRequests.IsEmpty());
+ MOZ_RELEASE_ASSERT(!mWriteRequests.IsEmpty());
// Step 3. Let writeRequest be stream.[[writeRequests]][0].
// Step 4. Remove writeRequest from stream.[[writeRequests]].
Loading diff…
References
On This Page