Firefox · DOM
CVE-2026-109732
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/streams/QueueWithSizes.h
Patch
diff --git a/dom/streams/QueueWithSizes.h b/dom/streams/QueueWithSizes.h
index 1a4a1adfc94..2269f71170c 100644
--- a/dom/streams/QueueWithSizes.h
+++ b/dom/streams/QueueWithSizes.h
@@ -23,6 +23,8 @@ struct ValueWithSize : LinkedListElement<ValueWithSize> {
JS::Heap<JS::Value> mValue;
double mSize = 0.0f;
+
+ void trace(JSTracer* aTrc) { TraceEdge(aTrc, &mValue, "value-with-size"); }
};
// This type is a little tricky lifetime wise: Despite the fact that we're
@@ -90,7 +92,8 @@ inline void DequeueValue(JSContext* aCx, QueueContainingClass aContainer,
// Step 3+4
// UniquePtr to ensure memory is freed.
- UniquePtr<ValueWithSize> valueWithSize(aContainer->Queue().popFirst());
+ JS::Rooted<UniquePtr<ValueWithSize>> valueWithSize(
+ aCx, aContainer->Queue().popFirst());
// Step 5.
aContainer->SetQueueTotalSize(aContainer->QueueTotalSize() -
Loading diff…
References
On This Page