High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionInvalid pointer in the DOM: Bindings (WebIDL) component
ComponentDOM
Bug ClassLogic Error
Tracker2049523
Fix commit88d871e6ff23 (firefox) +2/-2
CISA KEVNot listed
Creditedfedek
Disclosed2026-07-21

Files Changed

  • dom/bindings/ToJSValue.h
diff --git a/dom/bindings/ToJSValue.h b/dom/bindings/ToJSValue.h
index 6bf17bb77e4..2444cf11018 100644
--- a/dom/bindings/ToJSValue.h
+++ b/dom/bindings/ToJSValue.h
@@ -99,13 +99,13 @@ inline bool ToJSValue(JSContext* aCx, uint64_t aArgument,
   return true;
 }
 
-// accept floating point types
+// Accept floating point types.
 inline bool ToJSValue(JSContext* aCx, float aArgument,
                       JS::MutableHandle<JS::Value> aValue) {
   // Make sure we're called in a compartment
   MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
 
-  aValue.setNumber(aArgument);
+  aValue.set(JS_NumberValue(double(aArgument)));
   return true;
 }
 
Loading diff…