Firefox · SpiderMonkey
CVE-2026-6757
Logic Error in SpiderMonkey
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/vm/EnvironmentObject.cpp |
modified |
Files Changed
js/src/debugger/Debugger.cppjs/src/vm/EnvironmentObject.cppjs/src/vm/EnvironmentObject.hjs/src/wasm/WasmJS.cppjs/src/wasm/WasmJS.h
Patch
diff --git a/js/src/debugger/Debugger.cpp b/js/src/debugger/Debugger.cpp
index 6de2de47de4..ffbad4659d9 100644
--- a/js/src/debugger/Debugger.cpp
+++ b/js/src/debugger/Debugger.cpp
@@ -1160,6 +1160,9 @@ bool DebugAPI::slowPathOnLeaveFrame(JSContext* cx, AbstractFramePtr frame,
if (success && completion.get().suspending()) {
Debugger::suspendGeneratorDebuggerFrames(cx, frame);
} else {
+ if (frame.isWasmDebugFrame()) {
+ DebugEnvironments::onPopWasm(cx, frame);
+ }
Debugger::terminateDebuggerFrames(cx, frame);
}
});
diff --git a/js/src/vm/EnvironmentObject.cpp b/js/src/vm/EnvironmentObject.cpp
index 7f177875878..75804ba5ecf 100644
--- a/js/src/vm/EnvironmentObject.cpp
+++ b/js/src/vm/EnvironmentObject.cpp
@@ -3143,6 +3143,30 @@ void DebugEnvironments::onPopModule(JSContext* cx, const EnvironmentIter& ei) {
onPopGeneric<ModuleEnvironmentObject, ModuleScope>(cx, ei);
}
+void DebugEnvironments::onPopWasm(JSContext* cx, AbstractFramePtr frame) {
+ MOZ_ASSERT(frame.isWasmDebugFrame());
+
+ DebugEnvironments* envs = cx->realm()->debugEnvs();
+ if (!envs) {
+ return;
+ }
+
+ Rooted<WasmInstanceObject*> instance(cx, frame.wasmInstance()->object());
+ uint32_t funcIndex = frame.asWasmDebugFrame()->funcIndex();
+ Rooted<Scope*> wasmFunctionScope(
+ cx, instance->getExistingFunctionScope(funcIndex));
+ if (!wasmFunctionScope) {
+ return;
+ }
+
+ MissingEnvironmentKey key(frame, wasmFunctionScope);
+ if (MissingEnvironmentMap::Ptr p = envs->missingEnvs.lookup(key)) {
+ EnvironmentObject& env = p->value()->environment();
+ envs->liveEnvs.remove(&env);
+ envs->missingEnvs.remove(p);
+ }
+}
+
void DebugEnvironments::onRealmUnsetIsDebuggee(Realm* realm) {
if (DebugEnvironments* envs = realm->debugEnvs()) {
envs->proxiedEnvs.clear();
diff --git a/js/src/vm/EnvironmentObject.h b/js/src/vm/EnvironmentObject.h
index b5c044987e1..0e15e392b8c 100644
--- a/js/src/vm/EnvironmentObject.h
+++ b/js/src/vm/EnvironmentObject.h
@@ -1559,6 +1559,7 @@ class DebugEnvironments {
const jsbytecode* pc);
static void onPopWith(AbstractFramePtr frame);
static void onPopModule(JSContext* cx, const EnvironmentIter& ei);
+ static void onPopWasm(JSContext* cx, AbstractFramePtr frame);
static void onRealmUnsetIsDebuggee(Realm* realm);
};
diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
index 1f8a2853b4c..8c251c0d30a 100644
--- a/js/src/wasm/WasmJS.cpp
+++ b/js/src/wasm/WasmJS.cpp
@@ -2029,6 +2029,15 @@ JSObject& WasmInstanceObject::exportsObj() const {
return getReservedSlot(EXPORTS_OBJ_SLOT).toObject();
}
+WasmFunctionScope* WasmInstanceObject::getExistingFunctionScope(
+ uint32_t funcIndex) const {
+ if (auto p = scopes().asWasmFunctionScopeMap().lookup(funcIndex)) {
+ return p->value();
+ }
+
+ return nullptr;
+}
+
WasmInstanceObject::UnspecifiedScopeMap& WasmInstanceObject::scopes() const {
return *(UnspecifiedScopeMap*)(getReservedSlot(SCOPES_SLOT).toPrivate());
}
diff --git a/js/src/wasm/WasmJS.h b/js/src/wasm/WasmJS.h
index 6f7f7e1be8c..43e0518f883 100644
--- a/js/src/wasm/WasmJS.h
+++ b/js/src/wasm/WasmJS.h
@@ -223,6 +223,7 @@ class WasmInstanceObject : public NativeObject {
wasm::Instance& instance() const;
JSObject& exportsObj() const;
+ WasmFunctionScope* getExistingFunctionScope(uint32_t funcIndex) const;
[[nodiscard]] static bool getExportedFunction(
JSContext* cx, Handle<WasmInstanceObject*> instanceObj,
Loading diff…
References
On This Page