Firefox · SpiderMonkey
CVE-2026-74984
Race in SpiderMonkey
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ScriptSourcejs/src/vm/JSScript.cpp |
modified | |
isTwoByteString_js/src/vm/JSScript.cpp |
modified |
Files Changed
js/src/vm/GeckoProfiler.cppjs/src/vm/JSScript.cppjs/src/vm/JSScript.h
Patch
diff --git a/js/src/vm/GeckoProfiler.cpp b/js/src/vm/GeckoProfiler.cpp
index 03958d36d5e..15a55dd34fa 100644
--- a/js/src/vm/GeckoProfiler.cpp
+++ b/js/src/vm/GeckoProfiler.cpp
@@ -453,8 +453,9 @@ js::ProfilerJSSources GeckoProfilerRuntime::getProfilerScriptSources(
bool hasSourceText;
bool retrievableSource;
+ bool unused;
ScriptSource::getSourceProperties(scriptSource, &hasSourceText,
- &retrievableSource);
+ &retrievableSource, &unused);
uint32_t sourceId = scriptSource->id();
diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
index 9a13d49a713..6b6334ef6ec 100644
--- a/js/src/vm/JSScript.cpp
+++ b/js/src/vm/JSScript.cpp
@@ -899,21 +899,27 @@ bool ScriptSource::loadSource(JSContext* cx, ScriptSource* ss, bool* loaded) {
class ScriptSource::SourcePropertiesGetter {
bool* const hasSourceText_;
bool* const retrievable_;
+ bool* const isTwoByteString_;
public:
- explicit SourcePropertiesGetter(bool* hasSourceText, bool* retrievable)
- : hasSourceText_(hasSourceText), retrievable_(retrievable) {}
+ explicit SourcePropertiesGetter(bool* hasSourceText, bool* retrievable,
+ bool* isTwoByteString)
+ : hasSourceText_(hasSourceText),
+ retrievable_(retrievable),
+ isTwoByteString_(isTwoByteString) {}
template <typename Unit, SourceRetrievable CanRetrieve>
void operator()(const Compressed<Unit, CanRetrieve>&) const {
*hasSourceText_ = true;
*retrievable_ = false;
+ *isTwoByteString_ = std::is_same_v<Unit, char16_t>;
}
template <typename Unit, SourceRetrievable CanRetrieve>
void operator()(const Uncompressed<Unit, CanRetrieve>&) const {
*hasSourceText_ = true;
*retrievable_ = false;
+ *isTwoByteString_ = std::is_same_v<Unit, char16_t>;
}
template <typename Unit>
@@ -921,17 +927,21 @@ class ScriptSource::SourcePropertiesGetter {
// Retrievable requires the main thread. Do not attempt to retrieve it.
*hasSourceText_ = false;
*retrievable_ = true;
+ *isTwoByteString_ = std::is_same_v<Unit, char16_t>;
}
void operator()(const Missing&) const {
*hasSourceText_ = false;
*retrievable_ = false;
+ *isTwoByteString_ = false;
}
};
void ScriptSource::getSourceProperties(ScriptSource* ss, bool* hasSourceText,
- bool* retrievable) {
- ss->data.match(SourcePropertiesGetter(hasSourceText, retrievable));
+ bool* retrievable,
+ bool* isTwoByteString) {
+ ss->data.match(
+ SourcePropertiesGetter(hasSourceText, retrievable, isTwoByteString));
}
/* static */
diff --git a/js/src/vm/JSScript.h b/js/src/vm/JSScript.h
index eb272d790da..7e8220e3968 100644
--- a/js/src/vm/JSScript.h
+++ b/js/src/vm/JSScript.h
@@ -696,15 +696,13 @@ class ScriptSource {
// return false.
static bool loadSource(JSContext* cx, ScriptSource* ss, bool* loaded);
- // This is similar to loadSource, but it is designed to be used outside of the
- // main thread. This is done by removing the need of JSContext for the
- // Retrievable sources that require sourceHook. For retrievable cases, it
- // sets retrievable to true and sets the isUT16 depending on the encoding.
+ // Returns the source data properties of the script source.
//
// *loaded indicates whether source text is available, *retrievable indicates
- // whether the source can be retrieved later via source hook.
+ // whether the source can be retrieved later via source hook, and
+ // *isTwoByteString indicates if the underlying source data is char16_t-typed.
static void getSourceProperties(ScriptSource* ss, bool* hasSourceText,
- bool* retrievable);
+ bool* retrievable, bool* isTwoByteString);
// Assign source data from |srcBuf| to this recently-created |ScriptSource|.
template <typename Unit>
Loading diff…
References
On This Page