Low firefox Race 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionRace condition in the JavaScript Engine component
ComponentSpiderMonkey
Bug ClassRace
Tracker2053670
Fix commitaafbada78b13 (firefox) +20/-11
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
ScriptSource
js/src/vm/JSScript.cpp
modified
isTwoByteString_
js/src/vm/JSScript.cpp
modified

Files Changed

  • js/src/vm/GeckoProfiler.cpp
  • js/src/vm/JSScript.cpp
  • js/src/vm/JSScript.h
diff --git a/js/src/vm/GeckoProfiler.cpp b/js/src/vm/GeckoProfiler.cpp
index 03958d36d5e..15a55dd34fa 100644
--- a/js/src/vm/GeckoProfiler.cpp
+++ b/js/src/vm/GeckoProfiler.cpp
@@ -453,8 +453,9 @@ js::ProfilerJSSources GeckoProfilerRuntime::getProfilerScriptSources(
 
     bool hasSourceText;
     bool retrievableSource;
+    bool unused;
     ScriptSource::getSourceProperties(scriptSource, &hasSourceText,
-                                      &retrievableSource);
+                                      &retrievableSource, &unused);
 
     uint32_t sourceId = scriptSource->id();
 
diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
index 9a13d49a713..6b6334ef6ec 100644
--- a/js/src/vm/JSScript.cpp
+++ b/js/src/vm/JSScript.cpp
@@ -899,21 +899,27 @@ bool ScriptSource::loadSource(JSContext* cx, ScriptSource* ss, bool* loaded) {
 class ScriptSource::SourcePropertiesGetter {
   bool* const hasSourceText_;
   bool* const retrievable_;
+  bool* const isTwoByteString_;
 
  public:
-  explicit SourcePropertiesGetter(bool* hasSourceText, bool* retrievable)
-      : hasSourceText_(hasSourceText), retrievable_(retrievable) {}
+  explicit SourcePropertiesGetter(bool* hasSourceText, bool* retrievable,
+                                  bool* isTwoByteString)
+      : hasSourceText_(hasSourceText),
+        retrievable_(retrievable),
+        isTwoByteString_(isTwoByteString) {}
 
   template <typename Unit, SourceRetrievable CanRetrieve>
   void operator()(const Compressed<Unit, CanRetrieve>&) const {
     *hasSourceText_ = true;
     *retrievable_ = false;
+    *isTwoByteString_ = std::is_same_v<Unit, char16_t>;
   }
 
   template <typename Unit, SourceRetrievable CanRetrieve>
   void operator()(const Uncompressed<Unit, CanRetrieve>&) const {
     *hasSourceText_ = true;
     *retrievable_ = false;
+    *isTwoByteString_ = std::is_same_v<Unit, char16_t>;
   }
 
   template <typename Unit>
@@ -921,17 +927,21 @@ class ScriptSource::SourcePropertiesGetter {
     // Retrievable requires the main thread. Do not attempt to retrieve it.
     *hasSourceText_ = false;
     *retrievable_ = true;
+    *isTwoByteString_ = std::is_same_v<Unit, char16_t>;
   }
 
   void operator()(const Missing&) const {
     *hasSourceText_ = false;
     *retrievable_ = false;
+    *isTwoByteString_ = false;
   }
 };
 
 void ScriptSource::getSourceProperties(ScriptSource* ss, bool* hasSourceText,
-                                       bool* retrievable) {
-  ss->data.match(SourcePropertiesGetter(hasSourceText, retrievable));
+                                       bool* retrievable,
+                                       bool* isTwoByteString) {
+  ss->data.match(
+      SourcePropertiesGetter(hasSourceText, retrievable, isTwoByteString));
 }
 
 /* static */
diff --git a/js/src/vm/JSScript.h b/js/src/vm/JSScript.h
index eb272d790da..7e8220e3968 100644
--- a/js/src/vm/JSScript.h
+++ b/js/src/vm/JSScript.h
@@ -696,15 +696,13 @@ class ScriptSource {
   // return false.
   static bool loadSource(JSContext* cx, ScriptSource* ss, bool* loaded);
 
-  // This is similar to loadSource, but it is designed to be used outside of the
-  // main thread. This is done by removing the need of JSContext for the
-  // Retrievable sources that require sourceHook. For retrievable cases, it
-  // sets retrievable to true and sets the isUT16 depending on the encoding.
+  // Returns the source data properties of the script source.
   //
   // *loaded indicates whether source text is available, *retrievable indicates
-  // whether the source can be retrieved later via source hook.
+  // whether the source can be retrieved later via source hook, and
+  // *isTwoByteString indicates if the underlying source data is char16_t-typed.
   static void getSourceProperties(ScriptSource* ss, bool* hasSourceText,
-                                  bool* retrievable);
+                                  bool* retrievable, bool* isTwoByteString);
 
   // Assign source data from |srcBuf| to this recently-created |ScriptSource|.
   template <typename Unit>
Loading diff…