Firefox · SpiderMonkey
CVE-2026-0885
UAF in SpiderMonkey
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/gc/BufferAllocator.cpp |
modified |
Files Changed
js/src/gc/BufferAllocator.cpp
Patch
diff --git a/js/src/gc/BufferAllocator.cpp b/js/src/gc/BufferAllocator.cpp
index 66a5a9537ed..95de28d06dd 100644
--- a/js/src/gc/BufferAllocator.cpp
+++ b/js/src/gc/BufferAllocator.cpp
@@ -1375,6 +1375,13 @@ void BufferAllocator::abortMajorSweeping(const AutoLock& lock) {
clearAllocatedDuringCollectionState(lock);
+ if (minorState == State::Sweeping) {
+ // If we are minor sweeping then chunks with allocatedDuringCollection set
+ // may be present in |mixedChunksToSweep|. Set a flag so these are cleared
+ // when they are merged later.
+ majorFinishedWhileMinorSweeping = true;
+ }
+
for (BufferChunk* chunk : tenuredChunksToSweep.ref()) {
MOZ_ASSERT(chunk->ownsFreeLists);
Loading diff…
References
On This Page