High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Networking: Cache component
ComponentNetworking
Bug ClassLogic Error
Tracker2063680
Fix commit99f2f8d691af (firefox) +4/-53
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
DeleteCacheIndexRecordWrapper
netwerk/cache2/CacheIndex.cpp
modified
mWrapper
netwerk/cache2/CacheIndex.cpp
modified
if
netwerk/cache2/CacheIndex.cpp
modified
CacheIndexRecordWrapper
netwerk/cache2/CacheIndex.h
modified
CacheIndexEntry
netwerk/cache2/CacheIndex.h
modified

Files Changed

  • netwerk/cache2/CacheIndex.cpp
  • netwerk/cache2/CacheIndex.h
diff --git a/netwerk/cache2/CacheIndex.cpp b/netwerk/cache2/CacheIndex.cpp
index a73f057ac2d..c2125c815ce 100644
--- a/netwerk/cache2/CacheIndex.cpp
+++ b/netwerk/cache2/CacheIndex.cpp
@@ -72,52 +72,6 @@ class FrecencyComparator {
 
 }  // namespace
 
-// used to dispatch a wrapper deletion the caller's thread
-// cannot be used on IOThread after shutdown begins
-class DeleteCacheIndexRecordWrapper : public Runnable {
-  CacheIndexRecordWrapper* mWrapper;
-
- public:
-  explicit DeleteCacheIndexRecordWrapper(CacheIndexRecordWrapper* wrapper)
-      : Runnable("net::CacheIndex::DeleteCacheIndexRecordWrapper"),
-        mWrapper(wrapper) {}
-  NS_IMETHOD Run() override {
-    StaticMutexAutoLock lock(CacheIndex::sLock);
-
-    // if somehow the item is still in the frecency storage, remove it
-    RefPtr<CacheIndex> index = CacheIndex::gInstance;
-    if (index) {
-      bool found = index->mFrecencyStorage.RecordExistedUnlocked(mWrapper);
-      if (found) {
-        LOG(
-            ("DeleteCacheIndexRecordWrapper::Run() - \
-            record wrapper found in frecency storage during deletion"));
-        index->mFrecencyStorage.RemoveRecord(mWrapper, lock);
-      }
-    }
-
-    delete mWrapper;
-    return NS_OK;
-  }
-};
-
-void CacheIndexRecordWrapper::DispatchDeleteSelfToCurrentThread() {
-  // Dispatch during shutdown will not trigger DeleteCacheIndexRecordWrapper
-  nsCOMPtr<nsIRunnable> event = new DeleteCacheIndexRecordWrapper(this);
-  MOZ_ALWAYS_SUCCEEDS(NS_DispatchToCurrentThread(event));
-}
-
-CacheIndexRecordWrapper::~CacheIndexRecordWrapper() {
-#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
-  CacheIndex::sLock.AssertCurrentThreadOwns();
-  RefPtr<CacheIndex> index = CacheIndex::gInstance;
-  if (index) {
-    bool found = index->mFrecencyStorage.RecordExistedUnlocked(this);
-    MOZ_DIAGNOSTIC_ASSERT(!found);
-  }
-#endif
-}
-
 /**
  * This helper class is responsible for keeping CacheIndex::mIndexStats and
  * CacheIndex::mFrecencyStorage up to date.
@@ -3487,7 +3441,8 @@ void CacheIndex::FrecencyStorage::AppendRecord(
        "hash=%08x%08x%08x"
        "%08x%08x]",
        aRecord, LOGSHA1(aRecord->Get()->mHash)));
-  MOZ_DIAGNOSTIC_ASSERT(!mRecs.Contains(aRecord));
+  MOZ_RELEASE_ASSERT(!mRecs.Contains(aRecord),
+                     "Record is already in the frecency storage");
   mRecs.PutEntry(aRecord);
 }
 
diff --git a/netwerk/cache2/CacheIndex.h b/netwerk/cache2/CacheIndex.h
index d313cc8c6ac..6458b684700 100644
--- a/netwerk/cache2/CacheIndex.h
+++ b/netwerk/cache2/CacheIndex.h
@@ -127,17 +127,14 @@ static_assert(sizeof(CacheIndexRecord::mHash) +
 
 class CacheIndexRecordWrapper final {
  public:
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_DESTROY(
-      CacheIndexRecordWrapper, DispatchDeleteSelfToCurrentThread());
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(CacheIndexRecordWrapper)
 
   CacheIndexRecordWrapper() : mRec(MakeUnique<CacheIndexRecord>()) {}
   CacheIndexRecord* Get() { return mRec.get(); }
 
  private:
-  ~CacheIndexRecordWrapper();
-  void DispatchDeleteSelfToCurrentThread();
+  ~CacheIndexRecordWrapper() = default;
   UniquePtr<CacheIndexRecord> mRec;
-  friend class DeleteCacheIndexRecordWrapper;
 };
 
 class CacheIndexEntry : public PLDHashEntryHdr {
@@ -873,7 +870,6 @@ class CacheIndex final : public CacheFileIOListener, public nsIRunnable {
   friend class FileOpenHelper;
   friend class CacheIndexIterator;
   friend class CacheIndexRecordWrapper;
-  friend class DeleteCacheIndexRecordWrapper;
 
   virtual ~CacheIndex();
 
Loading diff…