High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUndefined behavior in the DOM: Streams component
ComponentDOM
Bug ClassLogic Error
Tracker2068336
Fix commita3ff76b64251 (firefox) +7/-7
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • dom/streams/QueueWithSizes.h
  • dom/streams/ReadableByteStreamController.cpp
  • dom/streams/ReadableStream.cpp
  • dom/streams/WritableStream.cpp
diff --git a/dom/streams/QueueWithSizes.h b/dom/streams/QueueWithSizes.h
index 59b662eff98..1a4a1adfc94 100644
--- a/dom/streams/QueueWithSizes.h
+++ b/dom/streams/QueueWithSizes.h
@@ -86,7 +86,7 @@ inline void DequeueValue(JSContext* aCx, QueueContainingClass aContainer,
                          ErrorResult& aRv) {
   // Step 1. Implicit via template instantiation.
   // Step 2.
-  MOZ_ASSERT(!aContainer->Queue().isEmpty());
+  MOZ_RELEASE_ASSERT(!aContainer->Queue().isEmpty());
 
   // Step 3+4
   // UniquePtr to ensure memory is freed.
@@ -117,7 +117,7 @@ inline void PeekQueueValue(JSContext* aCx, QueueContainingClass aContainer,
   // Step 1. Assert: container has [[queue]] and [[queueTotalSize]] internal
   // slots.
   // Step 2. Assert: container.[[queue]] is not empty.
-  MOZ_ASSERT(!aContainer->Queue().isEmpty());
+  MOZ_RELEASE_ASSERT(!aContainer->Queue().isEmpty());
 
   // Step 3. Let valueWithSize be container.[[queue]][0].
   ValueWithSize* valueWithSize = aContainer->Queue().getFirst();
diff --git a/dom/streams/ReadableByteStreamController.cpp b/dom/streams/ReadableByteStreamController.cpp
index 232bf7c5367..dc204c34c3d 100644
--- a/dom/streams/ReadableByteStreamController.cpp
+++ b/dom/streams/ReadableByteStreamController.cpp
@@ -679,7 +679,7 @@ void ReadableStreamFulfillReadIntoRequest(JSContext* aCx,
   ReadableStreamBYOBReader* reader = aStream->GetReader()->AsBYOB();
 
   // Step 3. Assert: reader.[[readIntoRequests]] is not empty.
-  MOZ_ASSERT(!reader->ReadIntoRequests().isEmpty());
+  MOZ_RELEASE_ASSERT(!reader->ReadIntoRequests().isEmpty());
 
   // Step 4. Let readIntoRequest be reader.[[readIntoRequests]][0].
   // Step 5. Remove readIntoRequest from reader.[[readIntoRequests]].
@@ -1600,7 +1600,7 @@ void ReadableByteStreamControllerRespond(
     JSContext* aCx, ReadableByteStreamController* aController,
     uint64_t aBytesWritten, ErrorResult& aRv) {
   // Step 1.
-  MOZ_ASSERT(!aController->PendingPullIntos().isEmpty());
+  MOZ_RELEASE_ASSERT(!aController->PendingPullIntos().isEmpty());
 
   // Step 2.
   PullIntoDescriptor* firstDescriptor =
@@ -1657,7 +1657,7 @@ void ReadableByteStreamControllerRespondWithNewView(
   aRv.MightThrowJSException();
 
   // Step 1.
-  MOZ_ASSERT(!aController->PendingPullIntos().isEmpty());
+  MOZ_RELEASE_ASSERT(!aController->PendingPullIntos().isEmpty());
 
   // Step 2.
   bool isSharedMemory;
diff --git a/dom/streams/ReadableStream.cpp b/dom/streams/ReadableStream.cpp
index 577c8e20f3f..16fa580a06a 100644
--- a/dom/streams/ReadableStream.cpp
+++ b/dom/streams/ReadableStream.cpp
@@ -850,7 +850,7 @@ void ReadableStreamFulfillReadRequest(JSContext* aCx, ReadableStream* aStream,
   ReadableStreamDefaultReader* reader = aStream->GetDefaultReader();
 
   // Step 3.
-  MOZ_ASSERT(!reader->ReadRequests().isEmpty());
+  MOZ_RELEASE_ASSERT(!reader->ReadRequests().isEmpty());
 
   // Step 4+5.
   RefPtr<ReadRequest> readRequest = reader->ReadRequests().popFirst();
diff --git a/dom/streams/WritableStream.cpp b/dom/streams/WritableStream.cpp
index da4f1188206..fd4ebe28953 100644
--- a/dom/streams/WritableStream.cpp
+++ b/dom/streams/WritableStream.cpp
@@ -333,7 +333,7 @@ void WritableStream::MarkFirstWriteRequestInFlight() {
   MOZ_ASSERT(!mInFlightWriteRequest);
 
   // Step 2. Assert: stream.[[writeRequests]] is not empty.
-  MOZ_ASSERT(!mWriteRequests.IsEmpty());
+  MOZ_RELEASE_ASSERT(!mWriteRequests.IsEmpty());
 
   // Step 3. Let writeRequest be stream.[[writeRequests]][0].
   // Step 4. Remove writeRequest from stream.[[writeRequests]].
Loading diff…