Firefox · DOM
CVE-2026-16353
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/bindings/ToJSValue.h
Patch
diff --git a/dom/bindings/ToJSValue.h b/dom/bindings/ToJSValue.h
index 6bf17bb77e4..2444cf11018 100644
--- a/dom/bindings/ToJSValue.h
+++ b/dom/bindings/ToJSValue.h
@@ -99,13 +99,13 @@ inline bool ToJSValue(JSContext* aCx, uint64_t aArgument,
return true;
}
-// accept floating point types
+// Accept floating point types.
inline bool ToJSValue(JSContext* aCx, float aArgument,
JS::MutableHandle<JS::Value> aValue) {
// Make sure we're called in a compartment
MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
- aValue.setNumber(aArgument);
+ aValue.set(JS_NumberValue(double(aArgument)));
return true;
}
Loading diff…
References
On This Page