Firefox · SpiderMonkey
CVE-2026-2763
UAF in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/vm/Iteration.cpp |
modified |
Files Changed
js/src/vm/Iteration.cpp
Patch
diff --git a/js/src/vm/Iteration.cpp b/js/src/vm/Iteration.cpp
index 27624fb264e..da9c2511a0f 100644
--- a/js/src/vm/Iteration.cpp
+++ b/js/src/vm/Iteration.cpp
@@ -44,6 +44,7 @@
#include "gc/StoreBuffer-inl.h"
#include "vm/NativeObject-inl.h"
#include "vm/PlainObject-inl.h" // js::PlainObject::createWithTemplate
+#include "vm/Shape-inl.h" // js::GetPropertyAttributes
using namespace js;
@@ -1808,10 +1809,9 @@ static bool SuppressDeletedProperty(JSContext* cx, NativeIterator* ni,
}
// Check whether id is still to come.
- Rooted<JSLinearString*> idStr(cx);
IteratorProperty* cursor = ni->nextProperty();
for (; cursor < ni->propertiesEnd(); ++cursor) {
- idStr = cursor->asString();
+ JSLinearString* idStr = cursor->asString();
// Common case: both strings are atoms.
if (idStr->isAtom() && str->isAtom()) {
if (idStr != str) {
@@ -1825,27 +1825,25 @@ static bool SuppressDeletedProperty(JSContext* cx, NativeIterator* ni,
// Check whether another property along the prototype chain became
// visible as a result of this deletion.
- RootedObject proto(cx);
- if (!GetPrototype(cx, obj, &proto)) {
- return false;
- }
- if (proto) {
- RootedId id(cx);
- RootedValue idv(cx, StringValue(idStr));
- if (!PrimitiveValueToId<CanGC>(cx, idv, &id)) {
- return false;
- }
-
- Rooted<mozilla::Maybe<PropertyDescriptor>> desc(cx);
- RootedObject holder(cx);
- if (!GetPropertyDescriptor(cx, proto, id, &desc, &holder)) {
- return false;
- }
-
- // If deletion just made something up the chain visible, no need to
- // do anything.
- if (desc.isSome() && desc->enumerable()) {
- return true;
+ if (obj->hasStaticPrototype()) {
+ JSObject* proto = obj->staticPrototype();
+ if (proto) {
+ JSAtom* atom = AtomizeString(cx, str);
+ if (!atom) {
+ return false;
+ }
+ PropertyKey key = AtomToId(atom);
+ NativeObject* holder = nullptr;
+ PropertyResult prop;
+ if (LookupPropertyPure(cx, proto, key, &holder, &prop) &&
+ prop.isFound()) {
+ // If deletion just made something up the chain visible, no need to
+ // do anything.
+ JS::PropertyAttributes attrs = GetPropertyAttributes(holder, prop);
+ if (attrs.enumerable()) {
+ return true;
+ }
+ }
}
}
Loading diff…
References
On This Page