Firefox · SpiderMonkey
CVE-2026-2767
UAF in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/wasm/WasmBaselineCompile.cpp
Patch
diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
index dc5950441ac..d13ade0c2bc 100644
--- a/js/src/wasm/WasmBaselineCompile.cpp
+++ b/js/src/wasm/WasmBaselineCompile.cpp
@@ -8801,27 +8801,25 @@ bool BaseCompiler::emitArrayFill() {
freePtr(RegPtr(PreBarrierReg));
}
- // Perform an initialization loop using `numElements` as the loop variable,
- // starting at `numElements` and counting down to zero.
+ // Perform the fill loop using `numElements` as the loop variable, counting
+ // down to zero.
Label done;
Label loop;
- // Skip initialization if numElements = 0
masm.branch32(Assembler::Equal, numElements, Imm32(0), &done);
- masm.bind(&loop);
- // Move to the next element
+ masm.bind(&loop);
masm.sub32(Imm32(1), numElements);
// Assign value to rdata[numElements]. All registers are preserved.
if (!emitGcArraySet(rp, rdata, numElements, arrayType, value,
- PreBarrierKind::None, PostBarrierKind::Imprecise)) {
+ PreBarrierKind::Normal, PostBarrierKind::Imprecise)) {
return false;
}
- // Loop back if there are still elements to initialize
masm.branch32(Assembler::NotEqual, numElements, Imm32(0), &loop);
masm.bind(&done);
+ // Clean up
freePtr(rdata);
freeRef(rp);
freeI32(numElements);
Loading diff…
References
On This Page