Firefox · SpiderMonkey
CVE-2026-2785
Logic Error in SpiderMonkey
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/builtin/ModuleObject.cppjs/src/vm/EnvironmentObject.hjs/src/vm/Modules.cppjs/src/vm/Scope.cpp
Patch
diff --git a/js/src/builtin/ModuleObject.cpp b/js/src/builtin/ModuleObject.cpp
index 92ca19bdee7..fd83fccea9b 100644
--- a/js/src/builtin/ModuleObject.cpp
+++ b/js/src/builtin/ModuleObject.cpp
@@ -941,8 +941,9 @@ bool ModuleObject::isInstance(HandleValue value) {
}
bool ModuleObject::hasCyclicModuleFields() const {
- // This currently only returns false if we GC during initialization.
- return !getReservedSlot(CyclicModuleFieldsSlot).isUndefined();
+ bool result = !getReservedSlot(CyclicModuleFieldsSlot).isUndefined();
+ MOZ_ASSERT_IF(result, !hasSyntheticModuleFields());
+ return result;
}
CyclicModuleFields* ModuleObject::cyclicModuleFields() {
@@ -1482,7 +1483,9 @@ bool ModuleObject::createSyntheticEnvironment(JSContext* cx,
return false;
}
- MOZ_ASSERT(env->shape()->propMapLength() == values.length());
+ // We expect one property per synthetic value plus one for the *namespace*
+ // binding.
+ MOZ_ASSERT(env->shape()->propMapLength() == values.length() + 1);
for (uint32_t i = 0; i < values.length(); i++) {
env->setAliasedBinding(env->firstSyntheticValueSlot() + i, values[i]);
diff --git a/js/src/vm/EnvironmentObject.h b/js/src/vm/EnvironmentObject.h
index e9dd45027e5..b5c044987e1 100644
--- a/js/src/vm/EnvironmentObject.h
+++ b/js/src/vm/EnvironmentObject.h
@@ -773,7 +773,7 @@ class ModuleEnvironmentObject : public EnvironmentObject {
// `env` may be a DebugEnvironmentProxy, but not a hollow environment.
static ModuleEnvironmentObject* find(JSObject* env);
- uint32_t firstSyntheticValueSlot() { return RESERVED_SLOTS; }
+ uint32_t firstSyntheticValueSlot() { return RESERVED_SLOTS + 1; }
private:
static bool lookupProperty(JSContext* cx, HandleObject obj, HandleId id,
diff --git a/js/src/vm/Modules.cpp b/js/src/vm/Modules.cpp
index b6e57fc7403..24df191b61f 100644
--- a/js/src/vm/Modules.cpp
+++ b/js/src/vm/Modules.cpp
@@ -1705,8 +1705,9 @@ static bool InnerModuleLinking(JSContext* cx, Handle<ModuleObject*> module,
size_t* indexOut) {
// Step 1. If module is not a Cyclic Module Record, then
if (!module->hasCyclicModuleFields()) {
- // Step 1.a. Perform ? module.Link(). (Skipped)
- // Step 2.b. Return index.
+ // Step 1.a. Perform ? module.Link().
+ // (Skipped as we have already created the environment for these modules).
+ // Step 1.b. Return index.
*indexOut = index;
return true;
}
diff --git a/js/src/vm/Scope.cpp b/js/src/vm/Scope.cpp
index 155a0025ebd..ac515c0d123 100644
--- a/js/src/vm/Scope.cpp
+++ b/js/src/vm/Scope.cpp
@@ -161,11 +161,22 @@ SharedShape* js::CreateEnvironmentShapeForSyntheticModule(
RootedId id(cx);
uint32_t slotIndex = numSlots;
+
+ auto addProperty = [&](PropertyName* name) {
+ id = NameToId(name);
+ return SharedPropMap::addPropertyWithKnownSlot(
+ cx, cls, &map, &mapLength, id, propFlags, slotIndex, &objectFlags);
+ };
+
+ // Add internal *namespace* property.
+ if (!addProperty(cx->names().star_namespace_star_)) {
+ return nullptr;
+ }
+ slotIndex++;
+
+ // Add synthetic exports.
for (JSAtom* exportName : module->syntheticExportNames()) {
- id = NameToId(exportName->asPropertyName());
- if (!SharedPropMap::addPropertyWithKnownSlot(cx, cls, &map, &mapLength, id,
- propFlags, slotIndex,
- &objectFlags)) {
+ if (!addProperty(exportName->asPropertyName())) {
return nullptr;
}
slotIndex++;
Loading diff…
References
On This Page