Medium firefox Race 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionRace condition in the JavaScript: GC component
ComponentSpiderMonkey
Bug ClassRace
Tracker2011069
Fix commit34384ff7e250 (firefox) +1/-0
CISA KEVNot listed
CreditedGary Kwong
Disclosed2026-02-24

Files Changed

  • js/src/gc/GC.cpp
diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
index e77b500ad65..5f66b5728b9 100644
--- a/js/src/gc/GC.cpp
+++ b/js/src/gc/GC.cpp
@@ -3887,6 +3887,7 @@ GCRuntime::IncrementalResult GCRuntime::resetIncrementalGC(
 }
 
 void GCRuntime::setGrayBitsInvalid() {
+  waitBackgroundSweepEnd();
   grayBitsValid = false;
   atomMarking.unmarkAllGrayReferences(this);
 }
Loading diff…