Firefox · SpiderMonkey
CVE-2026-74937
UAF in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forjs/src/gc/Marking.cpp |
modified |
Files Changed
js/src/gc/Marking.cppjs/src/gc/WeakMap.cpp
Patch
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 6093d714b15..80c7c18c209 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -774,6 +774,10 @@ void MarkingTracerT<opts>::markEphemeronEdges(EphemeronEdgeVector& edges,
DebugOnly<size_t> initialLength = edges.length();
for (auto& edge : edges) {
+ if (!edge.target()) {
+ continue;
+ }
+
MarkColor targetColor = std::min(srcColor, MarkColor(edge.color()));
MOZ_ASSERT(markColor() >= targetColor);
if (targetColor == markColor()) {
diff --git a/js/src/gc/WeakMap.cpp b/js/src/gc/WeakMap.cpp
index 2b5aca79835..892a44faeaa 100644
--- a/js/src/gc/WeakMap.cpp
+++ b/js/src/gc/WeakMap.cpp
@@ -117,8 +117,10 @@ bool WeakMapBase::addEphemeronEdgesForEntry(MarkColor mapColor,
}
}
- if (value && !addEphemeronEdge(mapColor, key, value)) {
- return false;
+ if (value || key->zone()->isAtomsZone()) {
+ if (!addEphemeronEdge(mapColor, key, value)) {
+ return false;
+ }
}
return true;
Loading diff…
References
On This Page