2 ms·

It's a JIT bug, you can see the fix here: https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2a2a7859b10508b6f05e99780c5e2dc68 https://hg.mozilla.org/re

• pdkl95 7y ago
  Assuming this[1] test for sparse indexes with extra properties in the unfixed version of the file as part of the bugged code, the annotations suggest that the bug MIGHT have been (partially?) introduced by this[2] changeset. If so, that means all versions of Firefox >= 38.0a1 (21 Apr 2015) might be vulnerable to the bug. If the bug is really that old, it's certainly possible it might have been abused in the wild, perhaps in more ways than the just the "targeted attacks" mentioned the report. [1] https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2a2a7859b10508b6f05e99780c5e2dc68#l1.62 https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2... [2] https://hg.mozilla.org/releases/mozilla-release/rev/6bfcb81d3716bfcdcd0045d0fb80153159513a83 https://hg.mozilla.org/releases/mozilla-release/rev/6bfcb81d...
• fiveoak 7y ago
  "This simplifies the code a bit because ElementAccessHasExtraIndexedProperty checks for length-overflow and sparse-indexes so the callers don't have to do that anymore." simple code best code, the less opportunity you give people to shoot themselves in the foot the better