PatchGap
Firefox · SpiderMonkey

CVE-2025-11153

Logic Error in SpiderMonkey
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionJIT miscompilation in the JavaScript Engine: JIT component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker1987481
Fix commit4e0b3249af9b (firefox) +0/-3
CISA KEVNot listed
CreditedNan Wang
Disclosed2025-09-30

Files Changed

  • js/src/jit/MIROps.yaml

Patch

view commit
diff --git a/js/src/jit/MIROps.yaml b/js/src/jit/MIROps.yaml
index d6c33f4144c..fbc383a75b7 100644
--- a/js/src/jit/MIROps.yaml
+++ b/js/src/jit/MIROps.yaml
@@ -1794,10 +1794,7 @@
   arguments:
     elementType: Scalar::Type
   result_type: Elements
-  movable: true
-  congruent_to: if_operands_equal
   alias_set: custom
-  clone: true
   generate_lir: true
 
 # Read the length of a resizable typed array.
Loading diff…
On This Page