High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionJIT miscompilation in the JavaScript Engine: JIT component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker1996840
Fix commit36888c1cec97 (firefox) +4/-2
CISA KEVNot listed
CreditedLingming Zhang
Disclosed2025-12-09

Changed Functions

FunctionChangeNotes
if
js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
modified

Files Changed

  • js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
diff --git a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
index b8f25e517a0..22866a9574c 100644
--- a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
+++ b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
@@ -746,8 +746,10 @@ struct AssemblerBufferWithConstantPools
       // secondary range veneers assuming the worst case deadlines.
 
       // Total pending secondary range veneer size.
-      size_t secondaryVeneers = guardSize_ * (branchDeadlines_.size() -
-                                              branchDeadlines_.maxRangeSize());
+      size_t secondaryVeneers =
+          guardSize_ *
+          (branchDeadlines_.size() - branchDeadlines_.maxRangeSize()) *
+          InstSize;
 
       if (deadline < poolEnd + secondaryVeneers) {
         return false;
Loading diff…