Firefox · SpiderMonkey
CVE-2025-14330
Logic Error in SpiderMonkey
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/jit/riscv64/MacroAssembler-riscv64.h
Patch
diff --git a/js/src/jit/riscv64/MacroAssembler-riscv64.h b/js/src/jit/riscv64/MacroAssembler-riscv64.h
index 9fce30365aa..9329cb6619a 100644
--- a/js/src/jit/riscv64/MacroAssembler-riscv64.h
+++ b/js/src/jit/riscv64/MacroAssembler-riscv64.h
@@ -841,10 +841,10 @@ class MacroAssemblerRiscv64Compat : public MacroAssemblerRiscv64 {
void unboxGCThingForGCBarrier(const Address& src, Register dest) {
loadPtr(src, dest);
- ExtractBits(dest, dest, 0, JSVAL_TAG_SHIFT - 1);
+ ExtractBits(dest, dest, 0, JSVAL_TAG_SHIFT);
}
void unboxGCThingForGCBarrier(const ValueOperand& src, Register dest) {
- ExtractBits(dest, src.valueReg(), 0, JSVAL_TAG_SHIFT - 1);
+ ExtractBits(dest, src.valueReg(), 0, JSVAL_TAG_SHIFT);
}
void unboxWasmAnyRefGCThingForGCBarrier(const Address& src, Register dest) {
Loading diff…
References
On This Page