Firefox · SpiderMonkey
CVE-2026-100776
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/vm/JitActivation.cpp |
modified |
Files Changed
js/src/vm/JitActivation.cpp
Patch
diff --git a/js/src/vm/JitActivation.cpp b/js/src/vm/JitActivation.cpp
index de26fa17fbf..a6c2c5431db 100644
--- a/js/src/vm/JitActivation.cpp
+++ b/js/src/vm/JitActivation.cpp
@@ -253,6 +253,14 @@ void js::jit::JitActivation::startWasmTrap(wasm::Trap trap,
MOZ_ASSERT_IF(!unwound,
code == &wasm::GetNearestEffectiveInstance(fp)->code());
+ // The cross-instance return_call switched cx->realm to the callee and
+ // collapsed the caller, so on unwind no live frame keeps that realm alive.
+ // Restore it to the frame we unwound to, as the exception handler will.
+ if (unwound) {
+ cx()->setRealmForJitExceptionHandler(
+ wasm::GetNearestEffectiveInstance(fp)->realm());
+ }
+
// Keep the trapping code alive across a GC. For an IndirectCallBadSig trap
// reached through a tail call, this code can belong to a different instance
// than the effective one above, whose frame has already been unwound. Nothing
Loading diff…
References
On This Page