Firefox · SpiderMonkey
CVE-2026-100792
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/wasm/WasmStubs.cpp
Patch
diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
index 763bea8c6de..cdc7e662fa6 100644
--- a/js/src/wasm/WasmStubs.cpp
+++ b/js/src/wasm/WasmStubs.cpp
@@ -1949,6 +1949,10 @@ static bool GenerateImportFunction(jit::MacroAssembler& masm,
MoveSPForJitABI(masm);
masm.wasmCallImport(desc, CalleeDesc::import(funcImportInstanceOffset));
+ // The call may not have preserved the stack pointer, so recover it from FP
+ // before reading the instance slot.
+ masm.freeStackTo(framePushed);
+
// Restore the instance register and pinned regs, per wasm function ABI.
masm.loadPtr(
Address(masm.getStackPointer(), framePushed - sizeOfInstanceSlot),
Loading diff…
References
On This Page