High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the JavaScript Engine component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2073267
Fix commit4d39f1257ff9 (firefox) +21/-1
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
if
js/src/jit-test/tests/environments/bug2073267.js
modified
for
js/src/jit-test/tests/environments/bug2073267.js
modified

Files Changed

  • js/src/jit-test/tests/environments/bug2073267.js
  • js/src/jit/CacheIR.cpp
diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
index 82b1723300a..0dbe43be6fa 100644
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -4519,7 +4519,9 @@ AttachDecision SetPropIRGenerator::tryAttachNativeSetSlot(HandleObject obj,
   maybeEmitIdGuard(id);
 
   NativeObject* nobj = &obj->as<NativeObject>();
-  if (!IsGlobalLexicalSetGName(JSOp(*pc_), nobj, *prop)) {
+  if (IsGlobalLexicalSetGName(JSOp(*pc_), nobj, *prop)) {
+    writer.guardSpecificObject(objId, nobj);
+  } else {
     // If the object has an ObjectFuse, we can only optimize for this specific
     // object so we have to emit GuardSpecificObject. We don't need to do this
     // for the global object because there's only one object with that shape.
diff --git a/js/src/jit-test/tests/environments/bug2073267.js b/js/src/jit-test/tests/environments/bug2073267.js
new file mode 100644
index 00000000000..ae74184ca0b
--- /dev/null
+++ b/js/src/jit-test/tests/environments/bug2073267.js
@@ -0,0 +1,18 @@
+function assign(mode) {
+  if (mode) {
+    newBinding = mode === 1 ? confuse() : "value for global lexical";
+  }
+}
+function confuse() {
+  evaluate("let newBinding;");
+  for (let i = 0; i < 3; i++) {
+    assign(2);
+  }
+  return "valueForGlobalThis";
+}
+for (let i = 0; i < 50; i++) {
+  assign(0);
+}
+assign(1);
+assertEq(globalThis["newBinding"], "valueForGlobalThis");
+assertEq(newBinding, "value for global lexical");
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/js/src/jit-test/tests/environments/bug2073267.js b/js/src/jit-test/tests/environments/bug2073267.js
new file mode 100644
index 00000000000..ae74184ca0b
--- /dev/null
+++ b/js/src/jit-test/tests/environments/bug2073267.js
@@ -0,0 +1,18 @@
+function assign(mode) {
+  if (mode) {
+    newBinding = mode === 1 ? confuse() : "value for global lexical";
+  }
+}
+function confuse() {
+  evaluate("let newBinding;");
+  for (let i = 0; i < 3; i++) {
+    assign(2);
+  }
+  return "valueForGlobalThis";
+}
+for (let i = 0; i < 50; i++) {
+  assign(0);
+}
+assign(1);
+assertEq(globalThis["newBinding"], "valueForGlobalThis");
+assertEq(newBinding, "value for global lexical");
Loading diff…