Firefox · SpiderMonkey
CVE-2026-109715
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/jit-test/tests/environments/bug2073267.js |
modified | |
forjs/src/jit-test/tests/environments/bug2073267.js |
modified |
Files Changed
js/src/jit-test/tests/environments/bug2073267.jsjs/src/jit/CacheIR.cpp
Patch
diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
index 82b1723300a..0dbe43be6fa 100644
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -4519,7 +4519,9 @@ AttachDecision SetPropIRGenerator::tryAttachNativeSetSlot(HandleObject obj,
maybeEmitIdGuard(id);
NativeObject* nobj = &obj->as<NativeObject>();
- if (!IsGlobalLexicalSetGName(JSOp(*pc_), nobj, *prop)) {
+ if (IsGlobalLexicalSetGName(JSOp(*pc_), nobj, *prop)) {
+ writer.guardSpecificObject(objId, nobj);
+ } else {
// If the object has an ObjectFuse, we can only optimize for this specific
// object so we have to emit GuardSpecificObject. We don't need to do this
// for the global object because there's only one object with that shape.
diff --git a/js/src/jit-test/tests/environments/bug2073267.js b/js/src/jit-test/tests/environments/bug2073267.js
new file mode 100644
index 00000000000..ae74184ca0b
--- /dev/null
+++ b/js/src/jit-test/tests/environments/bug2073267.js
@@ -0,0 +1,18 @@
+function assign(mode) {
+ if (mode) {
+ newBinding = mode === 1 ? confuse() : "value for global lexical";
+ }
+}
+function confuse() {
+ evaluate("let newBinding;");
+ for (let i = 0; i < 3; i++) {
+ assign(2);
+ }
+ return "valueForGlobalThis";
+}
+for (let i = 0; i < 50; i++) {
+ assign(0);
+}
+assign(1);
+assertEq(globalThis["newBinding"], "valueForGlobalThis");
+assertEq(newBinding, "value for global lexical");
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/js/src/jit-test/tests/environments/bug2073267.js b/js/src/jit-test/tests/environments/bug2073267.js
new file mode 100644
index 00000000000..ae74184ca0b
--- /dev/null
+++ b/js/src/jit-test/tests/environments/bug2073267.js
@@ -0,0 +1,18 @@
+function assign(mode) {
+ if (mode) {
+ newBinding = mode === 1 ? confuse() : "value for global lexical";
+ }
+}
+function confuse() {
+ evaluate("let newBinding;");
+ for (let i = 0; i < 3; i++) {
+ assign(2);
+ }
+ return "valueForGlobalThis";
+}
+for (let i = 0; i < 50; i++) {
+ assign(0);
+}
+assign(1);
+assertEq(globalThis["newBinding"], "valueForGlobalThis");
+assertEq(newBinding, "value for global lexical");
Loading diff…
References
On This Page