High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the JavaScript Engine component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2073269
Fix commit0ac45ac54e33 (firefox) +2/-0
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-13

Files Changed

  • js/src/frontend/BytecodeCompiler.cpp
diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
index e9466fbfc2c..bc0f57f773e 100644
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -1504,6 +1504,7 @@ static bool DelazifyCanonicalScriptedFunctionImpl(
       .setSelfHostingMode(false)
       .setEagerDelazificationStrategy(lazy->delazificationMode())
       .setEagerBaselineStrategy(JS::EagerBaselineOption::None);
+  options.allowHTMLComments = !lazy->hasModuleGoal();
 
   Rooted<CompilationInput> input(cx, CompilationInput(options));
   input.get().initFromLazy(cx, lazy, ss);
@@ -1615,6 +1616,7 @@ static const CompilationStencil* DelazifyCanonicalScriptedFunctionImpl(
       .setScriptSourceOffset(sourceStart)
       .setNoScriptRval(false)
       .setSelfHostingMode(false);
+  options.allowHTMLComments = !extra.hasModuleGoal();
 
   // CompilationInput initialized with initFromStencil only reference
   // information from the CompilationStencil context and the ref-counted
Loading diff…