Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionJIT miscompilation in the JavaScript: WebAssembly component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2032943
Fix commit167e27f02b30 (firefox) +40/-0
CISA KEVNot listed
CreditedJunYoung Park
Disclosed2026-06-16

Files Changed

  • js/src/jit-test/tests/wasm/bug2032943.js
diff --git a/js/src/jit-test/tests/wasm/bug2032943.js b/js/src/jit-test/tests/wasm/bug2032943.js
new file mode 100644
index 00000000000..57e76cddb3c
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/bug2032943.js
@@ -0,0 +1,40 @@
+// |jit-test| --fast-warmup
+
+const code = `
+(module
+  (memory 2 10 shared)
+  (export "mem" (memory 0))
+
+  (func (export "cas") (param i32 i32 i32) (result i32)
+    local.get 0  local.get 1  local.get 2
+    i32.atomic.rmw.cmpxchg offset=8192)
+
+  (func (export "add") (param i32 i32) (result i32)
+    local.get 0  local.get 1
+    i32.atomic.rmw.add offset=8192)
+
+  (func (export "store") (param i32 i32)
+    local.get 0  local.get 1
+    i32.atomic.store offset=8192)
+
+  (func (export "load") (param i32) (result i32)
+    local.get 0
+    i32.atomic.load offset=8192)
+
+  (func (export "xchg") (param i32 i32) (result i32)
+    local.get 0  local.get 1
+    i32.atomic.rmw.xchg offset=8192)
+)`;
+
+const mod = new WebAssembly.Module(wasmTextToBinary(code));
+const inst = new WebAssembly.Instance(mod);
+
+inst.exports.store(0, 0);
+const loaded = inst.exports.load(0);
+assertEq(loaded, 0);
+const add_old = inst.exports.add(0, 1);
+assertEq(add_old, 0);
+const cas_old = inst.exports.cas(0, 1, 2);
+assertEq(cas_old, 1);
+const xchg_old = inst.exports.xchg(0, 0);
+assertEq(xchg_old, 2);
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/js/src/jit-test/tests/wasm/bug2032943.js b/js/src/jit-test/tests/wasm/bug2032943.js
new file mode 100644
index 00000000000..57e76cddb3c
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/bug2032943.js
@@ -0,0 +1,40 @@
+// |jit-test| --fast-warmup
+
+const code = `
+(module
+  (memory 2 10 shared)
+  (export "mem" (memory 0))
+
+  (func (export "cas") (param i32 i32 i32) (result i32)
+    local.get 0  local.get 1  local.get 2
+    i32.atomic.rmw.cmpxchg offset=8192)
+
+  (func (export "add") (param i32 i32) (result i32)
+    local.get 0  local.get 1
+    i32.atomic.rmw.add offset=8192)
+
+  (func (export "store") (param i32 i32)
+    local.get 0  local.get 1
+    i32.atomic.store offset=8192)
+
+  (func (export "load") (param i32) (result i32)
+    local.get 0
+    i32.atomic.load offset=8192)
+
+  (func (export "xchg") (param i32 i32) (result i32)
+    local.get 0  local.get 1
+    i32.atomic.rmw.xchg offset=8192)
+)`;
+
+const mod = new WebAssembly.Module(wasmTextToBinary(code));
+const inst = new WebAssembly.Instance(mod);
+
+inst.exports.store(0, 0);
+const loaded = inst.exports.load(0);
+assertEq(loaded, 0);
+const add_old = inst.exports.add(0, 1);
+assertEq(add_old, 0);
+const cas_old = inst.exports.cas(0, 1, 2);
+assertEq(cas_old, 1);
+const xchg_old = inst.exports.xchg(0, 0);
+assertEq(xchg_old, 2);
Loading diff…