Firefox · SpiderMonkey
CVE-2026-92040
Logic Error in SpiderMonkey
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/wasm/WasmBCClass.hjs/src/wasm/WasmBCFrame.cppjs/src/wasm/WasmBaselineCompile.cpp
Patch
diff --git a/js/src/wasm/WasmBCClass.h b/js/src/wasm/WasmBCClass.h
index 2957c9054ae..e034384efae 100644
--- a/js/src/wasm/WasmBCClass.h
+++ b/js/src/wasm/WasmBCClass.h
@@ -961,6 +961,14 @@ struct BaseCompiler final {
[[nodiscard]] bool createStackMap(
Maybe<Trap> reason, HasDebugFrameWithLiveRefs debugFrameWithLiveRefs);
+ // Create a stackmap for the instruction described by `insnRange`, and note
+ // the presence of a ref-typed DebugFrame on the stack. The stackmap will be
+ // keyed to `insnRange.resumeOffset()`. Prefer this method over the above 3,
+ // which are regarded as "legacy" and should be phased out.
+ [[nodiscard]] bool createStackMap(
+ Maybe<Trap> reason, FaultingCodeRange insnRange,
+ HasDebugFrameWithLiveRefs debugFrameWithLiveRefs);
+
// When compiling for debugging, creates a stack map for a non-resuming trap
// instruction of kind `t1`, and, if specified, `t2`. When not compiling for
// debugging, no stackmap is generated.
diff --git a/js/src/wasm/WasmBCFrame.cpp b/js/src/wasm/WasmBCFrame.cpp
index 3f66eab1105..5c5352bd75c 100644
--- a/js/src/wasm/WasmBCFrame.cpp
+++ b/js/src/wasm/WasmBCFrame.cpp
@@ -167,6 +167,16 @@ bool BaseCompiler::createStackMap(
(!stackMap || stackMaps_->add(masm.currentOffset(), stackMap));
}
+bool BaseCompiler::createStackMap(
+ Maybe<Trap> reason, FaultingCodeRange insnRange,
+ HasDebugFrameWithLiveRefs debugFrameWithLiveRefs) {
+ const ExitStubMapVector noExtras;
+ StackMap* stackMap;
+ return stackMapGenerator_.createStackMap(
+ reason, noExtras, debugFrameWithLiveRefs, stk_, &stackMap) &&
+ (!stackMap || stackMaps_->add(insnRange.resumeOffset(), stackMap));
+}
+
bool BaseCompiler::createDebugOnlyStackMapForNonResumingTrap(StackMap** result,
Trap t1, Trap t2) {
// `t1`, and, if specified `t2`, definitely won't resume.
diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
index be07ff0b7b2..bf427915130 100644
--- a/js/src/wasm/WasmBaselineCompile.cpp
+++ b/js/src/wasm/WasmBaselineCompile.cpp
@@ -9214,6 +9214,12 @@ bool BaseCompiler::emitRefCast(bool nullable) {
masm.appendAndVerify(wasm::Trap::BadCast,
wasm::TrapMachineInsnForLoadWord(), fcr,
trapSiteDesc());
+ // stackmap for: debug: emitRefCast
+ if (compilerEnv_.debugEnabled() &&
+ !createStackMap(Some(Trap::BadCast), fcr,
+ HasDebugFrameWithLiveRefs::Maybe)) {
+ return false;
+ }
}
freeRegistersForBranchIfRefSubtype(regs);
Loading diff…
References
On This Page