High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the JavaScript: WebAssembly component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2068374
Fix commitd29cfe7c0c38 (firefox) +8/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
if
js/src/vm/JitActivation.cpp
modified

Files Changed

  • js/src/vm/JitActivation.cpp
diff --git a/js/src/vm/JitActivation.cpp b/js/src/vm/JitActivation.cpp
index de26fa17fbf..a6c2c5431db 100644
--- a/js/src/vm/JitActivation.cpp
+++ b/js/src/vm/JitActivation.cpp
@@ -253,6 +253,14 @@ void js::jit::JitActivation::startWasmTrap(wasm::Trap trap,
   MOZ_ASSERT_IF(!unwound,
                 code == &wasm::GetNearestEffectiveInstance(fp)->code());
 
+  // The cross-instance return_call switched cx->realm to the callee and
+  // collapsed the caller, so on unwind no live frame keeps that realm alive.
+  // Restore it to the frame we unwound to, as the exception handler will.
+  if (unwound) {
+    cx()->setRealmForJitExceptionHandler(
+        wasm::GetNearestEffectiveInstance(fp)->realm());
+  }
+
   // Keep the trapping code alive across a GC. For an IndirectCallBadSig trap
   // reached through a tail call, this code can belong to a different instance
   // than the effective one above, whose frame has already been unwound. Nothing
Loading diff…