PatchGap
Firefox · SpiderMonkey

CVE-2026-100817

Logic Error in SpiderMonkey
Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionOther issue in the JavaScript: WebAssembly component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2068670
Fix commit7f707be77c87 (firefox) +44/-14
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
for
js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
 modified

Files Changed

  • js/src/jit-test/tests/wasm/atomic.js
  • js/src/jit-test/tests/wasm/basic.js
  • js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js
  • js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
  • js/src/jit-test/tests/wasm/errors.js
  • js/src/jit-test/tests/wasm/exnref/try-table.js
  • js/src/jit-test/tests/wasm/gc/arrays.js
  • js/src/jit-test/tests/wasm/gc/cast-abstract.js
  • js/src/jit-test/tests/wasm/gc/ref-gvn.js
  • js/src/jit-test/tests/wasm/gc/signal-null-check.js
  • js/src/jit-test/tests/wasm/gc/structs.js
  • js/src/jit-test/tests/wasm/gc/structs2.js
  • js/src/jit-test/tests/wasm/integer.js
  • js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js
  • js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js
  • js/src/jit-test/tests/wasm/memory-partial-oob-store.js
  • js/src/jit-test/tests/wasm/memory64/basic.js
  • js/src/jit-test/tests/wasm/regress/bug1684861.js
  • js/src/jit-test/tests/wasm/simd/ad-hack-extra.js
  • js/src/jit-test/tests/wasm/timeout/stack-overflow.js

Patch

view commit
diff --git a/js/src/jit-test/tests/wasm/atomic.js b/js/src/jit-test/tests/wasm/atomic.js
index bb85ec8ed17..6be16174cde 100644
--- a/js/src/jit-test/tests/wasm/atomic.js
+++ b/js/src/jit-test/tests/wasm/atomic.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmThreadsEnabled()
+// |jit-test| skip-if: !wasmThreadsEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 const oob = /index out of bounds/;
 const unaligned = /unaligned memory access/;
diff --git a/js/src/jit-test/tests/wasm/basic.js b/js/src/jit-test/tests/wasm/basic.js
index 8935b36228e..73ca63e1176 100644
--- a/js/src/jit-test/tests/wasm/basic.js
+++ b/js/src/jit-test/tests/wasm/basic.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 const { LinkError } = WebAssembly;
 
 // ----------------------------------------------------------------------------
@@ -221,8 +223,14 @@ wasmValidateText('(module (func (nop)) (func (call 0)))');
 wasmValidateText('(module (func (param i32) (nop)) (func (call 0 (i32.const 0))))');
 
 wasmFullPass('(module (func (result i32) (i32.const 42)) (func (result i32) (call 0)) (export "run" (func 1)))', 42);
-assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
-assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 1)) (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
+
+// These two both get stack overflows, and take a long time (> 1 min) to run on
+// an optimised, debug build, when wasm_baseline_debug==true.  So skip in that case.
+// See bug 2068514.
+if (getPrefValue("wasm_baseline_debug") === false) {
+  assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
+  assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 1)) (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
+}
 
 wasmValidateText('(module (func (param i32 f32)) (func (call 0 (i32.const 0) (f32.const nan))))');
 wasmFailValidateText('(module (func (param i32 f32)) (func (call 0 (i32.const 0) (i32.const 0))))', mismatchError("i32", "f32"));
diff --git a/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js b/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js
index 29f492ab551..f23acc87b7c 100644
--- a/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js
+++ b/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 const bytes = wasmTextToBinary(`(module
   (import "wasm:js-string" "length" (func (param externref) (result i32)))
   (import "m" "mem" (memory 0))
diff --git a/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js b/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
index 013c05f43ef..41556c478cc 100644
--- a/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
+++ b/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmCustomPageSizesEnabled()
+// |jit-test| skip-if: !wasmCustomPageSizesEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 for (const addrtype of ["i32", "i64"]) {
   console.log(`Address type: ${addrtype}`);
diff --git a/js/src/jit-test/tests/wasm/errors.js b/js/src/jit-test/tests/wasm/errors.js
index e118a057a2f..2bb18ae6e27 100644
--- a/js/src/jit-test/tests/wasm/errors.js
+++ b/js/src/jit-test/tests/wasm/errors.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 load(libdir + "wasm-binary.js");
 
 const Module = WebAssembly.Module;
@@ -137,7 +139,13 @@ testStore(F64Store, 'f64.store', 'f64', 8, RuntimeError, /index out of bounds/);
 // semantics of call so use the same InternalError as JS and use the bytecode
 // offset of the function body (which happens to start with the number of
 // local entries).
-test(4 /* = num locals */, '(module (func (local i32 i64 f32 f64) (call 0)) (start 0))', InternalError, /too much recursion/);
+//
+// This gets a stack overflows, and takes a long time (~40 seconds) to run on
+// an optimised, debug build, when wasm_baseline_debug==true.  So skip in that case.
+// See bug 2068514.
+if (getPrefValue("wasm_baseline_debug") === false) {
+  test(4 /* = num locals */, '(module (func (local i32 i64 f32 f64) (call 0)) (start 0))', InternalError, /too much recursion/);
+}
 
 // Test whole callstack.
 var {stack, binary} = test(UnreachableCode, `(module
diff --git a/js/src/jit-test/tests/wasm/exnref/try-table.js b/js/src/jit-test/tests/wasm/exnref/try-table.js
index c2352d2beab..c6a4c0ec062 100644
--- a/js/src/jit-test/tests/wasm/exnref/try-table.js
+++ b/js/src/jit-test/tests/wasm/exnref/try-table.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 // A try_table acts like a block label, with results
 {
   let maxResults1 = Array.from(Array(1000).keys());
diff --git a/js/src/jit-test/tests/wasm/gc/arrays.js b/js/src/jit-test/tests/wasm/gc/arrays.js
index a6d1d4c941b..c84a2052a6b 100644
--- a/js/src/jit-test/tests/wasm/gc/arrays.js
+++ b/js/src/jit-test/tests/wasm/gc/arrays.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--gc-zeal=2; test-also=--no-avx
+// |jit-test| test-also=--gc-zeal=2; test-also=--no-avx; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Test array instructions on different valtypes
 
diff --git a/js/src/jit-test/tests/wasm/gc/cast-abstract.js b/js/src/jit-test/tests/wasm/gc/cast-abstract.js
index 5d2321536b2..617204eb9ea 100644
--- a/js/src/jit-test/tests/wasm/gc/cast-abstract.js
+++ b/js/src/jit-test/tests/wasm/gc/cast-abstract.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 load(libdir + "wasm-binary.js");
 
 // Replace this with a string like 'non-null (ref $s1) -> (ref any) -> (ref any)' to test exactly one specific case. Makes debugging easier.
diff --git a/js/src/jit-test/tests/wasm/gc/ref-gvn.js b/js/src/jit-test/tests/wasm/gc/ref-gvn.js
index 3118a5df91a..cca92cff2e8 100644
--- a/js/src/jit-test/tests/wasm/gc/ref-gvn.js
+++ b/js/src/jit-test/tests/wasm/gc/ref-gvn.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 // Tests that exercise GVN and LICM. The general pattern for these tests is to
 // create values near the top of the function and then create situations where
 // equivalent values are created below, including in loops.
diff --git a/js/src/jit-test/tests/wasm/gc/signal-null-check.js b/js/src/jit-test/tests/wasm/gc/signal-null-check.js
index 4570e11f1ec..83385dc52a7 100644
--- a/js/src/jit-test/tests/wasm/gc/signal-null-check.js
+++ b/js/src/jit-test/tests/wasm/gc/signal-null-check.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--no-avx
+// |jit-test| test-also=--no-avx; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Checks if null dereference works.
 
diff --git a/js/src/jit-test/tests/wasm/gc/structs.js b/js/src/jit-test/tests/wasm/gc/structs.js
index 6e49a588b3b..d38a452ae09 100644
--- a/js/src/jit-test/tests/wasm/gc/structs.js
+++ b/js/src/jit-test/tests/wasm/gc/structs.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--gc-zeal=2
+// |jit-test| test-also=--gc-zeal=2; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // This tests a bunch of wasm struct stuff, but not i8 or i16 fields.
 // See structs2.js for i8/i16 field tests.
diff --git a/js/src/jit-test/tests/wasm/gc/structs2.js b/js/src/jit-test/tests/wasm/gc/structs2.js
index 1a7700178a6..00bd349aeb5 100644
--- a/js/src/jit-test/tests/wasm/gc/structs2.js
+++ b/js/src/jit-test/tests/wasm/gc/structs2.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--gc-zeal=2
+// |jit-test| test-also=--gc-zeal=2; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // This tests 8- and 16-bit field accesses for structs.
 
diff --git a/js/src/jit-test/tests/wasm/integer.js b/js/src/jit-test/tests/wasm/integer.js
index cd5e924ec67..0d09854afc5 100644
--- a/js/src/jit-test/tests/wasm/integer.js
+++ b/js/src/jit-test/tests/wasm/integer.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 assertEq(wasmEvalText('(module (func (result i32) (i32.const -1)) (export "" (func 0)))').exports[""](), -1);
 assertEq(wasmEvalText('(module (func (result i32) (i32.const -2147483648)) (export "" (func 0)))').exports[""](), -2147483648);
 assertEq(wasmEvalText('(module (func (result i32) (i32.const 4294967295)) (export "" (func 0)))').exports[""](), -1);
diff --git a/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js b/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js
index 6705f35b0e9..20d82b8fcf3 100644
--- a/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js
+++ b/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmJSPromiseIntegrationEnabled()
+// |jit-test| skip-if: !wasmJSPromiseIntegrationEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Regression test for bug 2043062: the wrapper function built for a
 // WebAssembly.Suspending import must be given the import's actual declared
diff --git a/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js b/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js
index cfcfe0c64c3..6d964cd05e8 100644
--- a/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js
+++ b/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !largeArrayBufferSupported(); allow-oom
+// |jit-test| skip-if: !largeArrayBufferSupported(); allow-oom; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Test i32 index register is zero-extended.
 
diff --git a/js/src/jit-test/tests/wasm/memory-partial-oob-store.js b/js/src/jit-test/tests/wasm/memory-partial-oob-store.js
index e542ea9735c..8f77e740a8c 100644
--- a/js/src/jit-test/tests/wasm/memory-partial-oob-store.js
+++ b/js/src/jit-test/tests/wasm/memory-partial-oob-store.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 // Cloned from memory.js but kept separate because it may have to be disabled on
 // some devices until bugs are fixed.
 
diff --git a/js/src/jit-test/tests/wasm/memory64/basic.js b/js/src/jit-test/tests/wasm/memory64/basic.js
index 267aa53a4ee..e563c1e79e7 100644
--- a/js/src/jit-test/tests/wasm/memory64/basic.js
+++ b/js/src/jit-test/tests/wasm/memory64/basic.js
@@ -1,4 +1,4 @@
-// |jit-test| heavy; allow-oom
+// |jit-test| heavy; allow-oom; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Basic tests around creating and linking memories with i64 indices
 
diff --git a/js/src/jit-test/tests/wasm/regress/bug1684861.js b/js/src/jit-test/tests/wasm/regress/bug1684861.js
index 4cb9bb23838..15856730f4e 100644
--- a/js/src/jit-test/tests/wasm/regress/bug1684861.js
+++ b/js/src/jit-test/tests/wasm/regress/bug1684861.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 const oob = /index out of bounds/;
 const unaligned = /unaligned memory access/;
 const RuntimeError = WebAssembly.RuntimeError;
diff --git a/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js b/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js
index 9e68b1cf20e..7d2dd9d3d1a 100644
--- a/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js
+++ b/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmSimdEnabled()
+// |jit-test| skip-if: !wasmSimdEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Do not include this in the preamble, it must be loaded after lib/wasm.js
 load(scriptdir + "ad-hack-preamble.js")
diff --git a/js/src/jit-test/tests/wasm/timeout/stack-overflow.js b/js/src/jit-test/tests/wasm/timeout/stack-overflow.js
index f286997a9cf..607fc5509fd 100644
--- a/js/src/jit-test/tests/wasm/timeout/stack-overflow.js
+++ b/js/src/jit-test/tests/wasm/timeout/stack-overflow.js
@@ -1,4 +1,4 @@
-// |jit-test| exitstatus: 3; skip-if: !wasmIsSupported()
+// |jit-test| exitstatus: 3; skip-if: !wasmIsSupported(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 let { exports } = new WebAssembly.Instance(
     new WebAssembly.Module(wasmTextToBinary(`
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/js/src/jit-test/tests/wasm/atomic.js b/js/src/jit-test/tests/wasm/atomic.js
index bb85ec8ed17..6be16174cde 100644
--- a/js/src/jit-test/tests/wasm/atomic.js
+++ b/js/src/jit-test/tests/wasm/atomic.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmThreadsEnabled()
+// |jit-test| skip-if: !wasmThreadsEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 const oob = /index out of bounds/;
 const unaligned = /unaligned memory access/;
diff --git a/js/src/jit-test/tests/wasm/basic.js b/js/src/jit-test/tests/wasm/basic.js
index 8935b36228e..73ca63e1176 100644
--- a/js/src/jit-test/tests/wasm/basic.js
+++ b/js/src/jit-test/tests/wasm/basic.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 const { LinkError } = WebAssembly;
 
 // ----------------------------------------------------------------------------
@@ -221,8 +223,14 @@ wasmValidateText('(module (func (nop)) (func (call 0)))');
 wasmValidateText('(module (func (param i32) (nop)) (func (call 0 (i32.const 0))))');
 
 wasmFullPass('(module (func (result i32) (i32.const 42)) (func (result i32) (call 0)) (export "run" (func 1)))', 42);
-assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
-assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 1)) (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
+
+// These two both get stack overflows, and take a long time (> 1 min) to run on
+// an optimised, debug build, when wasm_baseline_debug==true.  So skip in that case.
+// See bug 2068514.
+if (getPrefValue("wasm_baseline_debug") === false) {
+  assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
+  assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 1)) (func (call 0)) (export "" (func 0)))').exports[""](), InternalError);
+}
 
 wasmValidateText('(module (func (param i32 f32)) (func (call 0 (i32.const 0) (f32.const nan))))');
 wasmFailValidateText('(module (func (param i32 f32)) (func (call 0 (i32.const 0) (i32.const 0))))', mismatchError("i32", "f32"));
diff --git a/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js b/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js
index 29f492ab551..f23acc87b7c 100644
--- a/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js
+++ b/js/src/jit-test/tests/wasm/builtin-modules/bug2019813.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 const bytes = wasmTextToBinary(`(module
   (import "wasm:js-string" "length" (func (param externref) (result i32)))
   (import "m" "mem" (memory 0))
diff --git a/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js b/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
index 013c05f43ef..41556c478cc 100644
--- a/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
+++ b/js/src/jit-test/tests/wasm/custom-page-sizes/runtime.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmCustomPageSizesEnabled()
+// |jit-test| skip-if: !wasmCustomPageSizesEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 for (const addrtype of ["i32", "i64"]) {
   console.log(`Address type: ${addrtype}`);
diff --git a/js/src/jit-test/tests/wasm/errors.js b/js/src/jit-test/tests/wasm/errors.js
index e118a057a2f..2bb18ae6e27 100644
--- a/js/src/jit-test/tests/wasm/errors.js
+++ b/js/src/jit-test/tests/wasm/errors.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 load(libdir + "wasm-binary.js");
 
 const Module = WebAssembly.Module;
@@ -137,7 +139,13 @@ testStore(F64Store, 'f64.store', 'f64', 8, RuntimeError, /index out of bounds/);
 // semantics of call so use the same InternalError as JS and use the bytecode
 // offset of the function body (which happens to start with the number of
 // local entries).
-test(4 /* = num locals */, '(module (func (local i32 i64 f32 f64) (call 0)) (start 0))', InternalError, /too much recursion/);
+//
+// This gets a stack overflows, and takes a long time (~40 seconds) to run on
+// an optimised, debug build, when wasm_baseline_debug==true.  So skip in that case.
+// See bug 2068514.
+if (getPrefValue("wasm_baseline_debug") === false) {
+  test(4 /* = num locals */, '(module (func (local i32 i64 f32 f64) (call 0)) (start 0))', InternalError, /too much recursion/);
+}
 
 // Test whole callstack.
 var {stack, binary} = test(UnreachableCode, `(module
diff --git a/js/src/jit-test/tests/wasm/exnref/try-table.js b/js/src/jit-test/tests/wasm/exnref/try-table.js
index c2352d2beab..c6a4c0ec062 100644
--- a/js/src/jit-test/tests/wasm/exnref/try-table.js
+++ b/js/src/jit-test/tests/wasm/exnref/try-table.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 // A try_table acts like a block label, with results
 {
   let maxResults1 = Array.from(Array(1000).keys());
diff --git a/js/src/jit-test/tests/wasm/gc/arrays.js b/js/src/jit-test/tests/wasm/gc/arrays.js
index a6d1d4c941b..c84a2052a6b 100644
--- a/js/src/jit-test/tests/wasm/gc/arrays.js
+++ b/js/src/jit-test/tests/wasm/gc/arrays.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--gc-zeal=2; test-also=--no-avx
+// |jit-test| test-also=--gc-zeal=2; test-also=--no-avx; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Test array instructions on different valtypes
diff --git a/js/src/jit-test/tests/wasm/gc/cast-abstract.js b/js/src/jit-test/tests/wasm/gc/cast-abstract.js
index 5d2321536b2..617204eb9ea 100644
--- a/js/src/jit-test/tests/wasm/gc/cast-abstract.js
+++ b/js/src/jit-test/tests/wasm/gc/cast-abstract.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 load(libdir + "wasm-binary.js");
 
 // Replace this with a string like 'non-null (ref $s1) -> (ref any) -> (ref any)' to test exactly one specific case. Makes debugging easier.
diff --git a/js/src/jit-test/tests/wasm/gc/ref-gvn.js b/js/src/jit-test/tests/wasm/gc/ref-gvn.js
index 3118a5df91a..cca92cff2e8 100644
--- a/js/src/jit-test/tests/wasm/gc/ref-gvn.js
+++ b/js/src/jit-test/tests/wasm/gc/ref-gvn.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 // Tests that exercise GVN and LICM. The general pattern for these tests is to
 // create values near the top of the function and then create situations where
 // equivalent values are created below, including in loops.
diff --git a/js/src/jit-test/tests/wasm/gc/signal-null-check.js b/js/src/jit-test/tests/wasm/gc/signal-null-check.js
index 4570e11f1ec..83385dc52a7 100644
--- a/js/src/jit-test/tests/wasm/gc/signal-null-check.js
+++ b/js/src/jit-test/tests/wasm/gc/signal-null-check.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--no-avx
+// |jit-test| test-also=--no-avx; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Checks if null dereference works.
diff --git a/js/src/jit-test/tests/wasm/gc/structs.js b/js/src/jit-test/tests/wasm/gc/structs.js
index 6e49a588b3b..d38a452ae09 100644
--- a/js/src/jit-test/tests/wasm/gc/structs.js
+++ b/js/src/jit-test/tests/wasm/gc/structs.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--gc-zeal=2
+// |jit-test| test-also=--gc-zeal=2; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // This tests a bunch of wasm struct stuff, but not i8 or i16 fields.
 // See structs2.js for i8/i16 field tests.
diff --git a/js/src/jit-test/tests/wasm/gc/structs2.js b/js/src/jit-test/tests/wasm/gc/structs2.js
index 1a7700178a6..00bd349aeb5 100644
--- a/js/src/jit-test/tests/wasm/gc/structs2.js
+++ b/js/src/jit-test/tests/wasm/gc/structs2.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--gc-zeal=2
+// |jit-test| test-also=--gc-zeal=2; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // This tests 8- and 16-bit field accesses for structs.
diff --git a/js/src/jit-test/tests/wasm/integer.js b/js/src/jit-test/tests/wasm/integer.js
index cd5e924ec67..0d09854afc5 100644
--- a/js/src/jit-test/tests/wasm/integer.js
+++ b/js/src/jit-test/tests/wasm/integer.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 assertEq(wasmEvalText('(module (func (result i32) (i32.const -1)) (export "" (func 0)))').exports[""](), -1);
 assertEq(wasmEvalText('(module (func (result i32) (i32.const -2147483648)) (export "" (func 0)))').exports[""](), -2147483648);
 assertEq(wasmEvalText('(module (func (result i32) (i32.const 4294967295)) (export "" (func 0)))').exports[""](), -1);
diff --git a/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js b/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js
index 6705f35b0e9..20d82b8fcf3 100644
--- a/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js
+++ b/js/src/jit-test/tests/wasm/js-promise-integration/suspending-canonical-type.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmJSPromiseIntegrationEnabled()
+// |jit-test| skip-if: !wasmJSPromiseIntegrationEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Regression test for bug 2043062: the wrapper function built for a
 // WebAssembly.Suspending import must be given the import's actual declared
diff --git a/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js b/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js
index cfcfe0c64c3..6d964cd05e8 100644
--- a/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js
+++ b/js/src/jit-test/tests/wasm/large-memory-atomics-index-zero-extended.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !largeArrayBufferSupported(); allow-oom
+// |jit-test| skip-if: !largeArrayBufferSupported(); allow-oom; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Test i32 index register is zero-extended.
diff --git a/js/src/jit-test/tests/wasm/memory-partial-oob-store.js b/js/src/jit-test/tests/wasm/memory-partial-oob-store.js
index e542ea9735c..8f77e740a8c 100644
--- a/js/src/jit-test/tests/wasm/memory-partial-oob-store.js
+++ b/js/src/jit-test/tests/wasm/memory-partial-oob-store.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 // Cloned from memory.js but kept separate because it may have to be disabled on
 // some devices until bugs are fixed.
diff --git a/js/src/jit-test/tests/wasm/memory64/basic.js b/js/src/jit-test/tests/wasm/memory64/basic.js
index 267aa53a4ee..e563c1e79e7 100644
--- a/js/src/jit-test/tests/wasm/memory64/basic.js
+++ b/js/src/jit-test/tests/wasm/memory64/basic.js
@@ -1,4 +1,4 @@
-// |jit-test| heavy; allow-oom
+// |jit-test| heavy; allow-oom; test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Basic tests around creating and linking memories with i64 indices
diff --git a/js/src/jit-test/tests/wasm/regress/bug1684861.js b/js/src/jit-test/tests/wasm/regress/bug1684861.js
index 4cb9bb23838..15856730f4e 100644
--- a/js/src/jit-test/tests/wasm/regress/bug1684861.js
+++ b/js/src/jit-test/tests/wasm/regress/bug1684861.js
@@ -1,3 +1,5 @@
+// |jit-test| test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
+
 const oob = /index out of bounds/;
 const unaligned = /unaligned memory access/;
 const RuntimeError = WebAssembly.RuntimeError;
diff --git a/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js b/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js
index 9e68b1cf20e..7d2dd9d3d1a 100644
--- a/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js
+++ b/js/src/jit-test/tests/wasm/simd/ad-hack-extra.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmSimdEnabled()
+// |jit-test| skip-if: !wasmSimdEnabled(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 // Do not include this in the preamble, it must be loaded after lib/wasm.js
 load(scriptdir + "ad-hack-preamble.js")
diff --git a/js/src/jit-test/tests/wasm/timeout/stack-overflow.js b/js/src/jit-test/tests/wasm/timeout/stack-overflow.js
index f286997a9cf..607fc5509fd 100644
--- a/js/src/jit-test/tests/wasm/timeout/stack-overflow.js
+++ b/js/src/jit-test/tests/wasm/timeout/stack-overflow.js
@@ -1,4 +1,4 @@
-// |jit-test| exitstatus: 3; skip-if: !wasmIsSupported()
+// |jit-test| exitstatus: 3; skip-if: !wasmIsSupported(); test-also=--setpref=wasm_baseline_debug=true; skip-variant-if: --setpref=wasm_baseline_debug=true, wasmCompileMode() == "ion"
 
 let { exports } = new WebAssembly.Instance(
     new WebAssembly.Module(wasmTextToBinary(`
Loading diff…
On This Page