High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionJIT miscompilation in the JavaScript Engine: JIT component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2040903
Fix commite43e6780c6c0 (firefox) +2/-7
CISA KEVNot listed
CreditedNebula Security
Disclosed2026-06-02

Files Changed

  • js/src/jit/MIR.h
  • js/src/jit/MIROps.yaml
  • js/src/jit/ScalarReplacement.cpp
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 40fc388fc06..563a5fb3131 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9362,12 +9362,6 @@ class MObjectToIterator : public MUnaryInstruction,
   TRIVIAL_NEW_WRAPPERS
   NAMED_OPERANDS((0, object))
 
-  AliasSet getAliasSet() const override {
-    return skipRegistration_
-               ? AliasSet::Load(AliasSet::ObjectFields | AliasSet::Element)
-               : AliasSet::Store(AliasSet::Any);
-  }
-
   bool wantsIndices() const { return wantsIndices_; }
   void setWantsIndices(bool value) { wantsIndices_ = value; }
 
diff --git a/js/src/jit/MIROps.yaml b/js/src/jit/MIROps.yaml
index 5bb075642e8..5b08566e9be 100644
--- a/js/src/jit/MIROps.yaml
+++ b/js/src/jit/MIROps.yaml
@@ -2377,6 +2377,7 @@
   operands:
     iterator: Object
   result_type: Object
+  alias_set: none
   can_recover: true
 
 - name: LoadUnboxedScalar
diff --git a/js/src/jit/ScalarReplacement.cpp b/js/src/jit/ScalarReplacement.cpp
index dee8891d7bc..0e225c9f9b6 100644
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -4430,6 +4430,7 @@ bool ObjectKeysReplacer::run(MInstructionIterator& outerIterator) {
 
   objToIter_ = MObjectToIterator::New(alloc_, objectKeys()->object(), nullptr);
   objToIter_->setSkipRegistration(true);
+  objToIter_->stealResumePoint(arr_);
   arr_->block()->insertBefore(arr_, objToIter_);
 
   // Iterate over each basic block.
@@ -4464,7 +4465,6 @@ bool ObjectKeysReplacer::run(MInstructionIterator& outerIterator) {
 
   auto* forRecovery = MObjectKeysFromIterator::New(alloc_, objToIter_);
   arr_->block()->insertBefore(arr_, forRecovery);
-  forRecovery->stealResumePoint(arr_);
   arr_->replaceAllUsesWith(forRecovery);
 
   // We need to explicitly discard the instruction since it's marked as
Loading diff…