Firefox · SpiderMonkey
CVE-2026-10702
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/jit/MIR.hjs/src/jit/MIROps.yamljs/src/jit/ScalarReplacement.cpp
Patch
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 40fc388fc06..563a5fb3131 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9362,12 +9362,6 @@ class MObjectToIterator : public MUnaryInstruction,
TRIVIAL_NEW_WRAPPERS
NAMED_OPERANDS((0, object))
- AliasSet getAliasSet() const override {
- return skipRegistration_
- ? AliasSet::Load(AliasSet::ObjectFields | AliasSet::Element)
- : AliasSet::Store(AliasSet::Any);
- }
-
bool wantsIndices() const { return wantsIndices_; }
void setWantsIndices(bool value) { wantsIndices_ = value; }
diff --git a/js/src/jit/MIROps.yaml b/js/src/jit/MIROps.yaml
index 5bb075642e8..5b08566e9be 100644
--- a/js/src/jit/MIROps.yaml
+++ b/js/src/jit/MIROps.yaml
@@ -2377,6 +2377,7 @@
operands:
iterator: Object
result_type: Object
+ alias_set: none
can_recover: true
- name: LoadUnboxedScalar
diff --git a/js/src/jit/ScalarReplacement.cpp b/js/src/jit/ScalarReplacement.cpp
index dee8891d7bc..0e225c9f9b6 100644
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -4430,6 +4430,7 @@ bool ObjectKeysReplacer::run(MInstructionIterator& outerIterator) {
objToIter_ = MObjectToIterator::New(alloc_, objectKeys()->object(), nullptr);
objToIter_->setSkipRegistration(true);
+ objToIter_->stealResumePoint(arr_);
arr_->block()->insertBefore(arr_, objToIter_);
// Iterate over each basic block.
@@ -4464,7 +4465,6 @@ bool ObjectKeysReplacer::run(MInstructionIterator& outerIterator) {
auto* forRecovery = MObjectKeysFromIterator::New(alloc_, objToIter_);
arr_->block()->insertBefore(arr_, forRecovery);
- forRecovery->stealResumePoint(arr_);
arr_->replaceAllUsesWith(forRecovery);
// We need to explicitly discard the instruction since it's marked as
Loading diff…
References
On This Page