High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the JavaScript Engine: JIT component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2074161
Fix commit9207a63782d9 (firefox) +4/-1
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-13

Files Changed

  • js/src/jit/MIR.cpp
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 0b5b2c2c484..e7f0159124c 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -328,7 +328,10 @@ static MConstant* EvaluateIntConstantOperands(TempAllocator& alloc,
 
 static MConstant* EvaluateInt32ConstantOperands(TempAllocator& alloc,
                                                 MBinaryInstruction* ins) {
-  return EvaluateIntConstantOperands<MIRType::Int32>(alloc, ins);
+  MConstant* result = EvaluateIntConstantOperands<MIRType::Int32>(alloc, ins);
+  MOZ_RELEASE_ASSERT(!result || !ins->range() ||
+                     ins->range()->contains(result->toInt32()));
+  return result;
 }
 
 static MConstant* EvaluateInt64ConstantOperands(TempAllocator& alloc,
Loading diff…