Firefox · SpiderMonkey
CVE-2026-109721
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/jit/MIR.cpp
Patch
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 0b5b2c2c484..e7f0159124c 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -328,7 +328,10 @@ static MConstant* EvaluateIntConstantOperands(TempAllocator& alloc,
static MConstant* EvaluateInt32ConstantOperands(TempAllocator& alloc,
MBinaryInstruction* ins) {
- return EvaluateIntConstantOperands<MIRType::Int32>(alloc, ins);
+ MConstant* result = EvaluateIntConstantOperands<MIRType::Int32>(alloc, ins);
+ MOZ_RELEASE_ASSERT(!result || !ins->range() ||
+ ins->range()->contains(result->toInt32()));
+ return result;
}
static MConstant* EvaluateInt64ConstantOperands(TempAllocator& alloc,
Loading diff…
References
On This Page