High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionJIT miscompilation in the JavaScript Engine: JIT component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2074164
Fix commitd87f25462232 (firefox) +31/-0
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
for
js/src/jit-test/tests/warp/bug2074164.js
modified

Files Changed

  • js/src/jit-test/tests/warp/bug2074164.js
diff --git a/js/src/jit-test/tests/warp/bug2074164.js b/js/src/jit-test/tests/warp/bug2074164.js
new file mode 100644
index 00000000000..e73253f4c0d
--- /dev/null
+++ b/js/src/jit-test/tests/warp/bug2074164.js
@@ -0,0 +1,31 @@
+// |jit-test| --no-threads; --fast-warmup
+
+function run(target) {
+  let g = newGlobal({newCompartment: true});
+  g.eval(`
+    let numGlobalProps = Object.keys(globalThis).length;
+    let padding = ${target} - numGlobalProps;
+    var value = 0;
+    function nonStrict() { return this; }
+    function assign(receiver) {
+      value = 1;
+      if (nonStrict.call(receiver)) {
+        value = 2;
+      }
+    }
+    const object = {};
+    for (let i = 0; i < padding; i++) {
+      globalThis["property" + i] = i;
+    }
+    for (let i = 0; i < 100; i++) {
+      assign(object);
+    }
+    assign(1n);
+    assertEq(value, 2);
+`);
+}
+
+let bestGuess = 996;
+for (let i = bestGuess - 30; i < bestGuess + 30; i++) {
+  run(i);
+}
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/js/src/jit-test/tests/warp/bug2074164.js b/js/src/jit-test/tests/warp/bug2074164.js
new file mode 100644
index 00000000000..e73253f4c0d
--- /dev/null
+++ b/js/src/jit-test/tests/warp/bug2074164.js
@@ -0,0 +1,31 @@
+// |jit-test| --no-threads; --fast-warmup
+
+function run(target) {
+  let g = newGlobal({newCompartment: true});
+  g.eval(`
+    let numGlobalProps = Object.keys(globalThis).length;
+    let padding = ${target} - numGlobalProps;
+    var value = 0;
+    function nonStrict() { return this; }
+    function assign(receiver) {
+      value = 1;
+      if (nonStrict.call(receiver)) {
+        value = 2;
+      }
+    }
+    const object = {};
+    for (let i = 0; i < padding; i++) {
+      globalThis["property" + i] = i;
+    }
+    for (let i = 0; i < 100; i++) {
+      assign(object);
+    }
+    assign(1n);
+    assertEq(value, 2);
+`);
+}
+
+let bestGuess = 996;
+for (let i = bestGuess - 30; i < bestGuess + 30; i++) {
+  run(i);
+}
Loading diff…