Firefox · SpiderMonkey
CVE-2026-109722
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forjs/src/jit-test/tests/warp/bug2074164.js |
modified |
Files Changed
js/src/jit-test/tests/warp/bug2074164.js
Patch
diff --git a/js/src/jit-test/tests/warp/bug2074164.js b/js/src/jit-test/tests/warp/bug2074164.js
new file mode 100644
index 00000000000..e73253f4c0d
--- /dev/null
+++ b/js/src/jit-test/tests/warp/bug2074164.js
@@ -0,0 +1,31 @@
+// |jit-test| --no-threads; --fast-warmup
+
+function run(target) {
+ let g = newGlobal({newCompartment: true});
+ g.eval(`
+ let numGlobalProps = Object.keys(globalThis).length;
+ let padding = ${target} - numGlobalProps;
+ var value = 0;
+ function nonStrict() { return this; }
+ function assign(receiver) {
+ value = 1;
+ if (nonStrict.call(receiver)) {
+ value = 2;
+ }
+ }
+ const object = {};
+ for (let i = 0; i < padding; i++) {
+ globalThis["property" + i] = i;
+ }
+ for (let i = 0; i < 100; i++) {
+ assign(object);
+ }
+ assign(1n);
+ assertEq(value, 2);
+`);
+}
+
+let bestGuess = 996;
+for (let i = bestGuess - 30; i < bestGuess + 30; i++) {
+ run(i);
+}
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/js/src/jit-test/tests/warp/bug2074164.js b/js/src/jit-test/tests/warp/bug2074164.js
new file mode 100644
index 00000000000..e73253f4c0d
--- /dev/null
+++ b/js/src/jit-test/tests/warp/bug2074164.js
@@ -0,0 +1,31 @@
+// |jit-test| --no-threads; --fast-warmup
+
+function run(target) {
+ let g = newGlobal({newCompartment: true});
+ g.eval(`
+ let numGlobalProps = Object.keys(globalThis).length;
+ let padding = ${target} - numGlobalProps;
+ var value = 0;
+ function nonStrict() { return this; }
+ function assign(receiver) {
+ value = 1;
+ if (nonStrict.call(receiver)) {
+ value = 2;
+ }
+ }
+ const object = {};
+ for (let i = 0; i < padding; i++) {
+ globalThis["property" + i] = i;
+ }
+ for (let i = 0; i < 100; i++) {
+ assign(object);
+ }
+ assign(1n);
+ assertEq(value, 2);
+`);
+}
+
+let bestGuess = 996;
+for (let i = bestGuess - 30; i < bestGuess + 30; i++) {
+ run(i);
+}
Loading diff…
References
On This Page