PatchGap
Firefox · SpiderMonkey

CVE-2026-6779

Logic Error in SpiderMonkey
Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionOther issue in the JavaScript Engine component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2023343
Fix commite1c02b62208d (firefox) +15/-2
CISA KEVNot listed
CreditedGary Kwong
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
for
js/src/jit-test/tests/errors/bug2023343.js
 modified

Files Changed

  • js/src/jit-test/tests/errors/bug2023343.js
  • js/src/vm/Interpreter.cpp

Patch

view commit
diff --git a/js/src/jit-test/tests/errors/bug2023343.js b/js/src/jit-test/tests/errors/bug2023343.js
new file mode 100644
index 00000000000..1ff924c8d80
--- /dev/null
+++ b/js/src/jit-test/tests/errors/bug2023343.js
@@ -0,0 +1,13 @@
+// |jit-test| --no-blinterp
+
+let g = newGlobal({newCompartment: true});
+
+function f() {
+  for (var y in {x:1}) {
+    try {
+      g.eval("throw 0")
+    } finally {}
+  }
+}
+try { f() } catch {}
+oomTest(f)
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 4181a7cb037..98fabae48dd 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -4501,8 +4501,8 @@ error:
       ReservedRooted<Value> exceptionStack(&rootValue1);
       if (!cx->getPendingException(&exception) ||
           !cx->getPendingExceptionStack(&exceptionStack)) {
-        interpReturnOK = false;
-        goto return_continuation;
+        exception = UndefinedValue();
+        exceptionStack = NullValue();
       }
       PUSH_COPY(exception);
       PUSH_COPY(exceptionStack);
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/js/src/jit-test/tests/errors/bug2023343.js b/js/src/jit-test/tests/errors/bug2023343.js
new file mode 100644
index 00000000000..1ff924c8d80
--- /dev/null
+++ b/js/src/jit-test/tests/errors/bug2023343.js
@@ -0,0 +1,13 @@
+// |jit-test| --no-blinterp
+
+let g = newGlobal({newCompartment: true});
+
+function f() {
+  for (var y in {x:1}) {
+    try {
+      g.eval("throw 0")
+    } finally {}
+  }
+}
+try { f() } catch {}
+oomTest(f)
Loading diff…
On This Page