Firefox · SpiderMonkey
CVE-2026-8389
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/builtin/TestingFunctions.cppjs/src/frontend/Stencil.cppjs/src/jit/BaselineCodeGen.cppjs/src/jit/BaselineJIT.cppjs/src/jit/BaselineJIT.h
Patch
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 72d7f2cae1d..120376ffdb7 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -9733,11 +9733,7 @@ static bool BaselineCompile(JSContext* cx, unsigned argc, Value* vp) {
returnedStr = "baseline disabled";
break;
}
- if (script->length() > jit::BaselineMaxScriptLength ||
- script->nslots() > jit::BaselineMaxScriptSlots) {
- script->disableBaselineCompile();
- }
- if (!script->canBaselineCompile()) {
+ if (!jit::CanBaselineCompileScript(cx, script)) {
returnedStr = "can't compile";
break;
}
diff --git a/js/src/frontend/Stencil.cpp b/js/src/frontend/Stencil.cpp
index 6d840fb7695..58360bd0332 100644
--- a/js/src/frontend/Stencil.cpp
+++ b/js/src/frontend/Stencil.cpp
@@ -31,7 +31,7 @@
#include "gc/AllocKind.h" // gc::AllocKind
#include "gc/Tracer.h" // TraceNullableRoot
#include "jit/BaselineCompileTask.h" // BaselineCompileTask::OffThreadBaselineCompilationAvailable
-#include "jit/BaselineJIT.h" // jit::BaselineScript, jit::CanBaselineInterpretScript
+#include "jit/BaselineJIT.h" // jit::BaselineScript, jit::CanBaselineCompileScript
#include "jit/JitContext.h" // jit::MethodStatus
#include "jit/JitRuntime.h" // jit::JitRuntime
#include "jit/JitScript.h" // AutoKeepJitScripts
@@ -2721,7 +2721,7 @@ static bool MaybeDoEagerBaselineCompilations(JSContext* cx,
const CompilationStencil& stencil,
CompilationGCOutput& gcOutput,
bool doAggressive) {
- if (!jit::IsBaselineInterpreterEnabled()) {
+ if (!jit::IsBaselineJitEnabled(cx)) {
return true;
}
@@ -2760,11 +2760,7 @@ static bool MaybeDoEagerBaselineCompilations(JSContext* cx,
}
}
- if (script->baselineDisabled()) {
- continue;
- }
-
- if (!jit::CanBaselineInterpretScript(script)) {
+ if (!jit::CanBaselineCompileScript(cx, script)) {
continue;
}
diff --git a/js/src/jit/BaselineCodeGen.cpp b/js/src/jit/BaselineCodeGen.cpp
index 8b978d6ba02..22920b45430 100644
--- a/js/src/jit/BaselineCodeGen.cpp
+++ b/js/src/jit/BaselineCodeGen.cpp
@@ -290,6 +290,9 @@ MethodStatus BaselineCompiler::compileOffThread() {
}
bool BaselineCompiler::compileImpl() {
+ MOZ_RELEASE_ASSERT(handler.script()->length() <= BaselineMaxScriptLength);
+ MOZ_RELEASE_ASSERT(handler.script()->nslots() <= BaselineMaxScriptSlots);
+
AutoCreatedBy acb(masm, "BaselineCompiler::compile");
perfSpewer_.startRecording();
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 038044d6a43..95afaa7fb3e 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -468,13 +468,7 @@ MethodStatus jit::BaselineCompile(JSContext* cx, JSScript* script,
static MethodStatus CanEnterBaselineJIT(JSContext* cx, HandleScript script,
AbstractFramePtr osrSourceFrame) {
- // Skip if the script has been disabled.
- if (!script->canBaselineCompile()) {
- return Method_Skipped;
- }
-
- if (!IsBaselineJitEnabled(cx)) {
- script->disableBaselineCompile();
+ if (!CanBaselineCompileScript(cx, script)) {
return Method_CantCompile;
}
@@ -503,16 +497,6 @@ static MethodStatus CanEnterBaselineJIT(JSContext* cx, HandleScript script,
return Method_Error;
}
- if (script->length() > BaselineMaxScriptLength) {
- script->disableBaselineCompile();
- return Method_CantCompile;
- }
-
- if (script->nslots() > BaselineMaxScriptSlots) {
- script->disableBaselineCompile();
- return Method_CantCompile;
- }
-
if (script->hasBaselineScript()) {
return Method_Compiled;
}
@@ -549,11 +533,6 @@ static MethodStatus CanEnterBaselineJIT(JSContext* cx, HandleScript script,
return Method_Error;
}
- if (script->hasForceInterpreterOp()) {
- script->disableBaselineCompile();
- return Method_CantCompile;
- }
-
// Frames can be marked as debuggee frames independently of its underlying
// script being a debuggee script, e.g., when performing
// Debugger.Frame.prototype.eval.
@@ -581,6 +560,27 @@ bool jit::CanBaselineInterpretScript(JSScript* script) {
return true;
}
+bool jit::CanBaselineCompileScript(JSContext* cx, JSScript* script) {
+ if (!script->canBaselineCompile()) {
+ return false;
+ }
+ if (!IsBaselineJitEnabled(cx)) {
+ script->disableBaselineCompile();
+ return false;
+ }
+ if (!CanBaselineInterpretScript(script)) {
+ script->disableBaselineCompile();
+ return false;
+ }
+ if (script->length() > BaselineMaxScriptLength) {
+ script->disableBaselineCompile();
+ return false;
+ }
+ MOZ_RELEASE_ASSERT(script->nslots() <= BaselineMaxScriptSlots,
+ "nslots is checked in CanBaselineInterpretScript");
+ return true;
+}
+
static bool MaybeCreateBaselineInterpreterEntryScript(JSContext* cx,
JSScript* script) {
MOZ_ASSERT(script->hasJitScript());
diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h
index 39f23aa0961..87ab64d9a3f 100644
--- a/js/src/jit/BaselineJIT.h
+++ b/js/src/jit/BaselineJIT.h
@@ -397,6 +397,7 @@ JitExecStatus EnterBaselineInterpreterAtBranch(JSContext* cx,
jsbytecode* pc);
bool CanBaselineInterpretScript(JSScript* script);
+bool CanBaselineCompileScript(JSContext* cx, JSScript* script);
// Called by the Baseline Interpreter to compile a script for the Baseline JIT.
// |res| is set to the native code address in the BaselineScript to jump to, or
Loading diff…
References
On This Page