SpiderMonkey JavaScript Engine — CWE-407 Analysis
==================================================

.. contents:: :local:

Overview
--------

SpiderMonkey is Mozilla's JavaScript and WebAssembly engine, used in Firefox. Its IonMonkey
JIT compiler (and successor WarpMonkey) performs SSA construction, CFG dominator analysis,
alias analysis, register allocation, and GVN.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

Scan of ``js/src`` (sparse clone of gecko-dev) returned 11 candidates. All triaged as false
positives.

Triage Summary
--------------

All 11 candidates were in non-graph-traversal contexts:

- ``IntlObject.cpp`` — ``std::find`` on a locale tag string (string parsing, not graph)
- ``Calendar.cpp`` — ``.contains(monthCode)`` on a ``Span<>`` of 12–13 month code strings
- ``CalendarFields.h`` — field presence bitset
- ``Heap.cpp`` — ``availableChunks.contains(this)`` on a GC hash set (O(1))
- ``Architecture-arm.cpp`` — CPU capability flags (``EnumSet<ARMCapability>``, bitfield)
- ``testPrintError.cpp`` — test assertion on an error message string buffer
- ``Watchtower.cpp`` — ``NativeObject.contains(cx, id)`` — JS property lookup (hash table, O(1))

No list-backed visited-set pattern in any compiler pass (IonMonkey CFG, SCC, loop analysis,
register allocation, alias analysis).

Key Finding
-----------

SpiderMonkey's JIT compiler infrastructure uses ``js::HashSet`` and ``js::HashMap``
throughout. Property lookup uses hash tables. GC chunk tracking uses hash sets. No
``Vector::Contains`` in any hot graph traversal. No CWE-407 defect.

References
----------

* Scan result: ``tools/scan-results/spidermonkey.txt``
