russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
45 lines
1.7 KiB
ReStructuredText
45 lines
1.7 KiB
ReStructuredText
SpiderMonkey JavaScript Engine — CWE-407 Analysis
|
||
==================================================
|
||
|
||
.. contents:: :local:
|
||
|
||
Overview
|
||
--------
|
||
|
||
SpiderMonkey is Mozilla's JavaScript and WebAssembly engine, used in Firefox. Its IonMonkey
|
||
JIT compiler (and successor WarpMonkey) performs SSA construction, CFG dominator analysis,
|
||
alias analysis, register allocation, and GVN.
|
||
|
||
Status: **CLEAN** (scanned 2026-03-23)
|
||
---------------------------------------
|
||
|
||
Scan of ``js/src`` (sparse clone of gecko-dev) returned 11 candidates. All triaged as false
|
||
positives.
|
||
|
||
Triage Summary
|
||
--------------
|
||
|
||
All 11 candidates were in non-graph-traversal contexts:
|
||
|
||
- ``IntlObject.cpp`` — ``std::find`` on a locale tag string (string parsing, not graph)
|
||
- ``Calendar.cpp`` — ``.contains(monthCode)`` on a ``Span<>`` of 12–13 month code strings
|
||
- ``CalendarFields.h`` — field presence bitset
|
||
- ``Heap.cpp`` — ``availableChunks.contains(this)`` on a GC hash set (O(1))
|
||
- ``Architecture-arm.cpp`` — CPU capability flags (``EnumSet<ARMCapability>``, bitfield)
|
||
- ``testPrintError.cpp`` — test assertion on an error message string buffer
|
||
- ``Watchtower.cpp`` — ``NativeObject.contains(cx, id)`` — JS property lookup (hash table, O(1))
|
||
|
||
No list-backed visited-set pattern in any compiler pass (IonMonkey CFG, SCC, loop analysis,
|
||
register allocation, alias analysis).
|
||
|
||
Key Finding
|
||
-----------
|
||
|
||
SpiderMonkey's JIT compiler infrastructure uses ``js::HashSet`` and ``js::HashMap``
|
||
throughout. Property lookup uses hash tables. GC chunk tracking uses hash sets. No
|
||
``Vector::Contains`` in any hot graph traversal. No CWE-407 defect.
|
||
|
||
References
|
||
----------
|
||
|
||
* Scan result: ``tools/scan-results/spidermonkey.txt``
|