js-102.15.0

[Xi Ruoyao]

New minor version.

There seems some security update. What should we do?

[Bruce Dubbs]

There are always security updates. Wait until after release and handle it normally.

[ken@…]

I don't see anything specific to spidermonkey mentioned in the release notes for either 102.14.0 or 102.15.0 ?

We are still on 102.13.0.

There is a JIT fix in 115.2.0, but we aren't using JS115 at the moment.

Assuming, for the moment, that any fix will be in js/src (maybe a dangerous assumption, dunno) the changes from 102.13 are:

diff -Naur firefox-102.13.0/js/src/jit/AliasAnalysis.cpp firefox-102.15.0/js/src/jit/AliasAnalysis.cpp
--- firefox-102.13.0/js/src/jit/AliasAnalysis.cpp       2023-06-29 19:12:07.000000000 +0100
+++ firefox-102.15.0/js/src/jit/AliasAnalysis.cpp       2023-08-22 16:44:36.000000000 +0100
@@ -187,8 +187,7 @@
       def->setId(newId++);
     }
 
-    for (MInstructionIterator def(block->begin()),
-         end(block->begin(block->lastIns()));
+    for (MInstructionIterator def(block->begin()), end(block->end());
          def != end; ++def) {
       def->setId(newId++);
 
@@ -252,10 +251,6 @@
       }
     }
 
-    // Renumber the last instruction, as the analysis depends on this and the
-    // order.
-    block->lastIns()->setId(newId++);
-
     if (block->isLoopBackedge()) {
       MOZ_ASSERT(loop_->loopHeader() == block->loopHeaderOfBackedge());
       JitSpew(JitSpew_Alias, "Processing loop backedge %u (header %u)",

and

diff -Naur firefox-102.13.0/js/src/jit/MIR.h firefox-102.15.0/js/src/jit/MIR.h
--- firefox-102.13.0/js/src/jit/MIR.h   2023-06-29 19:12:07.000000000 +0100
+++ firefox-102.15.0/js/src/jit/MIR.h   2023-08-22 16:44:37.000000000 +0100
@@ -1647,6 +1647,8 @@
   }
 
   MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
 };
 
 template <size_t Arity, size_t Successors>
@@ -9839,6 +9841,8 @@
  public:
   INSTRUCTION_HEADER(WasmReturn)
   TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
 };
 
 class MWasmReturnVoid : public MAryControlInstruction<1, 0>,
@@ -9851,6 +9855,8 @@
  public:
   INSTRUCTION_HEADER(WasmReturnVoid)
   TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
 };
 
 class MWasmStackArg : public MUnaryInstruction, public NoTypePolicy::Data {

[Douglas R. Reno]

There doesn't appear to be anything security related here since we are not on JS 115.

[Douglas R. Reno]

Fixed at 7aceb9d7397ad4e09e8f24be0cc7e91c51d2ef60