IonStack Part I: An Unsound IonBanana Peel in the Ion Compiler — Slipping Through Firefox’s SpiderMonkey JIT (CVE-2026-10702)

CVE-2026-10702 is a miscompilation bug in Firefox's SpiderMonkey Ion/Warp JIT. The MObjectToIterator instruction produced by scalar-replacing Object.keys() declares a load-only alias set,…