1729374 - Try-delegate crashes when there is a mismatch in stack height

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P2)

Description

[Asumu Takikawa]

Attachment: crash.js

The attached test case crashes in the jit-test suite (when put in jit-test/tests/wasm/exceptions) when run with mach jit-test exceptions/crash.js:

UndefinedBehaviorSanitizer:DEADLYSIGNAL
==3722052==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000078 (pc 0x3df6c24973bf bp 0x7ffe26621348 sp 0x7ffe26621348 T3722052)
==3722052==The signal is caused by a WRITE memory access.
==3722052==Hint: address points to the zero page.
    #0 0x3df6c24973bf  (<unknown module>)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV (<unknown module>) 
==3722052==ABORTING
Exit code: 1
FAIL - wasm/exceptions/crash.js
[1|1|0|0]  50% ==========================>                            |   0.2s

The crash is due to Wasm's try-delegate failing to correctly reset the stack height before jumping (triggered in this test case, which forces some values onto the stack before the try-delegate).

Comment 1

[Asumu Takikawa]

Attachment: Bug 1729374 - Fix try-delegate stack preparation for jump

Comment 2

[Asumu Takikawa]

Attachment: Bug 1729374 - Add test case for try-delegate bug

Depends on D124709

Comment 3

[Andrew McCreight [:mccr8]]

Does this need to be a security bug? The crash in comment 0 looks like a null deref.

Comment 4

[Ryan Hunt [:rhunt] (on leave until early May)]

(In reply to Andrew McCreight [:mccr8] from comment #3)

Does this need to be a security bug? The crash in comment 0 looks like a null deref.

I think the compile bug could have some security implications as we are mishandling the stack pointer. But this wasm feature is disabled by default everywhere, so it shouldn't be trigger-able by users. So I don't think this needs the security process.

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Fix try-delegate stack preparation for jump r=rhunt
https://hg.mozilla.org/integration/autoland/rev/a9056dbfdfd2b8ddae02d3311e5c664a96d97725
Add test case for try-delegate bug r=rhunt
https://hg.mozilla.org/integration/autoland/rev/2ce628f4653d20b2a5ac748cee51bd284d4b14b8

https://hg.mozilla.org/mozilla-central/rev/a9056dbfdfd2
https://hg.mozilla.org/mozilla-central/rev/2ce628f4653d

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Comment 7

[Asumu Takikawa]

Thanks, I filled out the survey.