Closed Bug 1962023 Opened 1 year ago Closed 1 year ago

[WASM] Assertion failure: k->wasmRefType() == l->wasmRefType()

Categories

(Core :: JavaScript: WebAssembly, defect, P1)

Product:
Core
Component:
JavaScript: WebAssembly
Version:
Firefox 139
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
140 Branch
Tracking Flags:
Tracking Status
firefox-esr128 --- unaffected
firefox137 --- unaffected
firefox138 --- unaffected
firefox139 --- fixed
firefox140 --- fixed

People

(Reporter: xiangwei1895, Assigned: bvisness)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, reporter-external, sec-other)

Attachments

(4 files, 3 external files)

PoC
81.96 KB, text/javascript
Details
backstrace
56.31 KB, text/plain
Details
testcase
6.89 KB, application/octet-stream
Details
1
79.71 KB, application/octet-stream
Details
Attached file PoC —

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36

Steps to reproduce:

My env:
Ubuntu 22.04 TLS
gecko-dev c3fd24fa4836680544dee8c31276bb9159a5308d

Build args:
../configure --disable-jemalloc --enable-fuzzing --enable-gczeal --enable-debug --enable-optimize --disable-shared-js --enable-address-sanitizer

Execution:
./dist/bin/js poc.js

Actual results:

[1045552] Assertion failure: k->wasmRefType() == l->wasmRefType(), at /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:59
#01: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6401251]
#02: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x65cb8d4]
#03: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x65cb36d]
#04: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6408743]
#05: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6409ee2]
#06: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x640e93c]
#07: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x640f210]
#08: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x641030f]
#09: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x641470f]
#10: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x632778a]
#11: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6ebbeb0]
#12: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6e2dfc7]
#13: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6e34300]
#14: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6d7cf57]
#15: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x6db58ff]
#16: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x3544012]
#17: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x3543cba]
#18: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x35d56e4]
#19: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x35d4cad]
#20: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x363238d]
#21: ???[/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js +0x2cd2409]
#22: ???[/lib/x86_64-linux-gnu/libc.so.6 +0x94ac3]
#23: ???[/lib/x86_64-linux-gnu/libc.so.6 +0x126850]
#24: ??? (???:???)
AddressSanitizer:DEADLYSIGNAL

==1045552==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5575d323327d bp 0x7f7a5de05b50 sp 0x7f7a5de05b10 T2)
==1045552==The signal is caused by a WRITE memory access.
==1045552==Hint: address points to the zero page.
/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:144:1 InternalError: too much recursion
Stack:
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0x90
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
@/data/workspace/WasmAFL/utils/aflpp_extractor/v8_wasm_compile_fuzzer/./wasm-module-builder.js line 2228 > WebAssembly.Module:wasm-function[0]:0xc7
#0 0x5575d323327d in MOZ_CrashSequence(void*, long) /data/workspace/gecko-dev/js/src/wasmfuzz/dist/include/mozilla/Assertions.h:248:3
#1 0x5575d323327d in js::jit::ValueNumberer::VisibleValues::ValueHasher::match(js::jit::MDefinition*, js::jit::MDefinition const*) /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:59:3
#2 0x5575d33fd8d3 in mozilla::detail::HashTable<js::jit::MDefinition* const, mozilla::HashSet<js::jit::MDefinition*, js::jit::ValueNumberer::VisibleValues::ValueHasher, js::jit::JitAllocPolicy>::SetHashPolicy, js::jit::JitAllocPolicy>::match(js::jit::MDefinition* const&, js::jit::MDefinition const* const&) /data/workspace/gecko-dev/js/src/wasmfuzz/dist/include/mozilla/HashTable.h:1779:12
#3 0x5575d33fd8d3 in mozilla::detail::EntrySlot<js::jit::MDefinition* const> mozilla::detail::HashTable<js::jit::MDefinition* const, mozilla::HashSet<js::jit::MDefinition*, js::jit::ValueNumberer::VisibleValues::ValueHasher, js::jit::JitAllocPolicy>::SetHashPolicy, js::jit::JitAllocPolicy>::lookup<(mozilla::detail::HashTable<js::jit::MDefinition* const, mozilla::HashSet<js::jit::MDefinition*, js::jit::ValueNumberer::VisibleValues::ValueHasher, js::jit::JitAllocPolicy>::SetHashPolicy, js::jit::JitAllocPolicy>::LookupReason)1>(js::jit::MDefinition const* const&, unsigned int) const /data/workspace/gecko-dev/js/src/wasmfuzz/dist/include/mozilla/HashTable.h:1809:37
#4 0x5575d33fd36c in mozilla::detail::HashTable<js::jit::MDefinition* const, mozilla::HashSet<js::jit::MDefinition*, js::jit::ValueNumberer::VisibleValues::ValueHasher, js::jit::JitAllocPolicy>::SetHashPolicy, js::jit::JitAllocPolicy>::lookupForAdd(js::jit::MDefinition const* const&) /data/workspace/gecko-dev/js/src/wasmfuzz/dist/include/mozilla/HashTable.h:2153:19
#5 0x5575d323a742 in mozilla::HashSet<js::jit::MDefinition*, js::jit::ValueNumberer::VisibleValues::ValueHasher, js::jit::JitAllocPolicy>::lookupForAdd(js::jit::MDefinition const* const&) /data/workspace/gecko-dev/js/src/wasmfuzz/dist/include/mozilla/HashTable.h:623:18
#6 0x5575d323a742 in js::jit::ValueNumberer::VisibleValues::findLeaderForAdd(js::jit::MDefinition*) /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:87:15
#7 0x5575d323a742 in js::jit::ValueNumberer::leader(js::jit::MDefinition*) /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:604:39
#8 0x5575d323bee1 in js::jit::ValueNumberer::visitDefinition(js::jit::MDefinition*) /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:840:22
#9 0x5575d324093b in js::jit::ValueNumberer::visitBlock(js::jit::MBasicBlock*) /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:1022:10
#10 0x5575d324120f in js::jit::ValueNumberer::visitDominatorTree(js::jit::MBasicBlock*) /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:1076:12
#11 0x5575d324230e in js::jit::ValueNumberer::visitGraph() /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:1115:12
#12 0x5575d324670e in js::jit::ValueNumberer::run(js::jit::ValueNumberer::UpdateAliasAnalysisFlag) /data/workspace/gecko-dev/js/src/jit/ValueNumbering.cpp:1283:10
#13 0x5575d3159789 in js::jit::OptimizeMIR(js::jit::MIRGenerator*) /data/workspace/gecko-dev/js/src/jit/Ion.cpp:1200:14
#14 0x5575d3cedeaf in js::wasm::IonCompileFunctions(js::wasm::CodeMetadata const&, js::wasm::CodeTailMetadata const*, js::wasm::CompilerEnvironment const&, js::LifoAlloc&, mozilla::Vector<js::wasm::FuncCompileInput, 8ul, js::SystemAllocPolicy> const&, js::wasm::CompiledCode*, mozilla::UniquePtr<char [], JS::FreePolicy>) /data/workspace/gecko-dev/js/src/wasm/WasmIonCompile.cpp:10729:12
#15 0x5575d3c5ffc6 in ExecuteCompileTask(js::wasm::CompileTask, mozilla::UniquePtr<char [], JS::FreePolicy>) /data/workspace/gecko-dev/js/src/wasm/WasmGenerator.cpp:603:12
#16 0x5575d3c662ff in js::wasm::ModuleGenerator::locallyCompileCurrentTask() /data/workspace/gecko-dev/js/src/wasm/WasmGenerator.cpp:702:8
#17 0x5575d3c662ff in js::wasm::ModuleGenerator::finishFuncDefs() /data/workspace/gecko-dev/js/src/wasm/WasmGenerator.cpp:839:24
#18 0x5575d3baef56 in js::wasm::CompilePartialTier2(js::wasm::Code const&, unsigned int, mozilla::UniquePtr<char [], JS::FreePolicy>, mozilla::Vector<mozilla::UniquePtr<char [], JS::FreePolicy>, 0ul, js::SystemAllocPolicy>, mozilla::Atomic<bool, (mozilla::MemoryOrdering)2, void>) /data/workspace/gecko-dev/js/src/wasm/WasmCompile.cpp:1099:13
#19 0x5575d3be78fe in js::wasm::Module::PartialTier2CompileTaskImpl::runHelperThreadTask(js::AutoLockHelperThreadState&) /data/workspace/gecko-dev/js/src/wasm/WasmCode.cpp:647:22
#20 0x5575d0376011 in js::GlobalHelperThreadState::runTaskLocked(JS::HelperThreadTask*, js::AutoLockHelperThreadState&) /data/workspace/gecko-dev/js/src/vm/HelperThreads.cpp:668:11
#21 0x5575d0375cb9 in js::GlobalHelperThreadState::runOneTask(JS::HelperThreadTask*, js::AutoLockHelperThreadState&) /data/workspace/gecko-dev/js/src/vm/HelperThreads.cpp:624:3
#22 0x5575d04076e3 in js::HelperThread::threadLoop(js::InternalThreadPool*) /data/workspace/gecko-dev/js/src/vm/InternalThreadPool.cpp:324:25
#23 0x5575d0406cac in js::HelperThread::ThreadMain(js::InternalThreadPool*, js::HelperThread*) /data/workspace/gecko-dev/js/src/vm/InternalThreadPool.cpp:251:11
#24 0x5575d046438c in void js::detail::ThreadTrampoline<void (&)(js::InternalThreadPool*, js::HelperThread*), js::InternalThreadPool*&, js::HelperThread*>::callMain<0ul, 1ul>(std::integer_sequence<unsigned long, 0ul, 1ul>) /data/workspace/gecko-dev/js/src/threading/Thread.h:228:5
#25 0x5575d046438c in js::detail::ThreadTrampoline<void (&)(js::InternalThreadPool*, js::HelperThread*), js::InternalThreadPool*&, js::HelperThread*>::Start(void*) /data/workspace/gecko-dev/js/src/threading/Thread.h:217:11
#26 0x5575cfb04408 in asan_thread_start(void*) crtstuff.c
#27 0x7f7a61024ac2 in start_thread nptl/pthread_create.c:442:8
#28 0x7f7a610b684f misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /data/workspace/gecko-dev/js/src/wasmfuzz/dist/include/mozilla/Assertions.h:248:3 in MOZ_CrashSequence(void*, long)
Thread T2 created by T0 here:
#0 0x5575cfaec341 in pthread_create (/data/workspace/gecko-dev/js/src/wasmfuzz/dist/bin/js+0x2cba341) (BuildId: c80c3bd1741f446f00a4b990d6262b81)
#1 0x5575d009a99e in js::Thread::create(void* ()(void), void*) /data/workspace/gecko-dev/js/src/threading/posix/PosixThread.cpp:57:7
#2 0x5575d04067f1 in bool js::Thread::init<void (&)(js::InternalThreadPool*, js::HelperThread*), js::InternalThreadPool*&, js::HelperThread*>(void (&)(js::InternalThreadPool*, js::HelperThread*), js::InternalThreadPool*&, js::HelperThread*&&) /data/workspace/gecko-dev/js/src/threading/Thread.h:90:16
#3 0x5575d04024f8 in js::HelperThread::init(js::InternalThreadPool*) /data/workspace/gecko-dev/js/src/vm/InternalThreadPool.cpp:241:17
#4 0x5575d04024f8 in js::InternalThreadPool::ensureThreadCount(unsigned long, js::AutoLockHelperThreadState&) /data/workspace/gecko-dev/js/src/vm/InternalThreadPool.cpp:147:29
#5 0x5575d0401ac2 in js::InternalThreadPool::Initialize(unsigned long, js::AutoLockHelperThreadState&) /data/workspace/gecko-dev/js/src/vm/InternalThreadPool.cpp:121:18
#6 0x5575d03681f0 in js::GlobalHelperThreadState::ensureInitialized() /data/workspace/gecko-dev/js/src/vm/HelperThreads.cpp:175:10
#7 0x5575d09611cc in JSRuntime::init(JSContext*, unsigned int) /data/workspace/gecko-dev/js/src/vm/Runtime.cpp:182:32
#8 0x5575d0493ca3 in js::NewContext(unsigned int, JSRuntime*) /data/workspace/gecko-dev/js/src/vm/JSContext.cpp:189:17
#9 0x5575cfb6c0b3 in main /data/workspace/gecko-dev/js/src/shell/js.cpp:12370:25
#10 0x7f7a60fb9d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

==1045552==ABORTING

Expected results:

exit normally

Attached file backstrace —

Sorry for the unanticipated formatting of my report. Now uploading backtrace as a file.

Group: firefox-core-security → javascript-core-security
Component: Untriaged → JavaScript: WebAssembly
Product: Firefox → Core
Assignee: nobody → bvisness
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Keywords: regression
Regressed by: 1892721

Here's a minimal repro:

const m = new WebAssembly.Module(wasmTextToBinary(`(module
  (type $s1 (struct (field i31ref)))
  (type $s2 (struct (field anyref)))
  (func
    ref.null $s1
    struct.get $s1 0
    drop

    ref.null $s2
    struct.get $s2 0
    drop
  )
)
`));

This is hitting a new debug assert that verifies that two nodes that are congruentTo also have the same ref type.

What seems to be happening is that congruentTo for MWasmLoadField (used by struct.get) does not check if the ref types are equal. Instead it just checks that the operands are equal and that all the other properties of the load are equal - which is fine except that it might cause this new ref type mixup.

In this case, the two ref.nulls are getting GVN'd into one, causing the two struct.get operations to be considered congruent, even though they are for different types. Importantly, the two nodes would codegen to the exact same thing (after all, this worked before), so the only way this could cause a problem is through downstream optimizations using the ref type, e.g. eliminating a cast. And furthermore, I think it is only possible to trigger this if you can indeed get two struct.gets for different types to share an operand, and I don't think that's possible except with a constant null value, which should render this problem harmless.

Set release status flags based on info from the regressing bug 1892721

status-firefox137: --- → unaffected
status-firefox138: --- → unaffected
status-firefox139: --- → affected
status-firefox-esr128: --- → unaffected
Blocks: sm-security
Severity: -- → S3
Priority: -- → P1

I think it is only possible to trigger this if you can indeed get two struct.gets for different types to share an operand, and I don't think that's possible except with a constant null value, which should render this problem harmless.

That makes this not a security bug? How confident are you?

Flags: needinfo?(bvisness)

The general shape of an exploit here would be:

  1. Write some wasm with two different MWasmLoadFields of two different wasm ref types, but otherwise identical offset/width/etc. (MWasmLoadField appears to be the only node whose congruentTo has this issue.)
  2. Persuade the inputs to those loads (e.g. the base pointer) to be commoned up, thereby persuading the loads themselves to be commoned up despite having different types, producing a field load with an incorrect type.
  3. Pass one of the loads into a ref.cast for a concrete parent type of this incorrect type. This cast will be eliminated because it is statically known to be trivial.
  4. Load out of bounds data, or something, using a struct.get.

It should be possible to construct types in your wasm module that could produce an invalid cast that would read out of bounds per the above strategy.

HOWEVER: the whole scheme hinges on step 2, specifically persuading the inputs to the loads to be commoned up WITHOUT causing the loads to trap. Doing so would require two nodes of type MIRType::WasmRefType to be congruent to each other despite being different values entirely - which would be a severe bug, thus unlikely. After auditing all wasm nodes with a congruentTo, these are the nodes that seem to be candidates for this:

  • MWasmNullConstant: Nulls can be commoned up even for two different types in the same hierarchy, as we saw in this bug. Furthermore, wasm validation will allow them to be passed directly to struct.get without any further casting. But, the struct.get will always fail on a null value, preventing any incorrectly-optimized downstream code from running.
  • MWasmNewI31Ref: These can be commoned up if they have the same value, but they cannot be used with MWasmLoadField without a ref.cast, which cannot be commoned up, and which will always fail when casting to a struct type.
  • MWasmLoadInstanceDataField and MWasmLoadGlobalCell: These can be used to load globals; however, based on my audit, in all cases where their congruentTo passes, they are for the very same value, and therefore there is no issue.
  • MWasmSelect and MWasmRefAsNonNull: These have straightforward congruentTo implementations that are based wholly on their inputs, therefore punting any problems to their inputs.
  • MWasmRefConvertAnyExtern: Congruence is based solely on operands and destination kind, again punting the problem to its input.

So, really the only potential problems are nulls and i31s, and nulls will always trap, and i31s will always need a cast and will therefore always trap. Therefore I am pretty confident this is not exploitable.

Flags: needinfo?(bvisness)

Simple fix for a recent regression. Setting flags to request tracking for 139.

status-firefox140: --- → affected
tracking-firefox139: --- → ?
tracking-firefox140: --- → ?

Does this really need to be tracked if we're not even sure it's a security bug?

I don't think it's exploitable, but I feel like we might as well keep it hidden just in case, and might as well fix it in beta so that we don't have the risks of incorrect codegen (especially for a recent release). It still doesn't need a high sec rating imo.

Feel free to nominate for Beta uplift if you think this bug should be fixed there. It doesn't need to be tracked for that.

tracking-firefox139: ? → ---
tracking-firefox140: ? → ---
Pushed by bvisness@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/10c60ece966a Include wasm ref type in congruentTo for fields. r=rhunt

https://hg.mozilla.org/mozilla-central/rev/10c60ece966a

Group: javascript-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
status-firefox140: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 140 Branch

Also tweaks the signature for creating MWasmLoadGlobalCell to make it
clearer and harder to mess up. (It would have been possible to construct
two MWasmLoadGlobalCells that are congruent but possibly missing a ref
type in one case or the other.)

Original Revision: https://phabricator.services.mozilla.com/D246491

Attachment #9484274 - Flags: approval-mozilla-beta?

beta Uplift Approval Request

  • User impact if declined: Incorrect code can be generated, but probably not in an exploitable fashion.
  • Code covered by automated testing: no
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing: n/a
  • Risk associated with taking this patch: Low
  • Explanation of risk level: Fewer MIR nodes will be marked congruent, which does not impact correctness.
  • String changes made/needed: n/a
  • Is Android affected?: yes
Attachment #9484274 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attached file testcase —

During regression testing of the latest build (126697140e711e04a9d95edae537541c3bde89cc), I found this issue can still be triggered.

Flags: needinfo?(bvisness)

Your most recent test case does not include the wasm-module-builder.js file, and it appears to be different from both the version in the WebAssembly spec repo and mozilla-central. Specifically your test case fails for me with:

% js poc.js
poc.js:16:21 TypeError: builder.nextTypeIndex is not a function
Stack:
  @poc.js:16:21

Please produce a standalone test case if you can.

Flags: needinfo?(bvisness) → needinfo?(xiangwei1895)
Attached file 1 —

You can use the attached test cases or use this one:

var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,229,128,128,128,0,4,78,1,94,120,1,78,1,94,119,1,78,8,80,0,95,0,80,1,2,95,0,80,0,95,0,80,1,2,95,0,96,1,127,1,127,96,7,100,2,100,2,100,2,100,7,100,2,100,2,100,7,7,127,99,8,100,110,100,9,108,99,7,109,96,13,127,127,127,127,127,127,127,127,127,127,127,127,127,8,108,99,5,115,109,99,5,127,127,127,96,0,0,96,0,3,100,9,108,99,7,2,151,128,128,128,0,2,3,109,111,100,4,102,111,111,48,0,6,3,109,111,100,4,102,111,111,49,0,9,3,133,128,128,128,0,4,6,7,8,9,4,133,128,128,128,0,1,112,1,4,4,5,132,128,128,128,0,1,1,0,32,13,131,128,128,128,0,1,0,9,7,136,128,128,128,0,1,4,109,97,105,110,0,2,9,148,128,128,128,0,1,6,0,65,0,11,112,4,210,2,11,210,3,11,210,4,11,210,5,11,10,187,130,128,128,0,4,86,0,65,187,253,244,0,251,0,2,251,0,2,251,0,2,210,3,251,0,2,251,0,2,210,3,16,3,26,26,26,26,26,26,1,16,2,1,251,1,2,212,251,0,2,251,0,2,210,3,208,2,251,23,108,251,22,2,251,0,2,210,3,16,3,26,26,26,26,26,26,1,16,2,1,16,2,1,254,60,64,0,240,224,1,70,11,199,1,10,1,100,110,1,100,1,1,127,1,100,1,1,114,1,127,1,100,108,1,112,1,124,1,127,65,173,218,201,0,208,8,65,153,189,1,65,180,151,18,65,20,111,251,6,0,67,88,110,94,67,65,132,132,143,161,2,4,64,5,11,67,75,38,142,231,143,144,145,91,4,64,65,174,200,210,12,208,8,251,0,2,210,5,208,108,208,7,208,109,214,1,26,26,26,33,7,26,33,9,5,11,2,10,210,5,208,108,208,7,11,65,169,1,65,196,0,65,20,111,251,6,0,251,25,0,0,109,0,26,26,26,26,33,7,26,33,9,65,173,213,235,0,251,28,33,7,65,145,7,65,3,65,20,111,251,6,1,33,8,65,0,65,235,2,65,20,111,251,6,1,33,10,65,42,251,28,33,13,65,148,167,173,186,1,208,8,251,0,2,210,5,208,108,208,7,208,109,11,20,1,7,127,208,108,208,5,208,115,208,109,208,5,65,36,65,9,65,29,11,4,1,7,127,11,0,152,128,128,128,0,4,110,97,109,101,1,141,128,128,128,0,2,0,4,102,111,111,48,1,4,102,111,111,49]);
var wasm_module = new WebAssembly.Module(wasm_code);
function foo(){};
const o15 = {"foo0": foo , "foo1": foo};
const o16 = {"mod": o15};
var wasm_instance = new WebAssembly.Instance(wasm_module, o16);
var main = wasm_instance.exports.main;
var result1 = main(1);
Flags: needinfo?(xiangwei1895)
See Also: → 1968410

It seems that this new test case is essentially a duplicate of bug 1968410. The fix in that bug appears to fix this new test case as well.

The original bug was deemed unexploitable in comment 7 so I'm giving this a sec-other rating while we deal with this variant. Since this bug has had patch committed and shipped, follow-up problems like this should get moved to a new bug to avoid release-tracking confusion. But in this case we now already have bug 1968410 to cover that need so we don't need yet another bug.

Blocks: 1968410
Keywords: sec-other
QA Whiteboard: [sec] [qa-triage-done-c141/b140]
Flags: qe-verify-
Flags: sec-bounty-
Group: core-security-release
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: