1983378 - GC: Assertion failure majorState != State::Sweeping in BufferAllocator via malformed WebAssembly.Memory constructor

Status: RESOLVED DUPLICATE of bug 1978767

(Core :: JavaScript: GC, defect, P1)

Description

[amolnaik4]

A short JavaScript test case reliably triggers an assertion failure in the Garbage Collector (majorState != State::Sweeping in js::gc::BufferAllocator::getAllocSize). The crash is caused by passing the WebAssembly.Memory constructor to itself, which appears to create a malformed object and lead to GC state confusion.

This was discovered via fuzzing with Fuzzilli. Given that this is a logic bug in the GC, it is likely exploitable and could lead to a Use-After-Free vulnerability.

Version: JavaScript-C143.0a1

Steps to reproduce:
test.js
const v3 = new Int8Array(256); for (const v4 of v3) { this.byteSize(WeakMap); const v9 = this.WebAssembly.Memory; v9.initial = 9; new v9(v9); } gc();

/path/to/your/js test.js

Crash log:
`developer@ubuntu:~/fuzz_sm/fuzzilli/sm_workdir/crashes$ ~/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/bin/js program_20250813164218_1FE48E32-B22A-4355-BB6E-7B96C0353D06_flaky.js
[COV] no shared memory bitmap available, skipping
[COV] edge counters initialized. Shared memory: (null) with 412719 edges
[4146308] Assertion failure: majorState != State::Sweeping, at /home/developer/fuzz_sm/new_sm/firefox/js/src/gc/BufferAllocator.cpp:1231
#01: ???[/home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/bin/js +0x2a6e637]
#02: JSObject::addSizeOfExcludingThis(unsigned long ()(void const), JS::ClassInfo*, JS::RuntimeSizes*)[/home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/bin/js +0x20e3042]
#03: JS::ubi::Concrete<JSObject>::size(unsigned long ()(void const)) const[/home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/bin/js +0x20e4950]
#04: ???[/home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/bin/js +0x25f277c]
#05: ??? (???:???)
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==4146308==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5cc83b64d64f bp 0x7fff2af6a090 sp 0x7fff2af6a060 T4146308)
==4146308==The signal is caused by a WRITE memory access.
==4146308==Hint: address points to the zero page.
/home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/bin/llvm-symbolizer: error: '[anon:js-executable-memory]': No such file or directory
#0 0x5cc83b64d64f in MOZ_CrashSequence(void*, long) /home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/include/mozilla/Assertions.h:248:3
#1 0x5cc83b64d64f in js::gc::BufferAllocator::getAllocSize(void*) /home/developer/fuzz_sm/new_sm/firefox/js/src/gc/BufferAllocator.cpp:1231:3
#2 0x5cc83acc2041 in js::gc::GetAllocSize(JS::Zone*, void*) /home/developer/fuzz_sm/new_sm/firefox/js/src/gc/BufferAllocator-inl.h:155:32
#3 0x5cc83acc2041 in JSObject::addSizeOfExcludingThis(unsigned long ()(void const), JS::ClassInfo*, JS::RuntimeSizes*) /home/developer/fuzz_sm/new_sm/firefox/js/src/vm/JSObject.cpp:3215:9
#4 0x5cc83acc394f in JS::ubi::Concrete<JSObject>::size(unsigned long ()(void const)) const /home/developer/fuzz_sm/new_sm/firefox/js/src/vm/JSObject.cpp:3325:7
#5 0x5cc83b1d177b in JS::ubi::Node::size(unsigned long ()(void const)) const /home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/include/js/UbiNode.h:817:25
#6 0x5cc83b1d177b in ByteSize(JSContext*, unsigned int, JS::Value*) /home/developer/fuzz_sm/new_sm/firefox/js/src/builtin/TestingFunctions.cpp:7578:43
#7 0x271626ae5db2 ([anon:js-executable-memory]+0xdb2)

==4146308==Register values:
rax = 0x0000000000000000 rbx = 0x0000368c2c20e730 rcx = 0x00000000000004cf rdx = 0x00007f00b7804563
rdi = 0x00007f00b7805700 rsi = 0x0000000000000000 rbp = 0x00007fff2af6a090 rsp = 0x00007fff2af6a060
r8 = 0x0000000000000000 r9 = 0x0000000000000003 r10 = 0x0000000000000000 r11 = 0x0000000000000293
r12 = 0x00005cc83a90e140 r13 = 0x00007f00b73f8740 r14 = 0x00007f00b73f8740 r15 = 0x000039e764e6b430
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /home/developer/fuzz_sm/new_sm/firefox/obj-fuzzbuild/dist/include/mozilla/Assertions.h:248:3 in MOZ_CrashSequence(void*, long)
==4146308==ABORTING`

Comment 1

[Ryan VanderMeulen [:RyanVM]]

nvm

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

Jon, any idea about the severity of this issue?

Comment 3

[Jon Coppeard (:jonco)]

It looks like a dupe of bug 1978767.

amolnaik4, does this still reproduce on tip?

Comment 4

[amolnaik4]

Just checked with latest code. Does not reproduce with JavaScript-C144.0a1 version