1987290 - FinalizationRegistryObject::unregister can read arguments out of bound when no arguments are supplied

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Rong Bao [:csmantle]]

Attachment: poc.js

This code snippet causes the JS shell to crash on Nightly:

const v = new FinalizationRegistry(() => {});
v.unregister();

> ../gecko-dev/obj-x86_64-pc-windows-msvc/dist/bin/js.exe poc.js
[26100] Assertion failure: i < argc_, at D:/Workspace/gecko-dev/obj-x86_64-pc-windows-msvc/dist/include\js/CallArgs.h:213
#01: js::FinalizationRegistryObject::unregister (D:\Workspace\gecko-dev\js\src\builtin\FinalizationRegistryObject.cpp:592)
#02: CallJSNative (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:501)
#03: js::InternalCallOrConstruct (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:597)
#04: js::Interpret (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:3287)
#05: js::RunScript (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:471)
#06: js::ExecuteKernel (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:866)
#07: js::Execute (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:895)
#08: ExecuteScript (D:\Workspace\gecko-dev\js\src\vm\CompilationAndEvaluation.cpp:548)
#09: JS_ExecuteScript (D:\Workspace\gecko-dev\js\src\vm\CompilationAndEvaluation.cpp:573)
#10: RunFile (D:\Workspace\gecko-dev\js\src\shell\js.cpp:1315)
#11: Process (D:\Workspace\gecko-dev\js\src\shell\js.cpp:2086)
#12: Shell (D:\Workspace\gecko-dev\js\src\shell\js.cpp:12260)
#13: main (D:\Workspace\gecko-dev\js\src\shell\js.cpp:12663)
#14: __scrt_common_main_seh (D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
#15: BaseThreadInitThunk[C:\WINDOWS\System32\KERNEL32.DLL +0x2e8d7]
#16: RtlUserThreadStart[C:\WINDOWS\SYSTEM32\ntdll.dll +0x8d9c]
>

This is regressed by Bug 1863140 Part 3 (D263113), where a args[0] is used to get an element rather than args.get(0) at https://searchfox.org/firefox-main/rev/f985f336deeb9f7cb63d43c4f8dc8612d27b79e4/js/src/builtin/FinalizationRegistryObject.cpp#592.

Comment 1

[Rong Bao [:csmantle]]

Attachment: (secure)

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1863140

Comment 3

[Rong Bao [:csmantle]]

Attachment: (secure)

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2b8155c2c4c2
https://hg.mozilla.org/integration/autoland/rev/9ecc08118361
Part 1: Use get() instead of operator[] to get arguments in FinalizationRegistryObject::unregister. r=jonco
https://github.com/mozilla-firefox/firefox/commit/dad31486e264
https://hg.mozilla.org/integration/autoland/rev/85925ba3c8a3
Part 2: Add FinalizationRegistry/unregister-no-args.js non262 test case. r=jonco

Comment 6

[Christian Holler (:decoder)]

Note that we also found this bug internally on 9/6/2025 11:09 UTC with the following test case:

a = function() {}
new FinalizationRegistry(a).unregister()

Comment 7

[Christian Holler (:decoder)]

Attachment: Internal fuzzing report

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/9ecc08118361
https://hg.mozilla.org/mozilla-central/rev/85925ba3c8a3

Comment 9

[Daniel Veditz [:dveditz]]

Flagging for bounty consideration at reporter's request to security@

Comment 10

[Tom Ritter [:tjr]]

While this is a legit report, because it was found internally within the grace period defined in the Bounty Policy it does not qualify. (Sorry)