1993004 - AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned: 0x79dd2f1012f0 [@ malloc_usable_size]

Status: VERIFIED FIXED

(Core :: JavaScript: WebAssembly, defect, P2)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20251006-b4f1173ee49f (build with asan-opt, run with --fuzzing-safe --ion-offthread-compile=off).

Backtrace:

    ==1901133==ERROR: AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned: 0x79dd2f1012f0
        #0 0x5baa51aba7dd in malloc_usable_size /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:116:3
        #1 0x5baa51a1e7a1 in Unwind /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_stacktrace.h:130:5
        #2 0x5baa51a1e7a1 in __asan::asan_malloc_usable_size(void const*, unsigned long, unsigned long) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:1102:5
        #3 0x5baa520b73bc in JSObject::sizeOfIncludingThisInNursery(unsigned long (*)(void const*)) const /js/src/vm/JSObject.cpp
        #4 0x5baa520b7646 in JS::ubi::Concrete<JSObject>::size(unsigned long (*)(void const*)) const /js/src/vm/JSObject.cpp:3317:16
        #5 0x5baa527243e1 in size /builds/worker/workspace/obj-build/dist/include/js/UbiNode.h:817:25
        #6 0x5baa527243e1 in js::Debugger::appendAllocationSite(JSContext*, JS::Handle<JSObject*>, JS::Handle<js::SavedFrame*>, mozilla::TimeStamp) /js/src/debugger/Debugger.cpp:3015:32
        #7 0x5baa52723f75 in js::DebugAPI::slowPathOnLogAllocationSite(JSContext*, JS::Handle<JSObject*>, JS::Handle<js::SavedFrame*>, mozilla::TimeStamp, mozilla::Vector<JS::Realm::DebuggerVectorEntry, 0ul, js::TrackedAllocPolicy<(js::TrackingKind)1>>&, js::gc::AutoSuppressGC const&) /js/src/debugger/Debugger.cpp:2988:18
        #8 0x5baa52260cf8 in onLogAllocationSite /js/src/debugger/DebugAPI-inl.h:68:10
        #9 0x5baa52260cf8 in js::SavedStacks::MetadataBuilder::build(JSContext*, JS::Handle<JSObject*>, js::AutoEnterOOMUnsafeRegion&) const /js/src/vm/SavedStacks.cpp:1993:8
        #10 0x5baa52225b8e in JS::Realm::setNewObjectMetadata(JSContext*, JS::Handle<JSObject*>) /js/src/vm/Realm.cpp:417:39
        #11 0x5baa52227d64 in SetNewObjectMetadata<JSObject> /js/src/vm/JSObject-inl.h:175:18
        #12 0x5baa52227d64 in js::AutoSetNewObjectMetadata::setPendingMetadata() /js/src/vm/Realm.cpp:663:9
        #13 0x5baa53a8ca6d in ~AutoSetNewObjectMetadata /js/src/vm/Realm.h:1022:7
        #14 0x5baa53a8ca6d in createStructOOL<false> /js/src/wasm/WasmGcObject-inl.h:144:1
        #15 0x5baa53a8ca6d in void* js::wasm::Instance::structNewOOL<false>(js::wasm::Instance*, unsigned int, js::gc::AllocSite*) /js/src/wasm/WasmInstance.cpp:1513:10
        #16 0x142c453eba17  ([anon:js-executable-memory]+0x1a17)
    
    Address 0x79dd2f1012f0 is a wild pointer inside of access range of size 0x000000000001.
    SUMMARY: AddressSanitizer: bad-malloc_usable_size /js/src/vm/JSObject.cpp in JSObject::sizeOfIncludingThisInNursery(unsigned long (*)(void const*)) const
    ==1901133==ABORTING

This could be an issue specifically with the debugger or the debugger just picking up an invalid pointer that would otherwise go unnoticed. Marking s-s until investigated.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Ryan Hunt [:rhunt]]

I'm guessing these are the lines that are going wrong [1]. Jonco just landed patches to stop using malloc for this data, I'm guessing this just needs to be updated for that.

These pointers are not invalid, they just are invalid to use malloc_usable_size with in our memory reporting infrastructure. So this is not security sensitive.

[1] https://searchfox.org/firefox-main/rev/08c6e2464d7ac105490e601eec1390e6edef190b/js/src/vm/JSObject.cpp#3300,3305

Comment 4

[Ryan Hunt [:rhunt]]

Jon, do you have time to take a look? Otherwise we can find someone else to look at this. I think Ben added the about:memory tracking here.

Comment 5

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1978645

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20251007213923-ffa7a0d3f05e.
The bug appears to have been introduced in the following build range:

Start: a7748727c23bf42350c54e3beaf2581458e91b78 (20251006091514)
End: 5ddf9be4e03ef0ebb58300e3a32fbb0fdf483702 (20251006102252)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a7748727c23bf42350c54e3beaf2581458e91b78&tochange=5ddf9be4e03ef0ebb58300e3a32fbb0fdf483702

Comment 7

[Jon Coppeard (:jonco)]

Attachment: Bug 1993004 - Fix memory size reporting for Wasm GC things now they use the buffer allocator instead of malloc r?jseward

This commons up the code to get the size and removes the now-unused
TrailerBlockOverhead constant.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/238d3985b1f0
https://hg.mozilla.org/integration/autoland/rev/cf150fe037c8
Fix memory size reporting for Wasm GC things now they use the buffer allocator instead of malloc r=jseward

Comment 9

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/cf150fe037c8

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20251008212103-da5bff21c5c7.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.