2005350 - Assertion failure: codeMeta().memories[memoryIndex].pageSize() == PageSize::Standard, at wasm/WasmIonCompile.cpp:1585

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20251210-7b4f11e5da3f (build with fuzzing-asan-afl-opt).

Backtrace:

    =================================================================
    ==49479==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x55555b27d986 bp 0x7fffffff6210 sp 0x7fffffff6180 T0)
    ==49479==The signal is caused by a WRITE memory access.
    ==49479==Hint: address points to the zero page.
        #0 0x55555b27d986 in MOZ_CrashSequence(void*, long) /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x55555b27d986 in (anonymous namespace)::FunctionCompiler::needBoundsCheck(unsigned int) /js/src/wasm/WasmIonCompile.cpp:1584:5
        #2 0x55555b27d986 in (anonymous namespace)::FunctionCompiler::checkOffsetAndAlignmentAndBounds(js::wasm::MemoryAccessDesc*, js::jit::MDefinition**) /js/src/wasm/WasmIonCompile.cpp:1687:9
        #3 0x55555b27f151 in (anonymous namespace)::FunctionCompiler::store(js::jit::MDefinition*, js::wasm::MemoryAccessDesc*, js::jit::MDefinition*) /js/src/wasm/WasmIonCompile.cpp:1789:7
        #4 0x55555b232ac6 in (anonymous namespace)::FunctionCompiler::emitMemFillInline(unsigned int, js::jit::MDefinition*, js::jit::MDefinition*, unsigned int) /js/src/wasm/WasmIonCompile.cpp:7903:5
        #5 0x55555b232ac6 in (anonymous namespace)::FunctionCompiler::emitMemFill() /js/src/wasm/WasmIonCompile.cpp:7961:14
        #6 0x55555b1d1fcb in (anonymous namespace)::FunctionCompiler::emitBodyExprs() /js/src/wasm/WasmIonCompile.cpp:10296:13
        #7 0x55555b17cf82 in (anonymous namespace)::RootCompiler::generate() /js/src/wasm/WasmIonCompile.cpp:10622:21
        #8 0x55555b17cf82 in js::wasm::IonCompileFunctions(js::wasm::CodeMetadata const&, js::wasm::CodeTailMetadata const*, js::wasm::CompilerEnvironment const&, js::LifoAlloc&, mozilla::Vector<js::wasm::FuncCompileInput, 8ul, js::SystemAllocPolicy> const&, js::wasm::CompiledCode*, std::unique_ptr<char [], JS::FreePolicy>*) /js/src/wasm/WasmIonCompile.cpp:10777:23
        #9 0x55555b123b81 in ExecuteCompileTask(js::wasm::CompileTask*, std::unique_ptr<char [], JS::FreePolicy>*) /js/src/wasm/WasmGenerator.cpp:613:12
        #10 0x55555b1245b2 in js::wasm::ModuleGenerator::locallyCompileCurrentTask() /js/src/wasm/WasmGenerator.cpp:712:8
        #11 0x55555b1274d9 in js::wasm::ModuleGenerator::finishFuncDefs() /js/src/wasm/WasmGenerator.cpp:849:24
        #12 0x55555b0ca01e in bool DecodeCodeSection<js::wasm::Decoder, js::wasm::ModuleGenerator>(js::wasm::CodeMetadata const&, js::wasm::Decoder&, js::wasm::ModuleGenerator&) /js/src/wasm/WasmCompile.cpp
        #13 0x55555b0c8fc1 in js::wasm::CompileBuffer(js::wasm::CompileArgs const&, js::wasm::BytecodeBufferOrSource const&, std::unique_ptr<char [], JS::FreePolicy>*, mozilla::Vector<std::unique_ptr<char [], JS::FreePolicy>, 0ul, js::SystemAllocPolicy>*, JS::OptimizedEncodingListener*) /js/src/wasm/WasmCompile.cpp:1004:10
        #14 0x555558815996 in testWasmFuzz(unsigned char const*, unsigned long) /js/src/fuzz-tests/testWasm.cpp:284:9
        #15 0x55555897e452 in afl_interface_raw(int (*)(unsigned char const*, unsigned long)) /tools/fuzzing/interface/FuzzingInterface.cpp:60:11
        #16 0x5555588115bd in main /js/src/fuzz-tests/tests.cpp:120:3
        #17 0x7ffff7974d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
        #18 0x7ffff7974e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
        #19 0x5555587297b8 in _start (/home/worker/js/dist/bin/fuzz-tests+0x31d57b8) (BuildId: 63b335ce31c6e9009995902e81c9d76dc50c7cbd)
    
    ==49479==Register values:
    rax = 0x0000000000000001  rbx = 0x0000000000000000  rcx = 0x0000000000000631  rdx = 0x0000000000000000  
    rdi = 0x000055555d58b250  rsi = 0x00007fffffff6138  rbp = 0x00007fffffff6210  rsp = 0x00007fffffff6180  
     r8 = 0x0000000000000000   r9 = 0xffffff0000000000  r10 = 0xefffffffffffffff  r11 = 0x4000000000000000  
    r12 = 0x0000000000000000  r13 = 0x00007fffffff6240  r14 = 0x00007d5ff6be5b10  r15 = 0x00000fffffffec48  
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3 in MOZ_CrashSequence(void*, long)
    ==49479==ABORTING

The testcase attached is a binary file ingested by the Wasm target that is built as part of fuzz-tests when building with the JS shell with --enable-tests --enable-fuzzing. You can run this by running FUZZER=Wasm /path/to/js test.bin.

I can look into getting a better test tomorrow - this is a fuzzblocker as it is happening quite frequently and started yesterday.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Julien Pages [:jpages]]

This assertion seems new, it was added in the custom page size patch: https://bugzilla.mozilla.org/show_bug.cgi?id=1977854

Comment 4

[Julien Pages [:jpages]]

Added regression information.

Comment 5

[Ben Visness [:bvisness]]

When I try to run test.bin per your instructions, I just get:

Error: can't open wasm: No such file or directory

Is there some other file that is supposed to be attached as well? Or am I misunderstanding something?

Comment 6

[Julien Pages [:jpages]]

I tried to reproduce this issue with this command line: FUZZER=Wasm js test.bin and got this error: SyntaxError: bad trailing UTF-8 byte 0x60 doesn't match the pattern 0b10xxxxxx:

I'm probably missing something for fuzzing, do you have a standalone test by any chance?

Comment 7

[Ben Visness [:bvisness]]

After looking into this a bit more, it's clear that we are simply running Ion with custom page sizes enabled, which was not supposed to happen. Presumably we just need to revisit the flags here so that custom page sizes are not allowed when Ion is allowed.

Comment 9

[Ryan Hunt [:rhunt] (PTO Sept 7-11)]

So the flag for custom page sizes is never being turned on, but we aren't properly feature gating the code here. This code here should be checking not just the compile flag (which is enabled in nightly), but also the runtime value which checks the pref (which is disabled in nightly).

This affects nightly only, because of the compile flag and also because it just landed in nightly.

There's a good chance we also covered all vulnerable code-paths with release assertions, but not 100% sure yet. The baseline code should be good, but the ion code has no support yet.

Comment 10

[Ben Visness [:bvisness]]

Attachment: (secure)

We missed this, meaning that we could easily slip into cases where
unexpected code is running with a non-standard page size.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8a07a5b43aa7
https://hg.mozilla.org/integration/autoland/rev/edae964806d8
Check custom page sizes pref at runtime. r=rhunt

Comment 12

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/mozilla-central/rev/edae964806d8

Comment 13

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 2005350 using build mozilla-central 20251210095635-7b4f11e5da3f. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.