2007364 - PerfSpewer tries to use a `stubCodeBlock` that was `std::move`d before

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P3)

Description

[Nazım Can Altınova [:canova]]

In this line, we try to call the sendToProfiler method of a js::wasm::CodeBlock. But it was already std::moved above here.

It leads to null pointer dereference inside that sendToProfiler if the perfspewer is enabled.

It looks like this was regressed recently by Bug 1998895. I'm not marking that bug as a regressor to not to appear in that bug.

I'm not so sure about the severity of this but I wanted to mark it as a security issue just in case. I would say that it's probably low considering that it requires PerfSpewer to be enabled, which is disabled by default.

Comment 1

[Nazım Can Altınova [:canova]]

Attachment: Bug 2007364 - Use the correct CodeBlock while calling sendToProfiler r?rhunt

Comment 2

[Nazım Can Altınova [:canova]]

Btw, for reference, I noticed this after getting UndefinedBehaviorSanitizer while working on my patches: https://treeherder.mozilla.org/logviewer?job_id=541101187&repo=try&task=AkflLJd3TiOvQuv5aFY7lg.0&lineNumber=64700

This is the error log:

[task 2025-12-22T09:37:02.780+00:00] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/wasm/ion-lazy-tables.js | UndefinedBehaviorSanitizer:DEADLYSIGNAL (code 1, args "") [0.9 s]
[task 2025-12-22T09:37:02.780+00:00] INFO exit-status     : 1
[task 2025-12-22T09:37:02.780+00:00] INFO timed-out       : False
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> UndefinedBehaviorSanitizer:DEADLYSIGNAL
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> ==460178==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x00000048 (pc 0x5bf47f07 bp 0xffa3b308 sp 0xffa3b2e0 T460178)
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> ==460178==The signal is caused by a READ memory access.
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> ==460178==Hint: address points to the zero page.
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #0 0x5bf47f07 in mozilla::Vector<js::wasm::CodeRange, 0u, js::SystemAllocPolicy>::begin() const /builds/worker/workspace/obj-spider/dist/include/mozilla/Vector.h:571:12
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #1 0x5bf47f07 in js::wasm::CodeBlock::sendToProfiler(js::wasm::CodeMetadata const&, js::wasm::CodeTailMetadata const&, js::CodeMetadataForAsmJS const*, mozilla::Span<js::wasm::FuncIonPerfSpewer, 4294967295u>, mozilla::Span<js::wasm::FuncBaselinePerfSpewer, 4294967295u>) const /builds/worker/checkouts/gecko/js/src/wasm/WasmCode.cpp:1003:35
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #2 0x5bf472dc in js::wasm::Code::createManyLazyEntryStubs(js::RWExclusiveData<js::wasm::Code::ProtectedData>::WriteGuard const&, mozilla::Vector<unsigned int, 8u, js::SystemAllocPolicy> const&, js::wasm::CodeBlock const&, unsigned int*) const /builds/worker/checkouts/gecko/js/src/wasm/WasmCode.cpp:531:18
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #3 0x5bf48236 in js::wasm::Code::createOneLazyEntryStub(js::RWExclusiveData<js::wasm::Code::ProtectedData>::WriteGuard const&, unsigned int, js::wasm::CodeBlock const&, void**) const /builds/worker/checkouts/gecko/js/src/wasm/WasmCode.cpp:547:8
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #4 0x5bf48798 in js::wasm::Code::getOrCreateInterpEntry(unsigned int, js::wasm::FuncExport const**, void**) const /builds/worker/checkouts/gecko/js/src/wasm/WasmCode.cpp:600:10
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #5 0x5bfaadf2 in GetInterpEntryAndEnsureStubs(JSContext*, js::wasm::Instance&, unsigned int, JS::CallArgs const&, void**, js::wasm::FuncType const**) /builds/worker/checkouts/gecko/js/src/wasm/WasmInstance.cpp:3357:24
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #6 0x5bfaadf2 in js::wasm::Instance::callExport(JSContext*, unsigned int, JS::CallArgs const&, js::wasm::CoercionLevel) /builds/worker/checkouts/gecko/js/src/wasm/WasmInstance.cpp:3867:8
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #7 0x5bfaac40 in WasmCall(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/wasm/WasmInstance.cpp:3746:19
[task 2025-12-22T09:37:02.780+00:00] INFO stderr         2> #8 0x5affe7bb in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13
[task 2025-12-22T09:37:02.966+00:00] INFO stderr         2> #9 0x5affe7bb in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12
[task 2025-12-22T09:37:02.966+00:00] INFO stderr         2> #10 0x5b00a3eb in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10
[task 2025-12-22T09:37:02.966+00:00] INFO stderr         2> #11 0x5b00a3eb in js::CallFromStack(JSContext*, JS::CallArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:658:10
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #12 0x5b00a3eb in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3272:16
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #13 0x5affe299 in MaybeEnterInterpreterTrampoline(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:384:10
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #14 0x5affe299 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #15 0x5afff911 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:850:10
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #16 0x5afff911 in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:880:10
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #17 0x5b0d15f1 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:548:10
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #18 0x5b0d168f in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:572:10
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #19 0x5af5b2d1 in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) /builds/worker/checkouts/gecko/js/src/shell/js.cpp:1388:10
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #20 0x5af5ae0c in Process(JSContext*, char const*, bool, FileKind) /builds/worker/checkouts/gecko/js/src/shell/js.cpp
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #21 0x5af2b1a8 in ProcessArgs(JSContext*, js::cli::OptionParser*) /builds/worker/checkouts/gecko/js/src/shell/js.cpp:12141:12
[task 2025-12-22T09:37:02.967+00:00] INFO stderr         2> #22 0x5af2b1a8 in Shell(JSContext*, js::cli::OptionParser*) /builds/worker/checkouts/gecko/js/src/shell/js.cpp:12468:12
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> #23 0x5af21d50 in main /builds/worker/checkouts/gecko/js/src/shell/js.cpp:12874:12
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> #24 0xf74c8294  (/lib32/libc.so.6+0x23294) (BuildId: 49fe9e32516a3fdac5bc92fc71cee0275ebd2b0f)
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> #25 0xf74c8357 in __libc_start_main (/lib32/libc.so.6+0x23357) (BuildId: 49fe9e32516a3fdac5bc92fc71cee0275ebd2b0f)
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> #26 0x5aeea5b0 in _start (/builds/worker/workspace/obj-spider/dist/bin/js+0x19b25b0) (BuildId: 4719db1b601fe1214bf5d4f73cd6b725c8231d6f)
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> 
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> ==460178==Register values:
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> eax = 0x00000000  ebx = 0x5c83dcdc  ecx = 0x00000000  edx = 0x5c83dcdc
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> edi = 0x00000000  esi = 0xffa3b328  ebp = 0xffa3b308  esp = 0xffa3b2e0
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> UndefinedBehaviorSanitizer can not provide additional info.
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-spider/dist/include/mozilla/Vector.h:571:12 in mozilla::Vector<js::wasm::CodeRange, 0u, js::SystemAllocPolicy>::begin() const
[task 2025-12-22T09:37:02.968+00:00] INFO stderr         2> ==460178==ABORTING
[task 2025-12-22T09:37:02.968+00:00] UndefinedBehaviorSanitizer:DEADLYSIGNAL

Comment 3

[Ryan Hunt [:rhunt]]

Thanks, and sorry about that. This will always be a null pointer dereference, and also low-severity because it requires the profiler to be enabled. (still good to be conservative when filing though!).

I'm going to open this up then.

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1998895

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ad197aca581f
https://hg.mozilla.org/integration/autoland/rev/47979895174c
Use the correct CodeBlock while calling sendToProfiler r=rhunt,jpages

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/47979895174c