2011069 - (CVE-2026-2802) Assertion failure: element, at ds/SinglyLinkedList.h:77

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

function f() {}
[x] = (() => {
  y = (function () {})();
  z = class e {
    #m() {}                                                                                                                                                   };
  return [f];
})();
this.gczeal(10);
for (
  a = b = 10;
  this;
  (function () {
    this.setGrayBitsInvalid();
  })()
);

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000100395258 js-dbg-64-darwin-arm64-82262ffdd5c4-604188`MOZ_CrashSequence(aAddress=0x0000000000000000, aLine=77) at Assertions.h:242:3 [
opt] [inlined]
    frame #1: 0x0000000100395258 js-dbg-64-darwin-arm64-82262ffdd5c4-604188`js::SinglyLinkedList<js::gc::Arena>::getFirst(this=<unavailable>) const at Singl
yLinkedList.h:77:5 [opt] [inlined]
    frame #2: 0x0000000100395224 js-dbg-64-darwin-arm64-82262ffdd5c4-604188`js::SinglyLinkedList<js::gc::Arena>::Iterator::Iterator(this=<unavailable>, list
=<unavailable>) at SinglyLinkedList.h:209:18 [opt] [inlined]
    frame #3: 0x0000000100395224 js-dbg-64-darwin-arm64-82262ffdd5c4-604188`js::SinglyLinkedList<js::gc::Arena>::Iterator::Iterator(this=<unavailable>, list
=<unavailable>) at SinglyLinkedList.h:209:52 [opt] [inlined]
    frame #4: 0x0000000100395224 js-dbg-64-darwin-arm64-82262ffdd5c4-604188`js::ChainedIterator<js::SinglyLinkedList<js::gc::Arena>::Iterator, 3ul>::Chained
Iterator<js::gc::ArenaList&, js::gc::ArenaList&, js::gc::ArenaList&>(this=0x000000016fdfd5a0, args=0x00000001086105e8, args=0x0000000108610758, args=0x00000
0016fdfd598) at IteratorUtils.h:87:19 [opt
    frame #5: 0x00000001005c2fe8 js-dbg-64-darwin-arm64-82262ffdd5c4-604188`js::gc::ArenaIter::ArenaIter(this=0x000000016fdfd190, zone=0x0000000108610000, k
ind=SYMBOL) at GC-inl.h:53:9 [opt] [inlined]
/snip

This seems to go back prior to gh rev https://github.com/mozilla-firefox/firefox/commit/73cbb9ff0fdbf8b13f38d078ce01ef6ec0794f9c and I am guessing it may be related to bug 1994023.

Run with --fuzzing-safe --ion-offthread-compile=off --ion-eager, compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on gh rev 82262ffdd5c46f52c51add41f48eec143c2c83c7.

Jon, is bug 1994023 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1994023

Comment 2

[Jon Coppeard (:jonco)]

This is a race between some OOM cleanup and background sweeping.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: (secure)

Marking gray bits invalid iterates the symbol arenas but the list can also be
modified by backgroun sweeping.

I tried adding an assert to catch this but it turns out it's not
straightforward to do this.

Comment 4

[Jon Coppeard (:jonco)]

Attachment: (secure)

Also name a previously anonymous testcase.

Comment 5

[Jon Coppeard (:jonco)]

Comment on attachment 9538997 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Difficult because it relies on GC timing and thread scheduling.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: Release and beta, introduced in version 146
• If not all supported branches, which bug introduced the flaw?: Bug 1994023
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: The same patch applies.
• How likely is this patch to cause regressions; how much testing does it need?: Very unlikely. The patch simply waits for background sweeping to finish in one place.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/34384ff7e250
https://hg.mozilla.org/integration/autoland/rev/08ff5eed67e7
Wait for any background sweeping to finish before marking gray bits invalid r=jandem

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 9538997 [details]
(secure)

sec-approval+, a=dveditz
please wait until after the 148 release to land the test (assuming this will be fixed in that release)

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/08ff5eed67e7

Comment 9

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:jonco, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox148 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Jon Coppeard (:jonco)]

Comment on attachment 9538997 [details]
(secure)

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: Possible crash / security vulnerability.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a very simple change to wait for a background task to complete to prevent a possible race condition. It's been on central for 5 days with no issues reported.
• String changes made/needed: None
• Is Android affected?: Yes

Comment 11

[Donal Meehan [:dmeehan]]

Comment on attachment 9538997 [details]
(secure)

Approved for 148.0b9

Comment 12

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/dc95979596a8
https://hg.mozilla.org/releases/mozilla-beta/rev/da7f963c060b

Comment 13

[BugBot [:suhaib / :marco]]

a month ago, dveditz placed a reminder on the bug using the whiteboard tag [reminder-test 2026-03-09] .

jonco, please refer to the original comment to better understand the reason for the reminder.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/4faa7e9916a8
https://hg.mozilla.org/integration/autoland/rev/33fed6720b1a
Add testcase r=jandem

Comment 15

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/33fed6720b1a