2044225 - [wasm][jspi] BUS crash with Debugger API

Status: RESOLVED DUPLICATE of bug 2042753

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Kanaru Sato [:canalun]]

Attachment: poc.js

OS
macOS 26.5 (25F71)

STR

• build SM with ASan (I tried 8019cf4baf51f753bb67 on origin/main) and run the attached js.

AR

• the following crash happens.

AddressSanitizer:DEADLYSIGNAL
=================================================================
==64399==ERROR: AddressSanitizer: BUS on unknown address (pc 0x0001017d2be8 bp 0x00016eeaa430 sp 0x00016eeaa410 T0)
==64399==The signal is caused by a READ memory access.
==64399==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x0001017d2be8 in std::__1::unique_ptr<js::wasm::DebugState, JS::DeletePolicy<js::wasm::DebugState>>::operator*[abi:sqn210106]() const+0x48 (js:arm64+0x1008c6be8)
    #1 0x0001016fcf74 in js::wasm::Instance::debug()+0x18 (js:arm64+0x1007f0f74)
    #2 0x0001018d2d78 in js::DebuggerFrame::incrementStepperCounter(JSContext*, js::AbstractFramePtr)+0x290 (js:arm64+0x1009c6d78)
    #3 0x0001018d1f18 in js::DebuggerFrame::setOnStepHandler(JSContext*, JS::Handle<js::DebuggerFrame*>, std::__1::unique_ptr<js::OnStepHandler, JS::DeletePolicy<js::OnStepHandler>>)+0x360 (js:arm64+0x1009c5f18)
    #4 0x0001018df0fc in js::DebuggerFrame::CallData::onStepSetter()+0x58c (js:arm64+0x1009d30fc)
    #5 0x0001018e6654 in bool js::DebuggerFrame::CallData::ToNative<&js::DebuggerFrame::CallData::onStepSetter()>(JSContext*, unsigned int, JS::Value*)+0x394 (js:arm64+0x1009da654)
    #6 0x00010345a994 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0xf18 (js:arm64+0x10254e994)
    #7 0x00010345b774 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)+0x30 (js:arm64+0x10254f774)
    #8 0x00010345ba34 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x2b0 (js:arm64+0x10254fa34)
    #9 0x00010345dd88 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>)+0x2b4 (js:arm64+0x102551d88)
    #10 0x0001039eb078 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&)+0x8bc (js:arm64+0x102adf078)
    #11 0x0001039ea41c in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)+0x1fd8 (js:arm64+0x102ade41c)
    #12 0x0001012444d0 in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)+0x264 (js:arm64+0x1003384d0)
    #13 0x00010348a5ec in js::Interpret(JSContext*, js::RunState&)+0x273dc (js:arm64+0x10257e5ec)
    #14 0x00010345939c in js::RunScript(JSContext*, js::RunState&)+0x105c (js:arm64+0x10254d39c)
    #15 0x00010345acb0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x1234 (js:arm64+0x10254ecb0)
    #16 0x00010345b774 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)+0x30 (js:arm64+0x10254f774)
    #17 0x00010345ba34 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x2b0 (js:arm64+0x10254fa34)
                                                                                                #18 0x0001016f3208 in js::Call(JSContext*, JS::Handle<JS::Value>, JSObject*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)+0x304 (js:arm64+0x1007e7208)
    #19 0x0001016f5bd0 in js::Debugger::fireEnterFrame(JSContext*, js::ResumeMode&, JS::MutableHandle<JS::Value>)+0x4c0 (js:arm64+0x1007e9bd0)                                                    #20 0x000101834140 in js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1::operator()(js::Debugger*, js::ResumeMode&, JS::MutableHandle<JS::Value>) const+0xc0 (js:arm64+0x100928140)                                                                                  #21 0x000101833ff0 in bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchResumptionHook<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1>(JSContext*, js::AbstractFramePtr, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)::'lambda'(js::Debugger*)::operator()(js::Debugger*) const+0x1cc (js:arm64+0x100927ff0)                                                              #22 0x000101833e14 in bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchHook<bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchResumptionHook<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1>(JSContext*, js::AbstractFramePtr, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)::'lambda'(js::Debugger*)>(JSContext*, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)::'lambda'()::operator()() const+0xb8 (js:arm64+0x100927e14)
    #23 0x000101833c20 in bool js::Debugger::enterDebuggerHook<bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchHook<bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchResumptionHook<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1>(JSContext*, js::AbstractFramePtr, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)::'lambda'(js::Debugger*)>(JSContext*, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)::'lambda'()>(JSContext*, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)+0x190 (js:arm64+0x100927c20)                                            #24 0x0001018338d4 in bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchHook<bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchResumptionHook<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1>(JSContext*, js::AbstractFramePtr, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)::'lambda'(js::Debugger*)>(JSContext*, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)+0x308 (js:arm64+0x1009278d4)                                                                                      #25 0x00010183324c in bool js::DebuggerList<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0>::dispatchResumptionHook<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1>(JSContext*, js::AbstractFramePtr, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)+0x29c (js:arm64+0x10092724c)                         #26 0x0001016e51d0 in bool js::Debugger::dispatchResumptionHook<js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1>(JSContext*, js::AbstractFramePtr, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_0, js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)::$_1)+0x208 (js:arm64+0x1007d91d0)                                                 #27 0x0001016e4e4c in js::DebugAPI::slowPathOnEnterFrame(JSContext*, js::AbstractFramePtr)+0x1e4 (js:arm64+0x1007d8e4c)                                                                       #28 0x0001030c9304 in js::DebugAPI::onEnterFrame(JSContext*, js::AbstractFramePtr)+0x158 (js:arm64+0x1021bd304)                                                                               #29 0x0001041018b0 in WasmHandleDebugTrap()+0x2dc (js:arm64+0x1031f58b0)                       #30 0x3bd19a8044d0  (<unknown module>)
                                                     ==64399==Register values:                                                                       x[0] = 0x000012bc249280a0   x[1] = 0x0000000000000008   x[2] = 0x0000000000000005   x[3] = 0x000000016eeaa0a0                                                                                 x[4] = 0x000000016eeaa080   x[5] = 0x0000000000000001   x[6] = 0x000060d000000040   x[7] = 0x0000000000000001                                                                                 x[8] = 0x000012bc249280a0   x[9] = 0x000012bc249280a0  x[10] = 0x000000016eeaa2c0  x[11] = 0x000000702ddf5408                                                                                x[12] = 0x000000002ddd5408  x[13] = 0x0000000000000000  x[14] = 0xf2f2f200f2f20000  x[15] = 0x000000016eeaa470                                                                                x[16] = 0x000000018b553360  x[17] = 0x000000016eeaa460  x[18] = 0x0000000000000000  x[19] = 0x000000016eeaa540                                                                                x[20] = 0x000000702ddf5ef5  x[21] = 0x000000702ddf5edd  x[22] = 0x000000702ddf5ecd  x[23] = 0x000000702ddf5e85                                                                                x[24] = 0x000000702ddf5ded  x[25] = 0x000000702ddf5dd5  x[26] = 0x000000702ddf5b7d  x[27] = 0x000000702ddf5b65                                                                                x[28] = 0x000000702ddf5b4d     fp = 0x000000016eeaa430     lr = 0x00000001016fcf78     sp = 0x000000016eeaa410                                                                                AddressSanitizer can not provide additional info.                                              SUMMARY: AddressSanitizer: BUS (js:arm64+0x1008c6be8) in std::__1::unique_ptr<js::wasm::DebugState, JS::DeletePolicy<js::wasm::DebugState>>::operator*[abi:sqn210106]() const+0x48            ==64399==ABORTING                                                                              zsh: abort      ./js ~/firefox/artifacts/jspi-debugger-uaf-repro.js

Comment 1

[Kanaru Sato [:canalun]]

Sorry, I don’t have a root-cause hypothesis, because this was an accidental finding during my AI-related experimentation.

Comment 2

[Ryan Hunt [:rhunt]]

Thanks for the report! This is a duplicate of bug 2042753. The attached patch on there fixes this issue.

Comment 3

[Kanaru Sato [:canalun]]

oh, nice! Thanks!!

Comment 4

[Kanaru Sato [:canalun]]

btw, I'm not an external reporter. So it would be good to remove the external-reporter tag :)