2044831 - Crash [@ js::LookupPropertyPure]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20260603-14f381ab3699 (opt build, run with --fuzzing-safe --ion-offthread-compile=off --ion-warmup-threshold=10 --inlining-entry-threshold=1 --baseline-warmup-threshold=1 --blinterp-warmup-threshold=10 --trial-inlining-warmup-threshold=10):

try {
evalInWorker(`
try {} catch(exc) {}
function manyParams(a69,b18,c73,d44,e8,f93,g76,h74,i97,j52,k10,l20,m37,n27,o72,p33,q58,r62,s41,t15,u19,v88,w2,x13,y30,z60,
                    aa,bb,cc,dd,ee,ff,gg,hh,ii,jj,kk,ll,mm,nn,oo,pp,qq,rr,ss,tt) {
  result = undefined;
  assertEq(result, 0);
  assertEq(result, 5);
  assertEq(result, 0);
}
async function assertEq() {
  for (await using x95 of [
    {
      [Symbol.asyncDispose]() {},
    },
  ]) {}
  let result = manyParams.apply(null, []);
  assertEq(result, 0);
  assertEq(result, 10);
  assertEq(result, 5);
}
for (let i97 = 0; i97 < 300; i97++) {
  let result = manyParams.apply(null, []);
  assertEq(result, 0);
  assertEq(result, 0);
  assertEq(result, 5);
}
try {evaluate(\`
async function assertEq() {
  for (await using x95 of [
    {
      [Symbol.asyncDispose]() {
      },
    },
  ]) {
    return 42;
  }
}
\`);
} catch(exc) {}
`); } catch (exc) {}

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000555556ecc4b1 in js::LookupPropertyPure(JSContext*, JSObject*, JS::PropertyKey, js::NativeObject**, js::PropertyResult*) ()
#1  0x0000555556ecc29c in CanAttachNativeGetProp(JSContext*, JSObject*, JS::PropertyKey, js::NativeObject**, mozilla::Maybe<js::PropertyInfoBase<unsigned int> >*, unsigned char*) ()
#2  0x0000555557613940 in js::jit::CloseIterIRGenerator::tryAttachStub() ()
#3  0x0000555557613282 in js::jit::DoCloseIterFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::Handle<JSObject*>) ()
#4  0x000036c00cd5d8b0 in ?? ()
[...]
#19 0x0000000000000000 in ?? ()
rax	0xdf51086227f8dc00	-2355091912467620864
rbx	0x7a49d02b6e0	8403590231776
rcx	0x7fffeebfe078	140737198940280
rdx	0x7a49d02b6e0	8403590231776
rsi	0x680000000002a	1829587348619306
rdi	0x7fffee255400	140737188811776
rbp	0x7fffeebfe060	140737198940256
rsp	0x7fffeebfdff0	140737198940144
r8	0x7fffeebfe080	140737198940288
r9	0x7fffed00ee69	140737169649257
r10	0x555558034938	93825037191480
r11	0x7fffee255488	140737188811912
r12	0x7fffeebfe0e0	140737198940384
r13	0x7fffeebfe0d8	140737198940376
r14	0x7fffee255400	140737188811776
r15	0x680000000002a	1829587348619306
rip	0x555556ecc4b1 <js::LookupPropertyPure(JSContext*, JSObject*, JS::PropertyKey, js::NativeObject**, js::PropertyResult*)+17>
=> 0x555556ecc4b1 <_ZN2js18LookupPropertyPureEP9JSContextP8JSObjectN2JS11PropertyKeyEPPNS_12NativeObjectEPNS_14PropertyResultE+17>:	mov    (%rsi),%r10
   0x555556ecc4b4 <_ZN2js18LookupPropertyPureEP9JSContextP8JSObjectN2JS11PropertyKeyEPPNS_12NativeObjectEPNS_14PropertyResultE+20>:	mov    (%r10),%rax

This is possibly related to bug 2003463 for which we never found a proper test.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260603204655-14f381ab3699.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 9deea8b0a7f33f6410ce3ee1b718a9bc3b394ea5 (20260307210637)
End: 14f381ab36994ba0e3e300b7592dca2756519ce8 (20260603204655)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Jan de Mooij [:jandem]]

This is a bug in the frontend's try note code for for-using.

The test case triggers an Ion compilation that throws an exception at a LoopHead op but I also wrote a different test that uses the debugger API to throw an exception.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: (secure)

Comment 6

[Jan de Mooij [:jandem]]

Attachment: (secure)

Comment 7

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1921317

Comment 8

[Jan de Mooij [:jandem]]

ESR140 is not affected because explicit resource management shipped in 141 (bug 1967744).

Comment 9

[Jan de Mooij [:jandem]]

Comment on attachment 9594700 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Not very easy to trigger; requires either the debugger API (unavailable to content) or triggering an OOM at a loop header.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: beta, release
• If not all supported branches, which bug introduced the flaw?: 1967744 enabled the feature
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: Should be easy.
• How likely is this patch to cause regressions; how much testing does it need?: Unlikely; explicit resource management is a fairly new feature.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/03c20671fe9c
https://hg.mozilla.org/integration/autoland/rev/9b887e587a96
Change tryNoteStart location in ForOfLoopControl::emitPrepareForNonLocalJumpFromScope. r=arai

Comment 11

[Jan de Mooij [:jandem]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D305106

Comment 12

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Crashes or security bugs.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small patch; affects a new feature that isn't used much on the web.
• String changes made/needed?: N/A
• Is Android affected?: yes

Comment 13

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/ff50082edb2c
https://hg.mozilla.org/releases/mozilla-beta/rev/119685ebdf4c

Comment 14

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/9b887e587a96

Comment 15

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260610101355-3244103125f5.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 17

[BugBot [:suhaib / :marco]]

Copying crash signatures from duplicate bugs.