2073652 - Ion skips Proxy get validation for non-writable array length

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Bugmon [:jkratzer for issues]]

GetObjectFlagsForNewProperty uses isDataProperty() when setting NeedsProxyGetSetResultValidation, excluding custom data properties such as array length. Making length non-writable therefore leaves the validation flag unset, causing Ion's scripted Proxy getter to skip the required result check.

A webpage can bypass JavaScript Proxy invariants by exercising Ion's optimized getter with an array whose length is non-writable. The verified result is 17 for a target length fixed at 0, where a TypeError is required. No memory corruption or sandbox escape was demonstrated.

This finding was discovered during variant analysis seeded by bug 1989978.

Build Info

• Branch: main
• Revision: 383240b1c47fcbe804430e196a78f57abf4e1dfb
• Timestamp: 2026-09-18T04:20:17+00:00

Affected Code

File: js/src/vm/ObjectFlags-inl.h, line 41-42

    if (propFlags.isDataProperty() && !propFlags.writable()) {
      flags.setFlag(ObjectFlag::NeedsProxyGetSetResultValidation);

File: js/src/vm/PropertyInfo.h, line 66-68

  bool isDataProperty() const {
    return !isAccessorProperty() && !isCustomDataProperty();
  }

File: js/src/jit/CodeGenerator.cpp, line 17960-17963

  masm.unboxObject(target, scratch);
  masm.branchTestObjectNeedsProxyResultValidation(Assembler::NonZero, scratch,
                                                  scratch2, ool->entry());
  masm.bind(ool->rejoin());

ArraySetLength preserves the custom-data classification when clearing Writable (js/src/builtin/Array.cpp:915-923). The generated validation gate tests NeedsProxyGetSetResultValidation (js/src/jit/MacroAssembler.cpp:6233-6235). The interpreter instead checks the exposed data descriptor and rejects unequal values (js/src/proxy/ScriptedProxyHandler.cpp:1195-1203).

Exploit Chain

1. Create an empty array and a Proxy whose get trap returns 17.
2. Warm a function reading proxy.length until Ion compiles the optimized getter.
3. Make the target array's length non-writable.
4. Read through the optimized getter; it returns 17 instead of throwing the required TypeError.

Steps to Reproduce

1. Use /app/output/verification-proxy-readonly-length/proxy-readonly-length.js.
2. Build clean source using build_firefox with firefox_dir=/firefox and mozconfig_path=/app/mozconfigs/mozconfig.js.linux.debug.
3. Run js_shell_differential_evaluator with /firefox/obj-js-debug/dist/bin/js for both shells, flags_a=[--no-threads,--no-jit-backend], and flags_b=[--no-threads,--ion-warmup-threshold=100]. The evaluator adds --fuzzing-safe.
4. Observe differs: true, shell A exit 0, and shell B exit 3 with Error: Missing TypeError for immutable array length.
5. Repeat with --differential-testing added to both flag sets; observe the same discrepancy without timeouts.
6. Independent controls pass with Ion disabled or --cache-ir-stubs=off. Adding an ordinary non-configurable, non-writable target property restores validation; adding a configurable property does not.
7. Exact evaluator commands, captured logs, and control testcases are preserved in /app/output/verification-proxy-readonly-length/evidence.json.

Security Impact

• Severity: Low
• Attacker capability: Obtain an incorrect Proxy result that violates an immutable property's invariant. The demonstrated capability is limited to JavaScript semantics; no memory corruption, disclosure, or privilege escalation was established.
• Preconditions: The property read must reach Ion's optimized scripted Proxy getter. The target array has non-writable length and lacks another property that sets the validation flag. Reproduction required no source patches, browser preferences, external services, or shell-only helpers.

ASAN Report

No sanitizer crash occurred; this finding is js_differential. Both required comparisons reported differs: true, with interpreter exit 0 and Ion exit 3. Ion stderr reported: Error: Missing TypeError for immutable array length. A diagnostic control confirmed returned value 17 with target length descriptor {"value":0,"writable":false,"enumerable":false,"configurable":false}.

Comment 1

[Bugmon [:jkratzer for issues]]

Attachment: fix.patch

Comment 2

[Bugmon [:jkratzer for issues]]

Attachment: crash_stack.txt

Comment 3

[Bugmon [:jkratzer for issues]]

Attachment: proxy-readonly-length.js

Comment 4

[Jesse Schwartzentruber (:truber)]

This bug was filed automatically by an AI-powered security testing tool. The analysis, testcase, and any suggested patches were generated by an AI model and have NOT been verified by a human.

Please review all details carefully before triaging. The issue was confirmed by an independent verifier, but for non-ASAN issues, the verifier has been made less strict. Additionally, the root cause analysis and suggested fix may contain errors.

Comment 5

[Iain Ireland [:iain]]

This isn't security-sensitive, but sure, the patch looks correct.

Comment 6

[Iain Ireland [:iain]]

Attachment: Bug 2073652: Fix proxy get validation for non-writable length r=#spidermonkey-reviewers

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3e14d4afd7ea
https://hg.mozilla.org/integration/autoland/rev/299f2d233b9b
Fix proxy get validation for non-writable length r=spidermonkey-reviewers,jonco

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9d978ac3bca4
https://hg.mozilla.org/integration/autoland/rev/c48b42840de5
Fix proxy get validation for non-writable length r=spidermonkey-reviewers,jonco

Comment 9

[rperta]

https://hg.mozilla.org/mozilla-central/rev/c48b42840de5