2076003 - Large function with a trailing empty switch crashes debug SpiderMonkey

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Bugmon [:jkratzer for issues]]

BytecodeEmitter::allocateTableSwitchResumeIndexRange assigns firstResumeIndex from numCaseOffsets(), but checks the resume-index limit only while appending cases (js/src/frontend/BytecodeEmitter.cpp:2177). After 16,777,216 entries, an empty switch receives 0x1000000, and SwitchEmitter::emitEnd passes it to SET_RESUMEINDEX, violating the 24-bit SET_UINT24 assertion (js/src/frontend/SwitchEmitter.cpp:386; js/src/vm/BytecodeUtil.h:89).

A JavaScript author can crash a debug SpiderMonkey shell by compiling a sufficiently large function ending in an empty switch. The unchanged --fuzzing-safe debug shell reproduces the assertion, while the optimized ASAN shell completes the same testcase. Release-build memory corruption is not demonstrated.

This finding was discovered during variant analysis seeded by bug 1827359.

Build Info

• Branch: main
• Revision: c32abda0190531351e22da36334f18f9e994d474
• Timestamp: 2026-09-26T04:22:48+00:00

Affected Code

File: js/src/frontend/BytecodeEmitter.cpp, line 2177

  *firstResumeIndex = list.numCaseOffsets();
  if (!list.appendTableSwitch(switchOffset)) {
    return false;
  }

  for (BytecodeOffset offset : caseOffsets) {
    if (!checkResumeIndexLimit()) {
      return false;
    }
    if (!list.appendCaseOffset(offset)) {
      return false;
    }
  }

File: js/src/frontend/SwitchEmitter.cpp, line 382

    if (!bce_->allocateTableSwitchResumeIndexRange(offsets, top_,
                                                   &firstResumeIndex)) {
      return false;
    }
    SET_RESUMEINDEX(pc, firstResumeIndex);

File: js/src/vm/BytecodeUtil.h, line 88

static MOZ_ALWAYS_INLINE void SET_UINT24(jsbytecode* pc, uint32_t i) {
  MOZ_ASSERT(i < (1 << 24));

MaxResumeIndex is the 24-bit mask (js/src/frontend/BytecodeEmitter.cpp:2138). The limit check runs before insertion, allowing a table to contain 2^24 entries (js/src/frontend/BytecodeEmitter.cpp:2150). An empty caseOffsets span bypasses that check and returns the one-past-end count as an index. Removing the final empty switch or retaining it with one fewer preceding entry makes the debug testcase succeed.

Exploit Chain

1. Generate 512 switches spanning integer cases 0 through 32766, followed by a switch spanning 0 through 511; their jump tables require 16,777,216 resume entries.
2. Append an empty switch and pass the generated body to the ordinary Function constructor.
3. Compilation passes the unrepresentable resume index to SET_UINT24 and aborts the debug engine.

Steps to Reproduce

1. Use unmodified Firefox revision c32abda0190531351e22da36334f18f9e994d474. Run build_firefox with firefox_dir=/firefox and mozconfig_path=/app/mozconfigs/mozconfig.js.linux.debug.
2. Run js_shell_evaluator with the contents of /app/output/verification-tmpfru_7e7y/resume-index-overflow.js, js_binary=/firefox/obj-js-debug/dist/bin/js, flags=[], and timeout=240.
3. Observe crashed=true, timed_out=false, and exit_code=1. The complete independent stack is saved at /app/output/verification-tmpfru_7e7y/debug-crash.stderr.txt:1. Build and control results are recorded in /app/output/verification-tmpfru_7e7y/verification.json:1.

Security Impact

• Severity: Low
• Attacker capability: Abort an assertions-enabled SpiderMonkey process during JavaScript compilation. Release-build memory corruption or code execution was not demonstrated.
• Preconditions: Ability to supply JavaScript to the Function constructor and sufficient resources to compile 16,777,216 table-switch resume entries. The demonstrated abort requires the debug build.

ASAN Report

[13572] Assertion failure: i < (1 << 24), at /firefox/js/src/vm/BytecodeUtil.h:89
    #0 0x5605929ea3ce in MOZ_CrashSequence(void*, long) /firefox/obj-js-debug/dist/include/mozilla/Assertions.h:261:3
    #1 0x5605929ea3ce in SET_UINT24(unsigned char*, unsigned int) /firefox/js/src/vm/BytecodeUtil.h:89:3
    #2 0x5605929ea3ce in SET_RESUMEINDEX(unsigned char*, unsigned int) /firefox/js/src/vm/BytecodeUtil.h:195:3
    #3 0x5605929ea3ce in js::frontend::SwitchEmitter::emitEnd() /firefox/obj-js-debug/js/src/frontend/./../../../../js/src/frontend/SwitchEmitter.cpp:386:5
    #4 0x5605928c810f in js::frontend::BytecodeEmitter::emitSwitch(js::frontend::SwitchStatement*) /firefox/obj-js-debug/js/src/frontend/./../../../../js/src/frontend/BytecodeEmitter.cpp:2131:11
SUMMARY: UndefinedBehaviorSanitizer: SEGV /firefox/obj-js-debug/dist/include/mozilla/Assertions.h:261:3 in MOZ_CrashSequence(void*, long)

Comment 1

[Bugmon [:jkratzer for issues]]

Attachment: fix.patch

Comment 2

[Bugmon [:jkratzer for issues]]

Attachment: crash_stack.txt

Comment 3

[Bugmon [:jkratzer for issues]]

Attachment: resume-index-overflow.js

Comment 4

[Christian Holler (:decoder)]

This bug was filed automatically by an AI-powered security testing tool. The analysis, testcase, and any suggested patches were generated by an AI model and have NOT been verified by a human.

Please review all details carefully before triaging. The issue was confirmed by an independent verifier, but for non-ASAN issues, the verifier has been made less strict. Additionally, the root cause analysis and suggested fix may contain errors.

Comment 6

[Iain Ireland [:iain]]

Attachment: Bug 2076003: Force resume index to 0 for empty switches r=#spidermonkey-reviewers

Comment 7

[BugBot [:suhaib / :marco]]

:iain, please review the release status flags for beta, release, and ESR and update each one as appropriate.

For each version, indicate whether it is affected, unaffected, disabled, or wontfix if it is affected but does not need to be fixed on that branch.

Comment 8

[Iain Ireland [:iain]]

As mentioned in this comment on the dupe, I'm pretty sure this doesn't affect non-release builds at all. Opening up.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/97aeb2a19423
https://hg.mozilla.org/integration/autoland/rev/4ce4044b5dd0
Force resume index to 0 for empty switches r=spidermonkey-reviewers,mgaudet

Comment 10

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/4ce4044b5dd0