Bug 285205 – [JSC] Crash on JSC::Wasm::wasmToJS(unsigned long, unsigned int)

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

Created attachment 473693 [details]
PoC

1. Tested on both Webkit branch (`@main` and `@safari-7260-branch`)
2. Target release or debug
3. Run with `./bin/jsc ./poc4.js`

# commit @main
```
commit d7ba780797fcdce60dc5c981fb9f233b93e360b1 (HEAD -> main, origin/main, origin/HEAD)
Author: Ahmad Saleem <[e-mail]>
Date:   Fri Dec 27 06:01:47 2024 -0800
```

# commit @safari-7620-branch
```
ommit 26c90c797c07bfa1920c36f0900e5ec90e6e946d (HEAD -> safari-7620-branch, origin/safari-7620-branch)
Author: Nikolaos Mouchtaris <[e-mail]>
Date:   Mon Nov 4 15:44:51 2024 -0800
```

# Error Stack
```
=================================================================
==200862==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x58df3d583049 bp 0x71d1cd5ff610 sp 0x71d1cd5fe940 T2)
==200862==The signal is caused by a READ memory access.
==200862==Hint: address points to the zero page.
SCARINESS: 10 (null-deref)
    #0 0x58df3d583049 in JSC::Wasm::wasmToJS(unsigned long, unsigned int) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x39ef049) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #1 0x58df3cf98774 in JSC::Wasm::EntryPlan::generateWasmToJSStubs() (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x3404774) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #2 0x58df3cf99036 in JSC::Wasm::EntryPlan::generateStubsIfNecessary() (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x3405036) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #3 0x58df3d126135 in JSC::Wasm::LLIntPlan::didCompleteCompilation() (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x3592135) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #4 0x58df3d55fd88 in JSC::Wasm::Worklist::Thread::work() (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x39cbd88) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #5 0x58df3e47534d in WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call() AutomaticThread.cpp
    #6 0x58df3e4c0a12 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x492ca12) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #7 0x58df3e56f1f5 in WTF::wtfThreadEntryPoint(void*) ThreadingPOSIX.cpp

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x39ef049) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da) in JSC::Wasm::wasmToJS(unsigned long, unsigned int)
Thread T2 (t Helper Thread) created by T0 here:
    #0 0x58df3a041ed5 in pthread_create (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x4aded5) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #1 0x58df3e56f02a in WTF::Thread::establishHandle(WTF::Thread::NewThreadContext*, std::optional<unsigned long>, WTF::Thread::QOS, WTF::Thread::SchedulingPolicy) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x49db02a) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #2 0x58df3e4c0fc3 in WTF::Thread::create(WTF::ASCIILiteral, WTF::Function<void ()>&&, WTF::ThreadType, WTF::Thread::QOS, WTF::Thread::SchedulingPolicy) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x492cfc3) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #3 0x58df3e472a6b in WTF::AutomaticThread::start(WTF::AbstractLocker const&) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x48dea6b) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #4 0x58df3e472f54 in WTF::AutomaticThreadCondition::notifyAll(WTF::AbstractLocker const&) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x48def54) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #5 0x58df3d5379d2 in JSC::Wasm::Worklist::enqueue(WTF::Ref<JSC::Wasm::Plan, WTF::RawPtrTraits<JSC::Wasm::Plan>, WTF::DefaultRefDerefTraits<JSC::Wasm::Plan>>) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x39a39d2) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #6 0x58df3d2bc137 in JSC::Wasm::Module::validateSync(JSC::VM&, WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x3728137) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #7 0x58df3d5a7002 in JSC::WebAssemblyModuleConstructor::createModule(JSC::JSGlobalObject*, JSC::CallFrame*, WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x3a13002) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #8 0x58df3d5a8a13 in JSC::constructJSWebAssemblyModule(JSC::JSGlobalObject*, JSC::CallFrame*) UnifiedSource-15db4ad9-11.cpp
    #9 0x71d1d6e103e6  (<unknown module>)
    #10 0x58df3d8f2c62 in llint_op_construct LowLevelInterpreter.cpp
    #11 0x58df3d8d35c3 in llint_call_javascript LowLevelInterpreter.cpp
    #12 0x58df3b89b92e in JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x1d0792e) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #13 0x58df3c337a24 in JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x27a3a24) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #14 0x58df3a0a3e68 in jscmain(int, char**) (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x50fe68) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #15 0x58df3a0a1c45 in main (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x50dc45) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)
    #16 0x71d219a2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #17 0x71d219a2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #18 0x58df39fc34a4 in _start (/home/rheza/jsc-build-release-asan-clang/bin/jsc+0x42f4a4) (BuildId: da43a9796e3cb39709b99dd29fe782025c9b73da)

==200862==ABORTING
```

[Radar WebKit Bug Importer]

<rdar://problem/142111335>

[Yusuke Suzuki]

This is nullptr crash => non security.

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/38828

[EWS]

Committed 288718@main (96d7b009c8c1): <https://commits.webkit.org/288718@main>

Reviewed commits have been landed. Closing PR #38828 and removing active labels.

[Yusuke Suzuki]

*** Bug 283261 has been marked as a duplicate of this bug. ***