VULNERABILITY DETAILS

I am still analyzing this PoC and have not yet identified the root cause. I can only explain the reason for the crash.

This crash is related to the Maglev register allocation process. The relevant Maglev graph is as follows:

After register allocation
Graph
    ....
│╭───►Block b2 (effects: ua)
││      32/35: φᵀ r1 (n33, n85) (compressed) → [rax|R|t] (spilled: [stack:15|t]), live range: [32-66]
││      33/36: φᵀ r5 (n32, n89) (decompressed) → [rdx|R|t] (spilled: [stack:7|t]), live range: [33-60]
││         98: GapMove([rdx|R|t] → [rbx|R|t])
││     79 : TestLessThan r5, [14]
││             ↱ eager @79 (11 live vars)
││      34/38: CheckedSmiUntag [v33/n36:[rdx|R|t]] → [rdx|R|w32] (spilled: [stack:1|w32]), live range: [34-60]
││         99: ConstantGapMove(n39 → [rsi|R|w32])
││     82 : JumpIfFalse [81]
││╭─────35/41: BranchIfInt32Compare(LessThan) [v34/n38:[rdx|R|w32], v13/n39:[rsi|R|w32]] b3 b9
│││         ↓
│││   Block b3    /*=== k[9] = k; ===*/
|||        ...
│││  0x09b1008384b1 <SharedFunctionInfo> (0x09b100848915 <String[8]: "./poc.js">:5:21)
│││    93 : SetKeyedProperty r5, r17, [15]
│││     36/44: 🐢 CallBuiltin(KeyedStoreIC_Megamorphic) [v33/n36:[rdx|R|t], v9/n43:[rcx|R|t], v33/n36:[rax|R|t], v16/n2:[rsi|R|t]] → [rax|R|t]
│││            ↳ lazy @93 (11 live vars)
│││            ↳ throw @126 (b7) : {<this>:n1, <context>:n2, r1:n35, r4:n26, r5:n36, r7:n11, r8:n12, r10:n14, r13:n17, r14:n18}

....        /*=== for (let m = 0; m<10; m++) { } ===*/

│││ ╰►Block b6    /*=== undefined(); ===*/
│││       108: ConstantGapMove(n33 → [rdi|R|t])
│││       109: GapMove([stack:-3|t] → [rsi|R|t])
│││  0x09b1008384b1 <SharedFunctionInfo> (0x09b100848915 <String[8]: "./poc.js">:8:16)
│││   120 : CallUndefinedReceiver0 r16, [20]
│││     44/62: 🐢 Call(NULL_OR_UNDEFINED, Any) [v4/n33:[rdi|R|t], v16/n2:[rsi|R|t], v4/n33:[rdi|R|t]] → [rax|R|t], live range: [44-45]
│││            ↳ lazy @120 (11 live vars)
│││            ↳ throw @126 (b7) : {<this>:n1, <context>:n2, r1:n33, r4:n26, r5:n36, r7:n11, r8:n12, r10:n14, r13:n17, r14:n18}
│││   124 : Jump [30]
│││╭────45/63: Jump b8
││││           with gap moves:
││││             - v44/n62:[rax|R|t] → 85: φᵀ r1 [rax|R|t]
││││           with register merges:
││││ 
││││  Block b7 (exception handler)    /*=== catch(exception) { ... } ===*/
││││    46/64: φᵀₑ <accumulator> (compressed) → [rax|R|t], live range: [46-54]
││││    47/65: φᵀₑ r1 (compressed) → [rcx|R|t] (spilled: [stack:14|t]), live range: [47-57]
....

In the PoC, there are two nodes that may throw exceptions, and the exceptions thrown by both will be handled by Block b7 (exception handler).

1. 36/44: CallBuiltin(...). If an exception is thrown from here, the value of r1 will be n35.
2. 44/62: Call(...). If an exception is thrown from here, the value of r1 will be n33.

Since the value of r1 differs in the two paths, an exception phi node 47/65: φᵀₑ r1 is additionally added in Block b7.

The crash occurs during the Maglev assembly process. According to the comments in the ExceptionHandlerTrampolineBuilder::EmitTrampolineFor() method, when handling exception phis, the NewHeapNumber builtin may be called to create a HeapNumber object for float64, which may overwrite registers. Therefore, it is required that the source of every exception phi must be spilled to the stack during processing.

However, when ExceptionHandlerTrampolineBuilder processes the 36/44: CallBuiltin node, n35 is the source of the exception phi node, but n35 is not spilled to the stack. Instead, it is simultaneously located in [rax|R|t] and (spilled: [stack:15|t]), causing the DCHECK to fail.

In the release version, ExceptionHandlerTrampolineBuilder directly loads the value from rax, which is unsafe because the NewHeapNumber builtin may overwrite the value in rax at any time.

As I continued to study the Maglev register allocation process, I found:

• When StraightForwardRegisterAllocator::AllocateNode() processes the 36/44: CallBuiltin(...) node, it correctly calls SpillAndClearRegisters() to spill all registers to the stack. Therefore, the location information of the 32/35: φᵀ r1 (n33, n85) node is (spilled: [stack:15|t]).
• However, when processing Block b9, InitializeRegisterValues() is called to reload the 32/35: φᵀ r1 (n33, n85) node into rax. This results in the location information (i.e., regalloc_info) of the node being [rax|R|t] (spilled: [stack:15|t]).

│││   Block b3
│││   live regs: rax=v32, rcx=v1, rdx=v34, rbx=v33, rsi=v13
│││   [holes: 45-59 63↰]
.....
│││   Using n2...
│││     clearing registers with n36      /* <=== Spill and Clean */
│││     spill: [stack:7|t] ← n36  
│││     clearing registers with n43
│││     clearing registers with n2
│││     clearing registers with n38
│││     spill: [stack:1|w32] ← n38
│││     clearing registers with n35
│││     spill: [stack:15|t] ← n35
│││   Allocating result...
│││     forcing rax to n44...
│││   Allocating lazy deopt inputs...
│││   Using n3...
│││   Using n1...
│││   Using n2...
│││   Using n35...
│││   Using n26...
│││   Using n36...
│││   Using n11...
│││   Using n12...
│││   Using n14...
│││   Using n17...
│││   Using n18...
│││   Using n2...
│││  0x09b1008384b1 <SharedFunctionInfo> (0x09b100848915 <String[8]: "./poc.js">:5:21)
│││    93 : SetKeyedProperty r5, r17, [15]
│││     44: 🐢 CallBuiltin(KeyedStoreIC_Megamorphic) [n36, n43, n36, n2], 0 uses, but required
│││         ↳ lazy @93 (11 live vars)
│││         ↳ throw @126 (b7) : {<this>:n1, <context>:n2, r1:n35, r4:n26, r5:n36, r7:n11, r8:n12, r10:n14, r13:n17, r14:n18}
....
│ ╰──►Block b9
│     live regs: rax=v32, rcx=v1, rsi=v13    /* Force Load */

RecordMoves() retrieves the location information of the node from source->regalloc_info()->allocation(). If a node’s value is simultaneously in a register and on the stack, allocation() will choose to load the value from the register.

class RegallocValueNodeInfo : public RegallocNodeInfo {
  ...
  compiler::InstructionOperand allocation() const {
    if (has_register()) {
      return compiler::AllocatedOperand(compiler::LocationOperand::REGISTER,
                                        representation_, FirstRegisterCode());
    }
    CHECK(is_loadable());
    return loadable_slot();
  }
  ...
}

That is all I know so far. I cannot determine the root cause of this crash. I believe you have a better understanding of Maglev than I do, so I report it to you.

REPRODUCTION CASE

poc.js:

let arr = [1, 2, 3];
for (const i of arr) {
    for (let j = 0; j < 50, true; j++) {
        for (let k = 0; k < 5; k++) {
            try {
                k[9] = k;
                for (let m = 0; m<10; m++) {
                }
                undefined();   
            } catch(exception) {
                print(exception);
            }
        }
    }
}

V8 must be built with a debug configuration, Execute v8 as follows:

./d8 \
    --predictable \
    --jit-fuzzing \
    ./poc.js

This will result in the following crash:

#
# Fatal error in ../../src/maglev/maglev-code-generator.cc, line 623
# Debug check failed: !source->regalloc_info()->allocation().IsRegister().
#

CREDIT INFORMATION

Reporter credit: [303f06e3]