High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the JavaScript: WebAssembly component
ComponentSpiderMonkey
Bug ClassUAF
Tracker2038081
Fix commit15fe5707e93d (firefox) +19/-40
CISA KEVNot listed
CreditedOpenAI Preparedness, Bill Demirkapi
Disclosed2026-05-12

Changed Functions

FunctionChangeNotes
if
js/src/wasm/WasmIonCompile.cpp
modified

Files Changed

  • js/src/wasm/WasmBuiltins.cpp
  • js/src/wasm/WasmIonCompile.cpp
diff --git a/js/src/wasm/WasmBuiltins.cpp b/js/src/wasm/WasmBuiltins.cpp
index 1f6a94cbb93..c50bbee0fb9 100644
--- a/js/src/wasm/WasmBuiltins.cpp
+++ b/js/src/wasm/WasmBuiltins.cpp
@@ -79,7 +79,6 @@ static const unsigned BUILTIN_THUNK_LIFO_SIZE = 64 * 1024;
 #define _I64 MIRType::Int64
 #define _PTR MIRType::Pointer
 #define _RoN MIRType::WasmAnyRef
-#define _WAD MIRType::WasmArrayData
 #define _VOID MIRType::None
 #define _END MIRType::None
 #define _Infallible FailureMode::Infallible
@@ -150,14 +149,10 @@ constexpr SymbolicAddressSignature SASigArrayMemMove = {
     _Infallible,
     _NoTrap,
     6,
-    {_WAD, _I32, _WAD, _I32, _I32, _I32, _END}};
+    {_RoN, _I32, _RoN, _I32, _I32, _I32, _END}};
 constexpr SymbolicAddressSignature SASigArrayRefsMove = {
-    SymbolicAddress::ArrayRefsMove,
-    _VOID,
-    _Infallible,
-    _NoTrap,
-    6,
-    {_RoN, _WAD, _I32, _WAD, _I32, _I32, _END}};
+    SymbolicAddress::ArrayRefsMove,      _VOID, _Infallible, _NoTrap, 5,
+    {_RoN, _I32, _RoN, _I32, _I32, _END}};
 constexpr SymbolicAddressSignature SASigMemoryGrowM32 = {
     SymbolicAddress::MemoryGrowM32, _I32, _Infallible, _NoTrap, 3,
     {_PTR, _I32, _I32, _END}};
@@ -1397,21 +1392,25 @@ template ALIGN_STACK_FOR_ROUNDING_FUNCTION double NearbyInt(double);
 
 #undef ALIGN_STACK_FOR_ROUNDING_FUNCTION
 
-static void WasmArrayMemMove(uint8_t* destArrayData, uint32_t destIndex,
-                             const uint8_t* srcArrayData, uint32_t srcIndex,
+static void WasmArrayMemMove(WasmArrayObject* destArrayObject,
+                             uint32_t destIndex,
+                             WasmArrayObject* srcArrayObject, uint32_t srcIndex,
                              uint32_t elementSize, uint32_t count) {
   AutoUnsafeCallWithABI unsafe;
+  uint8_t* destArrayData = destArrayObject->data_;
+  uint8_t* srcArrayData = srcArrayObject->data_;
   memmove(&destArrayData[size_t(elementSize) * destIndex],
           &srcArrayData[size_t(elementSize) * srcIndex],
           size_t(elementSize) * count);
 }
 
 static void WasmArrayRefsMove(WasmArrayObject* destArrayObject,
-                              AnyRef* destArrayData, uint32_t destIndex,
-                              AnyRef* srcArrayData, uint32_t srcIndex,
-                              uint32_t count) {
+                              uint32_t destIndex,
+                              WasmArrayObject* srcArrayObject,
+                              uint32_t srcIndex, uint32_t count) {
   AutoUnsafeCallWithABI unsafe;
-
+  AnyRef* destArrayData = (AnyRef*)(destArrayObject->data_);
+  AnyRef* srcArrayData = (AnyRef*)(srcArrayObject->data_);
   AnyRef* dstBegin = destArrayData + destIndex;
   AnyRef* srcBegin = srcArrayData + srcIndex;
   BarrieredMoveRange(destArrayObject, dstBegin, srcBegin, count);
@@ -1609,7 +1608,7 @@ void* wasm::AddressOf(SymbolicAddress imm, ABIFunctionType* abiType) {
       *abiType = Args_Void_GeneralInt32GeneralInt32Int32Int32;
       return FuncCast(WasmArrayMemMove, *abiType);
     case SymbolicAddress::ArrayRefsMove:
-      *abiType = Args_Void_GeneralGeneralInt32GeneralInt32Int32;
+      *abiType = Args_Void_GeneralInt32GeneralInt32Int32;
       return FuncCast(WasmArrayRefsMove, *abiType);
 
     case SymbolicAddress::MemoryGrowM32:
diff --git a/js/src/wasm/WasmIonCompile.cpp b/js/src/wasm/WasmIonCompile.cpp
index 55d8de0e9a6..9c79b9cf070 100644
--- a/js/src/wasm/WasmIonCompile.cpp
+++ b/js/src/wasm/WasmIonCompile.cpp
@@ -5527,31 +5527,11 @@ class FunctionCompiler {
     curBlock_->end(test);
     curBlock_ = copyBlock;
 
-    MInstruction* dstData = MWasmLoadField::New(
-        alloc(), dstArrayObject, nullptr, WasmArrayObject::offsetOfData(),
-        mozilla::Nothing(), MIRType::WasmArrayData, MWideningOp::None,
-        AliasSet::Load(AliasSet::WasmArrayDataPointer),
-        mozilla::Some(trapSiteDesc()));
-    if (!dstData) {
-      return false;
-    }
-    curBlock_->add(dstData);
-
-    MInstruction* srcData = MWasmLoadField::New(
-        alloc(), srcArrayObject, nullptr, WasmArrayObject::offsetOfData(),
-        mozilla::Nothing(), MIRType::WasmArrayData, MWideningOp::None,
-        AliasSet::Load(AliasSet::WasmArrayDataPointer),
-        mozilla::Some(trapSiteDesc()));
-    if (!srcData) {
-      return false;
-    }
-    curBlock_->add(srcData);
-
     if (elemsAreRefTyped) {
       MOZ_RELEASE_ASSERT(elemSize == sizeof(void*));
 
-      if (!builtinCall6(SASigArrayRefsMove, lineOrBytecode, dstArrayObject,
-                        dstData, dstArrayIndex, srcData, srcArrayIndex,
+      if (!builtinCall5(SASigArrayRefsMove, lineOrBytecode, dstArrayObject,
+                        dstArrayIndex, srcArrayObject, srcArrayIndex,
                         numElements, nullptr)) {
         return false;
       }
@@ -5561,9 +5541,9 @@ class FunctionCompiler {
         return false;
       }
 
-      if (!builtinCall6(SASigArrayMemMove, lineOrBytecode, dstData,
-                        dstArrayIndex, srcData, srcArrayIndex, elemSizeDef,
-                        numElements, nullptr)) {
+      if (!builtinCall6(SASigArrayMemMove, lineOrBytecode, dstArrayObject,
+                        dstArrayIndex, srcArrayObject, srcArrayIndex,
+                        elemSizeDef, numElements, nullptr)) {
         return false;
       }
     }
Loading diff…