Wasm canonical types

V8 deduplicates structurally equivalent WebAssembly types into a global registry so that two modules declaring the “same” type share one CanonicalTypeIndex, letting the engine treat their values as interchangeable.

`CanonicalStructType`

the canonicalized representation of a Wasm struct, holding the list of its field value types (fields()) and a parallel list of per-field mutability flags (mutabilities()).

Field mutability

a boolean per struct field distinguishing an immutable field from a mutable one, which governs whether struct.set is permitted and is part of a field’s subtyping/identity semantics.

Type confusion

treating a value of one type as if it were an unrelated type, which in V8 lets an attacker forge object layouts and bypass memory-safety invariants.

1. Declare colliding struct types Craft a Wasm module defining two struct types with identical field value types but different mutability on at least one field (immutable vs. mutable).
2. Trigger canonicalization Instantiate the module so V8 registers the types through CanonicalEquality::EqualStructType, which erroneously assigns both structs the same CanonicalTypeIndex.
3. Alias across the confusion Use the shared canonical index to pass or store an object of the immutable-field type where the mutable-field type is expected (or vice versa), which the verifier now accepts as the same type.
4. Perform an illegal mutation Execute a struct.set (or exploit relaxed subtyping) that mutates a field the true type declared immutable, corrupting an invariant the engine relied on.
5. Escalate to memory corruption Leverage the resulting type confusion to forge object contents or pointers, achieving out-of-bounds access and controlled read/write inside the renderer.

• src/wasm/canonical-types.h

• Incomplete structural equality
  Review every canonical-type comparison (EqualArrayType, function/signature equality, recursive-group hashing) to confirm each checks the full set of identity-bearing attributes, not just the obvious ones.
• Type-property parity with hashing
  Ensure any hash function used to bucket canonical types incorporates the same fields (including mutability) as the equality predicate, since a mismatch reintroduces collisions.
• Mutability-sensitive invariants
  Hunt for other places that key subtyping, deduplication, or caching on field/element types while dropping mutability or nullability, especially in Wasm GC struct/array handling.

Arbitrary Wasm type confusion due to missing struct field mutability check on canonicalization

    bool EqualStructType(const CanonicalStructType& type1,
                         const CanonicalStructType& type2) const {
      return std::equal(
          type1.fields().begin(), type1.fields().end(), type2.fields().begin(),
          type2.fields().end(),
          std::bind_front(&CanonicalEquality::EqualValueType, this));
    }