Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the JavaScript: WebAssembly component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2024248
Fix commit49c76e5ffdaf (firefox) +24/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • js/src/wasm/WasmBCClass.h
  • js/src/wasm/WasmBCFrame.cpp
  • js/src/wasm/WasmBaselineCompile.cpp
diff --git a/js/src/wasm/WasmBCClass.h b/js/src/wasm/WasmBCClass.h
index 2957c9054ae..e034384efae 100644
--- a/js/src/wasm/WasmBCClass.h
+++ b/js/src/wasm/WasmBCClass.h
@@ -961,6 +961,14 @@ struct BaseCompiler final {
   [[nodiscard]] bool createStackMap(
       Maybe<Trap> reason, HasDebugFrameWithLiveRefs debugFrameWithLiveRefs);
 
+  // Create a stackmap for the instruction described by `insnRange`, and note
+  // the presence of a ref-typed DebugFrame on the stack.  The stackmap will be
+  // keyed to `insnRange.resumeOffset()`.  Prefer this method over the above 3,
+  // which are regarded as "legacy" and should be phased out.
+  [[nodiscard]] bool createStackMap(
+      Maybe<Trap> reason, FaultingCodeRange insnRange,
+      HasDebugFrameWithLiveRefs debugFrameWithLiveRefs);
+
   // When compiling for debugging, creates a stack map for a non-resuming trap
   // instruction of kind `t1`, and, if specified, `t2`.  When not compiling for
   // debugging, no stackmap is generated.
diff --git a/js/src/wasm/WasmBCFrame.cpp b/js/src/wasm/WasmBCFrame.cpp
index 3f66eab1105..5c5352bd75c 100644
--- a/js/src/wasm/WasmBCFrame.cpp
+++ b/js/src/wasm/WasmBCFrame.cpp
@@ -167,6 +167,16 @@ bool BaseCompiler::createStackMap(
          (!stackMap || stackMaps_->add(masm.currentOffset(), stackMap));
 }
 
+bool BaseCompiler::createStackMap(
+    Maybe<Trap> reason, FaultingCodeRange insnRange,
+    HasDebugFrameWithLiveRefs debugFrameWithLiveRefs) {
+  const ExitStubMapVector noExtras;
+  StackMap* stackMap;
+  return stackMapGenerator_.createStackMap(
+             reason, noExtras, debugFrameWithLiveRefs, stk_, &stackMap) &&
+         (!stackMap || stackMaps_->add(insnRange.resumeOffset(), stackMap));
+}
+
 bool BaseCompiler::createDebugOnlyStackMapForNonResumingTrap(StackMap** result,
                                                              Trap t1, Trap t2) {
   // `t1`, and, if specified `t2`, definitely won't resume.
diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
index be07ff0b7b2..bf427915130 100644
--- a/js/src/wasm/WasmBaselineCompile.cpp
+++ b/js/src/wasm/WasmBaselineCompile.cpp
@@ -9214,6 +9214,12 @@ bool BaseCompiler::emitRefCast(bool nullable) {
     masm.appendAndVerify(wasm::Trap::BadCast,
                          wasm::TrapMachineInsnForLoadWord(), fcr,
                          trapSiteDesc());
+    // stackmap for: debug: emitRefCast
+    if (compilerEnv_.debugEnabled() &&
+        !createStackMap(Some(Trap::BadCast), fcr,
+                        HasDebugFrameWithLiveRefs::Maybe)) {
+      return false;
+    }
   }
   freeRegistersForBranchIfRefSubtype(regs);
 
Loading diff…