JSC: JSValue use-after-free in ValueProfiles Related CVE Numbers: CVE-2019-8672. While fuzzing JSC, I encountered the following JS program which crashes JSC from current HEAD and release (/System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc): \t// Run with --useConcurrentJIT=false --thresholdForJITAfterWarmUp=10 \tfunction fullGC() { \t\tfor (var i = 0; i < 10; i++) { \t\t\tnew Float64Array(0x1000000); \t\t} \t} \tfunction v62() { \t\tfunction v141() { \t\t\ttry { \t\t\t\tconst v146 = v141(); \t\t\t} catch(v147) { \t\t\t\tconst v154 = Object(); \t\t\t\tfunction v155(v156,v157,v158) { \t\t\t\t\ttry { \t\t\t\t\t\t// This typed array gets collected \t\t\t\t\t\t// but is still referenced from the \t\t\t\t\t\t// value profile of TypedArray.values \t\t\t\t\t\tconst v167 = new Uint32Array(); \t\t\t\t\t\tconst v171 = v167.values(); \t\t\t\t\t} catch(v177) { \t\t\t\t\t} \t\t\t\t} \t\t\t\tconst v181 = v155(); \t\t\t} \t\t} \t\tv141(); \t\tfunction edenGC() { \t\t\tfor (let v194 = 0; v194 < 100; v194++) { \t\t\t\tconst v204 = new Float64Array(0x10000); \t\t\t} \t\t} \t\tconst v205 = edenGC(); \t} \tfor (let i = 0; i < 6; i++) { \t\tconst v209 = v62(); \t} \tfullGC(); If the loop that calls v62 is run 100 instead of 6 times it will also crash without --thresholdForJITAfterWarmUp=10, albeit a bit less reliable. Running this sample will crash JSC in debug builds with an assertion like this: \tASSERTION FAILED: structureIndex < m_capacity \tSource/JavaScriptCore/runtime/StructureIDTable.h(175) : JSC::Structure *JSC::StructureIDTable::get(JSC::StructureID) \t1 0x101aadcf9 WTFCrash \t2 0x101aadd19 WTFCrashWithSecurityImplication \t3 0x10000cb18 JSC::StructureIDTable::get(unsigned int) \t4 0x10000ca23 JSC::VM::getStructure(unsigned int) \t5 0x10000c7cf JSC::JSCell::structure(JSC::VM&) const \t6 0x10001887b JSC::JSCell::structure() const \t7 0x10072fc05 JSC::speculationFromCell(JSC::JSCell*) \t8 0x10072fd9f JSC::speculationFromValue(JSC::JSValue) \t9 0x1006963dc JSC::ValueProfileBase<1u>::computeUpdatedPrediction(JSC::ConcurrentJSLocker const&) ... The crash is due to a JSValue pointing to a previously freed chunk which will have its JSCell header overwritten. As such, it then crashes when accessing the structure table out-of-bounds with the clobbered structure ID. The JSValue that is being accessed is part of a ValueProfile: a data structure attached to bytecode operations which keeps track of input types that have been observed for its operation. During execution in the interpreter or baseline JIT, input types for operations will be stored in their associated ValueProfile as can e.g. be seen in the implementation of the low-level interpreter (LLInt) [1]. This is a fundamental mechanism of current JS engines allowing optimizing JIT compilers (like the DFG and FTL) to speculate about types of variables in the compiled program by inspecting previously observed types collected in these ValueProfiles. A ValueProfile is implemented by the ValueProfileBase C++ struct: struct ValueProfileBase { ... int m_bytecodeOffset; // -1 for prologue unsigned m_numberOfSamplesInPrediction { 0 }; SpeculatedType m_prediction { SpecNone }; EncodedJSValue m_buckets[totalNumberOfBuckets]; }; Here, m_buckets will store the raw JSValues that have been observed during execution. m_prediction in turn will contain the current type prediction [2] for the associated value, which is what the JIT compilers ultimately rely on. The type prediction is regularly computed from the observed values in computeUpdatedPrediction [3]. This raises the question how the JSValues in m_buckets are kept alive during GC, as they are not stored in a MarkedArgumentBuffer [4] or similar (which automatically inform the GC of the objects and thus keep them alive). The answer is that they are in fact not kept alive during GC by the ValueProfiles themselves. Instead, computeUpdatedPrediction [3] is invoked from finalizeUnconditionally [5] at the end of the GC marking phase and will clear the m_buckets array before the pointers might become dangling. Basically, it works like this: * Observed JSValues are simply stored into ValueProfiles at runtime by the interpreter or baseline JIT without informing the GC about these references * Eventually, GC kicks in and starts its marking phase in which it visits all reachable objects and marks them as alive * Afterwards, before sweeping, the GC invokes various callbacks (called \"unconditionalFinalizers\") [6] on certain objects (e.g. CodeBlocks) * The CodeBlock finalizers update all value profiles, which in turn causes their current speculated type to be merged with the runtime values that were observed since the last update * Afterwards, all entries in the m_buckets array of the ValueProfiles are cleared to zero [7]. As such, the ValueProfiles no longer store any pointers to JSObjects * Finally, the sweeping phase runs and frees all JSCells that have not been marked For some time now, JSC has used lightweight GC cycles called \"eden\" collections. These will keep mark bits from previous eden collections and thus only scan newly allocated objects, not the entire object graph. As such they are quicker than a \"full\" GC, but might potentially leave unused (\"garbage\") objects alive which will only be collected during the next full collection. See also [8] for an in depth explanation of JSC's current garbage collector. As described above, the function finalizeMarkedUnconditionalFinalizers [6] is responsible for invoking some callback on objects that have been marked (and thus are alive) after the marking phase. However, during eden collections this function only iterates over JSCells that have been marked in the *current* eden collection, not any of the previous ones *. As such, it is possible that a CodeBlock has been marked in a previous eden collection (and is thus still alive), but hasn't been marked in the current one and will thus not be \"unconditionally finalized\". In that case, its ValueProfile will not be cleared and will still potentially contain pointers to various JSObjects, which, however, aren't protected from GC and thus might be freed by it. This is what happens in the program above: the TypedArray.values function is a JS builtin [9] and will thus be JIT compiled. At the time of the crash it will be baseline JIT compiled and thus store the newly allocated Uint32Array into one of its ValueProfile [10]. Directly afterwards, the compiled code raises another stack overflow exception [11]. As such, the Uint32Array is not used any further and no more references to it are taken which could protect it from GC. As such, the array will be collected during the next (eden) GC round. However, the CodeBlock for TypedArray.values was already marked in a previous eden collection and will not be finalized, thus leaving the pointer to the freed TypedArray dangling in the ValueProfile. During the next full GC, the CodeBlock is again \"unconditionally finalized\" and will then inspects its m_buckets, thus crashing when using the freed JSValue. The infinite recursion and following stack overflow exceptions in this sample might be necessary to force a situation in which the newly allocated Uint32Array is only stored into a profiling slot and nowhere else. But maybe they are also simply required to cause the right sequence of GC invocations. This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public. * This can be seen in the implementation of IsoCellSet::forEachMarkedCell which in addition to the mark bit checks if the JSCell is also in the current bit set of the IsoCell [12], into which CodeBlocks are put when they are visited [13] during marking, but are then removed from it during finalization [14] after marking completes [1] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm#L76 [2] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/bytecode/SpeculatedType.h#L40 [3] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/bytecode/ValueProfile.h#L129 [4] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/runtime/ArgList.h#L31 [5] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/bytecode/CodeBlock.cpp#L1357 [6] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/heap/Heap.cpp#L1504 [7] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/bytecode/ValueProfile.h#L139 [8] https://webkit.org/blog/7122/introducing-riptide-webkits-retreating-wavefront-concurrent-garbage-collector/ [9] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/builtins/TypedArrayPrototype.js#L71 [10] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/jit/JIT.cpp#L699 [11] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/jit/JIT.cpp#L710 [12] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/heap/IsoCellSetInlines.h#L74 [13] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/bytecode/CodeBlock.cpp#L978 [14] https://github.com/WebKit/webkit/blob/5dfe4ae818eba9866d5979035b72c482c16cbd6b/Source/JavaScriptCore/bytecode/CodeBlock.cpp#L1378 Found by: saelo@google.com