Skip to content

[v24.x backport] deps: V8: cherry-pick 1158ae719749#64498

Open
Renegade334 wants to merge 1 commit into
nodejs:v24.x-stagingfrom
Renegade334:v24.x-staging-64432
Open

[v24.x backport] deps: V8: cherry-pick 1158ae719749#64498
Renegade334 wants to merge 1 commit into
nodejs:v24.x-stagingfrom
Renegade334:v24.x-staging-64432

Conversation

@Renegade334

Copy link
Copy Markdown
Member

Backports #64432 to v24.x.

Original commit message:

[wasm] Fix jump table slot overflow on x64 with CET enabled

JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before
checking if the target was reachable via a 32-bit displacement when CET
was enabled. This caused a slot overflow when the far-jump fallback was
triggered, as the second attempt to emit the slot would start at an
incorrect offset.

This CL ensures that the displacement check is performed before any
instructions are emitted, making the function side-effect-free on
failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify
the displacement calculation, following the pattern used on ARM64.

Reported-by: Fabien Romano <fabienromano@gmail.com>

TAG=agy
R=jkummerow@chromium.org

Fixed: 532112743
Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108556}

Refs: v8/v8@1158ae7
PR-URL: #64432
Fixes: #64424
Reviewed-By: Michaël Zasso targos@protonmail.com
Reviewed-By: Richard Lau richard.lau@ibm.com

Original commit message:

    [wasm] Fix jump table slot overflow on x64 with CET enabled

    JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before
    checking if the target was reachable via a 32-bit displacement when CET
    was enabled. This caused a slot overflow when the far-jump fallback was
    triggered, as the second attempt to emit the slot would start at an
    incorrect offset.

    This CL ensures that the displacement check is performed before any
    instructions are emitted, making the function side-effect-free on
    failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify
    the displacement calculation, following the pattern used on ARM64.

    Reported-by: Fabien Romano <fabienromano@gmail.com>

    TAG=agy
    R=jkummerow@chromium.org

    Fixed: 532112743
    Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#108556}

Refs: v8/v8@1158ae7
PR-URL: nodejs#64432
Fixes: nodejs#64424
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/v8-update

@nodejs-github-bot nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. v8 engine Issues and PRs related to the V8 dependency. labels Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants