From a311836b6152faf35a2a0638be2ce93e74939364 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9?= Date: Tue, 14 Jul 2026 13:07:16 +0100 Subject: [PATCH] deps: V8: cherry-pick 1158ae719749 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Original commit message: [wasm] Fix jump table slot overflow on x64 with CET enabled JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before checking if the target was reachable via a 32-bit displacement when CET was enabled. This caused a slot overflow when the far-jump fallback was triggered, as the second attempt to emit the slot would start at an incorrect offset. This CL ensures that the displacement check is performed before any instructions are emitted, making the function side-effect-free on failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify the displacement calculation, following the pattern used on ARM64. Reported-by: Fabien Romano TAG=agy R=jkummerow@chromium.org Fixed: 532112743 Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803 Reviewed-by: Jakob Kummerow Commit-Queue: Clemens Backes Cr-Commit-Position: refs/heads/main@{#108556} Refs: https://github.com/v8/v8/commit/1158ae71974987dc6492c7f407e8a7c005756ffc PR-URL: https://github.com/nodejs/node/pull/64432 Fixes: https://github.com/nodejs/node/issues/64424 Reviewed-By: Michaël Zasso Reviewed-By: Richard Lau --- common.gypi | 2 +- deps/v8/src/wasm/jump-table-assembler.cc | 10 +++++----- deps/v8/src/wasm/jump-table-assembler.h | 2 ++ 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/common.gypi b/common.gypi index c9ff09b4dc04ca..54ea02e991958c 100644 --- a/common.gypi +++ b/common.gypi @@ -40,7 +40,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.50', + 'v8_embedder_string': '-node.51', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/wasm/jump-table-assembler.cc b/deps/v8/src/wasm/jump-table-assembler.cc index 80b5511bc17c5e..64222d347ba26c 100644 --- a/deps/v8/src/wasm/jump-table-assembler.cc +++ b/deps/v8/src/wasm/jump-table-assembler.cc @@ -114,6 +114,10 @@ void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index, } bool JumpTableAssembler::EmitJumpSlot(Address target) { + intptr_t displacement = target - (pc_ + kJumpTableSlotEntryMarkerSize + + MacroAssembler::kIntraSegmentJmpInstrSize); + if (!is_int32(displacement)) return false; + #ifdef V8_ENABLE_CET_IBT uint32_t endbr_insn = 0xfa1e0ff3; uint32_t nop = 0x00401f0f; @@ -122,11 +126,7 @@ bool JumpTableAssembler::EmitJumpSlot(Address target) { emit(nop, kRelaxedStore); #endif - intptr_t displacement = - target - (pc_ + MacroAssembler::kIntraSegmentJmpInstrSize); - if (!is_int32(displacement)) return false; - - uint8_t inst[kJumpTableSlotSize] = { + uint8_t inst[8] = { 0xe9, 0, 0, 0, 0, // near_jmp displacement 0xcc, 0xcc, 0xcc, // int3 * 3 }; diff --git a/deps/v8/src/wasm/jump-table-assembler.h b/deps/v8/src/wasm/jump-table-assembler.h index a76fe76396328c..5bad728156be6f 100644 --- a/deps/v8/src/wasm/jump-table-assembler.h +++ b/deps/v8/src/wasm/jump-table-assembler.h @@ -184,8 +184,10 @@ class V8_EXPORT_PRIVATE JumpTableAssembler { #if V8_TARGET_ARCH_X64 #ifdef V8_ENABLE_CET_IBT static constexpr int kJumpTableSlotSize = 16; + static constexpr int kJumpTableSlotEntryMarkerSize = 8; #else // V8_ENABLE_CET_IBT static constexpr int kJumpTableSlotSize = 8; + static constexpr int kJumpTableSlotEntryMarkerSize = 0; #endif static constexpr int kJumpTableLineSize = kJumpTableSlotSize; static constexpr int kFarJumpTableSlotSize = 16;