From ba053a6f100a02fbf24d3e0ab49b1871cb704483 Mon Sep 17 00:00:00 2001 From: Clemens Backes Date: Wed, 8 Jul 2026 12:23:37 +0200 Subject: [PATCH] deps: V8: cherry-pick 1158ae719749 Original commit message: [wasm] Fix jump table slot overflow on x64 with CET enabled JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before checking if the target was reachable via a 32-bit displacement when CET was enabled. This caused a slot overflow when the far-jump fallback was triggered, as the second attempt to emit the slot would start at an incorrect offset. This CL ensures that the displacement check is performed before any instructions are emitted, making the function side-effect-free on failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify the displacement calculation, following the pattern used on ARM64. Reported-by: Fabien Romano TAG=agy R=jkummerow@chromium.org Fixed: 532112743 Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803 Reviewed-by: Jakob Kummerow Commit-Queue: Clemens Backes Cr-Commit-Position: refs/heads/main@{#108556} Refs: https://github.com/v8/v8/commit/1158ae71974987dc6492c7f407e8a7c005756ffc --- common.gypi | 2 +- deps/v8/src/wasm/jump-table-assembler.cc | 10 +++++----- deps/v8/src/wasm/jump-table-assembler.h | 2 ++ 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/common.gypi b/common.gypi index 214615c3e085d9..8cf118455ec827 100644 --- a/common.gypi +++ b/common.gypi @@ -42,7 +42,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.25', + 'v8_embedder_string': '-node.26', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/wasm/jump-table-assembler.cc b/deps/v8/src/wasm/jump-table-assembler.cc index 47d21e29785be8..dfebd423c7c068 100644 --- a/deps/v8/src/wasm/jump-table-assembler.cc +++ b/deps/v8/src/wasm/jump-table-assembler.cc @@ -114,6 +114,10 @@ void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index, } bool JumpTableAssembler::EmitJumpSlot(Address target) { + intptr_t displacement = target - (pc_ + kJumpTableSlotEntryMarkerSize + + MacroAssembler::kIntraSegmentJmpInstrSize); + if (!is_int32(displacement)) return false; + #ifdef V8_ENABLE_CET_IBT uint32_t endbr_insn = 0xfa1e0ff3; uint32_t nop = 0x00401f0f; @@ -122,11 +126,7 @@ bool JumpTableAssembler::EmitJumpSlot(Address target) { emit(nop, kRelaxedStore); #endif - intptr_t displacement = - target - (pc_ + MacroAssembler::kIntraSegmentJmpInstrSize); - if (!is_int32(displacement)) return false; - - uint8_t inst[kJumpTableSlotSize] = { + uint8_t inst[8] = { 0xe9, 0, 0, 0, 0, // near_jmp displacement 0xcc, 0xcc, 0xcc, // int3 * 3 }; diff --git a/deps/v8/src/wasm/jump-table-assembler.h b/deps/v8/src/wasm/jump-table-assembler.h index 2024d74928136c..91252dc6e67c03 100644 --- a/deps/v8/src/wasm/jump-table-assembler.h +++ b/deps/v8/src/wasm/jump-table-assembler.h @@ -184,8 +184,10 @@ class V8_EXPORT_PRIVATE JumpTableAssembler { #if V8_TARGET_ARCH_X64 #ifdef V8_ENABLE_CET_IBT static constexpr int kJumpTableSlotSize = 16; + static constexpr int kJumpTableSlotEntryMarkerSize = 8; #else // V8_ENABLE_CET_IBT static constexpr int kJumpTableSlotSize = 8; + static constexpr int kJumpTableSlotEntryMarkerSize = 0; #endif static constexpr int kJumpTableLineSize = kJumpTableSlotSize; static constexpr int kFarJumpTableSlotSize = 16;