Commit 59f4318
deps: V8: cherry-pick 1158ae719749
Original commit message:
[wasm] Fix jump table slot overflow on x64 with CET enabled
JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before
checking if the target was reachable via a 32-bit displacement when CET
was enabled. This caused a slot overflow when the far-jump fallback was
triggered, as the second attempt to emit the slot would start at an
incorrect offset.
This CL ensures that the displacement check is performed before any
instructions are emitted, making the function side-effect-free on
failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify
the displacement calculation, following the pattern used on ARM64.
Reported-by: Fabien Romano <fabienromano@gmail.com>
TAG=agy
R=jkummerow@chromium.org
Fixed: 532112743
Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108556}
Refs: v8/v8@1158ae7
PR-URL: #64432
Fixes: #64424
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>1 parent 21389f7 commit 59f4318
3 files changed
Lines changed: 8 additions & 6 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -41,7 +41,7 @@ | |||
| 41 | 41 | ||
| 42 | 42 | # Reset this number to 0 on major V8 upgrades. | |
| 43 | 43 | # Increment by one for each non-official patch applied to deps/v8. | |
| 44 | - 'v8_embedder_string': '-node.25', | ||
| 44 | + 'v8_embedder_string': '-node.26', | ||
| 45 | 45 | ||
| 46 | 46 | ##### V8 defaults for Node.js ##### | |
| 47 | 47 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -114,6 +114,10 @@ void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index, | |||
| 114 | 114 | } | |
| 115 | 115 | ||
| 116 | 116 | bool JumpTableAssembler::EmitJumpSlot(Address target) { | |
| 117 | + intptr_t displacement = target - (pc_ + kJumpTableSlotEntryMarkerSize + | ||
| 118 | + MacroAssembler::kIntraSegmentJmpInstrSize); | ||
| 119 | + if (!is_int32(displacement)) return false; | ||
| 120 | + | ||
| 117 | 121 | #ifdef V8_ENABLE_CET_IBT | |
| 118 | 122 | uint32_t endbr_insn = 0xfa1e0ff3; | |
| 119 | 123 | uint32_t nop = 0x00401f0f; | |
@@ -122,11 +126,7 @@ bool JumpTableAssembler::EmitJumpSlot(Address target) { | |||
| 122 | 126 | emit<uint32_t>(nop, kRelaxedStore); | |
| 123 | 127 | #endif | |
| 124 | 128 | ||
| 125 | - intptr_t displacement = | ||
| 126 | - target - (pc_ + MacroAssembler::kIntraSegmentJmpInstrSize); | ||
| 127 | - if (!is_int32(displacement)) return false; | ||
| 128 | - | ||
| 129 | - uint8_t inst[kJumpTableSlotSize] = { | ||
| 129 | + uint8_t inst[8] = { | ||
| 130 | 130 | 0xe9, 0, 0, 0, 0, // near_jmp displacement | |
| 131 | 131 | 0xcc, 0xcc, 0xcc, // int3 * 3 | |
| 132 | 132 | }; | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -184,8 +184,10 @@ class V8_EXPORT_PRIVATE JumpTableAssembler { | |||
| 184 | 184 | #if V8_TARGET_ARCH_X64 | |
| 185 | 185 | #ifdef V8_ENABLE_CET_IBT | |
| 186 | 186 | static constexpr int kJumpTableSlotSize = 16; | |
| 187 | + static constexpr int kJumpTableSlotEntryMarkerSize = 8; | ||
| 187 | 188 | #else // V8_ENABLE_CET_IBT | |
| 188 | 189 | static constexpr int kJumpTableSlotSize = 8; | |
| 190 | + static constexpr int kJumpTableSlotEntryMarkerSize = 0; | ||
| 189 | 191 | #endif | |
| 190 | 192 | static constexpr int kJumpTableLineSize = kJumpTableSlotSize; | |
| 191 | 193 | static constexpr int kFarJumpTableSlotSize = 16; | |
0 commit comments