Skip to content

Commit fb0d0ca

Browse files
ruangustavorichardlau
ruangustavo
authored and
richardlau
committed
deps: V8: backport 0b94a9fd23ba
Original commit message: [leaptiering] Fix BaselineOutOfLinePrologue builtin ... which tried to preserve kJavaScriptCallDispatchHandleRegister even on configurations where it's not used which resulted in a random value on the stack discoverable by GC. This issue triggered only on non-sandbox configuration with enabled leaptiering. Drive-by: fix MacroAssembler::GenerateTailCallToReturnedCode() on riscv port which wasn't preserving dispatch handle as all the other ports do. Bug: 42204201 Fixed: 413769394 Change-Id: If146b0b7a6cf972ed5a881142f40980774f19cba Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6587010 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#100512} Node.js 24 builds V8 with leaptiering enabled and the sandbox disabled, so V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE is not defined and the JS calling convention does not carry the dispatch handle register (x4 on arm64). BaselineOutOfLinePrologue and GenerateTailCallToReturnedCode still pushed that register as a tagged slot of an INTERNAL frame, so whatever value the caller left there is dereferenced by ClearStaleLeftTrimmedPointerVisitor during mark-compact root scanning and crashes the process with SIGSEGV (seen as jest workers dying). Refs: v8/v8@0b94a9f Fixes: #62393 PR-URL: #65753 Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 13987f4 commit fb0d0ca

11 files changed

Lines changed: 47 additions & 24 deletions

File tree

‎common.gypi‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242

4343
# Reset this number to 0 on major V8 upgrades.
4444
# Increment by one for each non-official patch applied to deps/v8.
45-
'v8_embedder_string': '-node.53',
45+
'v8_embedder_string': '-node.54',
4646

4747
##### V8 defaults for Node.js #####
4848

‎deps/v8/src/builtins/arm64/builtins-arm64.cc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1293,11 +1293,12 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
12931293

12941294
FrameScope frame_scope(masm, StackFrame::INTERNAL);
12951295
// Save incoming new target or generator
1296-
Register maybe_dispatch_handle = V8_ENABLE_LEAPTIERING_BOOL
1296+
Register maybe_dispatch_handle = V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE_BOOL
12971297
? kJavaScriptCallDispatchHandleRegister
12981298
: padreg;
12991299
// No need to SmiTag as dispatch handles always look like Smis.
13001300
static_assert(kJSDispatchHandleShift > 0);
1301+
__ AssertSmi(maybe_dispatch_handle);
13011302
__ Push(maybe_dispatch_handle, new_target);
13021303
__ SmiTag(frame_size);
13031304
__ PushArgument(frame_size);

‎deps/v8/src/builtins/loong64/builtins-loong64.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1103,15 +1103,16 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
11031103
FrameScope frame_scope(masm, StackFrame::INTERNAL);
11041104
// Save incoming new target or generator
11051105
__ Push(kJavaScriptCallNewTargetRegister);
1106-
#ifdef V8_ENABLE_LEAPTIERING
1106+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
11071107
// No need to SmiTag as dispatch handles always look like Smis.
11081108
static_assert(kJSDispatchHandleShift > 0);
1109+
__ AssertSmi(kJavaScriptCallDispatchHandleRegister);
11091110
__ Push(kJavaScriptCallDispatchHandleRegister);
11101111
#endif
11111112
__ SmiTag(frame_size);
11121113
__ Push(frame_size);
11131114
__ CallRuntime(Runtime::kStackGuardWithGap);
1114-
#ifdef V8_ENABLE_LEAPTIERING
1115+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
11151116
__ Pop(kJavaScriptCallDispatchHandleRegister);
11161117
#endif
11171118
__ Pop(kJavaScriptCallNewTargetRegister);

‎deps/v8/src/builtins/mips64/builtins-mips64.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1065,15 +1065,16 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
10651065
FrameScope frame_scope(masm, StackFrame::INTERNAL);
10661066
// Save incoming new target or generator
10671067
__ Push(kJavaScriptCallNewTargetRegister);
1068-
#ifdef V8_ENABLE_LEAPTIERING
1068+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
10691069
// No need to SmiTag as dispatch handles always look like Smis.
10701070
static_assert(kJSDispatchHandleShift > 0);
1071+
__ AssertSmi(kJavaScriptCallDispatchHandleRegister);
10711072
__ Push(kJavaScriptCallDispatchHandleRegister);
10721073
#endif
10731074
__ SmiTag(frame_size);
10741075
__ Push(frame_size);
10751076
__ CallRuntime(Runtime::kStackGuardWithGap);
1076-
#ifdef V8_ENABLE_LEAPTIERING
1077+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
10771078
__ Pop(kJavaScriptCallDispatchHandleRegister);
10781079
#endif
10791080
__ Pop(kJavaScriptCallNewTargetRegister);

‎deps/v8/src/builtins/riscv/builtins-riscv.cc‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1099,15 +1099,18 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
10991099
FrameScope frame_scope(masm, StackFrame::INTERNAL);
11001100
// Save incoming new target or generator
11011101
__ Push(kJavaScriptCallNewTargetRegister);
1102-
#if defined(V8_ENABLE_LEAPTIERING) && defined(V8_TARGET_ARCH_RISCV64)
1102+
#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
1103+
defined(V8_TARGET_ARCH_RISCV64)
11031104
// No need to SmiTag as dispatch handles always look like Smis.
11041105
static_assert(kJSDispatchHandleShift > 0);
1106+
__ AssertSmi(kJavaScriptCallDispatchHandleRegister);
11051107
__ Push(kJavaScriptCallDispatchHandleRegister);
11061108
#endif
11071109
__ SmiTag(frame_size);
11081110
__ Push(frame_size);
11091111
__ CallRuntime(Runtime::kStackGuardWithGap);
1110-
#if defined(V8_ENABLE_LEAPTIERING) && defined(V8_TARGET_ARCH_RISCV64)
1112+
#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
1113+
defined(V8_TARGET_ARCH_RISCV64)
11111114
__ Pop(kJavaScriptCallDispatchHandleRegister);
11121115
#endif
11131116
__ Pop(kJavaScriptCallNewTargetRegister);

‎deps/v8/src/builtins/x64/builtins-x64.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2018,15 +2018,16 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
20182018
FrameScope inner_frame_scope(masm, StackFrame::INTERNAL);
20192019
// Save incoming new target or generator
20202020
__ Push(new_target);
2021-
#ifdef V8_ENABLE_LEAPTIERING
2021+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
20222022
// No need to SmiTag as dispatch handles always look like Smis.
20232023
static_assert(kJSDispatchHandleShift > 0);
2024+
__ AssertSmi(kJavaScriptCallDispatchHandleRegister);
20242025
__ Push(kJavaScriptCallDispatchHandleRegister);
20252026
#endif
20262027
__ SmiTag(frame_size);
20272028
__ Push(frame_size);
20282029
__ CallRuntime(Runtime::kStackGuardWithGap, 1);
2029-
#ifdef V8_ENABLE_LEAPTIERING
2030+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
20302031
__ Pop(kJavaScriptCallDispatchHandleRegister);
20312032
#endif
20322033
__ Pop(new_target);

‎deps/v8/src/codegen/arm64/macro-assembler-arm64.cc‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1518,14 +1518,15 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
15181518
FrameScope scope(this, StackFrame::INTERNAL);
15191519
// Push a copy of the target function, the new target, the actual
15201520
// argument count, and the dispatch handle.
1521-
Register lastreg = V8_ENABLE_LEAPTIERING_BOOL
1522-
? kJavaScriptCallDispatchHandleRegister
1523-
: padreg;
1521+
Register maybe_dispatch_handle = V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE_BOOL
1522+
? kJavaScriptCallDispatchHandleRegister
1523+
: padreg;
15241524
SmiTag(kJavaScriptCallArgCountRegister);
15251525
// No need to SmiTag the dispatch handle as it always looks like a Smi.
15261526
static_assert(kJSDispatchHandleShift > 0);
1527+
AssertSmi(maybe_dispatch_handle);
15271528
Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
1528-
kJavaScriptCallArgCountRegister, lastreg);
1529+
kJavaScriptCallArgCountRegister, maybe_dispatch_handle);
15291530
// Push another copy as a parameter to the runtime call.
15301531
PushArgument(kJavaScriptCallTargetRegister);
15311532

@@ -1534,7 +1535,7 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
15341535

15351536
// Restore target function, new target, actual argument count, and dispatch
15361537
// handle.
1537-
Pop(lastreg, kJavaScriptCallArgCountRegister,
1538+
Pop(maybe_dispatch_handle, kJavaScriptCallArgCountRegister,
15381539
kJavaScriptCallNewTargetRegister, kJavaScriptCallTargetRegister);
15391540
SmiUntag(kJavaScriptCallArgCountRegister);
15401541
}

‎deps/v8/src/codegen/loong64/macro-assembler-loong64.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5113,9 +5113,10 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
51135113
SmiTag(kJavaScriptCallArgCountRegister);
51145114
Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
51155115
kJavaScriptCallArgCountRegister);
5116-
#ifdef V8_ENABLE_LEAPTIERING
5116+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
51175117
// No need to SmiTag since dispatch handles always look like Smis.
51185118
static_assert(kJSDispatchHandleShift > 0);
5119+
AssertSmi(kJavaScriptCallDispatchHandleRegister);
51195120
Push(kJavaScriptCallDispatchHandleRegister);
51205121
#endif
51215122
// Function is also the parameter to the runtime call.
@@ -5126,7 +5127,7 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
51265127

51275128
// Restore target function, new target, actual argument count and dispatch
51285129
// handle.
5129-
#ifdef V8_ENABLE_LEAPTIERING
5130+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
51305131
Pop(kJavaScriptCallDispatchHandleRegister);
51315132
#endif
51325133
Pop(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,

‎deps/v8/src/codegen/mips64/macro-assembler-mips64.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6578,16 +6578,17 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
65786578
SmiTag(kJavaScriptCallArgCountRegister);
65796579
Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
65806580
kJavaScriptCallArgCountRegister);
6581-
#ifdef V8_ENABLE_LEAPTIERING
6581+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
65826582
// No need to SmiTag since dispatch handles always look like Smis.
65836583
static_assert(kJSDispatchHandleShift > 0);
6584+
AssertSmi(kJavaScriptCallDispatchHandleRegister);
65846585
Push(kJavaScriptCallDispatchHandleRegister);
65856586
#endif
65866587
// Function is also the parameter to the runtime call.
65876588
Push(kJavaScriptCallTargetRegister);
65886589
CallRuntime(function_id, 1);
65896590
// Restore target function, new target and actual argument count.
6590-
#ifdef V8_ENABLE_LEAPTIERING
6591+
#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
65916592
Pop(kJavaScriptCallDispatchHandleRegister);
65926593
#endif
65936594
Pop(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,

‎deps/v8/src/codegen/riscv/macro-assembler-riscv.cc‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -186,22 +186,34 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
186186
// -- a0 : actual argument count
187187
// -- a1 : target function (preserved for callee)
188188
// -- a3 : new target (preserved for callee)
189+
// -- a4 : dispatch handle (preserved for callee)
189190
// -----------------------------------
190191
{
191192
FrameScope scope(this, StackFrame::INTERNAL);
192-
// Push a copy of the target function, the new target and the actual
193-
// argument count.
193+
// Push a copy of the target function, the new target, the actual
194+
// argument count, and the dispatch handle.
194195
// Push function as parameter to the runtime call.
195196
SmiTag(kJavaScriptCallArgCountRegister);
197+
#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
198+
defined(V8_TARGET_ARCH_RISCV64)
199+
// No need to SmiTag as dispatch handles always look like Smis.
200+
static_assert(kJSDispatchHandleShift > 0);
201+
AssertSmi(kJavaScriptCallDispatchHandleRegister);
202+
Push(kJavaScriptCallDispatchHandleRegister);
203+
#endif
196204
Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
197-
kJavaScriptCallArgCountRegister, kJavaScriptCallTargetRegister);
205+
kJavaScriptCallArgCountRegister);
198206

199207
CallRuntime(function_id, 1);
200208
// Use the return value before restoring a0
201209
LoadCodeInstructionStart(a2, a0, kJSEntrypointTag);
202210
// Restore target function, new target and actual argument count.
203211
Pop(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
204212
kJavaScriptCallArgCountRegister);
213+
#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
214+
defined(V8_TARGET_ARCH_RISCV64)
215+
Pop(kJavaScriptCallDispatchHandleRegister);
216+
#endif
205217
SmiUntag(kJavaScriptCallArgCountRegister);
206218
}
207219

0 commit comments

Comments
 (0)