From f294033a41c8aaa3f8bd2532fbaeda0abaf0d1fe Mon Sep 17 00:00:00 2001 From: Barath Date: Wed, 14 Oct 2026 17:54:54 +0530 Subject: [PATCH] deps: V8: cherry-pick c21a93ec80d5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Original commit message: [sandbox] Fix JSDispatchTable entry mark-bit erasure A race condition exists in V8's concurrent marking and deoptimization logic where Code::SetMarkedForDeoptimization updates a dispatch table entry without running a write barrier. During concurrent marking, a background thread's CAS mark can be overwritten by the mutator's blind store, leading to a live entry being swept. Fixed: 525686865 Change-Id: I0cebd44b62ad5c16c19d73e5586058b1d2265ee4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8074259 Commit-Queue: Olivier Flückiger Reviewed-by: Dominik Inführ Auto-Submit: Olivier Flückiger Cr-Commit-Position: refs/heads/main@{#108583} Refs: https://github.com/v8/v8/commit/c21a93ec80d526fd270b119a2e8b7e26623d1b3b Signed-off-by: Barath --- common.gypi | 2 +- deps/v8/src/objects/code.cc | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/common.gypi b/common.gypi index 39229ef58787..2967d1e63a48 100644 --- a/common.gypi +++ b/common.gypi @@ -44,7 +44,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.39', + 'v8_embedder_string': '-node.40', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/objects/code.cc b/deps/v8/src/objects/code.cc index ddc928254e83..a035b69aeb52 100644 --- a/deps/v8/src/objects/code.cc +++ b/deps/v8/src/objects/code.cc @@ -226,6 +226,10 @@ void Code::SetMarkedForDeoptimization(Isolate* isolate, } else { jdt.SetCodeNoWriteBarrier(handle, *BUILTIN_CODE(isolate, CompileLazy)); } + // TODO(olivf, 525686865): Fix the race in dispatch handle marking by + // going back to a CAS loop. + static_assert(JSDispatchTable::kWriteBarrierSetsEntryMarkBit); + jdt.Mark(handle); } // Ensure we don't try to patch the entry multiple times. set_js_dispatch_handle(kNullJSDispatchHandle);