deps: V8: cherry-pick 1158ae719749

Original commit message:
[wasm] Fix jump table slot overflow on x64 with CET enabled
JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before
checking if the target was reachable via a 32-bit displacement when CET
was enabled. This caused a slot overflow when the far-jump fallback was
triggered, as the second attempt to emit the slot would start at an
incorrect offset.
This CL ensures that the displacement check is performed before any
instructions are emitted, making the function side-effect-free on
failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify
the displacement calculation, following the pattern used on ARM64.
Reported-by: Fabien Romano <fabienromano@gmail.com>
TAG=agy
R=jkummerow@chromium.org
Fixed: 532112743
Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108556}
Refs: v8/v8@1158ae7
PR-URL: #64432Fixes: #64424
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

Author: Renegade334

common.gypi

@@ -41,7 +41,7 @@
 
 # Reset this number to 0 on major V8 upgrades.
 # Increment by one for each non-official patch applied to deps/v8.
-'v8_embedder_string': '-node.25',
+'v8_embedder_string': '-node.26',
 
 ##### V8 defaults for Node.js #####
 

deps/v8/src/wasm/jump-table-assembler.cc

@@ -114,6 +114,10 @@ void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
 }
 
 boolJumpTableAssembler::EmitJumpSlot(Address target) {
+intptr_t displacement = target - (pc_ + kJumpTableSlotEntryMarkerSize +
+ MacroAssembler::kIntraSegmentJmpInstrSize);
+if (!is_int32(displacement)) returnfalse;
+
 #ifdef V8_ENABLE_CET_IBT
 uint32_t endbr_insn = 0xfa1e0ff3;
 uint32_t nop = 0x00401f0f;
@@ -122,11 +126,7 @@ bool JumpTableAssembler::EmitJumpSlot(Address target) {
  emit<uint32_t>(nop, kRelaxedStore);
 #endif
 
-intptr_t displacement =
- target - (pc_ + MacroAssembler::kIntraSegmentJmpInstrSize);
-if (!is_int32(displacement)) returnfalse;
-
-uint8_t inst[kJumpTableSlotSize] = {
+uint8_t inst[8] = {
 0xe9, 0, 0, 0, 0, // near_jmp displacement
 0xcc, 0xcc, 0xcc, // int3 * 3
  };

deps/v8/src/wasm/jump-table-assembler.h

@@ -184,8 +184,10 @@ class V8_EXPORT_PRIVATE JumpTableAssembler {
 #if V8_TARGET_ARCH_X64
 #ifdef V8_ENABLE_CET_IBT
 staticconstexprintkJumpTableSlotSize = 16;
+staticconstexprintkJumpTableSlotEntryMarkerSize = 8;
 #else// V8_ENABLE_CET_IBT
 staticconstexprintkJumpTableSlotSize = 8;
+staticconstexprintkJumpTableSlotEntryMarkerSize = 0;
 #endif
 staticconstexprintkJumpTableLineSize = kJumpTableSlotSize;
 staticconstexprintkFarJumpTableSlotSize = 16;