From c58fda1f0ec46429dd66c2cacf6a98fac001e4fd Mon Sep 17 00:00:00 2001
From: Victor Gomes <victorgomes@chromium.org>
Date: Fri, 27 Jun 2025 12:40:10 +0200
Subject: [PATCH] [arm64] Ensure InstructionAccurateScope is called with correct count

The scope prevents veneer pool generation. We need to pass the
correct count of instructions to CheckVeneerPool inside the scope
constructor, otherwise we might overflow the veneer distance
margin in the next check (after the scope has ended).

Fixed: 425583995
Change-Id: Iebb81898c4f7999137fc784ce6704773614c2bb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6683635
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#101089}
---

diff --git a/src/codegen/arm64/macro-assembler-arm64.cc b/src/codegen/arm64/macro-assembler-arm64.cc
index 74b995e..59c9aa6 100644
--- a/src/codegen/arm64/macro-assembler-arm64.cc
+++ b/src/codegen/arm64/macro-assembler-arm64.cc
@@ -1301,7 +1301,7 @@
                                 const CPURegister& src2,
                                 const CPURegister& src3) {
   // Ensure that we don't unintentially modify scratch or debug registers.
-  InstructionAccurateScope scope(this);
+  InstructionAccurateScope scope(this, count <= 2 ? 1 : 2);
 
   DCHECK(AreSameSizeAndType(src0, src1, src2, src3));
   DCHECK(size == src0.SizeInBytes());
@@ -1338,7 +1338,7 @@
                                const CPURegister& dst1, const CPURegister& dst2,
                                const CPURegister& dst3) {
   // Ensure that we don't unintentially modify scratch or debug registers.
-  InstructionAccurateScope scope(this);
+  InstructionAccurateScope scope(this, count <= 2 ? 1 : 2);
 
   DCHECK(AreSameSizeAndType(dst0, dst1, dst2, dst3));
   DCHECK(size == dst0.SizeInBytes());
@@ -1388,8 +1388,14 @@
 
 void MacroAssembler::PushCalleeSavedRegisters() {
   ASM_CODE_COMMENT(this);
+#ifdef V8_ENABLE_CONTROL_FLOW_INTEGRITY
+  constexpr int kInstrCount = 11;
+#else
+  constexpr int kInstrCount = 10;
+#endif
+
   // Ensure that the macro-assembler doesn't use any scratch registers.
-  InstructionAccurateScope scope(this);
+  InstructionAccurateScope scope(this, kInstrCount);
 
   MemOperand tos(sp, -2 * static_cast<int>(kXRegSize), PreIndex);
 
@@ -1422,8 +1428,14 @@
 
 void MacroAssembler::PopCalleeSavedRegisters() {
   ASM_CODE_COMMENT(this);
+#ifdef V8_ENABLE_CONTROL_FLOW_INTEGRITY
+  constexpr int kInstrCount = 11;
+#else
+  constexpr int kInstrCount = 10;
+#endif
+
   // Ensure that the macro-assembler doesn't use any scratch registers.
-  InstructionAccurateScope scope(this);
+  InstructionAccurateScope scope(this, kInstrCount);
 
   MemOperand tos(sp, 2 * kXRegSize, PostIndex);
 
diff --git a/src/codegen/arm64/macro-assembler-arm64.h b/src/codegen/arm64/macro-assembler-arm64.h
index b9ca871..84cc32e 100644
--- a/src/codegen/arm64/macro-assembler-arm64.h
+++ b/src/codegen/arm64/macro-assembler-arm64.h
@@ -2494,7 +2494,7 @@
 // emitted is what you specified when creating the scope.
 class V8_NODISCARD InstructionAccurateScope {
  public:
-  explicit InstructionAccurateScope(MacroAssembler* masm, size_t count = 0)
+  explicit InstructionAccurateScope(MacroAssembler* masm, size_t count)
       : masm_(masm),
         block_pool_(masm, count * kInstrSize)
 #ifdef DEBUG
@@ -2502,12 +2502,11 @@
         size_(count * kInstrSize)
 #endif
   {
+    DCHECK_GT(count, 0);
     masm_->CheckVeneerPool(false, true, count * kInstrSize);
     masm_->StartBlockVeneerPool();
 #ifdef DEBUG
-    if (count != 0) {
-      masm_->bind(&start_);
-    }
+    masm_->bind(&start_);
     previous_allow_macro_instructions_ = masm_->allow_macro_instructions();
     masm_->set_allow_macro_instructions(false);
 #endif
@@ -2516,9 +2515,7 @@
   ~InstructionAccurateScope() {
     masm_->EndBlockVeneerPool();
 #ifdef DEBUG
-    if (start_.is_bound()) {
-      DCHECK(masm_->SizeOfCodeGeneratedSince(&start_) == size_);
-    }
+    DCHECK(masm_->SizeOfCodeGeneratedSince(&start_) == size_);
     masm_->set_allow_macro_instructions(previous_allow_macro_instructions_);
 #endif
   }
diff --git a/test/mjsunit/regress/regress-425583995.js b/test/mjsunit/regress/regress-425583995.js
new file mode 100644
index 0000000..eaed312c
--- /dev/null
+++ b/test/mjsunit/regress/regress-425583995.js
@@ -0,0 +1,33 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const topLevel = %GetFunctionForCurrentFrame();
+%PrepareFunctionForOptimization(topLevel);
+
+function g(
+  // Too many arguments to fit here manually and overflow int32 calculation
+) {
+  return arguments.length + 1;
+}
+
+var num_args = 40000; // large number to cause overflow
+
+// Construct argument list string
+var argsList = "";
+for (var i = 0; i < num_args; i++) argsList += "a" + i + ",";
+argsList = argsList.slice(0, -1);
+
+// Construct function source to return sum of all args
+var body = "return arguments.length + 1;";
+
+// Create large argument function dynamically
+var bigArgFunc = new Function(argsList, body);
+
+// Call many times to trigger OSR in v8 maglev
+for (var i = 0; i < 2; i++) {
+  bigArgFunc(0);
+  %OptimizeOsr();
+}

diff --git a/test/mjsunit/regress/regress-425583995.js b/test/mjsunit/regress/regress-425583995.js
new file mode 100644
index 0000000..eaed312c
--- /dev/null
+++ b/test/mjsunit/regress/regress-425583995.js
@@ -0,0 +1,33 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const topLevel = %GetFunctionForCurrentFrame();
+%PrepareFunctionForOptimization(topLevel);
+
+function g(
+  // Too many arguments to fit here manually and overflow int32 calculation
+) {
+  return arguments.length + 1;
+}
+
+var num_args = 40000; // large number to cause overflow
+
+// Construct argument list string
+var argsList = "";
+for (var i = 0; i < num_args; i++) argsList += "a" + i + ",";
+argsList = argsList.slice(0, -1);
+
+// Construct function source to return sum of all args
+var body = "return arguments.length + 1;";
+
+// Create large argument function dynamically
+var bigArgFunc = new Function(argsList, body);
+
+// Call many times to trigger OSR in v8 maglev
+for (var i = 0; i < 2; i++) {
+  bigArgFunc(0);
+  %OptimizeOsr();
+}