From f2586e39cf4d2b288e7cd67194b3d5984e31133a Mon Sep 17 00:00:00 2001
From: Jakob Kummerow <jkummerow@chromium.org>
Date: Wed, 16 Sep 2026 17:55:28 +0200
Subject: [PATCH] [wasm] Fix safepoints in huge-frame stack check

For very large frames, we stack for check overflow before
writing into the frame, which means any tagged slots in the
frame are still uninitialized and not safe for GC visitation.
So the safepoint for the error case of the huge-frame stack check
should not indicate any tagged slots.

Fixed: 561660149
Change-Id: Ifd6c30de820df0d521a2d7883a064d3a6439e7f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8418288
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#109883}
---
diff --git a/src/compiler/backend/arm/code-generator-arm.cc b/src/compiler/backend/arm/code-generator-arm.cc
index 95ddaad..bb60c45 100644
--- a/src/compiler/backend/arm/code-generator-arm.cc
+++ b/src/compiler/backend/arm/code-generator-arm.cc
@@ -327,8 +327,7 @@
     // Just encode the stub index. This will be patched when the code
     // is added to the native module and copied into wasm code space.
     __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
-    ReferenceMap* reference_map = gen_->zone()->New<ReferenceMap>(gen_->zone());
-    gen_->RecordSafepoint(reference_map);
+    gen_->RecordSafepointWithoutTaggedSlots();
     if (v8_flags.debug_code) {
       __ stop();
     }
@@ -4036,8 +4035,7 @@
         // return in this case.
         // So either way, we can just ignore any references and record an empty
         // safepoint here.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         __ vldm(ia_w, sp, fp_regs_to_save.first(), fp_regs_to_save.last());
         __ ldm(ia_w, sp, regs_to_save);
       } else {
@@ -4045,8 +4043,7 @@
                 RelocInfo::WASM_STUB_CALL);
         // The call does not return, hence we can ignore any references and just
         // define an empty safepoint.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         if (v8_flags.debug_code) __ stop();
       }
 
diff --git a/src/compiler/backend/arm64/code-generator-arm64.cc b/src/compiler/backend/arm64/code-generator-arm64.cc
index 44fb16a..0a3fc03 100644
--- a/src/compiler/backend/arm64/code-generator-arm64.cc
+++ b/src/compiler/backend/arm64/code-generator-arm64.cc
@@ -552,8 +552,7 @@
   void GenerateCallToTrap(TrapId trap_id) {
     gen_->AssembleSourcePosition(instr_);
     __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
-    ReferenceMap* reference_map = gen_->zone()->New<ReferenceMap>(gen_->zone());
-    gen_->RecordSafepoint(reference_map);
+    gen_->RecordSafepointWithoutTaggedSlots();
     __ AssertUnreachable(AbortReason::kUnexpectedReturnFromWasmTrap);
   }
 
@@ -4514,8 +4513,7 @@
         // return in this case.
         // So either way, we can just ignore any references and record an empty
         // safepoint here.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         __ PopCPURegList(fp_regs_to_save);
         __ PopCPURegList(regs_to_save);
       } else {
@@ -4523,8 +4521,7 @@
                 RelocInfo::WASM_STUB_CALL);
         // The call does not return, hence we can ignore any references and just
         // define an empty safepoint.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         if (v8_flags.debug_code) __ Brk(0);
       }
       __ Bind(&done);
diff --git a/src/compiler/backend/code-generator.cc b/src/compiler/backend/code-generator.cc
index 237cc91..ed3c705 100644
--- a/src/compiler/backend/code-generator.cc
+++ b/src/compiler/backend/code-generator.cc
@@ -602,6 +602,10 @@
   }
 }
 
+void CodeGenerator::RecordSafepointWithoutTaggedSlots() {
+  safepoints()->DefineSafepoint(masm());
+}
+
 bool CodeGenerator::IsMaterializableFromRoot(Handle<HeapObject> object,
                                              RootIndex* index_return) {
   const CallDescriptor* incoming_descriptor =
diff --git a/src/compiler/backend/code-generator.h b/src/compiler/backend/code-generator.h
index b942d17..41006f5 100644
--- a/src/compiler/backend/code-generator.h
+++ b/src/compiler/backend/code-generator.h
@@ -123,6 +123,10 @@
   // the current pc is used to define the safepoint. Otherwise the provided
   // pc_offset is used.
   void RecordSafepoint(ReferenceMap* references, int pc_offset = 0);
+  // In special cases (such as stack checks before initializing the frame),
+  // tagged slots are not yet initialized and hence not safe to visit, so any
+  // safepoints should not include them.
+  void RecordSafepointWithoutTaggedSlots();
 
   Zone* zone() const { return zone_; }
   MacroAssembler* masm() { return &masm_; }
diff --git a/src/compiler/backend/ia32/code-generator-ia32.cc b/src/compiler/backend/ia32/code-generator-ia32.cc
index f7a877c..58cdec9 100644
--- a/src/compiler/backend/ia32/code-generator-ia32.cc
+++ b/src/compiler/backend/ia32/code-generator-ia32.cc
@@ -392,8 +392,7 @@
     // Just encode the stub index. This will be patched when the code
     // is added to the native module and copied into wasm code space.
     __ wasm_call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
-    ReferenceMap* reference_map = gen_->zone()->New<ReferenceMap>(gen_->zone());
-    gen_->RecordSafepoint(reference_map);
+    gen_->RecordSafepointWithoutTaggedSlots();
     __ AssertUnreachable(AbortReason::kUnexpectedReturnFromWasmTrap);
   }
 
@@ -4258,8 +4257,7 @@
         // return in this case.
         // So either way, we can just ignore any references and record an empty
         // safepoint here.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         for (size_t i = 0; i < arraysize(wasm::kFpParamRegisters); i++) {
           __ Movdqu(wasm::kFpParamRegisters[i], Operand(esp, kSimd128Size * i));
         }
@@ -4273,8 +4271,7 @@
                      RelocInfo::WASM_STUB_CALL);
         // The call does not return, hence we can ignore any references and just
         // define an empty safepoint.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         __ AssertUnreachable(AbortReason::kUnexpectedReturnFromWasmTrap);
       }
       __ bind(&done);
diff --git a/src/compiler/backend/x64/code-generator-x64.cc b/src/compiler/backend/x64/code-generator-x64.cc
index 1d83a04..bfbe284 100644
--- a/src/compiler/backend/x64/code-generator-x64.cc
+++ b/src/compiler/backend/x64/code-generator-x64.cc
@@ -675,8 +675,7 @@
     // Just encode the stub index. This will be patched when the code
     // is added to the native module and copied into wasm code space.
     __ near_call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
-    ReferenceMap* reference_map = gen_->zone()->New<ReferenceMap>(gen_->zone());
-    gen_->RecordSafepoint(reference_map);
+    gen_->RecordSafepointWithoutTaggedSlots();
     __ AssertUnreachable(AbortReason::kUnexpectedReturnFromWasmTrap);
   }
 
@@ -8488,8 +8487,7 @@
         // allocating the stack overflow exception object, but the call did not
         // return in this case.
         // So either way, we can just record an empty safepoint here.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         __ PopAll(fp_regs_to_save);
         __ PopAll(regs_to_save);
       } else {
@@ -8497,8 +8495,7 @@
                      RelocInfo::WASM_STUB_CALL);
         // The call does not return, hence we can ignore any references and just
         // define an empty safepoint.
-        ReferenceMap* reference_map = zone()->New<ReferenceMap>(zone());
-        RecordSafepoint(reference_map);
+        RecordSafepointWithoutTaggedSlots();
         __ AssertUnreachable(AbortReason::kUnexpectedReturnFromWasmTrap);
       }
       __ bind(&done);
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 0be8530..d36924d 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -2953,6 +2953,7 @@
   'regress/wasm/regress-483269968': [SKIP],
   'regress/wasm/regress-543901836': [SKIP],
   'regress/wasm/regress-560536735': [SKIP],
+  'regress/wasm/regress-561660149': [SKIP],
   'compiler/regress-347724915': [SKIP],
   'regress/regress-crbug-418520151': [SKIP],
   'regress/regress-535000102': [SKIP],
diff --git a/test/mjsunit/regress/wasm/regress-561660149.js b/test/mjsunit/regress/wasm/regress-561660149.js
new file mode 100644
index 0000000..eba91e8
--- /dev/null
+++ b/test/mjsunit/regress/wasm/regress-561660149.js
@@ -0,0 +1,75 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stack-size=100
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const array_type = builder.addArray(kWasmExternRef, {mutable: true});
+
+const kNumParamsA = 50;
+const sigA = makeSig(new Array(kNumParamsA).fill(kWasmI64), []);
+const funcA = builder.addFunction('A', sigA).addBody([]);
+
+const sigBC = makeSig([kWasmI32, wasmRefNullType(array_type)], []);
+
+const bodyB = [];
+for (let i = 0; i < kNumParamsA; i++) {
+  bodyB.push(...wasmI64Const(0x414141414141n));
+}
+bodyB.push(kExprCallFunction, funcA.index);
+builder.addFunction('B', sigBC).addBody(bodyB).exportFunc();
+
+const kNumParamsBig = 600;
+const sigBig = makeSig(new Array(kNumParamsBig).fill(kWasmI64), []);
+const funcBig = builder.addFunction('Big', sigBig).addBody([]);
+
+const kNumArrayFills = 15;
+const bodyC = [
+  kExprLocalGet, 0,
+  kExprI32Eqz,
+  kExprIf, kWasmVoid,
+];
+for (let i = 0; i < kNumArrayFills; i++) {
+  bodyC.push(
+    kExprLocalGet, 1,
+    kExprI32Const, 0,
+    kExprRefNull, kExternRefCode,
+    kExprI32Const, 32,
+    kGCPrefix, kExprArrayFill, array_type
+  );
+}
+for (let i = 0; i < kNumParamsBig; i++) {
+  bodyC.push(...wasmI64Const(0n));
+}
+bodyC.push(
+  kExprCallFunction, funcBig.index,
+  kExprEnd
+);
+
+builder.addFunction('C', sigBC)
+  .addBody(bodyC)
+  .exportFunc();
+
+const instance = builder.instantiate();
+const B = instance.exports.B;
+const C = instance.exports.C;
+
+%WasmTierUpFunction(B);
+%WasmTierUpFunction(C);
+Error.stackTraceLimit = 0;
+
+function recurse() {
+  try {
+    B(1, null);
+    recurse();
+  } catch (e) {
+    B(1, null);
+    %SimulateNewspaceFull();
+    C(1, null);
+  }
+}
+
+recurse();

diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 0be8530..d36924d 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -2953,6 +2953,7 @@
   'regress/wasm/regress-483269968': [SKIP],
   'regress/wasm/regress-543901836': [SKIP],
   'regress/wasm/regress-560536735': [SKIP],
+  'regress/wasm/regress-561660149': [SKIP],
   'compiler/regress-347724915': [SKIP],
   'regress/regress-crbug-418520151': [SKIP],
   'regress/regress-535000102': [SKIP],
diff --git a/test/mjsunit/regress/wasm/regress-561660149.js b/test/mjsunit/regress/wasm/regress-561660149.js
new file mode 100644
index 0000000..eba91e8
--- /dev/null
+++ b/test/mjsunit/regress/wasm/regress-561660149.js
@@ -0,0 +1,75 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stack-size=100
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const array_type = builder.addArray(kWasmExternRef, {mutable: true});
+
+const kNumParamsA = 50;
+const sigA = makeSig(new Array(kNumParamsA).fill(kWasmI64), []);
+const funcA = builder.addFunction('A', sigA).addBody([]);
+
+const sigBC = makeSig([kWasmI32, wasmRefNullType(array_type)], []);
+
+const bodyB = [];
+for (let i = 0; i < kNumParamsA; i++) {
+  bodyB.push(...wasmI64Const(0x414141414141n));
+}
+bodyB.push(kExprCallFunction, funcA.index);
+builder.addFunction('B', sigBC).addBody(bodyB).exportFunc();
+
+const kNumParamsBig = 600;
+const sigBig = makeSig(new Array(kNumParamsBig).fill(kWasmI64), []);
+const funcBig = builder.addFunction('Big', sigBig).addBody([]);
+
+const kNumArrayFills = 15;
+const bodyC = [
+  kExprLocalGet, 0,
+  kExprI32Eqz,
+  kExprIf, kWasmVoid,
+];
+for (let i = 0; i < kNumArrayFills; i++) {
+  bodyC.push(
+    kExprLocalGet, 1,
+    kExprI32Const, 0,
+    kExprRefNull, kExternRefCode,
+    kExprI32Const, 32,
+    kGCPrefix, kExprArrayFill, array_type
+  );
+}
+for (let i = 0; i < kNumParamsBig; i++) {
+  bodyC.push(...wasmI64Const(0n));
+}
+bodyC.push(
+  kExprCallFunction, funcBig.index,
+  kExprEnd
+);
+
+builder.addFunction('C', sigBC)
+  .addBody(bodyC)
+  .exportFunc();
+
+const instance = builder.instantiate();
+const B = instance.exports.B;
+const C = instance.exports.C;
+
+%WasmTierUpFunction(B);
+%WasmTierUpFunction(C);
+Error.stackTraceLimit = 0;
+
+function recurse() {
+  try {
+    B(1, null);
+    recurse();
+  } catch (e) {
+    B(1, null);
+    %SimulateNewspaceFull();
+    C(1, null);
+  }
+}
+
+recurse();