From a777999ee48633dc5587b01440180753a09eac31 Mon Sep 17 00:00:00 2001
From: Leszek Swirski <leszeks@chromium.org>
Date: Fri, 17 Jul 2026 15:31:42 +0200
Subject: [PATCH] [execution] Throw TypeError on re-entrant Atomics.wait calls

Each Isolate owns a single per-isolate FutexWaitListNode instance
accessed via isolate->futex_wait_list_node().

When FutexEmulation::WaitSyncImpl unlocks the FutexWaitList mutex during
isolate->stack_guard()->HandleInterrupts(), re-entrant JS execution
(e.g., via DevTools Runtime.evaluate on frozen workers) can call
Atomics.wait again on the same thread.

This re-entrancy reuses the same singleton FutexWaitListNode,
double-adding it to FutexWaitList and corrupting list pointers, leading
to Use-After-Free.

This CL checks if node->waiting_ is already true on entry to
WaitSyncImpl, and throws a JS TypeError
(MessageTemplate::kAtomicsOperationNotAllowed) to reject re-entrant
synchronous wait calls cleanly.

Bug: 532921336
Change-Id: Id2d2eab9a7fb19f5ce15246692ac2c3693bdc2cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8086043
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108975}
---

diff --git a/src/execution/futex-emulation.cc b/src/execution/futex-emulation.cc
index 00e0cb4..3d0c691 100644
--- a/src/execution/futex-emulation.cc
+++ b/src/execution/futex-emulation.cc
@@ -324,6 +324,23 @@
                            rel_timeout_ns, CallType::kIsWasm);
 }
 
+namespace {
+class InSyncWaitScope {
+ public:
+  explicit InSyncWaitScope(FutexWaitListNode* node) : node_(node) {
+    DCHECK(!node_->IsInSyncWait());
+    node_->SetInSyncWait(true);
+  }
+  ~InSyncWaitScope() {
+    DCHECK(node_->IsInSyncWait());
+    node_->SetInSyncWait(false);
+  }
+
+ private:
+  FutexWaitListNode* node_;
+};
+}  // namespace
+
 #if V8_ENABLE_WEBASSEMBLY
 Tagged<Object> FutexEmulation::WaitWasmManagedObject(
     Isolate* isolate, Tagged<HeapObject> object, int32_t offset,
@@ -334,6 +351,12 @@
       base::TimeDelta::FromNanoseconds(rel_timeout_ns);
 
   FutexWaitListNode* node = isolate->futex_wait_list_node();
+  if (node->IsInSyncWait()) {
+    return isolate->Throw(*isolate->factory()->NewTypeError(
+        MessageTemplate::kAtomicsOperationNotAllowed,
+        isolate->factory()->NewStringFromAsciiChecked("Atomics.wait")));
+  }
+  InSyncWaitScope wait_scope(node);
 
   bool use_timeout = rel_timeout_ns >= 0;
 
@@ -401,6 +424,13 @@
   FutexWaitList* wait_list = GetWaitList();
   FutexWaitListNode* node = isolate->futex_wait_list_node();
 
+  if (node->IsInSyncWait()) {
+    return isolate->Throw(*isolate->factory()->NewTypeError(
+        MessageTemplate::kAtomicsOperationNotAllowed,
+        isolate->factory()->NewStringFromAsciiChecked("Atomics.wait")));
+  }
+  InSyncWaitScope wait_scope(node);
+
   base::TimeTicks timeout_time;
   if (use_timeout) {
     base::TimeTicks current_time = base::TimeTicks::Now();
@@ -430,9 +460,10 @@
     NoGarbageCollectionMutexGuard& lock_guard, bool use_timeout,
     base::TimeTicks timeout_time, T value, T loaded_value,
     std::optional<void*> wait_location) {
+  DCHECK(!node->IsWaiting());
+
   DirectHandle<Object> result;
   if (loaded_value != value) {
-    DCHECK(!node->waiting_);
     return direct_handle(Smi::FromInt(WaitReturnValue::kNotEqualValue),
                          isolate);
   }
diff --git a/src/execution/futex-emulation.h b/src/execution/futex-emulation.h
index 8c1bb3d..baad1a2 100644
--- a/src/execution/futex-emulation.h
+++ b/src/execution/futex-emulation.h
@@ -64,6 +64,9 @@
   void NotifyWake();
 
   bool IsAsync() const { return async_state_ != nullptr; }
+  bool IsWaiting() const { return waiting_.load(std::memory_order_relaxed); }
+  bool IsInSyncWait() const { return in_sync_wait_; }
+  void SetInSyncWait(bool v) { in_sync_wait_ = v; }
 
   // Returns false if the cancelling failed, true otherwise.
   bool CancelTimeoutTask();
@@ -139,9 +142,13 @@
   // this node is alive.
   void* wait_location_ = nullptr;
 
-  // waiting_ and interrupted_ are protected by `GetWaitList()::mutex()`.
-  bool waiting_ = false;
+  // waiting_ is std::atomic<bool> to allow safe relaxed reads outside mutex
+  // locks.
+  std::atomic<bool> waiting_{false};
   bool interrupted_ = false;
+  // in_sync_wait_ tracks whether the isolate thread is executing inside a
+  // WaitSync scope. Modified exclusively by the isolate thread itself.
+  bool in_sync_wait_ = false;
 
   // State used for an async wait; nullptr on sync waits.
   const std::unique_ptr<AsyncState> async_state_;
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index 854af64..35eb589 100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -26207,6 +26207,56 @@
   timeout_thread.Join();
 }
 
+namespace {
+class ReentrantWaitThread : public v8::base::Thread {
+ public:
+  explicit ReentrantWaitThread(v8::Isolate* isolate)
+      : Thread(Options("ReentrantWaitThread")), isolate_(isolate) {}
+
+  static void InterruptCallback(v8::Isolate* isolate, void* data) {
+    v8::HandleScope scope(isolate);
+    v8::TryCatch try_catch(isolate);
+    CompileRun(
+        "var sab2 = new SharedArrayBuffer(4);"
+        "var i32a2 = new Int32Array(sab2);"
+        "Atomics.wait(i32a2, 0, 0, 10);");
+
+    CHECK(try_catch.HasCaught());
+    v8::String::Utf8Value exception_msg(isolate, try_catch.Exception());
+    CHECK_NOT_NULL(strstr(*exception_msg, "cannot be called in this context"));
+  }
+
+  void Run() override {
+    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
+    // Wait until main thread enters WaitSyncImpl and marks node->waiting_ =
+    // true
+    while (!i_isolate->futex_wait_list_node()->IsWaiting()) {
+      v8::base::OS::Sleep(v8::base::TimeDelta::FromMilliseconds(1));
+    }
+    isolate_->RequestInterrupt(InterruptCallback, nullptr);
+  }
+
+ private:
+  v8::Isolate* isolate_;
+};
+}  // namespace
+
+TEST(FutexReentrantWait) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  LocalContext env;
+
+  ReentrantWaitThread thread(isolate);
+  CHECK(thread.Start());
+
+  CompileRun(
+      "var ab = new SharedArrayBuffer(4);"
+      "var i32a = new Int32Array(ab);"
+      "Atomics.wait(i32a, 0, 0, 500);");
+
+  thread.Join();
+}
+
 TEST(StackCheckTermination) {
   v8::Isolate* isolate = CcTest::isolate();
   i::Isolate* i_isolate = CcTest::i_isolate();