PatchGap
Chrome · V8

CVE-2025-8010

Type Confusion in V8
High chrome Type Confusion 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactType Confusion in V8
DescriptionType Confusion in V8
ComponentV8
Bug ClassType Confusion
Tracker430344952
Fix commit0559da28e2a5 (v8/v8) +11/-3
CISA KEVNot listed
CreditedShaheen Fazim
Disclosed2025-07-22

Files Changed

  • src/parsing/preparser.cc
  • test/message/fail/preparse-arguments.js
  • test/message/fail/preparse-arguments.out

Patch

view commit
From 0559da28e2a55930279071a18b7444501e8d1223 Mon Sep 17 00:00:00 2001
From: Toon Verwaest <[email protected]>
Date: Mon, 14 Jul 2025 13:56:15 +0200
Subject: [PATCH] [preparser] Support escapes in arguments contextual keywords

Bug: 430344952
Change-Id: Ib35df2f992cfe5a5207109ab500a0baaadf9b988
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6732379
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Commit-Queue: Toon Verwaest <[email protected]>
Auto-Submit: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/heads/main@{#101389}
---

diff --git a/src/parsing/preparser.cc b/src/parsing/preparser.cc
index 201fbdb7..70c7d452 100644
--- a/src/parsing/preparser.cc
+++ b/src/parsing/preparser.cc
@@ -44,9 +44,6 @@
   if (string == avf->eval_string()) {
     return PreParserIdentifier::Eval();
   }
-  if (scanner->literal_contains_escapes()) {
-    return PreParserIdentifier::Default();
-  }
   if (string == avf->arguments_string()) {
     return PreParserIdentifier::Arguments();
   }
diff --git a/test/message/fail/preparse-arguments.js b/test/message/fail/preparse-arguments.js
new file mode 100644
index 0000000..7b42a0b
--- /dev/null
+++ b/test/message/fail/preparse-arguments.js
@@ -0,0 +1,7 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function f(a) { var \u0061rguments = 0; }
diff --git a/test/message/fail/preparse-arguments.out b/test/message/fail/preparse-arguments.out
new file mode 100644
index 0000000..2c54c31
--- /dev/null
+++ b/test/message/fail/preparse-arguments.out
@@ -0,0 +1,4 @@
+*%(basename)s:7: SyntaxError: Unexpected eval or arguments in strict mode
+function f(a) { var \u0061rguments = 0; }
+                    ^^^^^^^^^^^^^^
+SyntaxError: Unexpected eval or arguments in strict mode
Loading diff…

Original Bug Report

reported by [email protected]

Debug check failed: IsInBounds(index)



#
# Fatal error in ../../src/objects/fixed-array-inl.h, line 116
# Debug check failed: IsInBounds(index).
#
#
#
#FailureMessage Object: 0x7ffdb6786b58
==== C stack trace ===============================

    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x1e) [0x7f64fec3792e]
    /home/user/v8/v8/out/x64.debug/libv8_libplatform.so(+0x4b60d) [0x7f64feba460d]
    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(V8_Fatal(char const*, int, char const*, ...)+0x205) [0x7f64fec10ce5]
    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(+0x4d69c) [0x7f64fec1069c]
    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(V8_Dcheck(char const*, int, char const*)+0x4d) [0x7f64fec10dbd]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::TaggedArrayBase<v8::internal::WeakFixedArray, v8::internal::WeakFixedArrayShape, v8::internal::HeapObjectLayout>::get(int) const+0x47) [0x7f650670c1b7]
    /home/user/v8/v8/out/x64.debug/libv8.so(void v8::internal::DeclarationScope::AllocateScopeInfos<v8::internal::Isolate>(v8::internal::ParseInfo*, v8::internal::DirectHandle<v8::internal::Script>, v8::internal::Isolate*)+0x2ec) [0x7f650670ab0c]
    /home/user/v8/v8/out/x64.debug/libv8.so(+0x7c0ac9b) [0x7f6506853c9b]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::Compiler::Compile(v8::internal::Isolate*, v8::internal::Handle<v8::internal::SharedFunctionInfo>, v8::internal::Compiler::ClearExceptionFlag, v8::internal::IsCompiledScope*, v8::internal::CreateSourcePositions)+0x9f0) [0x7f65068537a0]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::Compiler::Compile(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::Compiler::ClearExceptionFlag, v8::internal::IsCompiledScope*)+0x4f0) [0x7f6506854730]
    /home/user/v8/v8/out/x64.debug/libv8.so(+0x8e5a176) [0x7f6507aa3176]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::Runtime_CompileLazy(int, unsigned long*, v8::internal::Isolate*)+0x151) [0x7f6507aa2bb1]
    /home/user/v8/v8/out/x64.debug/libv8.so(+0x6fca53d) [0x7f6505c1353d]
Trace/breakpoint trap (core dumped)

VERSION

V8 version 13.9.0 (candidate)

REPRODUCTION CASE

Build: python3 tools/dev/gm.py x64.debug

Run: ./d8 poc.js

Reporter credit: Shaheen Fazim

View on issue tracker
On This Page