From 42a63bb146721f2175fa7e557594ce698b3d8cbe Mon Sep 17 00:00:00 2001
From: Daniel Lehmann <[email protected]>
Date: Tue, 22 Sep 2026 01:53:21 +0200
Subject: [PATCH] [wasm] Flush icache before publishing wrapper code pointer

In WasmWrapperCache::ModificationScope::AddWrapper,
jit_allocation.UpdateWasmCodePointer() updated the process-wide
WasmCodePointerTable entry before FlushInstructionCache() was called.
On architectures with non-coherent instruction and data caches such as
arm64, another thread concurrently calling an imported function of the
same signature could load the new wrapper address from the table and
execute stale instruction cache lines (SIGILL) before the instruction
cache was flushed.

Move FlushInstructionCache() inside the WritableJitAllocation scope
immediately prior to UpdateWasmCodePointer() so that instruction cache
synchronization completes before the entry point becomes visible to
other threads.

TAG=agy
CONV=9a26f19b-f2cc-4dc2-ac4d-5aa62cb0da45

Fixed: 564326756
Change-Id: I1851fb4a2f33a5ee6499a517a20efae2e96ff6a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8430571
Reviewed-by: Jakob Kummerow <[email protected]>
Commit-Queue: Daniel Lehmann <[email protected]>
Cr-Commit-Position: refs/heads/main@{#110005}
---
diff --git a/src/wasm/wasm-wrapper-cache-inl.h b/src/wasm/wasm-wrapper-cache-inl.h
index 22f0a1c..11bbf70a 100644
--- a/src/wasm/wasm-wrapper-cache-inl.h
+++ b/src/wasm/wasm-wrapper-cache-inl.h
@@ -72,10 +72,10 @@
       DCHECK(!RelocInfo::IsWasmStubCall(it.rinfo()->rmode()));
       it.rinfo()->apply(delta);
     }
+    FlushInstructionCache(code_space.begin(), code_space.size());
     jit_allocation.UpdateWasmCodePointer(wrapper_handle->code_pointer(),
                                          signature_hash);
   }
-  FlushInstructionCache(code_space.begin(), code_space.size());
   const int frame_slot_count = result.frame_slot_count;
   const int ool_spill_count = result.ool_spill_count;
   constexpr bool frame_has_feedback_slot = false;
diff --git a/test/mjsunit/wasm/regress-564326756.js b/test/mjsunit/wasm/regress-564326756.js
new file mode 100644
index 0000000..e3cc56c
--- /dev/null
+++ b/test/mjsunit/wasm/regress-564326756.js
@@ -0,0 +1,136 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-wrapper-tiering-budget=250
+
+// WasmWrapperCache::ModificationScope::AddWrapper updated the shared
+// WasmCodePointerTable entry before flushing the instruction cache. On ARM64
+// CPUs with non-coherent instruction/data caches (e.g. Apple Silicon), a worker
+// thread concurrently calling an import of the same signature could jump to the
+// newly published wrapper address and fetch stale L1I cache lines (SIGILL).
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function TestConcurrentWasmToJSWrapperTierUp() {
+  const kNumSigs = 64;
+  const kImportsPerSig = 16;
+  const kNumReaders = 3;
+  // Lowering `--wasm-wrapper-tiering-budget` from its default (1000) to 250
+  // makes the compiler thread trigger tier-up 4x faster, while 16 imports *
+  // 249 calls = 3984 reader calls (~60us on Apple Silicon) spans the
+  // CompileWrapper window without any single reader import's budget reaching 0.
+  const kBudget = 250;
+
+  // 1. Build a Wasm module with 64 distinct 7-parameter signatures (`s = 0..63`)
+  // and 16 imports (`f_<s>_0..15`) per signature:
+  // - `compile_<s>(count)`: calls `f_<s>_0` `count` times to trigger tier-up.
+  // - `read_<s>(max_iters)`: calls `f_<s>_0..15` while `--max_iters > 0` and
+  //   `Atomics.load(mem, 4) <= s + 1` (so readers keep calling through `s`
+  //   after `AddWrapper(s)` finishes on native hardware, but bail out early on
+  //   slow simulator builds once the compiler thread moves past `s + 1`).
+  const builder = new WasmModuleBuilder();
+  builder.addImportedMemory('m', 'mem', 1, 1, true);
+  const makeParams = (s) => [0, 1, 2, 3, 4, 5, 6].map(
+      b => (s & (1 << b)) ? kWasmExternRef : kWasmI32);
+
+  for (let s = 0; s < kNumSigs; s++) {
+    const sig = builder.addType(makeSig(makeParams(s), [kWasmI32]));
+    for (let j = 0; j < kImportsPerSig; j++) {
+      builder.addImport('m', `f_${s}_${j}`, sig);
+    }
+  }
+
+  for (let s = 0; s < kNumSigs; s++) {
+    const args = makeParams(s).flatMap(
+        t => t === kWasmExternRef ? [kExprRefNull, kExternRefCode]
+                                  : [kExprI32Const, 0]);
+    const callOne = (j) => [
+      ...args,
+      kExprCallFunction, ...wasmUnsignedLeb(s * kImportsPerSig + j),
+      kExprDrop,
+    ];
+    const callAll = [];
+    for (let j = 0; j < kImportsPerSig; j++) callAll.push(...callOne(j));
+
+    builder.addFunction(`compile_${s}`, kSig_v_i)
+        .addBody([
+          kExprLoop, kWasmVoid,
+            ...callOne(0),
+            kExprLocalGet, 0, kExprI32Const, 1, kExprI32Sub, kExprLocalTee, 0,
+            kExprBrIf, 0,
+          kExprEnd,
+        ])
+        .exportFunc();
+
+    builder.addFunction(`read_${s}`, kSig_v_i)
+        .addBody([
+          kExprLoop, kWasmVoid,
+            ...callAll,
+            kExprLocalGet, 0, kExprI32Const, 1, kExprI32Sub, kExprLocalTee, 0,
+            kExprI32Const, 0, kExprI32GtS,
+            kExprI32Const, 4, kAtomicPrefix, kExprI32AtomicLoad, 2, 0,
+            kExprI32Const, ...wasmSignedLeb(s + 1), kExprI32LeS,
+            kExprI32And,
+            kExprBrIf, 0,
+          kExprEnd,
+        ])
+        .exportFunc();
+  }
+
+  // 2. Shared synchronization state inside the imported WebAssembly.Memory:
+  // - `sync[0]` (byte offset 0): count of workers that finished instantiation.
+  // - `sync[1]` (byte offset 4): current signature `s` being compiled.
+  const module = builder.toModule();
+  const memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+  const sync = new Int32Array(memory.buffer);
+  Atomics.store(sync, 1, -1);
+
+  // 3. Reader workers: instantiate the module, signal readiness (`sync[0]`),
+  // and spin-wait for each `s` before calling `read_<s>(kBudget - 1)`.
+  function workerCode() {
+    onmessage = function({data: {module, memory, kNumSigs, kImportsPerSig, kBudget}}) {
+      const sync = new Int32Array(memory.buffer);
+      const m = {mem: memory};
+      for (let s = 0; s < kNumSigs; s++) {
+        for (let j = 0; j < kImportsPerSig; j++) m[`f_${s}_${j}`] = () => 1;
+      }
+      const {exports} = new WebAssembly.Instance(module, {m});
+
+      Atomics.add(sync, 0, 1);
+      for (let s = 0; s < kNumSigs; s++) {
+        while (Atomics.load(sync, 1) < s) {}
+        exports[`read_${s}`](kBudget - 1);
+      }
+      postMessage('ok');
+    };
+  }
+
+  const workers = [];
+  for (let w = 0; w < kNumReaders; w++) {
+    const worker = new Worker(workerCode, {type: 'function'});
+    worker.postMessage({module, memory, kNumSigs, kImportsPerSig, kBudget});
+    workers.push(worker);
+  }
+
+  // 4. Main thread (compiler): wait for all workers to instantiate, then step
+  // through `s = 0..47`, releasing readers on `s` and calling `compile_<s>`.
+  const m = {mem: memory};
+  for (let s = 0; s < kNumSigs; s++) {
+    for (let j = 0; j < kImportsPerSig; j++) m[`f_${s}_${j}`] = () => 1;
+  }
+  const {exports} = new WebAssembly.Instance(module, {m});
+
+  while (Atomics.load(sync, 0) < workers.length) {}
+
+  for (let s = 0; s < kNumSigs; s++) {
+    Atomics.store(sync, 1, s);
+    exports[`compile_${s}`](kBudget);
+  }
+  Atomics.store(sync, 1, kNumSigs + 1);
+
+  for (const w of workers) {
+    assertEquals('ok', w.getMessage());
+    w.terminate();
+  }
+})();

diff --git a/test/mjsunit/wasm/regress-564326756.js b/test/mjsunit/wasm/regress-564326756.js
new file mode 100644
index 0000000..e3cc56c
--- /dev/null
+++ b/test/mjsunit/wasm/regress-564326756.js
@@ -0,0 +1,136 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-wrapper-tiering-budget=250
+
+// WasmWrapperCache::ModificationScope::AddWrapper updated the shared
+// WasmCodePointerTable entry before flushing the instruction cache. On ARM64
+// CPUs with non-coherent instruction/data caches (e.g. Apple Silicon), a worker
+// thread concurrently calling an import of the same signature could jump to the
+// newly published wrapper address and fetch stale L1I cache lines (SIGILL).
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function TestConcurrentWasmToJSWrapperTierUp() {
+  const kNumSigs = 64;
+  const kImportsPerSig = 16;
+  const kNumReaders = 3;
+  // Lowering `--wasm-wrapper-tiering-budget` from its default (1000) to 250
+  // makes the compiler thread trigger tier-up 4x faster, while 16 imports *
+  // 249 calls = 3984 reader calls (~60us on Apple Silicon) spans the
+  // CompileWrapper window without any single reader import's budget reaching 0.
+  const kBudget = 250;
+
+  // 1. Build a Wasm module with 64 distinct 7-parameter signatures (`s = 0..63`)
+  // and 16 imports (`f_<s>_0..15`) per signature:
+  // - `compile_<s>(count)`: calls `f_<s>_0` `count` times to trigger tier-up.
+  // - `read_<s>(max_iters)`: calls `f_<s>_0..15` while `--max_iters > 0` and
+  //   `Atomics.load(mem, 4) <= s + 1` (so readers keep calling through `s`
+  //   after `AddWrapper(s)` finishes on native hardware, but bail out early on
+  //   slow simulator builds once the compiler thread moves past `s + 1`).
+  const builder = new WasmModuleBuilder();
+  builder.addImportedMemory('m', 'mem', 1, 1, true);
+  const makeParams = (s) => [0, 1, 2, 3, 4, 5, 6].map(
+      b => (s & (1 << b)) ? kWasmExternRef : kWasmI32);
+
+  for (let s = 0; s < kNumSigs; s++) {
+    const sig = builder.addType(makeSig(makeParams(s), [kWasmI32]));
+    for (let j = 0; j < kImportsPerSig; j++) {
+      builder.addImport('m', `f_${s}_${j}`, sig);
+    }
+  }
+
+  for (let s = 0; s < kNumSigs; s++) {
+    const args = makeParams(s).flatMap(
+        t => t === kWasmExternRef ? [kExprRefNull, kExternRefCode]
+                                  : [kExprI32Const, 0]);
+    const callOne = (j) => [
+      ...args,
+      kExprCallFunction, ...wasmUnsignedLeb(s * kImportsPerSig + j),
+      kExprDrop,
+    ];
+    const callAll = [];
+    for (let j = 0; j < kImportsPerSig; j++) callAll.push(...callOne(j));
+
+    builder.addFunction(`compile_${s}`, kSig_v_i)
+        .addBody([
+          kExprLoop, kWasmVoid,
+            ...callOne(0),
+            kExprLocalGet, 0, kExprI32Const, 1, kExprI32Sub, kExprLocalTee, 0,
+            kExprBrIf, 0,
+          kExprEnd,
+        ])
+        .exportFunc();
+
+    builder.addFunction(`read_${s}`, kSig_v_i)
+        .addBody([
+          kExprLoop, kWasmVoid,
+            ...callAll,
+            kExprLocalGet, 0, kExprI32Const, 1, kExprI32Sub, kExprLocalTee, 0,
+            kExprI32Const, 0, kExprI32GtS,
+            kExprI32Const, 4, kAtomicPrefix, kExprI32AtomicLoad, 2, 0,
+            kExprI32Const, ...wasmSignedLeb(s + 1), kExprI32LeS,
+            kExprI32And,
+            kExprBrIf, 0,
+          kExprEnd,
+        ])
+        .exportFunc();
+  }
+
+  // 2. Shared synchronization state inside the imported WebAssembly.Memory:
+  // - `sync[0]` (byte offset 0): count of workers that finished instantiation.
+  // - `sync[1]` (byte offset 4): current signature `s` being compiled.
+  const module = builder.toModule();
+  const memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+  const sync = new Int32Array(memory.buffer);
+  Atomics.store(sync, 1, -1);
+
+  // 3. Reader workers: instantiate the module, signal readiness (`sync[0]`),
+  // and spin-wait for each `s` before calling `read_<s>(kBudget - 1)`.
+  function workerCode() {
+    onmessage = function({data: {module, memory, kNumSigs, kImportsPerSig, kBudget}}) {
+      const sync = new Int32Array(memory.buffer);
+      const m = {mem: memory};
+      for (let s = 0; s < kNumSigs; s++) {
+        for (let j = 0; j < kImportsPerSig; j++) m[`f_${s}_${j}`] = () => 1;
+      }
+      const {exports} = new WebAssembly.Instance(module, {m});
+
+      Atomics.add(sync, 0, 1);
+      for (let s = 0; s < kNumSigs; s++) {
+        while (Atomics.load(sync, 1) < s) {}
+        exports[`read_${s}`](kBudget - 1);
+      }
+      postMessage('ok');
+    };
+  }
+
+  const workers = [];
+  for (let w = 0; w < kNumReaders; w++) {
+    const worker = new Worker(workerCode, {type: 'function'});
+    worker.postMessage({module, memory, kNumSigs, kImportsPerSig, kBudget});
+    workers.push(worker);
+  }
+
+  // 4. Main thread (compiler): wait for all workers to instantiate, then step
+  // through `s = 0..47`, releasing readers on `s` and calling `compile_<s>`.
+  const m = {mem: memory};
+  for (let s = 0; s < kNumSigs; s++) {
+    for (let j = 0; j < kImportsPerSig; j++) m[`f_${s}_${j}`] = () => 1;
+  }
+  const {exports} = new WebAssembly.Instance(module, {m});
+
+  while (Atomics.load(sync, 0) < workers.length) {}
+
+  for (let s = 0; s < kNumSigs; s++) {
+    Atomics.store(sync, 1, s);
+    exports[`compile_${s}`](kBudget);
+  }
+  Atomics.store(sync, 1, kNumSigs + 1);
+
+  for (const w of workers) {
+    assertEquals('ok', w.getMessage());
+    w.terminate();
+  }
+})();