MarshallOfSound

#53262: fix: crash when V8 optimises a call to a node:wasi import

Merged
Created: Aug 28, 2026, 2:35:03 AM
Merged: Aug 28, 2026, 4:46:01 AM
5 comments
Target: main

Description of Change

Backport of nodejs/node#63679 as a Node patch.

  • WASI::WasiFunction::SetFunction passed a stack-local v8::CFunction to FunctionTemplate::New. Since crrev.com/c/7828135 V8 keeps that pointer, so an optimised call to any wasiImport.* function read a dead stack slot (ASan: stack-use-after-return; crashes in practice).
  • Upstream landed the fix on main only (dont-land-on-v24.x / v26.x) because their bundled V8 predates the change; ours doesn't, on every supported line (42-x-y carries the V8 CL as fastapi_store_v8_cfunction_pointer_directly_in.patch).
  • The node_external_reference.h half of the upstream commit is already in electron_enable_node_startup_snapshot_generation_in_chromium_s_v8.patch, so this patch is just the node_wasi.cc hunk.
  • Adds a node:wasi spec that forces TurboFan to optimise a wasi import call under ELECTRON_RUN_AS_NODE.

Checklist

Release Notes

Notes: Fixed a crash when calling node:wasi functions in optimized code.

Backports

42-x-y
In-flight
PR Number
#53267
Waiting to be merged
43-x-y
In-flight
PR Number
#53265
Waiting to be merged
44-x-y
In-flight
PR Number
#53268
Waiting to be merged
45-x-y
In-flight
PR Number
#53266
Waiting to be merged

Semver Impact

Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.

Semantic Versioning helps users understand the impact of updates:

  • Major (X.y.z): Breaking changes that may require code modifications
  • Minor (x.Y.z): New features that maintain backward compatibility
  • Patch (x.y.Z): Bug fixes that don't change the API
  • None: Changes that don't affect using facing parts of Electron