[rpms/qt6-qtwebengine] rawhide: PPC/s390: Codegen - fix signed integer overdlow in Assembler:GrowBuffer

[rpms/qt6-qtwebengine] rawhide: PPC/s390: Codegen - fix signed integer overdlow in Assembler:GrowBuffer

[Jan Grulich]

A new commit has been pushed.

Repo   : rpms/qt6-qtwebengine
Branch : rawhide
Commit : a4d311c2ea6fdd51952f1ad7c4f4774c765ecb60
Author : Jan Grulich <jgrulich@redhat.com>
Date   : 2026-08-25T17:41:50+02:00
Stats  : +111/-20 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/qt6-qtwebengine/c/a4d311c2ea6fdd51952f1ad7c4f4774c765ecb60?branch=rawhide

Log:
PPC/s390: Codegen - fix signed integer overdlow in Assembler:GrowBuffer

---
diff --git a/qt6-qtwebengine.spec b/qt6-qtwebengine.spec
index 32ba45c..4dcf861 100644
--- a/qt6-qtwebengine.spec
+++ b/qt6-qtwebengine.spec
@@ -88,7 +88,7 @@
 Summary: Qt6 - QtWebEngine components
 Name:    qt6-qtwebengine
 Version: 6.11.2
-Release: 1%{?dist}
+Release: 2%{?dist}
 
 # See LICENSE.GPL LICENSE.LGPL LGPL_EXCEPTION.txt, for details
 # See also http://qt-project.org/doc/qt-5.0/qtdoc/licensing.html
@@ -133,11 +133,11 @@ Patch5:   qtwebengine-chromium-141-glibc-2.42-SYS_SECCOMP.patch
 ## Upstream patches:
 # https://bugreports.qt.io/browse/QTBUG-129985
 Patch80:  qtwebengine-fix-arm-build.patch
+Patch81:  qtwebengine-codegen-fix-signed-integer-overflow-in-assembler-growbuffer.patch
 
 ## Upstreamable patches:
 Patch101: qtwebengine-fix-build-against-gcc16.patch
 Patch102: qtwebengine-fix-delay-signature.patch
-Patch103: qtwebengine-fix-v8-kMaximalBufferSize-private.patch
 
 ## ppc64le port
 Patch200: qtwebengine-6.9-ppc64.patch
@@ -495,11 +495,11 @@ popd
 
 ## upstream patches
 %patch -P80 -p1 -b .fix-arm-build
+%patch -P81 -p1 -b .codegen-fix-signed-integer-overflow-in-assembler-growbuffer
 
 ## upstreamable patches
 %patch -P101 -p1 -b .fix-build-against-gcc16
 %patch -P102 -p1 -b .fix-delay-signature
-%patch -P103 -p1 -b .fix-v8-kMaximalBufferSize-private
 
 # ppc64le support
 %patch -P200 -p1
@@ -859,6 +859,9 @@ done
 %endif
 
 %changelog
+* Tue Aug 25 2026 Jan Grulich <jgrulich@redhat.com> - 6.11.2-2
+- PPC/s390: Codegen - fix signed integer overdlow in Assembler:GrowBuffer
+
 * Mon Aug 24 2026 Jan Grulich <jgrulich@redhat.com> - 6.11.2-1
 - 6.11.2
 

diff --git a/qtwebengine-codegen-fix-signed-integer-overflow-in-assembler-growbuffer.patch b/qtwebengine-codegen-fix-signed-integer-overflow-in-assembler-growbuffer.patch
new file mode 100644
index 0000000..12816e1
--- /dev/null
+++ b/qtwebengine-codegen-fix-signed-integer-overflow-in-assembler-growbuffer.patch
@@ -0,0 +1,105 @@
+From 9197b407b59db8c36cc4ded4a0b8e330cadd78bd Mon Sep 17 00:00:00 2001
+From: Milad Fa <mfarazma@ibm.com>
+Date: Tue, 28 Apr 2026 13:05:23 +0000
+Subject: [PATCH] PPC/s390: [codegen] Fix signed integer overflow in
+ Assembler::GrowBuffer
+
+Port 19b8e4cb5e838e786d3883b531765b3b07514dfb
+
+Original Commit Message:
+
+    Compiling extremely large functions could cause `Assembler::GrowBuffer`
+    to calculate a negative buffer size due to a signed integer overflow
+    when doubling the size. This bypassed the out-of-memory guard and
+    resulted in a massive heap-based buffer overflow.
+
+    This CL fixes the issue by:
+    1. Moving `kMaximalBufferSize` to `AssemblerBase` as a common constant.
+    2. Adding a non-static helper method `ComputeNewBufferSize` to
+       `AssemblerBase` that takes a `BufferGrowthStrategy` enum flag.
+    3. Adding a `DCHECK` to ensure the new size fits within `int` boundaries.
+    4. Updating `GrowBuffer` in arm, arm64, ia32, and x64 to use this helper.
+    5. Adding a check against `kMaximalBufferSize` in
+       `BaselineCompiler::AllocateBuffer` to prevent huge initial
+       allocations.
+
+R=victorgomes@chromium.org, junyan1@ibm.com
+BUG=
+LOG=N
+
+Change-Id: I12a42713627049add7c4b7e7b7ccb1b124d8e843
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7796624
+Reviewed-by: Victor Gomes <victorgomes@chromium.org>
+Commit-Queue: Milad Farazmand <mfarazma@ibm.com>
+Cr-Commit-Position: refs/heads/main@{#106891}
+---
+ src/codegen/ppc/assembler-ppc.cc   | 5 +----
+ src/codegen/ppc/assembler-ppc.h    | 3 ---
+ src/codegen/s390/assembler-s390.cc | 5 +----
+ src/codegen/s390/assembler-s390.h  | 3 ---
+ 4 files changed, 2 insertions(+), 14 deletions(-)
+
+diff --git a/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.cc b/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.cc
+index d605e20715d5..4cdbf60a578d 100644
+--- a/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.cc
++++ b/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.cc
+@@ -2068,12 +2068,9 @@ void Assembler::GrowBuffer(int needed) {
+ 
+   // Compute new buffer size.
+   int old_size = buffer_->size();
+-  int new_size = std::min(2 * old_size, old_size + 1 * MB);
++  int new_size = ComputeNewBufferSize(BufferGrowthStrategy::kDoubleCapped1MB);
+   int space = buffer_space() + (new_size - old_size);
+   new_size += (space < needed) ? needed - space : 0;
+-
+-  // Some internal data structures overflow for very large buffers,
+-  // they must ensure that kMaximalBufferSize is not too large.
+   if (new_size > kMaximalBufferSize) {
+     V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
+   }
+diff --git a/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.h b/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.h
+index 2295c8a2c584..5d4178c1ab36 100644
+--- a/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.h
++++ b/src/3rdparty/chromium/v8/src/codegen//ppc/assembler-ppc.h
+@@ -1443,9 +1443,6 @@ class Assembler : public AssemblerBase {
+   RelocInfoWriter reloc_info_writer;
+ 
+  private:
+-  // Avoid overflows for displacements etc.
+-  static const int kMaximalBufferSize = 512 * MB;
+-
+   // Repeated checking whether the trampoline pool should be emitted is rather
+   // expensive. By default we only check again once a number of instructions
+   // has been generated.
+diff --git a/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.cc b/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.cc
+index db51cd96c5f2..75d6fdefa442 100644
+--- a/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.cc
++++ b/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.cc
+@@ -773,12 +773,9 @@ void Assembler::GrowBuffer(int needed) {
+ 
+   // Compute new buffer size.
+   int old_size = buffer_->size();
+-  int new_size = std::min(2 * old_size, old_size + 1 * MB);
++  int new_size = ComputeNewBufferSize(BufferGrowthStrategy::kDoubleCapped1MB);
+   int space = buffer_space() + (new_size - old_size);
+   new_size += (space < needed) ? needed - space : 0;
+-
+-  // Some internal data structures overflow for very large buffers,
+-  // they must ensure that kMaximalBufferSize is not too large.
+   if (new_size > kMaximalBufferSize) {
+     V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
+   }
+diff --git a/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.h b/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.h
+index 5f4aca67ea5d..8cef29e287ee 100644
+--- a/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.h
++++ b/src/3rdparty/chromium/v8/src/codegen//s390/assembler-s390.h
+@@ -1383,9 +1383,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
+   void RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data = 0);
+ 
+  private:
+-  // Avoid overflows for displacements etc.
+-  static const int kMaximalBufferSize = 512 * MB;
+-
+   // Relocation info generation
+   // Each relocation is encoded as a variable size value
+   static constexpr int kMaxRelocSize = RelocInfoWriter::kMaxSize;

diff --git a/qtwebengine-fix-v8-kMaximalBufferSize-private.patch b/qtwebengine-fix-v8-kMaximalBufferSize-private.patch
deleted file mode 100644
index 5e5d186..0000000
--- a/qtwebengine-fix-v8-kMaximalBufferSize-private.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/src/3rdparty/chromium/v8/src/baseline/baseline-compiler.cc b/src/3rdparty/chromium/v8/src/baseline/baseline-compiler.cc
---- a/src/3rdparty/chromium/v8/src/baseline/baseline-compiler.cc
-+++ b/src/3rdparty/chromium/v8/src/baseline/baseline-compiler.cc
-@@ -275,11 +275,11 @@ std::unique_ptr<AssemblerBuffer> AllocateBuffer(
-   }
-   int raw_estimated_size;
-   if (!estimated_size.AssignIfValid(&raw_estimated_size) ||
--      raw_estimated_size > Assembler::kMaximalBufferSize) {
-+      raw_estimated_size > AssemblerBase::kMaximalBufferSize) {
-     V8::FatalProcessOutOfMemory(nullptr, "BaselineCompiler::AllocateBuffer");
-   }
-   int rounded_size = RoundUp(raw_estimated_size, 4 * KB);
--  if (rounded_size > Assembler::kMaximalBufferSize) {
-+  if (rounded_size > AssemblerBase::kMaximalBufferSize) {
-     V8::FatalProcessOutOfMemory(nullptr, "BaselineCompiler::AllocateBuffer");
-   }
-   return NewAssemblerBuffer(rounded_size);