From 0a84413ba8c8f877f608442a25ba749b76fc027d Mon Sep 17 00:00:00 2001 From: Sadhbh Code Date: Mon, 15 Jun 2026 10:58:53 +0100 Subject: [PATCH 1/5] quickjs set stack limit --- quickjs/deps/quickjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/quickjs/deps/quickjs b/quickjs/deps/quickjs index cec4427..9a59f17 160000 --- a/quickjs/deps/quickjs +++ b/quickjs/deps/quickjs @@ -1 +1 @@ -Subproject commit cec44274d0b0abb9670e978a32ed4b4c2dd3b0bd +Subproject commit 9a59f17a026ebc3b6932afa886c21ebf02689a2e From f6a584a11caf7a4bb90af20bb70b7b43b39c65b9 Mon Sep 17 00:00:00 2001 From: Arshia Ghafoori Date: Wed, 24 Jun 2026 07:49:53 +0000 Subject: [PATCH 2/5] Remove NAPI_V8_NODE_ROOT defaults pointing at the node submodule. EdgeJS now resolves Node tests and fixtures from the repo root, so the V8 and QuickJS CMake entry points no longer need a separate upstream Node checkout path. Co-authored-by: Cursor --- quickjs/CMakeLists.txt | 8 -------- v8/CMakeLists.txt | 8 -------- 2 files changed, 16 deletions(-) diff --git a/quickjs/CMakeLists.txt b/quickjs/CMakeLists.txt index 9f83a39..8e16f59 100644 --- a/quickjs/CMakeLists.txt +++ b/quickjs/CMakeLists.txt @@ -17,14 +17,6 @@ set(NAPI_QUICKJS_ROOT "${CMAKE_CURRENT_SOURCE_DIR}") # include("${NAPI_V8_ROOT}/cmake/NapiEngine.cmake") # include("${NAPI_V8_ROOT}/cmake/NapiV8Resolver.cmake") # napi_engine_set_layout("${NAPI_V8_ROOT}") -# set(NAPI_V8_NODE_ROOT_DEFAULT "${PROJECT_ROOT}/node") -# if(DEFINED ENV{NAPI_V8_NODE_ROOT}) -# set(NAPI_V8_NODE_ROOT_DEFAULT "$ENV{NAPI_V8_NODE_ROOT}") -# endif() -# set(NAPI_V8_NODE_ROOT -# "${NAPI_V8_NODE_ROOT_DEFAULT}" -# CACHE PATH "Path to Node source root (for raw Node tests/fixtures)" -# ) # napi_v8_resolve_configuration() include("${NAPI_QUICKJS_ROOT}/cmake/NapiEngine.cmake") diff --git a/v8/CMakeLists.txt b/v8/CMakeLists.txt index 3830d2d..c5fa182 100644 --- a/v8/CMakeLists.txt +++ b/v8/CMakeLists.txt @@ -16,14 +16,6 @@ napi_enable_sccache_if_available() include("${NAPI_V8_ROOT}/cmake/NapiEngine.cmake") include("${NAPI_V8_ROOT}/cmake/NapiV8Resolver.cmake") napi_engine_set_layout("${NAPI_V8_ROOT}") -set(NAPI_V8_NODE_ROOT_DEFAULT "${PROJECT_ROOT}/node") -if(DEFINED ENV{NAPI_V8_NODE_ROOT}) - set(NAPI_V8_NODE_ROOT_DEFAULT "$ENV{NAPI_V8_NODE_ROOT}") -endif() -set(NAPI_V8_NODE_ROOT - "${NAPI_V8_NODE_ROOT_DEFAULT}" - CACHE PATH "Path to Node source root (for raw Node tests/fixtures)" -) napi_v8_resolve_configuration() file(GLOB_RECURSE NAPI_V8_SRC_FILES From bfe2ddcc80d4fca36876204184e9468bf1d74c91 Mon Sep 17 00:00:00 2001 From: Arshia Ghafoori Date: Wed, 24 Jun 2026 08:39:49 +0000 Subject: [PATCH 3/5] fix(quickjs): match JSEvalOptions designated initializer field order Place eval_flags before filename in napi_contextify so the struct matches QuickJS header field order and WASIX/native builds compile cleanly. Co-authored-by: Cursor --- quickjs/src/internal/napi_contextify.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/quickjs/src/internal/napi_contextify.cc b/quickjs/src/internal/napi_contextify.cc index ccadc15..d4ac04c 100644 --- a/quickjs/src/internal/napi_contextify.cc +++ b/quickjs/src/internal/napi_contextify.cc @@ -817,9 +817,9 @@ namespace quickjs::detail napi_env_context_scope__ child_scope{env_, record->ctx}; JSEvalOptions options{ .version = JS_EVAL_OPTIONS_VERSION, + .eval_flags = JS_EVAL_TYPE_GLOBAL, .filename = label.c_str(), .line_num = std::max(1, line_offset + 1), - .eval_flags = JS_EVAL_TYPE_GLOBAL, }; result = JS_EvalThis2(record->ctx, record->global, src.c_str(), src.size(), &options); if (JS_IsException(result)) From 3fb23117110fd4db3fcf9b351ed97816f115cef6 Mon Sep 17 00:00:00 2001 From: Arshia Ghafoori Date: Tue, 30 Jun 2026 15:59:57 +0000 Subject: [PATCH 4/5] Bump quickjs: cycle-GC use-after-free fix for async closures Points the quickjs submodule at wasmerio/quickjs#6 (fix/async-generator-gc-uaf, a5522a7), porting the CVE-2023-48184 / bellard#156 fix so the cycle collector no longer frees a value still referenced by a suspended async generator's closure var_ref. NOTE: not final until wasmerio/quickjs#6 merges; update this pointer to the merged commit afterward. Co-Authored-By: Claude Opus 4.8 (1M context) --- quickjs/deps/quickjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/quickjs/deps/quickjs b/quickjs/deps/quickjs index 9a59f17..a5522a7 160000 --- a/quickjs/deps/quickjs +++ b/quickjs/deps/quickjs @@ -1 +1 @@ -Subproject commit 9a59f17a026ebc3b6932afa886c21ebf02689a2e +Subproject commit a5522a7209cd4d57fc012556a1a788a53abe33c1 From 8bfea8b46f5bc2e9c2975dda3988da4cbd4d8bd7 Mon Sep 17 00:00:00 2001 From: Arshia Ghafoori Date: Tue, 30 Jun 2026 16:45:46 +0000 Subject: [PATCH 5/5] Bump quickjs: fix UAF of open closure var_refs in cycle GC Pulls in wasmerio/quickjs 14bf204, which fixes a heap-use-after-free where open closure var_refs could outlive the async frame they point into when an incomplete async function/generator is freed during cycle collection. Co-Authored-By: Claude Opus 4.8 (1M context) --- quickjs/deps/quickjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/quickjs/deps/quickjs b/quickjs/deps/quickjs index a5522a7..14bf204 160000 --- a/quickjs/deps/quickjs +++ b/quickjs/deps/quickjs @@ -1 +1 @@ -Subproject commit a5522a7209cd4d57fc012556a1a788a53abe33c1 +Subproject commit 14bf204368c94862b6e82b728de69bf4cb6cc350