FEX ARM64EC: null dereference in InvalidationTracker::InvalidateAlignedInterval when Node.js starts V8 — the process hangs

(FEX component; willfaust/FEX has issues disabled.)

Setup: iPhone 15 Pro, iOS 27, ARM64EC xtajit64.dll built from FEX ios-port-2607 (f59cab9) plus the ProcessorID change in willfaust/FEX#25. node.exe 22.23.4 (official x64 Windows zip), run as a child of a resident x64 supervisor.

Symptom: node.exe --version prints v22.23.4 and exits normally (V8 is not started). Anything that starts V8 does not:

node.exe -e "console.log(6*7)"     # no output, never exits
node.exe -e "process.exit(0)"      # never exits

The process is idle afterwards (no CPU, every thread parked), the parent's WaitForSingleObject on it never returns, and terminating it leaves the session unusable.

What the log says (first unhandled fault of the run, on the node thread):

[store-noalias] addr=0xf0 insn=0xf940794b pc=0x14eaa4404
[mach_exc] UNHANDLED #1 pc=0x14eaa4404 addr=0xf0 type=1 (EXC_BAD_ACCESS)

pc is libarm64ecfex.dll+0x12e404. With the unstripped module it symbolizes to FEX::Windows::InvalidationTracker::InvalidateAlignedInterval(unsigned long long, unsigned long long, bool), at

ldr x0,  [x0, #0x58]     ; this->CTX (the Context& member)
ldr x10, [x0]            ; the Context's first word (vtable)
...
ldr x11, [x10, #0xf0]    ; vtable slot 30  <-- x10 == 0

So a virtual call on CTX (presumably GetCodeInvalidationMutex() through InvalidateIntervalInternal) finds a null vtable pointer: the Context this tracker references reads as zero.

It happens right after FEX's own allocator releases a 16 MB span from that thread ([span-census] FREE #1 0x7c0c810000+0x1000000 tid=… live=18, then [iOS-xrem] via=aligned #40 … 0x7c0c810000-0x7c0d810000), i.e. while Wine notifies the tracker about FEX's own NtFreeVirtualMemory. V8 is the difference: it flips code pages between RW and RX continuously, so the tracker is entered far more often than in anything else tried (CPython, Go programs, Rust programs and vim all run fine).

Not known: whether the Context is genuinely destroyed at that point or this is a stale tracker; the failing call is the first one after the #40 log line. No FEX code was changed for this. Repro: any Node 20+ node.exe -e 1.

This is also where Electron/VS Code ends once its 32 GB V8-sandbox reservations are satisfied.