deps: update V8 to 14.6 by targos · Pull Request #61898 · nodejs/node

targos · 2026-02-20T11:02:38Z

PR for previous version: #61681

nodejs-github-bot · 2026-02-20T11:02:43Z

Review requested:

@nodejs/gyp
@nodejs/security-wg
@nodejs/v8-update

targos · 2026-02-20T11:04:00Z

Compared to version 14.5, there is a new test failure that is not obvious. Local run:

=== release test-repl-mode ===                                                
Path: parallel/test-repl-mode
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: The input did not match the regular expression /ReferenceError: x is not defined/. Input:

'> 3\n> '

    at testStrictMode (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:38:10)
    at /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:18:3
    at Array.forEach (<anonymous>)
    at Object.<anonymous> (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:17:7)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5) {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: '> 3\n> ',
  expected: /ReferenceError: x is not defined/,
  operator: 'match',
  diff: 'simple'
}

Node.js v26.0.0-pre
Command: out/Release/node /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js

targos · 2026-02-20T13:46:29Z

Additionally, snapshot is no longer reproducible:

Edit: not macOS-specific: https://github.com/nodejs/node/actions/runs/22221811293/job/64279253109

=== release test-snapshot-reproducible ===
Path: parallel/test-snapshot-reproducible
Error: --- stderr ---
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines

  [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
...
    'namespace node {',
+   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
-   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,-72,125,-78,63,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
    '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,-95,18,0,40,-48,24,0,104,-6,28,0,-48,-8,29,0,-24,-11,30,0,-48,-15,31,0,-88,6,-34,-64,-80,-96,18,0,-95,24,96,0,0,0,0,83,0,0,0,96,0,0,0,0,  // 1',
    '0,0,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,-61,1,0,0,96,0,0,0,0,60,0,0,0,96,0,0,0,0,-28,1,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,36,1,0,0,11,5,24,-30,-1,1,  // 2',
    '5,24,-94,0,2,5,24,98,1,2,5,24,34,2,2,5,24,-30,2,2,5,24,-94,3,2,5,24,98,4,2,5,24,34,5,2,5,24,-30,5,2,5,24,-94,6,2,5,24,98,7,2,5,24,34,8,2,5,24,-30,8,2,1,76,7,101,  // 3',
    '15,69,64,97,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,98,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,64,96,0,0,0,0,0,0,0,0,7,-123,2,64,96,0,0,0,  // 4',
    '0,8,0,0,0,-127,0,91,64,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,  // 5',
...
    '0,0,0,4,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-124,0,7,33,10,1,28,-108,-128,27,31,16,5,24,-94,-65,2,6,77,31,4,-67,52,1,12,7,29,1,64,32,109,18,96,  // 34655',
+   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-45,31,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
-   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-122,33,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
    '0,0,0,30,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-115,0,9,53,8,1,12,7,1,  // 34657',
    '15,1,28,-106,-128,27,32,4,6,5,1,1,40,4,92,96,0,0,0,0,8,0,0,0,6,9,1,4,100,1,28,-106,-128,27,31,8,5,24,-94,-65,2,6,85,31,-109,1,12,-108,64,32,117,18,9,-107,2,1,32,4,-124,-128,27,32,81,15,  // 34658',
    '6,-31,27,4,61,59,4,29,47,65,1,28,-106,-128,27,32,85,15,6,-27,27,-108,4,37,47,64,1,28,4,40,-128,27,32,89,15,6,-23,27,-108,4,45,47,4,49,47,66,96,0,0,0,0,1,3,0,0,71,7,117,16,96,0,0,0,0,  // 34659',
    '13,2,0,0,72,7,121,16,96,0,0,0,0,13,1,0,0,91,32,93,15,6,-19,27,-108,4,53,47,1,28,-105,-128,27,31,8,5,24,-94,-65,2,6,89,31,4,-67,52,1,12,7,29,1,64,32,121,18,1,32,4,-124,-128,27,31,20,5,  // 34660',
    '24,-94,-65,2,6,93,31,-107,1,12,-106,64,32,125,18,65,1,32,-105,-128,27,31,12,5,24,-94,-65,2,6,97,31,-107,1,12,-106,64,32,-127,18,65,1,32,-105,-128,27,31,16,5,24,-94,-65,2,6,101,31,-107,1,12,-106,64,32,-123,18,65,  // 34661',

    at Object.<anonymous> (/Users/runner/work/node/node/node/test/parallel/test-snapshot-reproducible.js:47:8)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5)
    at node:internal/main/run_main_module:33:47 {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
    '',
    '// This file is generated by tools/snapshot. Do not edit.',
    '',
    'namespace node {',
    'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88

Renegade334 · 2026-02-21T13:48:21Z

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

sxa · 2026-02-22T22:04:58Z

Additionally, snapshot is no longer reproducible:

FYI @joyeecheung

sxa · 2026-02-22T22:06:07Z

For what it's worth this branch seems to build ok with a RISC-V cross compiler too 👍🏻 (An experimental platform but I thought I'd mention it anyway ;-) )

targos · 2026-03-13T14:51:08Z

@nodejs/platform-windows Can you please have a look at the Windows build failure?

targos · 2026-03-13T15:54:32Z

There's still this REPL strict mode issue: #61898 (comment)

@nodejs/repl

targos · 2026-03-13T15:55:25Z

And the reproducible snapshot: #61898 (comment)

@nodejs/startup (for lack of a more specific team)

Renegade334 · 2026-03-13T16:19:59Z

There's still this REPL strict mode issue: #61898 (comment)

It's not so much a REPL issue as an issue with the VM global sandbox interceptors, introduced as a regression with 113b5cf. Previously, we were simulating CheckContextualStoreToJSGlobalObject-esque behaviour by rejecting interceptions on global proxy properties in strict mode if the receiver was not the global object. Now that we can no longer observe the receiver, that mechanism doesn't exist, and statements like nonExistantGlobalVariable = 42 are setting a property on the global sandbox instead of throwing in strict mode.

(We should probably have VM tests for this.)

Renegade334 · 2026-03-13T16:21:22Z

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

We will either need to merge (or upstream) this, or change the GCC build requirement to >=14.1.

targos · 2026-03-13T16:22:41Z

Would you like to try and upstream it?

Renegade334 · 2026-03-13T16:27:52Z

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

joyeecheung · 2026-03-14T03:19:39Z

Locally this fixes the snapshot reproducibility test for me

See diff

diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index 0bc45bac300..f0047f044f2 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -63,6 +63,10 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kTargetOffset, target);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kHandlerOffset, handler);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kFlagsOffset, flags);
+#if TAGGED_SIZE_8_BYTES
+  StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kPaddingOffset,
+                                 Int32Constant(0));
+#endif
 
   return CAST(proxy);
 }
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index b6f6938450c..e0117df19f9 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -3945,6 +3945,9 @@ Handle<JSProxy> Factory::NewJSProxy(DirectHandle<JSReceiver> target,
   result->set_target(*target, SKIP_WRITE_BARRIER);
   result->set_handler(*handler, SKIP_WRITE_BARRIER);
   result->set_flags(JSProxy::IsRevocableBit::encode(revocable));
+#if TAGGED_SIZE_8_BYTES
+  result->set_padding(0);
+#endif
   return handle(result, isolate());
 }

Uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666243

joyeecheung · 2026-03-14T04:21:34Z

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

Also uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666244 (IIUC, it was a libstdc++ issue fixed by https://gcc.gnu.org/pipermail/libstdc++/2023-February/055493.html)

StefanStojanovic · 2026-03-16T12:43:04Z

@nodejs/platform-windows Can you please have a look at the Windows build failure?

I'll take a look. Thanks for the ping.

StefanStojanovic · 2026-03-16T16:54:08Z

@nodejs/platform-windows Can you please have a look at the Windows build failure?

Will look into it. Thanks for the ping.

So that snapshots with proxies can be reproducible. Refs: nodejs/node#61898 Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105830}

StefanStojanovic · 2026-03-17T09:46:58Z

@targos, here is the patch to enable building on Windows: v8-146-fix.patch. Two small changes were needed.

Original commit message: Zero-initialize proxy padding So that snapshots with proxies can be reproducible. Refs: nodejs#61898 Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105830} Refs: v8/v8@edeb0a4

targos · 2026-03-17T10:46:42Z

Thanks @StefanStojanovic and @joyeecheung. I pushed your fixes. Let's see how it goes on GH runners.

In illumos, madvise(3C) now takes `void *` for its first argument post-illumos#14418, but uses `caddr_t` pre-illumos#14418. This fix will detect if the illumos mman.h file in use is pre-or-post-illumos#14418 so builds can work either way. PR-URL: nodejs#58237 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Original commit message: GCC 15 removed avx10.2-512 target PiperOrigin-RevId: 823560321 Refs: google/highway@989a498 PR-URL: nodejs#60682 Fixes: nodejs#60566 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>

Original commit message: PPC/S390: [wasm] Fix jump table offset when patching ... need to make sure patching of target occurs at the correct spot based on what `EmitFarJumpSlot` emits. Also mask the branch offset in PPC64 EmitJumpSlot to match `Assembler::b()`. Change-Id: I5a8079d0079d8ad427034761d42c90b64d5746dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7642190 Reviewed-by: John <junyan1@ibm.com> Commit-Queue: Milad Farazmand <mfarazma@ibm.com> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#105646} Refs: v8/v8@aa0b288 PR-URL: nodejs#62136 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Original commit message: Zero-initialize proxy padding So that snapshots with proxies can be reproducible. Refs: nodejs#61898 Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105830} Refs: v8/v8@edeb0a4

Original commit message: Fix compilation for older version of libstdc++ On older versions of libstdc++, cmath didn't expose std::powl. Use std::pow instead. Co-Authored-By: René <contact.9a5d6388@renegade334.me.uk> Refs: https://gcc.gnu.org/pipermail/libstdc++/2023-February/055493.html Refs: nodejs#61898 Change-Id: I4587e14525cae68a05eda03c36b0af40759d9b64 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666244 Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#105884} Refs: v8/v8@d83f479

This enables v8_enable_seeded_array_index_hash and add a test for it. Fixes: https://hackerone.com/reports/3511792 deps: V8: backport 0a8b1cdcc8b2 Original commit message: implement rapidhash secret generation Bug: 409717082 Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: snek <snek@chromium.org> Cr-Commit-Position: refs/heads/main@{#101499} Refs: v8/v8@0a8b1cd Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 185f0fe09b72 Original commit message: [numbers] Refactor HashSeed as a lightweight view over ByteArray Instead of copying the seed and secrets into a struct with value fields, HashSeed now stores a pointer pointing either into the read-only ByteArray, or the static default seed for off-heap HashSeed::Default() calls. The underlying storage is always 8-byte aligned so we can cast it directly into a struct. Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105531} Refs: v8/v8@185f0fe Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 1361b2a49d02 Original commit message: [strings] improve array index hash distribution Previously, the hashes stored in a Name's raw_hash_field for decimal numeric strings (potential array indices) consist of the literal integer value along with the length of the string. This means consecutive numeric strings can have consecutive hash values, which can lead to O(n^2) probing for insertion in the worst case when e.g. a non-numeric string happen to land in the these buckets. This patch adds a build-time flag v8_enable_seeded_array_index_hash that scrambles the 24-bit array-index value stored in a Name's raw_hash_field to improve the distribution. x ^= x >> kShift; x = (x * m1) & kMask; // round 1 x ^= x >> kShift; x = (x * m2) & kMask; // round 2 x ^= x >> kShift; // finalize To decode, apply the same steps with the modular inverses of m1 and m2 in reverse order. x ^= x >> kShift; x = (x * m2_inv) & kMask; // round 1 x ^= x >> kShift; x = (x * m1_inv) & kMask; // round 2 x ^= x >> kShift; // finalize where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask, m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv, m2_inv (modular inverses) are precomputed modular inverse of m1 and m2. The pre-computed values are appended to the hash_seed ByteArray in ReadOnlyRoots and accessed in generated code to reduce overhead. In call sites that don't already have access to the seeds, we read them from the current isolate group/isolate's read only roots. To consolidate the code that encode/decode these hashes, this patch adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA that perform seeding/unseeding if enabled, and updates places where encoding/decoding of array index is needed to use them. Bug: 477515021 Change-Id: I350afe511951a54c4378396538152cc56565fd55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105596} Refs: v8/v8@1361b2a Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: cherry-pick aac14dd95e5b Original commit message: [string] add 3rd round to seeded array index hash Since we already have 3 derived secrets, and arithmetics are relatively cheap, add a 3rd round to the xorshift-multiply seeding scheme. This brings the bias from ~3.4 to ~0.4. Bug: 477515021 Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117 Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net> Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#105824} Refs: v8/v8@aac14dd PR-URL: nodejs-private/node-private#834 CVE-ID: CVE-2026-21717 deps: V8: backport 185f0fe09b72 Original commit message: [numbers] Refactor HashSeed as a lightweight view over ByteArray Instead of copying the seed and secrets into a struct with value fields, HashSeed now stores a pointer pointing either into the read-only ByteArray, or the static default seed for off-heap HashSeed::Default() calls. The underlying storage is always 8-byte aligned so we can cast it directly into a struct. Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105531} Refs: v8/v8@185f0fe Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 1361b2a49d02 Original commit message: [strings] improve array index hash distribution Previously, the hashes stored in a Name's raw_hash_field for decimal numeric strings (potential array indices) consist of the literal integer value along with the length of the string. This means consecutive numeric strings can have consecutive hash values, which can lead to O(n^2) probing for insertion in the worst case when e.g. a non-numeric string happen to land in the these buckets. This patch adds a build-time flag v8_enable_seeded_array_index_hash that scrambles the 24-bit array-index value stored in a Name's raw_hash_field to improve the distribution. x ^= x >> kShift; x = (x * m1) & kMask; // round 1 x ^= x >> kShift; x = (x * m2) & kMask; // round 2 x ^= x >> kShift; // finalize To decode, apply the same steps with the modular inverses of m1 and m2 in reverse order. x ^= x >> kShift; x = (x * m2_inv) & kMask; // round 1 x ^= x >> kShift; x = (x * m1_inv) & kMask; // round 2 x ^= x >> kShift; // finalize where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask, m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv, m2_inv (modular inverses) are precomputed modular inverse of m1 and m2. The pre-computed values are appended to the hash_seed ByteArray in ReadOnlyRoots and accessed in generated code to reduce overhead. In call sites that don't already have access to the seeds, we read them from the current isolate group/isolate's read only roots. To consolidate the code that encode/decode these hashes, this patch adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA that perform seeding/unseeding if enabled, and updates places where encoding/decoding of array index is needed to use them. Bug: 477515021 Change-Id: I350afe511951a54c4378396538152cc56565fd55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105596} Refs: v8/v8@1361b2a Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: cherry-pick aac14dd95e5b Original commit message: [string] add 3rd round to seeded array index hash Since we already have 3 derived secrets, and arithmetics are relatively cheap, add a 3rd round to the xorshift-multiply seeding scheme. This brings the bias from ~3.4 to ~0.4. Bug: 477515021 Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117 Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net> Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#105824} Refs: v8/v8@aac14dd

Co-Authored-By: StefanStojanovic <stefan.stojanovic@janeasystems.com>

Refs: v8/v8@51d2067

Add args to `tools/make-v8.sh` for compiling Rust-based components, such as Temporal, for the Linux on ppc64le and s390x V8 CI builds.

Use the method without context parameter; the old API is deprecated. Refs: https://crrev.com/c/7141498

Use the new API which gets a `ModuleCachingCallback` parameter. Refs: https://crrev.com/c/7078551

Refs: nodejs#60616

targos · 2026-03-26T09:25:36Z

The GitHub CI is now green, but we know that the vm case has not been fixed. What do we do?

nodejs-github-bot · 2026-03-26T10:17:06Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71989/
V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/7088/

targos · 2026-03-26T10:50:59Z

Okay, now we're back to a debug build error that already happened with earlier V8 versions. @joyeecheung found a fix for it (093b60b) but that doesn't work anymore, because debug builds also create a release binary and the v8_enable_verify_write_barriers should not be set when creating the release binary. I don't know how to tweak the config to fix that!

nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. labels Feb 20, 2026

This was referenced Feb 20, 2026

deps: update V8 to 14.4 #61002

Closed

deps: update V8 to 14.5 #61681

Closed

targos added the semver-major PRs that contain breaking changes and should be released in the next major version. label Feb 20, 2026

targos force-pushed the v8-146 branch from 1e241d1 to 25c85aa Compare February 20, 2026 11:10

targos added the help wanted Issues that need assistance from volunteers or PRs that need help to proceed. label Feb 20, 2026

targos force-pushed the v8-146 branch from 25c85aa to c63c70d Compare March 13, 2026 14:08

danmcd and others added 17 commits March 26, 2026 07:13

deps: patch V8 to fix Windows build

cc22bc0

tools: update V8 gypfiles for 14.4

ff00823

Co-Authored-By: StefanStojanovic <stefan.stojanovic@janeasystems.com>

tools: update V8 gypfiles for 14.5

2c31076

tools: update V8 gypfiles for 14.6

a28a2d3

Refs: v8/v8@51d2067

tools: add Rust args to tools/make-v8.sh

8d8435a

Add args to `tools/make-v8.sh` for compiling Rust-based components, such as Temporal, for the Linux on ppc64le and s390x V8 CI builds.

src: avoid deprecated FixedArray::Get

be6e87f

Use the method without context parameter; the old API is deprecated. Refs: https://crrev.com/c/7141498

src: avoid deprecated Wasm API

2958a8e

Use the new API which gets a `ModuleCachingCallback` parameter. Refs: https://crrev.com/c/7078551

src: stop using v8::PropertyCallbackInfo<T>::This()

8b8a1e1

Refs: nodejs#60616

src: replace uses of deprecated v8::External APIs

4833051

test: add type tags to uses of v8::External

6f80a3b

test: support presence of Temporal global

8ed3a3f

targos force-pushed the v8-146 branch from b91a34a to 8ed3a3f Compare March 26, 2026 06:28

targos added the request-ci Add this label to start a Jenkins CI on a PR. label Mar 26, 2026

github-actions bot added request-ci-failed An error occurred while starting CI via request-ci label, and manual interventon is needed. and removed request-ci Add this label to start a Jenkins CI on a PR. labels Mar 26, 2026

Uh oh!

Conversation

targos commented Feb 20, 2026

Uh oh!

nodejs-github-bot commented Feb 20, 2026

Uh oh!

targos commented Feb 20, 2026

Uh oh!

targos commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Renegade334 commented Feb 21, 2026

Uh oh!

sxa commented Feb 22, 2026

Uh oh!

sxa commented Feb 22, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

Renegade334 commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Renegade334 commented Mar 13, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

Renegade334 commented Mar 13, 2026

Uh oh!

joyeecheung commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joyeecheung commented Mar 14, 2026

Uh oh!

StefanStojanovic commented Mar 16, 2026

Uh oh!

StefanStojanovic commented Mar 16, 2026

Uh oh!

StefanStojanovic commented Mar 17, 2026

Uh oh!

targos commented Mar 17, 2026

Uh oh!

targos commented Mar 26, 2026

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented Mar 26, 2026 • edited by targos Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

targos commented Mar 26, 2026

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

targos commented Feb 20, 2026 •

edited

Loading

Renegade334 commented Mar 13, 2026 •

edited

Loading

joyeecheung commented Mar 14, 2026 •

edited

Loading

nodejs-github-bot commented Mar 26, 2026 •

edited by targos

Loading