Skip to content

deps: update V8 to 14.6#61898

Open
targos wants to merge 31 commits intonodejs:mainfrom
targos:v8-146
Open

deps: update V8 to 14.6#61898
targos wants to merge 31 commits intonodejs:mainfrom
targos:v8-146

Conversation

@targos
Copy link
Copy Markdown
Member

@targos targos commented Feb 20, 2026

PR for previous version: #61681

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/v8-update

@nodejs-github-bot nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. labels Feb 20, 2026
@targos
Copy link
Copy Markdown
Member Author

targos commented Feb 20, 2026

Compared to version 14.5, there is a new test failure that is not obvious. Local run:

=== release test-repl-mode ===                                                
Path: parallel/test-repl-mode
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: The input did not match the regular expression /ReferenceError: x is not defined/. Input:

'> 3\n> '

    at testStrictMode (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:38:10)
    at /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:18:3
    at Array.forEach (<anonymous>)
    at Object.<anonymous> (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:17:7)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5) {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: '> 3\n> ',
  expected: /ReferenceError: x is not defined/,
  operator: 'match',
  diff: 'simple'
}

Node.js v26.0.0-pre
Command: out/Release/node /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js

This was referenced Feb 20, 2026
@targos targos added the semver-major PRs that contain breaking changes and should be released in the next major version. label Feb 20, 2026
@targos
Copy link
Copy Markdown
Member Author

targos commented Feb 20, 2026

Additionally, snapshot is no longer reproducible:

Edit: not macOS-specific: https://github.com/nodejs/node/actions/runs/22221811293/job/64279253109

=== release test-snapshot-reproducible ===
Path: parallel/test-snapshot-reproducible
Error: --- stderr ---
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines

  [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
...
    'namespace node {',
+   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
-   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,-72,125,-78,63,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
    '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,-95,18,0,40,-48,24,0,104,-6,28,0,-48,-8,29,0,-24,-11,30,0,-48,-15,31,0,-88,6,-34,-64,-80,-96,18,0,-95,24,96,0,0,0,0,83,0,0,0,96,0,0,0,0,  // 1',
    '0,0,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,-61,1,0,0,96,0,0,0,0,60,0,0,0,96,0,0,0,0,-28,1,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,36,1,0,0,11,5,24,-30,-1,1,  // 2',
    '5,24,-94,0,2,5,24,98,1,2,5,24,34,2,2,5,24,-30,2,2,5,24,-94,3,2,5,24,98,4,2,5,24,34,5,2,5,24,-30,5,2,5,24,-94,6,2,5,24,98,7,2,5,24,34,8,2,5,24,-30,8,2,1,76,7,101,  // 3',
    '15,69,64,97,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,98,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,64,96,0,0,0,0,0,0,0,0,7,-123,2,64,96,0,0,0,  // 4',
    '0,8,0,0,0,-127,0,91,64,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,  // 5',
...
    '0,0,0,4,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-124,0,7,33,10,1,28,-108,-128,27,31,16,5,24,-94,-65,2,6,77,31,4,-67,52,1,12,7,29,1,64,32,109,18,96,  // 34655',
+   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-45,31,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
-   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-122,33,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
    '0,0,0,30,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-115,0,9,53,8,1,12,7,1,  // 34657',
    '15,1,28,-106,-128,27,32,4,6,5,1,1,40,4,92,96,0,0,0,0,8,0,0,0,6,9,1,4,100,1,28,-106,-128,27,31,8,5,24,-94,-65,2,6,85,31,-109,1,12,-108,64,32,117,18,9,-107,2,1,32,4,-124,-128,27,32,81,15,  // 34658',
    '6,-31,27,4,61,59,4,29,47,65,1,28,-106,-128,27,32,85,15,6,-27,27,-108,4,37,47,64,1,28,4,40,-128,27,32,89,15,6,-23,27,-108,4,45,47,4,49,47,66,96,0,0,0,0,1,3,0,0,71,7,117,16,96,0,0,0,0,  // 34659',
    '13,2,0,0,72,7,121,16,96,0,0,0,0,13,1,0,0,91,32,93,15,6,-19,27,-108,4,53,47,1,28,-105,-128,27,31,8,5,24,-94,-65,2,6,89,31,4,-67,52,1,12,7,29,1,64,32,121,18,1,32,4,-124,-128,27,31,20,5,  // 34660',
    '24,-94,-65,2,6,93,31,-107,1,12,-106,64,32,125,18,65,1,32,-105,-128,27,31,12,5,24,-94,-65,2,6,97,31,-107,1,12,-106,64,32,-127,18,65,1,32,-105,-128,27,31,16,5,24,-94,-65,2,6,101,31,-107,1,12,-106,64,32,-123,18,65,  // 34661',

    at Object.<anonymous> (/Users/runner/work/node/node/node/test/parallel/test-snapshot-reproducible.js:47:8)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5)
    at node:internal/main/run_main_module:33:47 {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
    '',
    '// This file is generated by tools/snapshot. Do not edit.',
    '',
    'namespace node {',
    'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88

@targos targos added the help wanted Issues that need assistance from volunteers or PRs that need help to proceed. label Feb 20, 2026
@Renegade334
Copy link
Copy Markdown
Member

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

@sxa
Copy link
Copy Markdown
Member

sxa commented Feb 22, 2026

Additionally, snapshot is no longer reproducible:

FYI @joyeecheung

@sxa
Copy link
Copy Markdown
Member

sxa commented Feb 22, 2026

For what it's worth this branch seems to build ok with a RISC-V cross compiler too 👍🏻 (An experimental platform but I thought I'd mention it anyway ;-) )

@targos
Copy link
Copy Markdown
Member Author

targos commented Mar 13, 2026

@nodejs/platform-windows Can you please have a look at the Windows build failure?

@targos
Copy link
Copy Markdown
Member Author

targos commented Mar 13, 2026

There's still this REPL strict mode issue: #61898 (comment)

@nodejs/repl

@targos
Copy link
Copy Markdown
Member Author

targos commented Mar 13, 2026

And the reproducible snapshot: #61898 (comment)

@nodejs/startup (for lack of a more specific team)

@Renegade334
Copy link
Copy Markdown
Member

Renegade334 commented Mar 13, 2026

There's still this REPL strict mode issue: #61898 (comment)

It's not so much a REPL issue as an issue with the VM global sandbox interceptors, introduced as a regression with 113b5cf. Previously, we were simulating CheckContextualStoreToJSGlobalObject-esque behaviour by rejecting interceptions on global proxy properties in strict mode if the receiver was not the global object. Now that we can no longer observe the receiver, that mechanism doesn't exist, and statements like nonExistantGlobalVariable = 42 are setting a property on the global sandbox instead of throwing in strict mode.

(We should probably have VM tests for this.)

@Renegade334
Copy link
Copy Markdown
Member

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

We will either need to merge (or upstream) this, or change the GCC build requirement to >=14.1.

@targos
Copy link
Copy Markdown
Member Author

targos commented Mar 13, 2026

Would you like to try and upstream it?

@Renegade334
Copy link
Copy Markdown
Member

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

@joyeecheung
Copy link
Copy Markdown
Member

joyeecheung commented Mar 14, 2026

Locally this fixes the snapshot reproducibility test for me

See diff
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index 0bc45bac300..f0047f044f2 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -63,6 +63,10 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kTargetOffset, target);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kHandlerOffset, handler);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kFlagsOffset, flags);
+#if TAGGED_SIZE_8_BYTES
+  StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kPaddingOffset,
+                                 Int32Constant(0));
+#endif
 
   return CAST(proxy);
 }
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index b6f6938450c..e0117df19f9 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -3945,6 +3945,9 @@ Handle<JSProxy> Factory::NewJSProxy(DirectHandle<JSReceiver> target,
   result->set_target(*target, SKIP_WRITE_BARRIER);
   result->set_handler(*handler, SKIP_WRITE_BARRIER);
   result->set_flags(JSProxy::IsRevocableBit::encode(revocable));
+#if TAGGED_SIZE_8_BYTES
+  result->set_padding(0);
+#endif
   return handle(result, isolate());
 }
 

Uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666243

@joyeecheung
Copy link
Copy Markdown
Member

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

Also uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666244 (IIUC, it was a libstdc++ issue fixed by https://gcc.gnu.org/pipermail/libstdc++/2023-February/055493.html)

@StefanStojanovic
Copy link
Copy Markdown
Contributor

@nodejs/platform-windows Can you please have a look at the Windows build failure?

I'll take a look. Thanks for the ping.

@StefanStojanovic
Copy link
Copy Markdown
Contributor

@nodejs/platform-windows Can you please have a look at the Windows build failure?

Will look into it. Thanks for the ping.

hubot pushed a commit to v8/v8 that referenced this pull request Mar 16, 2026
So that snapshots with proxies can be reproducible.

Refs: nodejs/node#61898
Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#105830}
@StefanStojanovic
Copy link
Copy Markdown
Contributor

@targos, here is the patch to enable building on Windows: v8-146-fix.patch. Two small changes were needed.

targos pushed a commit to targos/node that referenced this pull request Mar 17, 2026
Original commit message:

    Zero-initialize proxy padding

    So that snapshots with proxies can be reproducible.

    Refs: nodejs#61898
    Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105830}

Refs: v8/v8@edeb0a4
@targos
Copy link
Copy Markdown
Member Author

targos commented Mar 17, 2026

Thanks @StefanStojanovic and @joyeecheung. I pushed your fixes. Let's see how it goes on GH runners.

@targos
Copy link
Copy Markdown
Member Author

targos commented Apr 3, 2026

I opened nodejs/build#4290 to skip smartos22
nodejs/build#4286 is the other blocker

So we're waiting for these to get a green CI, but this PR is now ready!

/cc @nodejs/v8-update @nodejs/tsc

@targos targos removed request-ci-failed An error occurred while starting CI via request-ci label, and manual interventon is needed. help wanted Issues that need assistance from volunteers or PRs that need help to proceed. labels Apr 3, 2026
@aduh95 aduh95 added the request-ci Add this label to start a Jenkins CI on a PR. label Apr 3, 2026
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Apr 3, 2026
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

targos pushed a commit to targos/node that referenced this pull request Apr 3, 2026
Original commit message:

    [runtime] always sort transition arrays during rehashing

    After rehashing, the arrays are no longer in hash-sorted order.
    In this case, we need to force a re-sort even for small arrays,
    so that subsequent linear searches can find the correct transition
    and avoid inserting duplicates.

    Refs: nodejs#61898 (comment)
    Change-Id: Ia813d1fb9d23e08012811d672052d235c0e0bf4d
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7723678
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Reviewed-by: Igor Sheludko <ishell@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#106255}

Refs: v8/v8@00f6e83
@targos
Copy link
Copy Markdown
Member Author

targos commented Apr 3, 2026

Needs a new change after #59034

Error: Found 4 unexpected passes. Consider updating test/wpt/status/wasm/jsapi.json for these files:
memory/to-fixed-length-buffer-shared.any.js
memory/to-fixed-length-buffer.any.js
memory/to-resizable-buffer-shared.any.js
memory/to-resizable-buffer.any.js
    at process.<anonymous> (/home/runner/work/node/node/node/test/common/wpt.js:813:15)
    at process.emit (node:events:509:20)

Node.js v26.0.0-pre

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. semver-major PRs that contain breaking changes and should be released in the next major version. v8 engine Issues and PRs related to the V8 dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

V8 deprecates passing receiver to interceptor callbacks