Skip to content

[v24.x] deps: V8: backport 6a0a25abaed3#61670

Open
kxxt wants to merge 64 commits intonodejs:v24.x-stagingfrom
kxxt:v24-rv-sp
Open

[v24.x] deps: V8: backport 6a0a25abaed3#61670
kxxt wants to merge 64 commits intonodejs:v24.x-stagingfrom
kxxt:v24-rv-sp

Conversation

@kxxt
Copy link
Contributor

@kxxt kxxt commented Feb 4, 2026

Original commit message:

[riscv] Fix sp handling in MacroAssembler::LeaveFrame

Keep sp <= fp to ensure that data right above fp doesn't get clobbered
by an inopportune signal and its handler.

Such clobbering can happen in e.g. Node.js when JIT-compiled code is
interrupted by a SIGCHLD handler.

Bug: None
Change-Id: Ief0836032ada7942e89f081f7605f61632c4d414
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7540554
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn>
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#105069}

Refs: v8/v8@6a0a25a

This V8 backport fixes a long-standing heisenbug that affects riscv64 since at least node.js 16.

CC @sxa

@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/v8-update

@nodejs-github-bot nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. v8 engine Issues and PRs related to the V8 dependency. labels Feb 4, 2026
kxxt added a commit to kxxt/archriscv-packages that referenced this pull request Feb 4, 2026
- Backport chromium-review.googlesource.com/c/v8/v8/+/7540554 to fix the
  long-standing nodejs heisenbug Sporadic Nodejs segfault on sg2042 revyos/revyos#27.
  Upstream PR: nodejs/node#61670
- `--nocheck` is needed. There is one test failure:

    === release test-repl-paste-big-data ===
    Path: parallel/test-repl-paste-big-data
    node:internal/assert/utils:77
        throw err;
        ^

    AssertionError [ERR_ASSERTION]: The expression evaluated to a falsy value:

      assert.ok(diff.user < 1e6)

        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js:22:10)
        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/common/index.js:476:15)
        at Object.onceWrapper (node:events:622:28)
        at REPLServer.emit (node:events:508:28)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.emitExit (node:repl:850:10)
        at REPLServer.emit (node:events:520:35)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.close (node:internal/readline/interface:555:10)
        at node:repl:1114:5 {
      generatedMessage: true,
      code: 'ERR_ASSERTION',
      actual: false,
      expected: true,
      operator: '==',
      diff: 'simple'
    }

    Node.js v24.13.0
    Command: out/Release/node /build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js
@aduh95 aduh95 added the blocked PRs that are blocked by other issues or PRs. label Feb 4, 2026
@aduh95
Copy link
Contributor

aduh95 commented Feb 4, 2026

Blocked on #61666

felixonmars pushed a commit to felixonmars/archriscv-packages that referenced this pull request Feb 4, 2026
- Backport chromium-review.googlesource.com/c/v8/v8/+/7540554 to fix the
  long-standing nodejs heisenbug Sporadic Nodejs segfault on sg2042 revyos/revyos#27.
  Upstream PR: nodejs/node#61670
- `--nocheck` is needed. There is one test failure:

    === release test-repl-paste-big-data ===
    Path: parallel/test-repl-paste-big-data
    node:internal/assert/utils:77
        throw err;
        ^

    AssertionError [ERR_ASSERTION]: The expression evaluated to a falsy value:

      assert.ok(diff.user < 1e6)

        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js:22:10)
        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/common/index.js:476:15)
        at Object.onceWrapper (node:events:622:28)
        at REPLServer.emit (node:events:508:28)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.emitExit (node:repl:850:10)
        at REPLServer.emit (node:events:520:35)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.close (node:internal/readline/interface:555:10)
        at node:repl:1114:5 {
      generatedMessage: true,
      code: 'ERR_ASSERTION',
      actual: false,
      expected: true,
      operator: '==',
      diff: 'simple'
    }

    Node.js v24.13.0
    Command: out/Release/node /build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js
joyeecheung and others added 16 commits February 10, 2026 17:39
This adds tests to ensure the V8 parts (v8, libplatform, cppgc)
in shared libnode works correctly.

PR-URL: nodejs#61463
Refs: nodejs#61144
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: nodejs#61540
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Support an `env` option that is passed to the underlying child_process.

Fixes: nodejs#60709
PR-URL: nodejs#61367
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
- Add bytes() method to get Uint8Array from streams
- Add tests for bytes() method in PassThrough and ObjectMode scenarios
- Update documentation

Fixes: nodejs#59542
PR-URL: nodejs#60426
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Use StringPrototypeStartsWith from primordials instead of
String.prototype.startsWith to prevent prototype pollution.

Refs: nodejs#59699
PR-URL: nodejs#61492
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: nodejs#61564
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
PR-URL: nodejs#61550
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61568
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Avoid creating unnecessary garbage in the old space.

PR-URL: nodejs#61461
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Split and simplify the tests into individual files.

Refs: nodejs#61433
PR-URL: nodejs#61494
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: nodejs#60462
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
The comparison has to accept these as identical.

Fixes: nodejs#61583
PR-URL: nodejs#61587
Reviewed-By: Jithil P Ponnan <jithil@outlook.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
PR-URL: nodejs#61549
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61549
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
This patch extends `LoadEnvironment` to support loading ES modules,
and adds the following new types:

```cpp
enum class ModuleFormat : uint8_t {
  kCommonJS,
  kModule,
};

// Data for specifying an entry point script for LoadEnvironment().
// This class uses an opaque layout to allow future additions without
// breaking ABI. Use the setter methods to configure the entry point.
class ModuleData {
  void set_source(std::string_view source);
  void set_format(ModuleFormat format);
  void set_resource_name(std::string_view name);

  std::string_view source() const;
  ModuleFormat format() const;
  std::string_view resource_name() const;
};

class StartExecutionCallbackInfoWithModule {
  void set_env(Environment* env);
  void set_process_object(v8::Local<v8::Object> process_object);
  void set_native_require(v8::Local<v8::Function> native_require);
  void set_run_module(v8::Local<v8::Function> run_module);
  void set_data(void* data);

  Environment* env();
  v8::Local<v8::Object> process();
  v8::Local<v8::Function> native_require();
  v8::Local<v8::Function> run_module();
  void* data();
};
```

And two new `LoadEnvironment()` overloads:

```cpp
// Run entry point with ModuleData configuration
MaybeLocal<Value> LoadEnvironment(
    Environment* env,
    const ModuleData* entry_point,
    EmbedderPreloadCallback preload = nullptr);

// Callback-based with new StartExecutionCallbackInfoWithModule
MaybeLocal<Value> LoadEnvironment(
    Environment* env,
    StartExecutionCallbackWithModule cb,
    EmbedderPreloadCallback preload = nullptr,
    void* callback_data = nullptr);
```

PR-URL: nodejs#61548
Refs: nodejs#53565
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Aditi Singh <aditisingh1400@gmail.com>
PR-URL: nodejs#61573
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
mertcanaltin and others added 24 commits February 10, 2026 17:39
PR-URL: nodejs#61432
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
PR-URL: nodejs#61562
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
PR-URL: nodejs#61642
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Refs: nodejs#55017
PR-URL: nodejs#61644
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Tierney Cyren <hello@bnb.im>
PR-URL: nodejs#61663
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61672
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Defer socket.destroy() calls in internalConnect and
internalConnectMultiple to the next tick. This ensures that error
handlers have a chance to be set up before errors are emitted,
particularly important when using http.request with a custom
lookup function that returns synchronously.

Previously, if a synchronous lookup function returned an IP that
triggered an immediate error (e.g., via blockList), the error would
be emitted before the HTTP client had set up its error handler
(which happens via process.nextTick in onSocket). This caused
unhandled 'error' events.

Fixes: nodejs#48771
PR-URL: nodejs#61658
Refs: nodejs#51038
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
On Windows, file paths are case-insensitive but string comparison is
case-sensitive. When the drive letter case differs between the computed
project root and the actual output (e.g., 'C:/' vs 'c:/'), the path
replacement in transformProjectRoot() would fail.

This fix uses case-insensitive regex replacement on Windows to ensure
paths are correctly normalized in snapshot tests regardless of drive
letter casing.

Refs: nodejs/reliability#1453
PR-URL: nodejs#61682
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#61683
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
PR-URL: nodejs#61675
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
When binding UTF-8 strings to prepared statements, transfer ownership of
malloc-backed Utf8Value buffers to SQLite to avoid an extra copy for
large strings. Use sqlite3_bind_blob64() when binding BLOB parameters.

PR-URL: nodejs#61580
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
PR-URL: nodejs#61696
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: nodejs#61659
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
`require(mod)` does not keep the mod in require cache if
mod throws synchronously. This fixes the tests to print
the stack immediately in case that source map cache could
be cleaned up when the CJS module is reclaimed by GC in
the next event loop tick.

PR-URL: nodejs#61699
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Add documentation explaining that applications are expected to attach
'error' event handlers to EventEmitters that can emit errors, including
HTTP streams. Crashes resulting from missing error handlers are not
considered denial-of-service vulnerabilities in Node.js.

PR-URL: nodejs#61701
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Small perf improvement:

    $ node benchmark/compare.js --runs 100 \
    >   --old ./node-0da120f879 --new ./node \
    >   --filter structured-clone misc > comparison.csv && \
    >   npx node-benchmark-compare comparison.csv

    [00:02:15|% 100| 1/1 files | 200/200 runs | 3/3 configs]: Done
                                                        confidence improvement accuracy (*)   (**)  (***)
    misc/structured-clone.js n=10000 type='arraybuffer'         **      1.81 %       ±1.28% ±1.68% ±2.16%
    misc/structured-clone.js n=10000 type='object'               *      0.62 %       ±0.55% ±0.73% ±0.93%
    misc/structured-clone.js n=10000 type='string'             ***      8.30 %       ±1.46% ±1.92% ±2.47%

    Be aware that when doing many comparisons the risk of a false-positive result increases.
    In this case, there are 3 comparisons, you can thus expect the following amount of false-positive results:
      0.15 false positives, when considering a   5% risk acceptance (*, **, ***),
      0.03 false positives, when considering a   1% risk acceptance (**, ***),
      0.00 false positives, when considering a 0.1% risk acceptance (***)

PR-URL: nodejs#61703
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#61732
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
PR-URL: nodejs#61730
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61685
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: nodejs#61748
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#61279
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: nodejs#61280
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: nodejs#61341
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61456
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
@kxxt
Copy link
Contributor Author

kxxt commented Feb 13, 2026

Blocked on #61666

This could be unblocked now as #61666 has landed.

Original commit message:

    [riscv] Fix sp handling in MacroAssembler::LeaveFrame

    Keep sp <= fp to ensure that data right above fp doesn't get clobbered
    by an inopportune signal and its handler.

    Such clobbering can happen in e.g. Node.js when JIT-compiled code is
    interrupted by a SIGCHLD handler.

    Bug: None
    Change-Id: Ief0836032ada7942e89f081f7605f61632c4d414
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7540554
    Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
    Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn>
    Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105069}

Refs: v8/v8@6a0a25a
Co-authored-by: kxxt <rsworktech@outlook.com>
@aduh95 aduh95 requested a review from a team as a code owner February 14, 2026 09:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

blocked PRs that are blocked by other issues or PRs. build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.