Skip to content

deps: update V8 to 14.6#61898

Open
targos wants to merge 20 commits intonodejs:mainfrom
targos:v8-146
Open

deps: update V8 to 14.6#61898
targos wants to merge 20 commits intonodejs:mainfrom
targos:v8-146

Conversation

@targos
Copy link
Member

@targos targos commented Feb 20, 2026

PR for previous version: #61681

@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/v8-update

@nodejs-github-bot nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. labels Feb 20, 2026
@targos
Copy link
Member Author

targos commented Feb 20, 2026

Compared to version 14.5, there is a new test failure that is not obvious. Local run:

=== release test-repl-mode ===                                                
Path: parallel/test-repl-mode
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: The input did not match the regular expression /ReferenceError: x is not defined/. Input:

'> 3\n> '

    at testStrictMode (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:38:10)
    at /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:18:3
    at Array.forEach (<anonymous>)
    at Object.<anonymous> (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:17:7)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5) {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: '> 3\n> ',
  expected: /ReferenceError: x is not defined/,
  operator: 'match',
  diff: 'simple'
}

Node.js v26.0.0-pre
Command: out/Release/node /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js

This was referenced Feb 20, 2026
@targos targos added the semver-major PRs that contain breaking changes and should be released in the next major version. label Feb 20, 2026
@targos
Copy link
Member Author

targos commented Feb 20, 2026

Additionally, snapshot is no longer reproducible:

Edit: not macOS-specific: https://github.com/nodejs/node/actions/runs/22221811293/job/64279253109

=== release test-snapshot-reproducible ===
Path: parallel/test-snapshot-reproducible
Error: --- stderr ---
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines

  [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
...
    'namespace node {',
+   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
-   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,-72,125,-78,63,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
    '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,-95,18,0,40,-48,24,0,104,-6,28,0,-48,-8,29,0,-24,-11,30,0,-48,-15,31,0,-88,6,-34,-64,-80,-96,18,0,-95,24,96,0,0,0,0,83,0,0,0,96,0,0,0,0,  // 1',
    '0,0,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,-61,1,0,0,96,0,0,0,0,60,0,0,0,96,0,0,0,0,-28,1,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,36,1,0,0,11,5,24,-30,-1,1,  // 2',
    '5,24,-94,0,2,5,24,98,1,2,5,24,34,2,2,5,24,-30,2,2,5,24,-94,3,2,5,24,98,4,2,5,24,34,5,2,5,24,-30,5,2,5,24,-94,6,2,5,24,98,7,2,5,24,34,8,2,5,24,-30,8,2,1,76,7,101,  // 3',
    '15,69,64,97,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,98,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,64,96,0,0,0,0,0,0,0,0,7,-123,2,64,96,0,0,0,  // 4',
    '0,8,0,0,0,-127,0,91,64,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,  // 5',
...
    '0,0,0,4,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-124,0,7,33,10,1,28,-108,-128,27,31,16,5,24,-94,-65,2,6,77,31,4,-67,52,1,12,7,29,1,64,32,109,18,96,  // 34655',
+   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-45,31,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
-   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-122,33,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
    '0,0,0,30,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-115,0,9,53,8,1,12,7,1,  // 34657',
    '15,1,28,-106,-128,27,32,4,6,5,1,1,40,4,92,96,0,0,0,0,8,0,0,0,6,9,1,4,100,1,28,-106,-128,27,31,8,5,24,-94,-65,2,6,85,31,-109,1,12,-108,64,32,117,18,9,-107,2,1,32,4,-124,-128,27,32,81,15,  // 34658',
    '6,-31,27,4,61,59,4,29,47,65,1,28,-106,-128,27,32,85,15,6,-27,27,-108,4,37,47,64,1,28,4,40,-128,27,32,89,15,6,-23,27,-108,4,45,47,4,49,47,66,96,0,0,0,0,1,3,0,0,71,7,117,16,96,0,0,0,0,  // 34659',
    '13,2,0,0,72,7,121,16,96,0,0,0,0,13,1,0,0,91,32,93,15,6,-19,27,-108,4,53,47,1,28,-105,-128,27,31,8,5,24,-94,-65,2,6,89,31,4,-67,52,1,12,7,29,1,64,32,121,18,1,32,4,-124,-128,27,31,20,5,  // 34660',
    '24,-94,-65,2,6,93,31,-107,1,12,-106,64,32,125,18,65,1,32,-105,-128,27,31,12,5,24,-94,-65,2,6,97,31,-107,1,12,-106,64,32,-127,18,65,1,32,-105,-128,27,31,16,5,24,-94,-65,2,6,101,31,-107,1,12,-106,64,32,-123,18,65,  // 34661',

    at Object.<anonymous> (/Users/runner/work/node/node/node/test/parallel/test-snapshot-reproducible.js:47:8)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5)
    at node:internal/main/run_main_module:33:47 {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
    '',
    '// This file is generated by tools/snapshot. Do not edit.',
    '',
    'namespace node {',
    'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88

@targos targos added the help wanted Issues that need assistance from volunteers or PRs that need help to proceed. label Feb 20, 2026
@Renegade334
Copy link
Member

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

@sxa
Copy link
Member

sxa commented Feb 22, 2026

Additionally, snapshot is no longer reproducible:

FYI @joyeecheung

@sxa
Copy link
Member

sxa commented Feb 22, 2026

For what it's worth this branch seems to build ok with a RISC-V cross compiler too 👍🏻 (An experimental platform but I thought I'd mention it anyway ;-) )

targos and others added 16 commits March 13, 2026 14:53
Major V8 updates are usually API/ABI incompatible with previous
versions. This commit adapts NODE_MODULE_VERSION for V8 14.6.

Refs: https://github.com/nodejs/CTC/blob/master/meetings/2016-09-28.md
PR-URL: nodejs#54077
Reviewed-By: Jiawen Geng <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
It's causing linker errors with node.lib in node-gyp and potentially
breaks other 3rd party tools

PR-URL: nodejs#56238
Refs: nodejs#55784
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
GCC emits warnings because of the trailing backslashes.

PR-URL: nodejs#58070
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
illumos pointers are VA48, can allocate from the top of the 64-bit range
as well.

PR-URL: nodejs#59805
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
In illumos, madvise(3C) now takes `void *` for its first argument
post-illumos#14418, but uses `caddr_t` pre-illumos#14418. This fix will
detect if the illumos mman.h file in use is pre-or-post-illumos#14418 so
builds can work either way.

PR-URL: nodejs#58237
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Original commit message:

    GCC 15 removed avx10.2-512 target

    PiperOrigin-RevId: 823560321

Refs: google/highway@989a498
PR-URL: nodejs#60682
Fixes: nodejs#60566
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>
Original commit message:

    PPC/S390: [wasm] Fix jump table offset when patching

    ... need to make sure patching of target occurs at the correct spot
    based on what `EmitFarJumpSlot` emits. Also mask the branch offset in
    PPC64 EmitJumpSlot to match `Assembler::b()`.

    Change-Id: I5a8079d0079d8ad427034761d42c90b64d5746dd
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7642190
    Reviewed-by: John <[email protected]>
    Commit-Queue: Milad Farazmand <[email protected]>
    Reviewed-by: Clemens Backes <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#105646}

Refs: v8/v8@aa0b288
PR-URL: nodejs#62136
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Add args to `tools/make-v8.sh` for compiling Rust-based components,
such as Temporal, for the Linux on ppc64le and s390x V8 CI builds.
Use the method without context parameter; the old API is deprecated.

Refs: https://crrev.com/c/7141498
Use the new API which gets a `ModuleCachingCallback` parameter.

Refs: https://crrev.com/c/7078551
@targos
Copy link
Member Author

targos commented Mar 13, 2026

@nodejs/platform-windows Can you please have a look at the Windows build failure?

@targos
Copy link
Member Author

targos commented Mar 13, 2026

There's still this REPL strict mode issue: #61898 (comment)

@nodejs/repl

@targos
Copy link
Member Author

targos commented Mar 13, 2026

And the reproducible snapshot: #61898 (comment)

@nodejs/startup (for lack of a more specific team)

@Renegade334
Copy link
Member

Renegade334 commented Mar 13, 2026

There's still this REPL strict mode issue: #61898 (comment)

It's not so much a REPL issue as an issue with the VM global sandbox interceptors, introduced as a regression with 113b5cf. Previously, we were simulating CheckContextualStoreToJSGlobalObject-esque behaviour by rejecting interceptions on global proxy properties in strict mode if the receiver was not the global object. Now that we can no longer observe the receiver, that mechanism doesn't exist, and statements like nonExistantGlobalVariable = 42 are setting a property on the global sandbox instead of throwing in strict mode.

(We should probably have VM tests for this.)

@Renegade334
Copy link
Member

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

We will either need to merge (or upstream) this, or change the GCC build requirement to >=14.1.

@targos
Copy link
Member Author

targos commented Mar 13, 2026

Would you like to try and upstream it?

@Renegade334
Copy link
Member

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

@joyeecheung
Copy link
Member

joyeecheung commented Mar 14, 2026

Locally this fixes the snapshot reproducibility test for me

See diff
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index 0bc45bac300..f0047f044f2 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -63,6 +63,10 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kTargetOffset, target);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kHandlerOffset, handler);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kFlagsOffset, flags);
+#if TAGGED_SIZE_8_BYTES
+  StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kPaddingOffset,
+                                 Int32Constant(0));
+#endif
 
   return CAST(proxy);
 }
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index b6f6938450c..e0117df19f9 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -3945,6 +3945,9 @@ Handle<JSProxy> Factory::NewJSProxy(DirectHandle<JSReceiver> target,
   result->set_target(*target, SKIP_WRITE_BARRIER);
   result->set_handler(*handler, SKIP_WRITE_BARRIER);
   result->set_flags(JSProxy::IsRevocableBit::encode(revocable));
+#if TAGGED_SIZE_8_BYTES
+  result->set_padding(0);
+#endif
   return handle(result, isolate());
 }
 

Uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666243

@joyeecheung
Copy link
Member

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

Also uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666244 (IIUC, it was a libstdc++ issue fixed by https://gcc.gnu.org/pipermail/libstdc++/2023-February/055493.html)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Issues and PRs related to build files or the CI. help wanted Issues that need assistance from volunteers or PRs that need help to proceed. needs-ci PRs that need a full CI run. semver-major PRs that contain breaking changes and should be released in the next major version. v8 engine Issues and PRs related to the V8 dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.