Uh oh!
There was an error while loading. Please reload this page.
deps: update V8 to 14.9 - #64784
Open
targos wants to merge 36 commits into
Open
Conversation
nodejs-github-bot
commented
Jul 27, 2026
Collaborator
Review requested:
|
targos
commented
Jul 27, 2026
MemberAuthor
|
targos
commented
Jul 27, 2026
MemberAuthor
@nodejs/v8-update @joyeecheung |
avivkeller
commented
Jul 27, 2026
Member
Can we try to include #64631? |
targos
commented
Jul 29, 2026
MemberAuthor
I will include it if it lands. |
Major V8 updates are usually API/ABI incompatible with previous versions. This commit adapts NODE_MODULE_VERSION for V8 14.9. Refs: https://github.com/nodejs/CTC/blob/master/meetings/2016-09-28.md
PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
It's causing linker errors with node.lib in node-gyp and potentially breaks other 3rd party tools Refs: nodejs#55784 PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
GCC emits warnings because of the trailing backslashes. PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
illumos pointers are VA48, can allocate from the top of the 64-bit range as well. PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
In illumos, madvise(3C) now takes `void *` for its first argument post-illumos#14418, but uses `caddr_t` pre-illumos#14418. This fix will detect if the illumos mman.h file in use is pre-or-post-illumos#14418 so builds can work either way. PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Original commit message: GCC 15 removed avx10.2-512 target PiperOrigin-RevId: 823560321 Refs: google/highway@989a498Fixes: nodejs#60566 PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
aix: simplify OS::DecommitPages implementation Replace complex mmap/munmap retry logic with mprotect + madvise approach. This fixes a race condition that was causing test failures in Node.js. Node.js stress test was run with this fix and testing shows 0 failures out of 1000 runs of wpt/test-wasm-jsapi with this patch compared to 224 failures without it. Refs: nodejs#62647 Refs: https://chromium-review.googlesource.com/c/v8/v8/+/7780464 PR-URL: nodejs#61898 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Signed-Off-By: Michaël Zasso <targos@protonmail.com>
Original commit message: [fastapi] Store v8::CFunction pointer directly in FunctionTemplateInfo FunctionTemplateInfo objects store a list of C-function pointer and signature pairs used to generate fast API calls. Previously, a separate struct was allocated and wrapped in a Managed<> object to store these pairs. With this CL, the v8::CFunction object provided by the API is instead wrapped in a Foreign object and stored directly in the FunctionTemplateInfo. Replacing Managed<> objects with Foreign objects restores the ability to serialize FunctionTemplateInfo objects. This change relies on the assumption that the CFunction object passed to FunctionTemplate::New outlives the FunctionTemplate itself. In practice, all embedders—including Chrome—already ensure this by holding the CFunction object in a static variable. In Chrome, this is how it has always been done; see, for example: https://source.chromium.org/chromium/chromium/src/+/main:out/android-Debug/gen/third_party/blink/renderer/bindings/modules/v8/v8_webgl2_rendering_context.cc;l=19485;drc=398e74869153a12e825bc789c2134762cbe81c36 Change-Id: Ib5eadb62b50edf7bd289a501f737750ed6e9e4fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7828135 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Arash Kazemi <arashk@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#107265} Refs: v8/v8@84f4af5
Original commit message: [wasm] Make LimitsByte::is_shared() work in GCC Importing a shared WebAssembly memory currently fails under gcc with LinkError: ...mismatch in shared state of memory, declared = 0, imported = 1 Since SharedFlag is `enum class : bool`, due to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96496, gcc currently incorrectly truncates the integer instead of converting it into boolean, so 0x3 ends up being converted to SharedFlag::kNo. This patch works around it with an explicit conversion. Change-Id: I426e578513b721888076c64616d2486ccae9e12a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7867245 Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#107524} Refs: v8/v8@000de18
Original commit message: [api] Add explicit `inline` to definitions using V8_INLINE `__forceinline` is only a hint and does not enforce inline linkage. When `V8_INLINE` expands to just `__forceinline`, out-of-class definitions can still violate ODR. Add explicit `inline` so it holds across all toolchains. Refs: nodejs#62572 Change-Id: I531f4a53e74dcaaf3b7b175cddc72e81ff6e5e4e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7874797 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#107600} Refs: v8/v8@bfa86ad
Original commit message: [runtime] Fix non-conforming std::atomic_flag initialization std::atomic_flag has no constructor taking bool. Use ATOMIC_FLAG_INIT to ensure it works across different standard library implementations. Refs: nodejs#62572 Change-Id: If5ff61339560aa0b9a2219aad9e5b6f2fd2b1155 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7874000 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#107728} Refs: v8/v8@70924d7
Original commit message: [api] Add ArrayBuffer::CopyArrayBufferBytes Make the not uncommon case of copying bytes from one ArrayBuffer to another easier and less surprising, in particular when SharedArrayBuffer semantics are involved. Change-Id: I2a2bc5cba4e8c3b2d88cfcb2df0ef7e2021a8f6f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7735151 Auto-Submit: Ben Noordhuis <info@bnoordhuis.nl> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#107890} Refs: v8/v8@ba2b3f0
Original commit message: [api] Deprecate kPromiseRejectAfterResolved and kPromiseResolveAfterResolved These events will be removed soon. Bug: 42213031 Change-Id: Ie70474ff33c40c7d9cb0c2d0fbe6b75da3c53a22 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7774767 Commit-Queue: Kevin Gibbons <bakkot@gmail.com> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#107395} Refs: v8/v8@1a391f9
Original commit message: [api] Remove PromiseResolveAfterResolved and PromiseRejectAfterResolved These were previously deprecated in https://crrev.com/c/7774767 Bug: 42213031 Change-Id: I07b802b743bf052611f30a61c1132231df22f0bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7897881 Commit-Queue: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#108040} Refs: v8/v8@0cc9eb2
Original commit message: [builtins] Make Promise resolvers not keep resolved Promises alive Currently a Promise's resolve/reject functions unconditionally hold the Promise, plus a separate bit to track whether the Promise has been resolved. Instead, hold a single field with Promise|Undefined. This allows GC'ing a resolved Promise even if its resolvers are still alive. R=olivf@chromium.org Fixed: 42213031 Change-Id: Ice645dbabb79e63dfcac8ae843cad95439d7a1f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7646250 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Kevin Gibbons <bakkot@gmail.com> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#108183} Refs: v8/v8@da20a19
Original commit message: [execution] Lookup interceptor for RestrictedGlobalProperty When the script context looks up if a global property is restricted, it should also query the global interceptor. To avoid calling the interceptor for every declaration unconditionally, an interceptor has to be defined with `PropertyHandlerFlags::kHasDontDeleteProperty` to intercept restricted global property queries. Refs: nodejs#63715 Refs: nodejs#52634 Change-Id: I623ff285c4e8773d8ee7f681cbad68ba24bd3f40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7898818 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#108280} Refs: v8/v8@a05321e Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net> PR-URL: nodejs#64202Fixes: nodejs#63715 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Original commit message: [wasm] Fix jump table slot overflow on x64 with CET enabled JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before checking if the target was reachable via a 32-bit displacement when CET was enabled. This caused a slot overflow when the far-jump fallback was triggered, as the second attempt to emit the slot would start at an incorrect offset. This CL ensures that the displacement check is performed before any instructions are emitted, making the function side-effect-free on failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify the displacement calculation, following the pattern used on ARM64. Reported-by: Fabien Romano <fabienromano@gmail.com> TAG=agy R=jkummerow@chromium.org Fixed: 532112743 Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#108556} Refs: v8/v8@1158ae7
Original commit message: [loong64][compiler] Extend Word64Select instruction functionality Change-Id: Iba762777642d2d2d3aa904f9afc1e9005139992e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7801520 Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Commit-Queue: Liu Yu <liuyu@loongson.cn> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Auto-Submit: Liu Yu <liuyu@loongson.cn> Cr-Commit-Position: refs/heads/main@{#107619} Refs: v8/v8@c4d06ba Co-authored-by: liujiahui <liujiahui@loongson.cn> PR-URL: nodejs#63731Fixes: nodejs#63721 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Michaël Zasso <targos@protonmail.com>
Original commit message: fix(inspector): hold on to promises Keep `m_evaluationResult` strong for evaluations until the promise settles or the request is cancelled. Bug: 536271637 Change-Id: If21cc4aa0ba6bb2e2722d5ee73eb7744a0ead207 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8123081 Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Reviewed-by: Kim-Anh Tran <kimanh@chromium.org> Cr-Commit-Position: refs/heads/main@{#108874} Refs: v8/v8@5177b10 Co-authored-by: avivkeller <me@aviv.sh> PR-URL: nodejs#64631 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Co-Authored-By: Joyee Cheung <joyeec9h3@gmail.com> Signed-Off-By: Michaël Zasso <targos@protonmail.com>
Signed-Off-By: Michaël Zasso <targos@protonmail.com>
Post-mortem libraries should use v8's debug_helper library instead.
- Set/GetPrototype - Holder Signed-Off-By: Michaël Zasso <targos@protonmail.com>
Signed-Off-By: Michaël Zasso <targos@protonmail.com>
Signed-Off-By: Michaël Zasso <targos@protonmail.com>
Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
ICU_UTIL_DATA_SHARED had been removed since https://crrev.com/c/1513615, but Node.js still defined it and relied on the removed path on Windows, so the ICU initialization in mksnapshot had been silently failing since then. https://crrev.com/c/7679153 made the failure visible so the build started breaking on Windows. Fix it by always using ICU_UTIL_DATA_STATIC since we already compile the ICU data statically in. Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
V8 bumped its wire-format version from 0x0f to 0x10. Update the expected hex in test-v8-serdes, and derive the v8 header bytes dynamically in test-runner-v8-deserializer so it tracks future bumps automatically. Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
V8 no longer supports JSON.parse on worker isolates while the shared string table is enabled. Since --harmony-struct enables that table and Node workers parse process.config during bootstrap, use direct MessageChannel instead of a worker. Signed-Off-By: Michaël Zasso <targos@protonmail.com>
targos
commented
Aug 5, 2026
MemberAuthor
The main issue now is with |
Member
I suspect the reproducibility issues come from the lack of https://chromium-review.googlesource.com/c/v8/v8/+/7816877 or friends, since it doesn't reproduce on the canary build now. Going to bisect a little.. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See #62572 for some context.