deps: update V8 to 14.6 by targos · Pull Request #61898 · nodejs/node

targos · 2026-02-20T11:02:38Z

PR for previous version: #61681

nodejs-github-bot · 2026-02-20T11:02:43Z

Review requested:

@nodejs/gyp
@nodejs/security-wg
@nodejs/v8-update

targos · 2026-02-20T11:04:00Z

Compared to version 14.5, there is a new test failure that is not obvious. Local run:

=== release test-repl-mode ===                                                
Path: parallel/test-repl-mode
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: The input did not match the regular expression /ReferenceError: x is not defined/. Input:

'> 3\n> '

    at testStrictMode (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:38:10)
    at /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:18:3
    at Array.forEach (<anonymous>)
    at Object.<anonymous> (/home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js:17:7)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5) {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: '> 3\n> ',
  expected: /ReferenceError: x is not defined/,
  operator: 'match',
  diff: 'simple'
}

Node.js v26.0.0-pre
Command: out/Release/node /home/targos/git/nodejs/v8-next-update/test/parallel/test-repl-mode.js

targos · 2026-02-20T13:46:29Z

Additionally, snapshot is no longer reproducible:

Edit: not macOS-specific: https://github.com/nodejs/node/actions/runs/22221811293/job/64279253109

=== release test-snapshot-reproducible ===
Path: parallel/test-snapshot-reproducible
Error: --- stderr ---
node:internal/assert/utils:146
  throw error;
  ^

AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines

  [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
...
    'namespace node {',
+   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
-   'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,-72,125,-78,63,100,19,-88,-44,49,52,46,54,46,50,48,50,46,52,45,110,111,100,101,46,54,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,  // 0',
    '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,-95,18,0,40,-48,24,0,104,-6,28,0,-48,-8,29,0,-24,-11,30,0,-48,-15,31,0,-88,6,-34,-64,-80,-96,18,0,-95,24,96,0,0,0,0,83,0,0,0,96,0,0,0,0,  // 1',
    '0,0,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,-61,1,0,0,96,0,0,0,0,60,0,0,0,96,0,0,0,0,-28,1,0,0,96,0,0,0,0,0,0,0,0,96,0,0,0,0,36,1,0,0,11,5,24,-30,-1,1,  // 2',
    '5,24,-94,0,2,5,24,98,1,2,5,24,34,2,2,5,24,-30,2,2,5,24,-94,3,2,5,24,98,4,2,5,24,34,5,2,5,24,-30,5,2,5,24,-94,6,2,5,24,98,7,2,5,24,34,8,2,5,24,-30,8,2,1,76,7,101,  // 3',
    '15,69,64,97,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,98,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,64,96,0,0,0,0,0,0,0,0,7,-123,2,64,96,0,0,0,  // 4',
    '0,8,0,0,0,-127,0,91,64,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,0,0,0,0,0,0,1,0,0,0,93,1,20,83,69,97,0,0,0,0,96,0,  // 5',
...
    '0,0,0,4,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-124,0,7,33,10,1,28,-108,-128,27,31,16,5,24,-94,-65,2,6,77,31,4,-67,52,1,12,7,29,1,64,32,109,18,96,  // 34655',
+   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-45,31,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
-   '0,0,0,0,0,2,0,0,7,13,13,1,28,4,40,-128,27,31,20,5,24,-94,-65,2,6,81,31,-109,1,12,-108,64,32,113,18,96,0,0,0,0,0,1,0,0,91,96,0,0,0,0,-122,33,0,0,1,28,4,33,53,1,-128,-111,102,0,  // 34656',
    '0,0,0,30,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-115,0,9,53,8,1,12,7,1,  // 34657',
    '15,1,28,-106,-128,27,32,4,6,5,1,1,40,4,92,96,0,0,0,0,8,0,0,0,6,9,1,4,100,1,28,-106,-128,27,31,8,5,24,-94,-65,2,6,85,31,-109,1,12,-108,64,32,117,18,9,-107,2,1,32,4,-124,-128,27,32,81,15,  // 34658',
    '6,-31,27,4,61,59,4,29,47,65,1,28,-106,-128,27,32,85,15,6,-27,27,-108,4,37,47,64,1,28,4,40,-128,27,32,89,15,6,-23,27,-108,4,45,47,4,49,47,66,96,0,0,0,0,1,3,0,0,71,7,117,16,96,0,0,0,0,  // 34659',
    '13,2,0,0,72,7,121,16,96,0,0,0,0,13,1,0,0,91,32,93,15,6,-19,27,-108,4,53,47,1,28,-105,-128,27,31,8,5,24,-94,-65,2,6,89,31,4,-67,52,1,12,7,29,1,64,32,121,18,1,32,4,-124,-128,27,31,20,5,  // 34660',
    '24,-94,-65,2,6,93,31,-107,1,12,-106,64,32,125,18,65,1,32,-105,-128,27,31,12,5,24,-94,-65,2,6,97,31,-107,1,12,-106,64,32,-127,18,65,1,32,-105,-128,27,31,16,5,24,-94,-65,2,6,101,31,-107,1,12,-106,64,32,-123,18,65,  // 34661',

    at Object.<anonymous> (/Users/runner/work/node/node/node/test/parallel/test-snapshot-reproducible.js:47:8)
    at Module._compile (node:internal/modules/cjs/loader:1811:14)
    at Object..js (node:internal/modules/cjs/loader:1951:10)
    at Module.load (node:internal/modules/cjs/loader:1532:32)
    at Module._load (node:internal/modules/cjs/loader:1334:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5)
    at node:internal/main/run_main_module:33:47 {
  generatedMessage: true,
  code: 'ERR_ASSERTION',
  actual: [
    '#include <cstddef>',
    '#include "env.h"',
    '#include "node_snapshot_builder.h"',
    '#include "v8.h"',
    '',
    '// This file is generated by tools/snapshot. Do not edit.',
    '',
    'namespace node {',
    'static const char v8_snapshot_blob_data[] = {4,0,0,0,1,0,0,0,3,126,58,75,100,19,-88

Renegade334 · 2026-02-21T13:48:21Z

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

sxa · 2026-02-22T22:04:58Z

Additionally, snapshot is no longer reproducible:

FYI @joyeecheung

sxa · 2026-02-22T22:06:07Z

For what it's worth this branch seems to build ok with a RISC-V cross compiler too 👍🏻 (An experimental platform but I thought I'd mention it anyway ;-) )

targos · 2026-03-13T14:51:08Z

@nodejs/platform-windows Can you please have a look at the Windows build failure?

targos · 2026-03-13T15:54:32Z

There's still this REPL strict mode issue: #61898 (comment)

@nodejs/repl

targos · 2026-03-13T15:55:25Z

And the reproducible snapshot: #61898 (comment)

@nodejs/startup (for lack of a more specific team)

Renegade334 · 2026-03-13T16:19:59Z

There's still this REPL strict mode issue: #61898 (comment)

It's not so much a REPL issue as an issue with the VM global sandbox interceptors, introduced as a regression with 113b5cf. Previously, we were simulating CheckContextualStoreToJSGlobalObject-esque behaviour by rejecting interceptions on global proxy properties in strict mode if the receiver was not the global object. Now that we can no longer observe the receiver, that mechanism doesn't exist, and statements like nonExistantGlobalVariable = 42 are setting a property on the global sandbox instead of throwing in strict mode.

(We should probably have VM tests for this.)

Renegade334 · 2026-03-13T16:21:22Z

Note that this changeset does not compile with GCC <14.1, unless the following patch is applied:

diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 41bdbc2cc6..c9ef451713 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -807,7 +807,7 @@ void OutputFractional(const char* type, int64_t integer, int32_t powerOfTen,
   // Pass in the value as int64_t and ask ICU to scale down.
   nfOpts = nfOpts.scale(icu::number::Scale::powerOfTen(-powerOfTen));

-  int64_t factor = static_cast<int64_t>(std::powl(10, powerOfTen));
+  int64_t factor = static_cast<int64_t>(std::pow(10.0L, powerOfTen));
   int64_t bound = std::numeric_limits<int64_t>::max() / factor - 1;
   UErrorCode status = U_ZERO_ERROR;
   // Use faster ICU API formatInt if the value fit the precision int64_t,

We will either need to merge (or upstream) this, or change the GCC build requirement to >=14.1.

targos · 2026-03-13T16:22:41Z

Would you like to try and upstream it?

Renegade334 · 2026-03-13T16:27:52Z

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

joyeecheung · 2026-03-14T03:19:39Z

Locally this fixes the snapshot reproducibility test for me

See diff

diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index 0bc45bac300..f0047f044f2 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -63,6 +63,10 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kTargetOffset, target);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kHandlerOffset, handler);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kFlagsOffset, flags);
+#if TAGGED_SIZE_8_BYTES
+  StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kPaddingOffset,
+                                 Int32Constant(0));
+#endif
 
   return CAST(proxy);
 }
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index b6f6938450c..e0117df19f9 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -3945,6 +3945,9 @@ Handle<JSProxy> Factory::NewJSProxy(DirectHandle<JSReceiver> target,
   result->set_target(*target, SKIP_WRITE_BARRIER);
   result->set_handler(*handler, SKIP_WRITE_BARRIER);
   result->set_flags(JSProxy::IsRevocableBit::encode(revocable));
+#if TAGGED_SIZE_8_BYTES
+  result->set_padding(0);
+#endif
   return handle(result, isolate());
 }

Uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666243

joyeecheung · 2026-03-14T04:21:34Z

It would be easier if someone with existing Chromium contributor status did the honours, I'd rather not jump through the hoops for a one-liner!

Also uploaded https://chromium-review.googlesource.com/c/v8/v8/+/7666244 (IIUC, it was a libstdc++ issue fixed by https://gcc.gnu.org/pipermail/libstdc++/2023-February/055493.html)

StefanStojanovic · 2026-03-16T12:43:04Z

@nodejs/platform-windows Can you please have a look at the Windows build failure?

I'll take a look. Thanks for the ping.

StefanStojanovic · 2026-03-16T16:54:08Z

@nodejs/platform-windows Can you please have a look at the Windows build failure?

Will look into it. Thanks for the ping.

So that snapshots with proxies can be reproducible. Refs: nodejs/node#61898 Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105830}

StefanStojanovic · 2026-03-17T09:46:58Z

@targos, here is the patch to enable building on Windows: v8-146-fix.patch. Two small changes were needed.

Original commit message: Zero-initialize proxy padding So that snapshots with proxies can be reproducible. Refs: nodejs#61898 Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105830} Refs: v8/v8@edeb0a4

targos · 2026-03-17T10:46:42Z

Thanks @StefanStojanovic and @joyeecheung. I pushed your fixes. Let's see how it goes on GH runners.

Original commit message: Mark MemCopyAndSwitchEndianness src input as `const` Needed after this CL: http://crrev.com/c/7600437 Currently getting the following error: ``` candidate function not viable: no known conversion from 'const unsigned char *' to 'void *' ``` Change-Id: I0c0f065b822e0f95ffd06207d280fc8b7bab4403 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7601332 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Milad Farazmand <mfarazma@ibm.com> Cr-Commit-Position: refs/heads/main@{#105413} Refs: v8/v8@daf4656

Original commit message: [wasm] Fix S128Const on big endian Since http://crrev.com/c/2944437 globals are no longer little endian enforced. S128Const handling in the initializer needs to take this into account and byte reverse values which are hard coded in little endian order. This is currently causing failures on Node.js upstream: nodejs#59034 (comment) Change-Id: Ifcc9ade93ee51565ab19b16e9dadf0ff5752f7a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7704213 Commit-Queue: Milad Farazmand <mfarazma@ibm.com> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#106082} Refs: v8/v8@cf1bce4 PR-URL: nodejs#62449 Refs: v8/v8@cf1bce4 Reviewed-By: Guy Bedford <guybedford@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Original commit message: [api] Add V8::GetWasmMemoryReservationSizeInBytes() When the system does not have enough virtual memory for the wasm cage, installing the trap handler would cause any code allocating wasm memory to throw. Therefore it's useful for the embedder to know when the system doesn't have enough virtual address space to allocate enough wasm cages and in that case, skip the trap handler installation so that wasm code can at least work (even not at the maximal performance). Node.js previously has a command line option --disable-wasm-trap-handler to fully disable trap-based bound checks, this new API would allow it to adapt automatically while keeping the optimization in the happy path, since it's not always possible for end users to opt-into disabling trap-based bound checks (for example, when a VS Code Server is loaded in a remote server for debugging). Refs: nodejs#62132 Refs: microsoft/vscode#251777 Change-Id: I345c076af2b2b47700e5716b49c3133fdf8a0981 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7638233 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#105702} Refs: v8/v8@bef0d9c Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> PR-URL: nodejs#62132 Refs: microsoft/vscode#251777 Refs: https://chromium-review.googlesource.com/c/v8/v8/+/7638233 Reviewed-By: Aditi Singh <aditisingh1400@gmail.com>

Original commit message: [runtime] always sort transition arrays during rehashing After rehashing, the arrays are no longer in hash-sorted order. In this case, we need to force a re-sort even for small arrays, so that subsequent linear searches can find the correct transition and avoid inserting duplicates. Refs: nodejs#61898 (comment) Change-Id: Ia813d1fb9d23e08012811d672052d235c0e0bf4d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7723678 Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#106255} Refs: v8/v8@00f6e83

targos · 2026-04-13T13:31:06Z

Thanks @legendecas and @StefanStojanovic, I added both patches.

nodejs-github-bot · 2026-04-13T13:32:13Z

CI: https://ci.nodejs.org/job/node-test-pull-request/72670/

nodejs-github-bot · 2026-04-13T13:32:46Z

V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/nodes=benchmark-ubuntu2404-intel-64,v8test=v8test/7120/

nodejs-github-bot · 2026-04-13T13:33:03Z

V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/nodes=rhel8-s390x,v8test=v8test/7120/

nodejs-github-bot · 2026-04-13T13:33:09Z

V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/nodes=rhel8-power9le,v8test=v8test/7120/

targos · 2026-04-13T14:03:26Z

We're still blocked by AIX (GCC 12). @nodejs/platform-aix what's the status on the migration to Clang?

Original commit message: [runtime] Fix contextual stores to global with interceptor According to the spec, contextual store in strict mode must first check whether property exists and if not, the ReferenceError should be thrown instead of calling the interceptor setter. See https://tc39.es/ecma262/#sec-object-environment-records-setmutablebinding-n-v-s Drive-by: - introduce new Api v8::Object::GetPropertyAttributes(..) which is able to return "property does not exist" result, which wasn't possible with the existing GetPropertyAttributes(..) Api, - update GenericInterceptor* callbacks in test-api-interceptors.cc to better suite for implementing a proxy-like interceptor. Bug: 455600234 Change-Id: I0986c18c406844f58c453e7aa7513c52a9097e04 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7718821 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#106322} Refs: v8/v8@088b711 Co-authored-by: Michaël Zasso <targos@protonmail.com>

This enables v8_enable_seeded_array_index_hash and add a test for it. Fixes: https://hackerone.com/reports/3511792 deps: V8: backport 0a8b1cdcc8b2 Original commit message: implement rapidhash secret generation Bug: 409717082 Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: snek <snek@chromium.org> Cr-Commit-Position: refs/heads/main@{#101499} Refs: v8/v8@0a8b1cd Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 185f0fe09b72 Original commit message: [numbers] Refactor HashSeed as a lightweight view over ByteArray Instead of copying the seed and secrets into a struct with value fields, HashSeed now stores a pointer pointing either into the read-only ByteArray, or the static default seed for off-heap HashSeed::Default() calls. The underlying storage is always 8-byte aligned so we can cast it directly into a struct. Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105531} Refs: v8/v8@185f0fe Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 1361b2a49d02 Original commit message: [strings] improve array index hash distribution Previously, the hashes stored in a Name's raw_hash_field for decimal numeric strings (potential array indices) consist of the literal integer value along with the length of the string. This means consecutive numeric strings can have consecutive hash values, which can lead to O(n^2) probing for insertion in the worst case when e.g. a non-numeric string happen to land in the these buckets. This patch adds a build-time flag v8_enable_seeded_array_index_hash that scrambles the 24-bit array-index value stored in a Name's raw_hash_field to improve the distribution. x ^= x >> kShift; x = (x * m1) & kMask; // round 1 x ^= x >> kShift; x = (x * m2) & kMask; // round 2 x ^= x >> kShift; // finalize To decode, apply the same steps with the modular inverses of m1 and m2 in reverse order. x ^= x >> kShift; x = (x * m2_inv) & kMask; // round 1 x ^= x >> kShift; x = (x * m1_inv) & kMask; // round 2 x ^= x >> kShift; // finalize where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask, m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv, m2_inv (modular inverses) are precomputed modular inverse of m1 and m2. The pre-computed values are appended to the hash_seed ByteArray in ReadOnlyRoots and accessed in generated code to reduce overhead. In call sites that don't already have access to the seeds, we read them from the current isolate group/isolate's read only roots. To consolidate the code that encode/decode these hashes, this patch adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA that perform seeding/unseeding if enabled, and updates places where encoding/decoding of array index is needed to use them. Bug: 477515021 Change-Id: I350afe511951a54c4378396538152cc56565fd55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105596} Refs: v8/v8@1361b2a Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: cherry-pick aac14dd95e5b Original commit message: [string] add 3rd round to seeded array index hash Since we already have 3 derived secrets, and arithmetics are relatively cheap, add a 3rd round to the xorshift-multiply seeding scheme. This brings the bias from ~3.4 to ~0.4. Bug: 477515021 Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117 Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net> Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#105824} Refs: v8/v8@aac14dd PR-URL: nodejs-private/node-private#834 CVE-ID: CVE-2026-21717 deps: V8: backport 185f0fe09b72 Original commit message: [numbers] Refactor HashSeed as a lightweight view over ByteArray Instead of copying the seed and secrets into a struct with value fields, HashSeed now stores a pointer pointing either into the read-only ByteArray, or the static default seed for off-heap HashSeed::Default() calls. The underlying storage is always 8-byte aligned so we can cast it directly into a struct. Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105531} Refs: v8/v8@185f0fe Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 1361b2a49d02 Original commit message: [strings] improve array index hash distribution Previously, the hashes stored in a Name's raw_hash_field for decimal numeric strings (potential array indices) consist of the literal integer value along with the length of the string. This means consecutive numeric strings can have consecutive hash values, which can lead to O(n^2) probing for insertion in the worst case when e.g. a non-numeric string happen to land in the these buckets. This patch adds a build-time flag v8_enable_seeded_array_index_hash that scrambles the 24-bit array-index value stored in a Name's raw_hash_field to improve the distribution. x ^= x >> kShift; x = (x * m1) & kMask; // round 1 x ^= x >> kShift; x = (x * m2) & kMask; // round 2 x ^= x >> kShift; // finalize To decode, apply the same steps with the modular inverses of m1 and m2 in reverse order. x ^= x >> kShift; x = (x * m2_inv) & kMask; // round 1 x ^= x >> kShift; x = (x * m1_inv) & kMask; // round 2 x ^= x >> kShift; // finalize where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask, m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv, m2_inv (modular inverses) are precomputed modular inverse of m1 and m2. The pre-computed values are appended to the hash_seed ByteArray in ReadOnlyRoots and accessed in generated code to reduce overhead. In call sites that don't already have access to the seeds, we read them from the current isolate group/isolate's read only roots. To consolidate the code that encode/decode these hashes, this patch adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA that perform seeding/unseeding if enabled, and updates places where encoding/decoding of array index is needed to use them. Bug: 477515021 Change-Id: I350afe511951a54c4378396538152cc56565fd55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105596} Refs: v8/v8@1361b2a Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: cherry-pick aac14dd95e5b Original commit message: [string] add 3rd round to seeded array index hash Since we already have 3 derived secrets, and arithmetics are relatively cheap, add a 3rd round to the xorshift-multiply seeding scheme. This brings the bias from ~3.4 to ~0.4. Bug: 477515021 Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117 Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net> Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#105824} Refs: v8/v8@aac14dd

Co-Authored-By: StefanStojanovic <stefan.stojanovic@janeasystems.com>

Refs: v8/v8@51d2067

Add args to `tools/make-v8.sh` for compiling Rust-based components, such as Temporal, for the Linux on ppc64le and s390x V8 CI builds.

Use the method without context parameter; the old API is deprecated. Refs: https://crrev.com/c/7141498

Use the new API which gets a `ModuleCachingCallback` parameter. Refs: https://crrev.com/c/7078551

Refs: nodejs#60616

richardlau · 2026-04-13T14:18:14Z

We're still blocked by AIX (GCC 12). @nodejs/platform-aix what's the status on the migration to Clang?

clang is installed on the three AIX test machines, but isn't currently selected by the select-compiler.sh script pending #62656.

abmusse · 2026-04-13T15:01:48Z

@targos

Like Richard mentioned I've opened #62656 to add required changes to get aix building with clang. I do believe this update to 14.6 includes this v8 cherry-pick commit: 24119b8 so we can drop that ones the PR lands.

The game plan I have in mind to get AIX building with clang:

Confirm the changes in this PR doesn't break gcc builds (Node.js 24, 22, 20 still use it), then merge aix: add required changes to build with clang #62656
Then update select compiler to use clang for Node.js 26+ builds
(I have a draft PR for that here: aix: select clang for Node.26+ builds build#4286)

Temporary commit. Just to test builds. Refs: #61898

nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. labels Feb 20, 2026

This was referenced Feb 20, 2026

deps: update V8 to 14.4 #61002

Closed

deps: update V8 to 14.5 #61681

Closed

targos added the semver-major PRs that contain breaking changes and should be released in the next major version. label Feb 20, 2026

targos force-pushed the v8-146 branch from 1e241d1 to 25c85aa Compare February 20, 2026 11:10

targos added the help wanted Issues that need assistance from volunteers or PRs that need help to proceed. label Feb 20, 2026

targos force-pushed the v8-146 branch from 25c85aa to c63c70d Compare March 13, 2026 14:08

miladfarca and others added 4 commits April 13, 2026 14:06

targos force-pushed the v8-146 branch from 4534bc6 to 2178ebe Compare April 13, 2026 13:30

isheludko and others added 15 commits April 13, 2026 16:10

tools: update V8 gypfiles for 14.4

8aa1539

Co-Authored-By: StefanStojanovic <stefan.stojanovic@janeasystems.com>

tools: update V8 gypfiles for 14.5

ac5053d

tools: update V8 gypfiles for 14.6

f335371

Refs: v8/v8@51d2067

tools: add Rust args to tools/make-v8.sh

f7c84c2

Add args to `tools/make-v8.sh` for compiling Rust-based components, such as Temporal, for the Linux on ppc64le and s390x V8 CI builds.

src: avoid deprecated FixedArray::Get

5cbac84

Use the method without context parameter; the old API is deprecated. Refs: https://crrev.com/c/7141498

src: avoid deprecated Wasm API

1a5dbd6

Use the new API which gets a `ModuleCachingCallback` parameter. Refs: https://crrev.com/c/7078551

src: stop using v8::PropertyCallbackInfo<T>::This()

40b038e

Refs: nodejs#60616

src: replace uses of deprecated v8::External APIs

c0fbd86

test: add type tags to uses of v8::External

98813f7

test: support presence of Temporal global

b79edb0

tools: remove v8_initializers_slow workaround from v8.gyp

c944365

build: enable V8_VERIFY_WRITE_BARRIERS in debug build

bf27852

test: update wpt Wasm jsapi expectations

098b44e

targos force-pushed the v8-146 branch from 2178ebe to 098b44e Compare April 13, 2026 14:10

RafaelGSS added a commit that referenced this pull request Apr 14, 2026

deps: V8 14.6

4cebc9d

Temporary commit. Just to test builds. Refs: #61898

Uh oh!

Conversation

targos commented Feb 20, 2026

Uh oh!

nodejs-github-bot commented Feb 20, 2026

Uh oh!

targos commented Feb 20, 2026

Uh oh!

targos commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Renegade334 commented Feb 21, 2026

Uh oh!

sxa commented Feb 22, 2026

Uh oh!

sxa commented Feb 22, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

Renegade334 commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Renegade334 commented Mar 13, 2026

Uh oh!

targos commented Mar 13, 2026

Uh oh!

Renegade334 commented Mar 13, 2026

Uh oh!

joyeecheung commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joyeecheung commented Mar 14, 2026

Uh oh!

StefanStojanovic commented Mar 16, 2026

Uh oh!

StefanStojanovic commented Mar 16, 2026

Uh oh!

StefanStojanovic commented Mar 17, 2026

Uh oh!

targos commented Mar 17, 2026

Uh oh!

targos commented Apr 13, 2026

Uh oh!

nodejs-github-bot commented Apr 13, 2026

Uh oh!

nodejs-github-bot commented Apr 13, 2026

Uh oh!

nodejs-github-bot commented Apr 13, 2026

Uh oh!

nodejs-github-bot commented Apr 13, 2026

Uh oh!

targos commented Apr 13, 2026

Uh oh!

richardlau commented Apr 13, 2026

Uh oh!

abmusse commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

targos commented Feb 20, 2026 •

edited

Loading

Renegade334 commented Mar 13, 2026 •

edited

Loading

joyeecheung commented Mar 14, 2026 •

edited

Loading

abmusse commented Apr 13, 2026 •

edited

Loading