node icon indicating copy to clipboard operation
node copied to clipboard
verified publisher icon nodejs

deps: update V8 to 14.4

Open targos opened this issue 2 weeks ago • 7 comments

  • deps: update V8 to 14.4.258.6
  • build: reset embedder string to "-node.0"
  • src: update NODE_MODULE_VERSION to 145
  • deps: patch V8 to avoid duplicated zlib symbol
  • deps: define V8_PRESERVE_MOST as no-op on Windows
  • deps: remove problematic comment from v8-internal
  • deps: use std::map in MSVC STL for EphemeronRememberedSet
  • deps: patch V8 for illumos
  • deps: support madvise(3C) across ALL illumos revisions
  • tools: update V8 gypfiles for 14.4

targos avatar Dec 09 '25 09:12 targos

Review requested:

  • [ ] @nodejs/gyp
  • [ ] @nodejs/security-wg
  • [ ] @nodejs/v8-update

nodejs-github-bot avatar Dec 09 '25 09:12 nodejs-github-bot

Note that the debug build is unable to run anything:

➤ out/Debug/node -p 42


#
# Fatal error in ../../deps/v8/src/objects/transitions.cc, line 687
# Debug check failed: TransitionArray::kNotFound != new_target_index (-1 vs. -1).
#
#
#
#FailureMessage Object: 0x16d1ea1a8
----- Native stack trace -----

 1: 0x102d21800 node::DumpNativeBacktrace(__sFILE*) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 2: 0x102fb9530 node::NodePlatform::GetStackTracePrinter()::$_0::operator()() const [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 3: 0x102fb94ec node::NodePlatform::GetStackTracePrinter()::$_0::__invoke() [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 4: 0x105624058 V8_Fatal(char const*, int, char const*, ...) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 5: 0x1056238c8 v8::base::SetFatalFunction(void (*)(char const*, int, char const*)) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 6: 0x1068a58c0 v8::internal::TransitionsAccessor::CheckNewTransitionsAreConsistent(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::Tagged<v8::internal::Object>) (.cold.11) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 7: 0x103c12c94 v8::internal::TransitionsAccessor::CheckNewTransitionsAreConsistent(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::Tagged<v8::internal::Object>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 8: 0x103c10764 v8::internal::TransitionsAccessor::ReplaceTransitions(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::Tagged<v8::internal::Union<v8::internal::TransitionArray, v8::internal::MaybeWeak<v8::internal::Map>>>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
 9: 0x103c10388 v8::internal::TransitionsAccessor::InsertHelper(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::DirectHandle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::TransitionKindFlag) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
10: 0x103b51f50 v8::internal::Map::ConnectTransition(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::DirectHandle<v8::internal::Name>, v8::internal::TransitionKindFlag, bool) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
11: 0x103b52194 v8::internal::Map::CopyReplaceDescriptors(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::DirectHandle<v8::internal::DescriptorArray>, v8::internal::TransitionFlag, v8::internal::MaybeDirectHandle<v8::internal::Name>, char const*, v8::internal::TransitionKindFlag) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
12: 0x103b4c37c v8::internal::Map::CopyAddDescriptor(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::Descriptor*, v8::internal::TransitionFlag) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
13: 0x103b4c0cc v8::internal::Map::CopyWithField(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::DirectHandle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::FieldType>, v8::internal::PropertyAttributes, v8::internal::PropertyConstness, v8::internal::Representation, v8::internal::TransitionFlag) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
14: 0x103b53860 v8::internal::Map::TransitionToDataProperty(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Map>, v8::internal::DirectHandle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::PropertyAttributes, v8::internal::PropertyConstness, v8::internal::StoreOrigin) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
15: 0x103b3b974 v8::internal::LookupIterator::PrepareTransitionToDataProperty(v8::internal::DirectHandle<v8::internal::JSReceiver>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::PropertyAttributes, v8::internal::StoreOrigin) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
16: 0x103ba7634 v8::internal::Object::TransitionAndWriteDataProperty(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::PropertyAttributes, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
17: 0x103af7cb8 v8::internal::JSObject::DefineOwnPropertyIgnoreAttributes(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::PropertyAttributes, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::JSObject::AccessorInfoHandling, v8::internal::EnforceDefineSemantics, v8::internal::StoreOrigin, v8::internal::MaybeDirectHandle<v8::internal::Object>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
18: 0x103b040d0 v8::internal::JSObject::SetOwnPropertyIgnoreAttributes(v8::internal::DirectHandle<v8::internal::JSObject>, v8::internal::DirectHandle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::PropertyAttributes) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
19: 0x103d823c4 v8::internal::(anonymous namespace)::CreateObjectLiteral(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::ObjectBoilerplateDescription>, int, v8::internal::AllocationType) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
20: 0x103d80f0c v8::internal::MaybeDirectHandle<v8::internal::JSObject> v8::internal::(anonymous namespace)::CreateLiteralWithoutAllocationSite<v8::internal::(anonymous namespace)::ObjectLiteralHelper>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, int) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
21: 0x103d7e2fc v8::internal::Runtime_CreateObjectLiteral(int, unsigned long*, v8::internal::Isolate*) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
22: 0x104745cd4 Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
23: 0x104890acc Builtins_CreateObjectLiteralHandler [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
24: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
25: 0x135640610
26: 0x1356402b4
27: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
28: 0x135640610
29: 0x1356402b4
30: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
31: 0x135640610
32: 0x1356402b4
33: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
34: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
35: 0x10469d8e0 Builtins_LoadIC_NoFeedback [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
36: 0x10487cc54 Builtins_GetNamedPropertyHandler [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
37: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
38: 0x10469d8e0 Builtins_LoadIC_NoFeedback [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
39: 0x10487cc54 Builtins_GetNamedPropertyHandler [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
40: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
41: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
42: 0x104689354 Builtins_JSEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
43: 0x104688ff0 Builtins_JSEntry [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
44: 0x1035d4730 v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
45: 0x1035d39a0 v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
46: 0x10646e624 v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
47: 0x103215290 node::inspector::(anonymous namespace)::InspectorConsoleCall(v8::FunctionCallbackInfo<v8::Value> const&) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
48: 0x10468e438 Builtins_CallApiCallbackGeneric [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
49: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
50: 0x10468c70c Builtins_InterpreterEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
51: 0x104689354 Builtins_JSEntryTrampoline [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
52: 0x104688ff0 Builtins_JSEntry [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
53: 0x1035d4730 v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
54: 0x1035d39a0 v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
55: 0x10646e624 v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
56: 0x102c61158 node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
57: 0x102c61ad8 node::InternalMakeCallback(v8::Isolate*, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
58: 0x102c61998 node::MakeCallback(v8::Isolate*, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
59: 0x102c61724 node::MakeCallback(v8::Isolate*, v8::Local<v8::Object>, v8::Local<v8::String>, int, v8::Local<v8::Value>*, node::async_context) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
60: 0x102fc2f08 node::ProcessEmit(node::Environment*, std::__1::basic_string_view<char, std::__1::char_traits<char>>, v8::Local<v8::Value>) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
61: 0x102c80f84 node::EmitProcessExitInternal(node::Environment*) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
62: 0x102c65ce0 node::SpinEventLoopInternal(node::Environment*) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
63: 0x102f32e50 node::NodeMainInstance::Run(node::ExitCode*, node::Environment*) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
64: 0x102f32acc node::NodeMainInstance::Run() [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
65: 0x102deb7d8 node::StartInternal(int, char**) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
66: 0x102deb3f4 node::Start(int, char**) [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
67: 0x104d42adc main [/Users/mzasso/git/nodejs/v8-next-update/out/Debug/node]
68: 0x18199dd54 start [/usr/lib/dyld]
fish: Job 1, 'out/Debug/node -p 42' terminated by signal SIGTRAP (Trace or breakpoint trap)

targos avatar Dec 09 '25 09:12 targos

We also encounter https://github.com/nodejs/node-v8/issues/304 And another error with shared libraries, maybe related to GCC.

targos avatar Dec 09 '25 12:12 targos

This appears to have dropped https://github.com/nodejs/node/commit/da71ab68951836cb7c9e12f3e13697cdd30d63ea which fixed building with gcc 15.

richardlau avatar Dec 09 '25 14:12 richardlau

Ah, I forgot about this one. The change should really be upstreamed. It was lost because I always take the canary branch as a reference for V8 updates.

targos avatar Dec 09 '25 14:12 targos

Still failing with gcc 14:

 In file included from ../../deps/v8/src/runtime/runtime.h:14,
                 from ../../deps/v8/src/codegen/external-reference.h:9,
                 from ../../deps/v8/src/codegen/external-reference-table.h:11,
                 from ../../deps/v8/src/execution/isolate-data.h:10,
                 from ../../deps/v8/src/execution/isolate.h:33,
                 from ../../deps/v8/src/api/api.h:18,
                 from ../../deps/v8/src/api/api.cc:5:
../../deps/v8/src/strings/unicode.h:218:13: error: explicit specialization in non-namespace scope 'class unibrow::Utf8'
  218 |   template <>
      |             ^
../../deps/v8/src/strings/unicode.h:219:10: error: template-id 'WriteLeadingAscii<uint8_t>' in declaration of primary template
  219 |   size_t WriteLeadingAscii<uint8_t>(const uint8_t* src, char* dest,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~
../../deps/v8/src/strings/unicode.h:222:13: error: explicit specialization in non-namespace scope 'class unibrow::Utf8'
  222 |   template <>
      |             ^
../../deps/v8/src/strings/unicode.h:223:10: error: template-id 'WriteLeadingAscii<uint16_t>' in declaration of primary template
  223 |   size_t WriteLeadingAscii<uint16_t>(const uint16_t* src, char* dest,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~
ninja: build stopped: subcommand failed.

targos avatar Dec 09 '25 14:12 targos

Ah, I forgot about this one. The change should really be upstreamed. It was lost because I always take the canary branch as a reference for V8 updates.

It is in later upstream highway than is in V8. I have no idea what V8's policy is on when they roll highway forward.

richardlau avatar Dec 09 '25 14:12 richardlau

About https://github.com/nodejs/node/pull/61002#issuecomment-3631137188

I'm not used to debugging V8. If I try to print the name and value of the property being added at frame 21, I get this:

(lldb) print name
(v8::internal::DirectHandle<v8::internal::String>) {
  handle_ = 0x174f88dd3fd9: [String] in OldSpace: #getEntries
}
(lldb) print value
(v8::internal::Handle<v8::internal::Object>) 0x2e6f03789d01: [Hole] in ReadOnlySpace

targos avatar Dec 10 '25 11:12 targos

@targos bisected it to https://chromium-review.googlesource.com/c/v8/v8/+/7090677 , locally this fixes it for me:

diff --git a/deps/v8/src/objects/transitions.cc b/deps/v8/src/objects/transitions.cc
index e30cd53e7a..b274382894 100644
--- a/deps/v8/src/objects/transitions.cc
+++ b/deps/v8/src/objects/transitions.cc
@@ -173,6 +173,7 @@ void TransitionsAccessor::InsertHelper(Isolate* isolate, DirectHandle<Map> map,
       }
       array->SetKey(insertion_index, *name);
       array->SetRawTarget(insertion_index, MakeWeak(*target));
+      array->Sort();
       SLOW_DCHECK(array->IsSortedNoDuplicates());
       return;
     }
@@ -221,7 +222,7 @@ void TransitionsAccessor::InsertHelper(Isolate* isolate, DirectHandle<Map> map,
   for (int i = insertion_index; i < number_of_transitions; ++i) {
     result->Set(i + 1, array->GetKey(i), array->GetRawTarget(i));
   }
-
+  result->Sort();
   SLOW_DCHECK(result->IsSortedNoDuplicates());
   ReplaceTransitions(isolate, map, result);
 }

joyeecheung avatar Dec 11 '25 19:12 joyeecheung

I'll cherry-pick https://chromium-review.googlesource.com/c/v8/v8/+/7252791 when it's landed.

targos avatar Dec 12 '25 14:12 targos