Skip to content

[v24.x] deps: V8: backport 6a0a25abaed3#61670

Open
kxxt wants to merge 109 commits intonodejs:v24.x-stagingfrom
kxxt:v24-rv-sp
Open

[v24.x] deps: V8: backport 6a0a25abaed3#61670
kxxt wants to merge 109 commits intonodejs:v24.x-stagingfrom
kxxt:v24-rv-sp

Conversation

@kxxt
Copy link
Contributor

@kxxt kxxt commented Feb 4, 2026

Original commit message:

[riscv] Fix sp handling in MacroAssembler::LeaveFrame

Keep sp <= fp to ensure that data right above fp doesn't get clobbered
by an inopportune signal and its handler.

Such clobbering can happen in e.g. Node.js when JIT-compiled code is
interrupted by a SIGCHLD handler.

Bug: None
Change-Id: Ief0836032ada7942e89f081f7605f61632c4d414
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7540554
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn>
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#105069}

Refs: v8/v8@6a0a25a

This V8 backport fixes a long-standing heisenbug that affects riscv64 since at least node.js 16.

CC @sxa

@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/v8-update

@nodejs-github-bot nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. v8 engine Issues and PRs related to the V8 dependency. labels Feb 4, 2026
kxxt added a commit to kxxt/archriscv-packages that referenced this pull request Feb 4, 2026
- Backport chromium-review.googlesource.com/c/v8/v8/+/7540554 to fix the
  long-standing nodejs heisenbug Sporadic Nodejs segfault on sg2042 revyos/revyos#27.
  Upstream PR: nodejs/node#61670
- `--nocheck` is needed. There is one test failure:

    === release test-repl-paste-big-data ===
    Path: parallel/test-repl-paste-big-data
    node:internal/assert/utils:77
        throw err;
        ^

    AssertionError [ERR_ASSERTION]: The expression evaluated to a falsy value:

      assert.ok(diff.user < 1e6)

        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js:22:10)
        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/common/index.js:476:15)
        at Object.onceWrapper (node:events:622:28)
        at REPLServer.emit (node:events:508:28)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.emitExit (node:repl:850:10)
        at REPLServer.emit (node:events:520:35)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.close (node:internal/readline/interface:555:10)
        at node:repl:1114:5 {
      generatedMessage: true,
      code: 'ERR_ASSERTION',
      actual: false,
      expected: true,
      operator: '==',
      diff: 'simple'
    }

    Node.js v24.13.0
    Command: out/Release/node /build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js
@aduh95 aduh95 added the blocked PRs that are blocked by other issues or PRs. label Feb 4, 2026
@aduh95
Copy link
Contributor

aduh95 commented Feb 4, 2026

Blocked on #61666

felixonmars pushed a commit to felixonmars/archriscv-packages that referenced this pull request Feb 4, 2026
- Backport chromium-review.googlesource.com/c/v8/v8/+/7540554 to fix the
  long-standing nodejs heisenbug Sporadic Nodejs segfault on sg2042 revyos/revyos#27.
  Upstream PR: nodejs/node#61670
- `--nocheck` is needed. There is one test failure:

    === release test-repl-paste-big-data ===
    Path: parallel/test-repl-paste-big-data
    node:internal/assert/utils:77
        throw err;
        ^

    AssertionError [ERR_ASSERTION]: The expression evaluated to a falsy value:

      assert.ok(diff.user < 1e6)

        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js:22:10)
        at REPLServer.<anonymous> (/build/nodejs-lts-krypton/src/node/test/common/index.js:476:15)
        at Object.onceWrapper (node:events:622:28)
        at REPLServer.emit (node:events:508:28)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.emitExit (node:repl:850:10)
        at REPLServer.emit (node:events:520:35)
        at REPLServer.emit (node:domain:489:12)
        at REPLServer.close (node:internal/readline/interface:555:10)
        at node:repl:1114:5 {
      generatedMessage: true,
      code: 'ERR_ASSERTION',
      actual: false,
      expected: true,
      operator: '==',
      diff: 'simple'
    }

    Node.js v24.13.0
    Command: out/Release/node /build/nodejs-lts-krypton/src/node/test/parallel/test-repl-paste-big-data.js
mcollina and others added 16 commits February 10, 2026 15:11
Wrap pskCallback and ALPNCallback invocations in try-catch blocks
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This prevents remote attackers from
crashing TLS servers or causing resource exhaustion.

Fixes: https://hackerone.com/reports/3473882
PR-URL: nodejs-private/node-private#782
PR-URL: nodejs-private/node-private#790
CVE-ID: CVE-2026-21637
PR-URL: nodejs#60634
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Add support for the creation of ReadableByteStream to Readable.toWeb()
and Duplex.toWeb()
This enables the use of .getReader({ mode: "byob" }) on
e.g. socket().toWeb()

Refs: nodejs#56004 (comment)
Refs: https://developer.mozilla.org/en-US/docs/Web/API/Streams_API/Using_readable_byte_streams
PR-URL: nodejs#58664
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@08c6903...93cb6ef)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: nodejs#60767
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: hainenber <dotronghai96@gmail.com>
PR-URL: nodejs#60319
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: nodejs#60796
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#60214
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.1
to 6.0.0.

- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: nodejs#60925
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
It's a common ecosystem pattern to map a source root directory to
`@/` but it requires special tooling support. This turns `#/*` into
a more realistic alternative for that pattern.

PR-URL: nodejs#60864
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
PR-URL: nodejs#60912
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
This adds an API to dynamically enable built-in proxy support
for all of fetch() and http.request()/https.request(), so
that users do not have to be aware of them all and configure them
one by one.

PR-URL: nodejs#60953
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Add convertProcessSignalToExitCode() to convert signal names to POSIX
exit codes (128 + signal number). Exposed in public util API.

Refs: nodejs#60720
PR-URL: nodejs#60963
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
PR-URL: nodejs#61043
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Aviv Keller <me@aviv.sh>
PR-URL: nodejs#60913
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
PR-URL: nodejs#60907
Fixes: nodejs#55203
Reviewed-By: Raz Luvaton <rluvaton@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@330a01c...b7c566a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: nodejs#61238
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
MikeMcC399 and others added 23 commits February 10, 2026 17:39
PR-URL: nodejs#61562
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
PR-URL: nodejs#61642
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Refs: nodejs#55017
PR-URL: nodejs#61644
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Tierney Cyren <hello@bnb.im>
PR-URL: nodejs#61663
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61672
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Defer socket.destroy() calls in internalConnect and
internalConnectMultiple to the next tick. This ensures that error
handlers have a chance to be set up before errors are emitted,
particularly important when using http.request with a custom
lookup function that returns synchronously.

Previously, if a synchronous lookup function returned an IP that
triggered an immediate error (e.g., via blockList), the error would
be emitted before the HTTP client had set up its error handler
(which happens via process.nextTick in onSocket). This caused
unhandled 'error' events.

Fixes: nodejs#48771
PR-URL: nodejs#61658
Refs: nodejs#51038
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
On Windows, file paths are case-insensitive but string comparison is
case-sensitive. When the drive letter case differs between the computed
project root and the actual output (e.g., 'C:/' vs 'c:/'), the path
replacement in transformProjectRoot() would fail.

This fix uses case-insensitive regex replacement on Windows to ensure
paths are correctly normalized in snapshot tests regardless of drive
letter casing.

Refs: nodejs/reliability#1453
PR-URL: nodejs#61682
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#61683
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
PR-URL: nodejs#61675
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
When binding UTF-8 strings to prepared statements, transfer ownership of
malloc-backed Utf8Value buffers to SQLite to avoid an extra copy for
large strings. Use sqlite3_bind_blob64() when binding BLOB parameters.

PR-URL: nodejs#61580
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
PR-URL: nodejs#61696
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: nodejs#61659
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
`require(mod)` does not keep the mod in require cache if
mod throws synchronously. This fixes the tests to print
the stack immediately in case that source map cache could
be cleaned up when the CJS module is reclaimed by GC in
the next event loop tick.

PR-URL: nodejs#61699
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Add documentation explaining that applications are expected to attach
'error' event handlers to EventEmitters that can emit errors, including
HTTP streams. Crashes resulting from missing error handlers are not
considered denial-of-service vulnerabilities in Node.js.

PR-URL: nodejs#61701
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Small perf improvement:

    $ node benchmark/compare.js --runs 100 \
    >   --old ./node-0da120f879 --new ./node \
    >   --filter structured-clone misc > comparison.csv && \
    >   npx node-benchmark-compare comparison.csv

    [00:02:15|% 100| 1/1 files | 200/200 runs | 3/3 configs]: Done
                                                        confidence improvement accuracy (*)   (**)  (***)
    misc/structured-clone.js n=10000 type='arraybuffer'         **      1.81 %       ±1.28% ±1.68% ±2.16%
    misc/structured-clone.js n=10000 type='object'               *      0.62 %       ±0.55% ±0.73% ±0.93%
    misc/structured-clone.js n=10000 type='string'             ***      8.30 %       ±1.46% ±1.92% ±2.47%

    Be aware that when doing many comparisons the risk of a false-positive result increases.
    In this case, there are 3 comparisons, you can thus expect the following amount of false-positive results:
      0.15 false positives, when considering a   5% risk acceptance (*, **, ***),
      0.03 false positives, when considering a   1% risk acceptance (**, ***),
      0.00 false positives, when considering a 0.1% risk acceptance (***)

PR-URL: nodejs#61703
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#61732
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
PR-URL: nodejs#61730
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61685
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: nodejs#61748
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#61279
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: nodejs#61280
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: nodejs#61341
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#61456
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
@kxxt
Copy link
Contributor Author

kxxt commented Feb 13, 2026

Blocked on #61666

This could be unblocked now as #61666 has landed.

Original commit message:

    [riscv] Fix sp handling in MacroAssembler::LeaveFrame

    Keep sp <= fp to ensure that data right above fp doesn't get clobbered
    by an inopportune signal and its handler.

    Such clobbering can happen in e.g. Node.js when JIT-compiled code is
    interrupted by a SIGCHLD handler.

    Bug: None
    Change-Id: Ief0836032ada7942e89f081f7605f61632c4d414
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7540554
    Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
    Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn>
    Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105069}

Refs: v8/v8@6a0a25a
Co-authored-by: kxxt <rsworktech@outlook.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

blocked PRs that are blocked by other issues or PRs. build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.