Skip to content

deps: V8: backport 8dcf14f490c2 - #66707

Open
eliau2005 wants to merge 2 commits into
nodejs:mainfrom
eliau2005:deps-v8-backport-8dcf14f490c2
Open

eliau2005 wants to merge 2 commits into
nodejs:mainfrom
eliau2005:deps-v8-backport-8dcf14f490c2

Conversation

@eliau2005

Copy link
Copy Markdown
Contributor

Backports the V8 fix for a fatal OOM in Parser::HandleDebugMagicComments:
the values of //# sourceURL, sourceMappingURL and debugId are now created
as substrings of the script source instead of being copied and
internalized, so a large inline source map no longer aborts the process
when loaded in a worker with a small heap limit.

The patch needed small adaptations for deps/v8 (no src/base/unique-array.h,
different CodeSerializer layout); see the first commit message.

Note: as the upstream commit says, consuming a code cache
(NODE_COMPILE_CACHE) still creates these values as full strings on the
heap.

Fixes: #64155
Refs: https://chromium-review.googlesource.com/c/v8/v8/+/8472768
Refs: https://issues.chromium.org/issues/566467883

Original commit message:

    [parser] Create debug magic comment values as source substrings

    The values of the //# sourceURL, sourceMappingURL and debugId magic
    comments were copied into LiteralBuffers while scanning and then
    internalized. An inline source map (sourceMappingURL=data:...) can be
    tens of MiB, so this allocated a string of that size on the heap in a
    non-throwing allocation, e.g. aborting a Node.js worker with a small
    old-generation limit even though the (external) source fits.

    The scanner now only records the source locations of these values, and
    the values are created as substrings of the script source:
    - On the main thread, when parsing finishes.
    - For background and streaming compiles, where the source is not
      available while parsing, the locations are kept in the
      BackgroundCompileTask and the substrings are created in
      FinalizeScript after the source is set. Locations outside of the
      source provided by the embedder are ignored.

    The semantics are unchanged: the last comment wins, trailing garbage or
    an empty value removes the value, and a source map URL provided through
    the API takes precedence.

    Since these values are now usually SlicedStrings of the script source,
    the code serializer serializes all sliced strings as sequential
    strings (one-byte if their contents are, even if their parent is
    two-byte). The script source is an attached object, and off-thread
    deserialization attaches a placeholder for it, so a serialized slice
    of it would not be valid.

    Consuming a code cache still materializes these values as sequential
    strings, e.g. on Node.js's NODE_COMPILE_CACHE path, so a huge cached
    value can still be large on the heap there. Keeping them as substrings
    of the source when deserializing requires a code cache format change
    and is left for a follow-up.

    This also removes the LiteralBuffer copies of the values.

    R=leszeks@chromium.org, verwaest@chromium.org

    Bug: 566467883
    Change-Id: I07d8d0c36f56c7aee40793b1db272657832ab36f
    Refs: nodejs#64155
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8472768
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Reviewed-by: Patrick Thier <pthier@chromium.org>
    Auto-Submit: eliau elkouby (‫אליהו אלקובי‬‎) <eliau.elkouby@gmail.com>
    Commit-Queue: Patrick Thier <pthier@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#110612}

Adapted to deps/v8: src/base/unique-array.h does not exist yet, so
base::OwnedVector is used in the serializer, and the CodeSerializer
override is placed for the older class layout.

Refs: v8/v8@8dcf14f
Assisted-by: a closed-source coding agent
Signed-off-by: eliau2005 <eliau.elkouby@gmail.com>
Assisted-by: a closed-source coding agent
Signed-off-by: eliau2005 <eliau.elkouby@gmail.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/v8-update

@nodejs-github-bot nodejs-github-bot added build Issues and PRs related to Node.js builds or CI infrastructure. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. labels Oct 13, 2026
@codecov

codecov Bot commented Oct 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.48%. Comparing base (29bd740) to head (8d57314).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #66707      +/-   ##
==========================================
+ Coverage   90.47%   90.48%   +0.01%     
==========================================
  Files         791      791              
  Lines      277245   277204      -41     
  Branches    53310    53318       +8     
==========================================
- Hits       250834   250825       -9     
+ Misses      16811    16792      -19     
+ Partials     9600     9587      -13     

see 38 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@eliau2005

Copy link
Copy Markdown
Contributor Author

@richardlau @legendecas @joyeecheung could you take a look? This backports my V8 fix for #64155 (v8/v8@8dcf14f490c2).

It didn't apply cleanly, so the first commit has three small adaptations for deps/v8, listed in the commit message: src/base/unique-array.h doesn't exist yet so base::OwnedVector is used in the serializer, the CodeSerializer override is placed for the older class layout, and literal-buffer.cc had a context-only conflict.

The test-linux (ubuntu-24.04-arm) failure is sequential/test-http-server-request-timeouts-mixed, a known flake (#43465, #54817), unrelated to this change.

A CI run, including V8 CI, would be appreciated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Issues and PRs related to Node.js builds or CI infrastructure. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Worker with large inline source map aborts process in V8 HandleDebugMagicComments

2 participants