control: forwarded -1 https://github.com/nodejs/node/issues/67066
Hi, On 2026-10-26 23:47, Aurelien Jarno wrote: > Hi, > > On 2026-10-24 11:24, Aurelien Jarno wrote: > > On 2026-10-23 21:25, Aurelien Jarno wrote: > > > Source: nodejs > > > Version: 24.22.0+dfsg+~cs24.19.2-2 > > > Severity: serious > > > Tags: ftbfs upstream > > > Justification: fails to build from source (but built successfully in the > > > past) > > > X-Debbugs-Cc: [email protected] > > > User: [email protected] > > > Usertags: riscv64 > > > > > > Dear maintainer, > > > > > > As you surely have noticed, the latest version of nodejs fails to build > > > on riscv64. It fails with: > > > > ... > > > > > I have rebuilt version 24.21.0+dfsg+~cs24.13.4-1 in the same > > > environment, and it works fine, so the issue is not due to a dependency. > > > > > > I have also been able to reproduce the issue with upstream tag v24.22.0 > > > as well as v24.22.1. On the other hand upstream tag v24.21.0 works fine, > > > so the issue is not due to a debian change. > > > > > > I have started bisecting, but it will take some time. > > > > Here is the result: > > > > | fb0d0ca28993802d67360edc84d467fe3ccdc20b is the first 'bad' commit > > | commit fb0d0ca28993802d67360edc84d467fe3ccdc20b (HEAD) > > | Author: Ruan Gustavo <[email protected]> > > | Date: Wed Sep 2 22:00:20 2026 -0300 > > | > > | deps: V8: backport 0b94a9fd23ba > > | > > | Original commit message: > > | > > | [leaptiering] Fix BaselineOutOfLinePrologue builtin > > | > > | ... which tried to preserve kJavaScriptCallDispatchHandleRegister > > even > > | on configurations where it's not used which resulted in a random > > value > > | on the stack discoverable by GC. > > | This issue triggered only on non-sandbox configuration with > > enabled > > | leaptiering. > > | > > | Drive-by: fix MacroAssembler::GenerateTailCallToReturnedCode() on > > riscv > > | port which wasn't preserving dispatch handle as all the other > > ports do. > > | > > | Bug: 42204201 > > | Fixed: 413769394 > > | > > | Change-Id: If146b0b7a6cf972ed5a881142f40980774f19cba > > | Reviewed-on: > > https://chromium-review.googlesource.com/c/v8/v8/+/6587010 > > | Commit-Queue: Igor Sheludko <[email protected]> > > | Reviewed-by: Olivier Flückiger <[email protected]> > > | Cr-Commit-Position: refs/heads/main@{#100512} > > | > > | Node.js 24 builds V8 with leaptiering enabled and the sandbox > > disabled, > > | so V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE is not defined and the JS > > | calling convention does not carry the dispatch handle register (x4 on > > | arm64). BaselineOutOfLinePrologue and GenerateTailCallToReturnedCode > > | still pushed that register as a tagged slot of an INTERNAL frame, so > > | whatever value the caller left there is dereferenced by > > | ClearStaleLeftTrimmedPointerVisitor during mark-compact root scanning > > | and crashes the process with SIGSEGV (seen as jest workers dying). > > | > > | Refs: > > https://github.com/v8/v8/commit/0b94a9fd23ba5f59b3f675fb04d60a9b0102e27d > > | Fixes: https://github.com/nodejs/node/issues/62393 > > | PR-URL: https://github.com/nodejs/node/pull/65753 > > | Reviewed-By: Richard Lau <[email protected]> > > | > > | common.gypi | 2 +- > > | deps/v8/src/builtins/arm64/builtins-arm64.cc | 3 ++- > > | deps/v8/src/builtins/loong64/builtins-loong64.cc | 5 +++-- > > | deps/v8/src/builtins/mips64/builtins-mips64.cc | 5 +++-- > > | deps/v8/src/builtins/riscv/builtins-riscv.cc | 7 +++++-- > > | deps/v8/src/builtins/x64/builtins-x64.cc | 5 +++-- > > | deps/v8/src/codegen/arm64/macro-assembler-arm64.cc | 11 ++++++----- > > | deps/v8/src/codegen/loong64/macro-assembler-loong64.cc | 5 +++-- > > | deps/v8/src/codegen/mips64/macro-assembler-mips64.cc | 5 +++-- > > | deps/v8/src/codegen/riscv/macro-assembler-riscv.cc | 18 > > +++++++++++++++--- > > | deps/v8/src/codegen/x64/macro-assembler-x64.cc | 5 +++-- > > | 11 files changed, 47 insertions(+), 24 deletions(-) > > > > I have tested that reverting that commit on upstream v24.22.1 or on the > > Debian package fix the issue. I still need to understand what is broken, > > any help is welcome. > > I have found that the following v8 commit is missing from the backport: > https://chromium.googlesource.com/v8/v8.git/+/ec2f506f97dfbb5fa19e4fe9103965a3c94690af > > Backporting it to the embedded v8 copy fixes the issue. I have reported the bug upstream: https://github.com/nodejs/node/issues/67066 Regards Aurelien -- Aurelien Jarno GPG: 4096R/1DDD8C9B [email protected] http://aurel32.net
