Summary
Please backport V8 commit b44239fe / V8 bug 554421904, "Turboshaft LLE: non-writing calls can create aliases", to the active Node.js 26.x and 24.x release lines.
This is the same upstream V8 miscompilation tracked in #66083 for 26.x, but 24.x is also affected by default: Node 24 ships V8 13.6 with Turboshaft load elimination enabled by default, and the minimized reproducer returns the wrong value there too.
Version
Reproduced locally with:
v26.9.0 / V8 14.6.202.34-node.32v24.18.0 / V8 13.6.233.17-node.50
Source check after fetching current tags/branches:
upstream/v26.x and upstream/v26.x-staging: V8 14.6.202.34, no regress-554421904 testupstream/v24.x and upstream/v24.x-staging: V8 13.6.233.17, no regress-554421904 test
Platform
This appears to be a compiler optimization bug rather than platform-specific behavior.
Subsystem
V8 / deps
What steps will reproduce the bug?
Run the minimized reproducer from #66083 with native syntax enabled:
node --allow-natives-syntax v8-lle-poc.js
I also checked the relevant runtime flag defaults:
26.x: --turboshaft-load-elimination is enabled by default24.x: --turboshaft-load-elimination is enabled by default22.x: --turboshaft-load-elimination is disabled by default, so this request is intentionally limited to 26.x and 24.x
How often does it reproduce? Is there a required condition?
It reproduced consistently for me on both default-affected lines listed above.
The reproducer requires optimized code and the Turboshaft load-elimination pass. That pass is enabled by default on the Node 26 and Node 24 builds tested.
What is the expected behavior? Why is that the expected behavior?
The store to staleArray[7] should be preserved, so the returned array slot should contain 1.1:
staleArray[7]: 1.1 | expected: 1.1 | OK
RESULT: NOT TRIGGERED on this build
What do you see instead?
Node 26:
v26.9.0 V8 14.6.202.34-node.32
staleArray[7]: undefined | expected: 1.1 | WRONG!
RESULT: BUG TRIGGERED — Turboshaft LLE eliminated a valid store
Node 24:
v24.18.0 V8 13.6.233.17-node.50
staleArray[7]: undefined | expected: 1.1 | WRONG!
RESULT: BUG TRIGGERED — Turboshaft LLE eliminated a valid store
Additional information
The upstream fix is small and directly addresses the alias invalidation ordering in Turboshaft late load elimination:
The current 26.x and 24.x V8 snapshots still have the vulnerable early !op.Effects().can_write() bailout before invalidating non-aliasing inputs in deps/v8/src/compiler/turboshaft/late-load-elimination-reducer.cc.
Summary
Please backport V8 commit
b44239fe/ V8 bug 554421904, "Turboshaft LLE: non-writing calls can create aliases", to the active Node.js26.xand24.xrelease lines.This is the same upstream V8 miscompilation tracked in #66083 for
26.x, but24.xis also affected by default: Node 24 ships V8 13.6 with Turboshaft load elimination enabled by default, and the minimized reproducer returns the wrong value there too.Version
Reproduced locally with:
v26.9.0/ V814.6.202.34-node.32v24.18.0/ V813.6.233.17-node.50Source check after fetching current tags/branches:
upstream/v26.xandupstream/v26.x-staging: V814.6.202.34, noregress-554421904testupstream/v24.xandupstream/v24.x-staging: V813.6.233.17, noregress-554421904testPlatform
This appears to be a compiler optimization bug rather than platform-specific behavior.
Subsystem
V8 / deps
What steps will reproduce the bug?
Run the minimized reproducer from #66083 with native syntax enabled:
node --allow-natives-syntax v8-lle-poc.jsI also checked the relevant runtime flag defaults:
26.x:--turboshaft-load-eliminationis enabled by default24.x:--turboshaft-load-eliminationis enabled by default22.x:--turboshaft-load-eliminationis disabled by default, so this request is intentionally limited to26.xand24.xHow often does it reproduce? Is there a required condition?
It reproduced consistently for me on both default-affected lines listed above.
The reproducer requires optimized code and the Turboshaft load-elimination pass. That pass is enabled by default on the Node 26 and Node 24 builds tested.
What is the expected behavior? Why is that the expected behavior?
The store to
staleArray[7]should be preserved, so the returned array slot should contain1.1:What do you see instead?
Node 26:
Node 24:
Additional information
The upstream fix is small and directly addresses the alias invalidation ordering in Turboshaft late load elimination:
The current
26.xand24.xV8 snapshots still have the vulnerable early!op.Effects().can_write()bailout before invalidating non-aliasing inputs indeps/v8/src/compiler/turboshaft/late-load-elimination-reducer.cc.