[v24.x] build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY by pkubaj · Pull Request #66082 · nodejs/node

pkubaj · 2026-09-17T10:51:01Z

Since v24.20.0 (backport of #59941) ProcessGlobalArgsInternal() pushes
--experimental-wasm-jspi unconditionally. With ./configure --v8-lite-mode,
v8_enable_webassembly is 0, V8 is built without V8_ENABLE_WEBASSEMBLY, and
the whole experimental_wasm_* flag block in flag-definitions.h does not
exist. V8::SetFlagsFromCommandLine() is called with remove_flags=true, which
silently leaves unknown flags in argv, so node reports them as bad options and
exits with kInvalidCommandLineArgument. The first binary to run that code is
node_mksnapshot, so every lite-mode build fails:

bad option: --experimental-wasm-jspi
node_mksnapshot failed with exit code 9

This forwards v8_enable_webassembly to all targets as
V8_ENABLE_WEBASSEMBLY, the same way common.gypi already forwards the other
V8 feature defines, adds the % default the file needs for node-gyp, and only
pushes the JSPI flag when WebAssembly is compiled in. V8's public headers do not
reference V8_ENABLE_WEBASSEMBLY, so defining it for node's own sources does
not affect the V8 API.

--v8-lite-mode is not covered by CI, which is why this was not caught.

Verification

FreeBSD/amd64, ./configure --v8-lite-mode (the www/node24 port with the
JIT option off): node_mksnapshot now succeeds and the build completes;
node -p 'typeof WebAssembly' prints undefined as expected for lite mode.
Default configure: unchanged; node -p 'typeof WebAssembly.Suspending'
still prints function, so JSPI remains enabled.

AI disclosure

The root-cause analysis and the patch were drafted with Claude (Anthropic's
coding agent). I verified the analysis against deps/v8/src/flags/flag-definitions.h,
deps/v8/src/flags/flags.cc, configure.py and tools/v8_gypfiles/features.gypi,
and build-tested both configurations listed above myself.

Refs: #59941

Since d937c8c ("wasm: enable JSPI") ProcessGlobalArgsInternal() unconditionally appends --experimental-wasm-jspi to the V8 argument list. V8 only defines the experimental_wasm_* flags when it is built with V8_ENABLE_WEBASSEMBLY, and configure --v8-lite-mode sets v8_enable_webassembly=0. V8::SetFlagsFromCommandLine() is called with remove_flags=true, which silently leaves unrecognized flags in argv, so node reports "bad option: --experimental-wasm-jspi" and exits with kInvalidCommandLineArgument. The first binary to run that code is node_mksnapshot, so every --v8-lite-mode build has failed since v24.20.0: bad option: --experimental-wasm-jspi node_mksnapshot failed with exit code 9 Forward v8_enable_webassembly to all targets as V8_ENABLE_WEBASSEMBLY, the same way common.gypi already forwards the other V8 build flags, and only push the JSPI flag when WebAssembly is compiled in. Refs: nodejs#59941 Assisted-by: claude:fable-5.1 Signed-off-by: Piotr Kubaj <pkubaj@FreeBSD.org>

nodejs-github-bot · 2026-09-17T10:51:06Z

Review requested:

@nodejs/gyp
@nodejs/startup

github-actions · 2026-09-17T10:51:38Z

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

the guide for first-time contributors
the contribution and automation policies
the pull request guide
the AI use policy
the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.

codecov · 2026-09-17T21:58:41Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.32%. Comparing base (9e39360) to head (b44cdd0).
⚠️ Report is 583 commits behind head on v24.x-staging.

Additional details and impacted files

@@                Coverage Diff                @@
##           v24.x-staging   #66082      +/-   ##
=================================================
+ Coverage          90.31%   90.32%   +0.01%     
=================================================
  Files                711      714       +3     
  Lines             228425   231856    +3431     
  Branches           43160    43953     +793     
=================================================
+ Hits              206293   209427    +3134     
- Misses             14090    14151      +61     
- Partials            8042     8278     +236

Files with missing lines	Coverage Δ
src/node.cc	`73.90% <ø> (-0.59%)`	⬇️

... and 170 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-09-26T15:25:24Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77963/

aduh95 · 2026-10-06T12:55:12Z

Why does this target v24.x-staging and not main?

pkubaj · 2026-10-06T13:13:37Z

The bug only exists on v24.x. On main the push from #59941 (4396cf2) was reverted five days later in #60014 (23b8340, "revert enable JSPI as already enabled"): main's V8 ships JSPI unconditionally and no longer has an experimental_wasm_jspi flag, so there is nothing to gate.

aduh95 · 2026-10-06T13:28:44Z

Landed in 249e9a1

Ref: nodejs/node#66082

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * fix(patch): fix shared buffer growability validation Ref: nodejs/node#65845 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * chore: remove obsolete TLS external-memory accounting patch Upstream moved the SecureContext external-memory Increase() into Init() and guards the Decrease() on ctx_, so the leak this patch fixed is gone. The patch's removal of that guard now double-decrements when v24.22.0's TLSSocket closes a single-use context before the wrapper is destroyed, tripping V8's ExternalMemoryAccounter DCHECK in every TLS test. Already dropped on main in #53524. * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * fix(patch): fix shared buffer growability validation Ref: nodejs/node#65845 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * chore: remove obsolete TLS external-memory accounting patch Upstream moved the SecureContext external-memory Increase() into Init() and guards the Decrease() on ctx_, so the leak this patch fixed is gone. The patch's removal of that guard now double-decrements when v24.22.0's TLSSocket closes a single-use context before the wrapper is destroyed, tripping V8's ExternalMemoryAccounter DCHECK in every TLS test. Already dropped on main in #53524. * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * fix(patch): fix shared buffer growability validation Ref: nodejs/node#65845 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

github-actions Bot added the agentscan:mixed-signals label Sep 17, 2026

guybedford approved these changes Sep 17, 2026

View reviewed changes

aduh95 force-pushed the v24.x-staging branch from 00d2960 to 4396c9b Compare September 19, 2026 14:06

inoway46 added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 25, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 25, 2026

This comment has been minimized.

Sign in to view

aduh95 added author ready PRs with CI started, the required approvals, and no outstanding review comments. resume-ci Add this label to resume the latest eligible Jenkins CI run on a PR with an approving review. labels Sep 25, 2026

panva removed the resume-ci Add this label to resume the latest eligible Jenkins CI run on a PR with an approving review. label Sep 26, 2026

aduh95 changed the title ~~build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY~~ [v26.x] build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY Oct 6, 2026

aduh95 changed the title ~~[v26.x] build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY~~ [v24.x] build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY Oct 6, 2026

aduh95 merged commit 249e9a1 into nodejs:v24.x-staging Oct 6, 2026
84 checks passed

pkubaj deleted the jitless-v24-fix branch October 6, 2026 14:10

github-actions Bot mentioned this pull request Oct 11, 2026

2026-10-14, Version 24.22.0 'Krypton' (LTS) #66667

Merged

MarshallOfSound added a commit to electron/electron that referenced this pull request Oct 15, 2026

fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY

84a190e

Ref: nodejs/node#66082

MarshallOfSound added a commit to electron/electron that referenced this pull request Oct 15, 2026

fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY

bcedc8a

Ref: nodejs/node#66082

MarshallOfSound added a commit to electron/electron that referenced this pull request Oct 15, 2026

fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY

49046ec

Ref: nodejs/node#66082

MarshallOfSound added a commit to electron/electron that referenced this pull request Oct 15, 2026

fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY

99d1e84

Ref: nodejs/node#66082

MarshallOfSound added a commit to electron/electron that referenced this pull request Oct 15, 2026

fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY

e301ce6

Ref: nodejs/node#66082

Navigation Menu

Repository navigation

[v24.x] build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY - #66082

[v24.x] build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY#66082
aduh95 merged 1 commit into
nodejs:v24.x-stagingfrom
pkubaj:jitless-v24-fix

pkubaj commented Sep 17, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

codecov Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

nodejs-github-bot commented Sep 26, 2026

Uh oh!

aduh95 commented Oct 6, 2026

Uh oh!

pkubaj commented Oct 6, 2026

Uh oh!

Uh oh!

aduh95 commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

pkubaj commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

codecov Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment has been minimized.

nodejs-github-bot commented Sep 26, 2026

Uh oh!

aduh95 commented Oct 6, 2026

Uh oh!

pkubaj commented Oct 6, 2026

Uh oh!

Uh oh!

aduh95 commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

pkubaj commented Sep 17, 2026 •

edited

Loading

codecov Bot commented Sep 17, 2026 •

edited

Loading