[v24.x backport] deps: V8: cherry-pick 1158ae719749 - #64498

Replace object spread in nested WebIDL conversion
options with stable-shape ordinary objects. This keeps
hot dictionary and sequence conversion paths from
allocating null-prototype spread results.

Apply the same pattern to Web Crypto converter wrappers
that override allowResizable or enable [EnforceRange].

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#62756
Reviewed-By: Yagiz Nizipli <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs#62562
Reviewed-By: James M Snell <[email protected]>

Signed-off-by: Nad Alaba <[email protected]>
PR-URL: nodejs#63117
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: avivkeller <[email protected]>
PR-URL: nodejs#63493
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: René <[email protected]>

Rename WebCrypto operation parameters and local variables to match the
spec terminology.

Use operation, algorithm, and key names consistently between the docs
and implementation.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#63518
Reviewed-By: René <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Drive the regression test from the WebCrypto algorithm registry so all
supported algorithms and operations must add explicit coverage
regardless of whether they are native-job backed or js-based.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#63520
Reviewed-By: René <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Refs: nodejs#62761
Signed-off-by: StefanStojanovic <[email protected]>
PR-URL: nodejs#63413
Reviewed-By: Vinícius Lourenço Claro Cardoso <[email protected]>

Signed-off-by: Mohamed Sayed <[email protected]>
PR-URL: nodejs#63529
Fixes: nodejs#63514
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#63556
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#63556
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#63556
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#63556
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Signed-off-by: Mert Can Altin <[email protected]>
PR-URL: nodejs#63385
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Fix build warnings by casting the number literals to the size_t
constants they are compared against.

Signed-off-by: Maya Lekova <[email protected]>
PR-URL: nodejs#63490
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: René <[email protected]>

PR-URL: nodejs#63668
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: nodejs#63669
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Mohamed Sayed <[email protected]>
PR-URL: nodejs#63601
Fixes: nodejs#63513
Reviewed-By: LiviaMedeiros <[email protected]>
Reviewed-By: Matthew Aitken <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs#63293
Reviewed-By: Antoine du Hamel <[email protected]>

This function call can fail with `Z_VERSION_ERROR` if the compiled
library vs loaded library mismatched in version number or in
stream structure size.
In those cases, zlib doesn't initialize the `strm_.msg` field to
null. Therefore, when a `CompressionError` object is created via
`ErrorForMessage()`, it can read a stale or uninitialized `strm_.msg`
pointer that will cause a crash.

Example ASAN report:
```
AddressSanitizer: SEGV on unknown address
    #0 __strlen_avx2
        string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76
    #1 strlen (/work/node/out/Debug/node+0x1a42ab7)
    nodejs#2 v8::(anonymous namespace)::StringLength(char const*)
        /work/node/out/../deps/v8/src/api/api.cc:7581:16
    nodejs#3 v8::(anonymous namespace)::StringLength(unsigned char const*)
        /work/node/out/../deps/v8/src/api/api.cc:7587:10
    nodejs#4 v8::String::NewFromOneByte(v8::Isolate*,
        unsigned char const*, v8::NewStringType, int)
        /work/node/out/../deps/v8/src/api/api.cc:7677:3
    nodejs#5 node::OneByteString(v8::Isolate*,
        char const*, int, v8::NewStringType)
        /work/node/out/../src/util-inl.h:166:10
    nodejs#6 node::(anonymous namespace)::CompressionStream<
        node::(anonymous namespace)::ZlibContext>
        ::EmitError(node::(anonymous namespace)
        ::CompressionError const&)
        /work/node/out/../src/node_zlib.cc:565:7
    nodejs#7 node::(anonymous namespace)::CompressionStream<
        node::(anonymous namespace)::ZlibContext>
        ::CheckError()
        /work/node/out/../src/node_zlib.cc:519:5
    nodejs#8 node::(anonymous namespace)::CompressionStream<
        node::(anonymous namespace)::ZlibContext>
        ::AfterThreadPoolWork(int)
        /work/node/out/../src/node_zlib.cc:543:10
    nodejs#9 node::ThreadPoolWork::ScheduleWork()
        ::'lambda'(uv_work_s*, int)
        ::operator()(uv_work_s*, int) const
        /work/node/out/../src/threadpoolwork-inl.h:57:15
    nodejs#10 node::ThreadPoolWork::ScheduleWork()
        ::'lambda'(uv_work_s*, int)
        ::__invoke(uv_work_s*, int)
        /work/node/out/../src/threadpoolwork-inl.h:48:7
    nodejs#11 uv__work_done /work/libuv-1.51.0/src/threadpool.c:330:5
    nodejs#12 uv__async_io.part.0
        /work/libuv-1.51.0/src/unix/async.c:208:5
```

Signed-off-by: ndossche <[email protected]>
PR-URL: nodejs#63476
Reviewed-By: Anna Henningsen <[email protected]>

Signed-off-by: arbinger <[email protected]>
PR-URL: nodejs#63050
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

PR-URL: nodejs#63670
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: nodejs#63545
Refs: nodejs#55794
Reviewed-By: Antoine du Hamel <[email protected]>

Signed-off-by: Tobias Nießen <[email protected]>
PR-URL: nodejs#63644
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

Update the setRawMode documentation to specify that raw mode disables
special processing of input characters only. Output processing, such as
newline translation on Unix terminals, is not affected.

Fixes: nodejs#63059
Signed-off-by: zeeshan56656 <[email protected]>
PR-URL: nodejs#63438
Reviewed-By: Anna Henningsen <[email protected]>

A recursively watched directory can be removed after a parent watcher
observes it but before the non-native recursive watcher scans it.

Ignore ENOENT from the directory scan so this deletion race does not
emit an unhandled watcher error.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: nodejs#63686
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-06-01.md#jstest-failure
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Use common.nodeProcessAborted() for the intentional abort path so
platform-specific abort signals such as SIGILL are accepted.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: nodejs#63687
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-06-01.md#jstest-failure
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Herrtian <[email protected]>
PR-URL: nodejs#63542
Fixes: nodejs#62774
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

Signed-off-by: Daijiro Wachi <[email protected]>
PR-URL: nodejs#63700
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Tierney Cyren <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: nodejs#63707
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: nodejs#64089
Refs: https://hackerone.com/reports/3817602
Reviewed-By: Yagiz Nizipli <[email protected]>

Signed-off-by: vassudanagunta <[email protected]>
PR-URL: nodejs#64184
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Jason Zhang <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs#64195
Refs: nodejs/undici#5358
Reviewed-By: Matthew Aitken <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Add guidance to the collaborator guide and onboarding docs recommending
node-stress-single-test when fixing flaky tests, so contributors verify
stability under repeated runs.

Signed-off-by: Kamat, Trivikram <[email protected]>
PR-URL: nodejs#64223
Refs: https://openjs-foundation.slack.com/archives/C03BJP63CH0/p1782716150521499
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Stewart X Addison <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>

Signed-off-by: Gürgün Dayıoğlu <[email protected]>
PR-URL: nodejs#64169
Reviewed-By: Daniel Lemire <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: nodejs#64281
Reviewed-By: René <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Minwoo Jung <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>

Co-authored-by: Antoine du Hamel <[email protected]>
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs#64213
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

Signed-off-by: Stewart X Addison <[email protected]>
PR-URL: nodejs#64256
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

Signed-off-by: haramjeong <[email protected]>
PR-URL: nodejs#60161
Reviewed-By: René <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: James M Snell <[email protected]>

The allowZero guard compared the raw value with `port === 0`, but
validatePort accepts strings and coerces them with `+port` in every
other clause. Since `'0' === 0` is false, string forms of zero
('0', ' 0 ', '00', '0x0', ...) slipped past the guard when
allowZero was false, while the numeric 0 was correctly rejected.

This is reachable via dgram's send(), connect(), and bind(), which
call validatePort(port, 'Port', false): passing '0' was silently
accepted instead of throwing ERR_SOCKET_BAD_PORT.

Coerce the value with `+port` so the zero check matches the rest of
the validation.

Signed-off-by: Daijiro Wachi <[email protected]>
PR-URL: nodejs#64174
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

Signed-off-by: YuSheng Chen <[email protected]>
PR-URL: nodejs#64187
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

ProtocolHandler::WriteRaw() dereferences tcp_ without a null check.
When the remote end disconnects, OnEof() resets tcp_ to nullptr, but
queued messages from the uv_async callback can still trigger Write()
on the same event loop iteration, causing a null pointer dereference
crash (EXCEPTION_ACCESS_VIOLATION on Windows).

Additionally, ParseWsFrames() can call OnEof() internally (on
compressed or error frames), which resets tcp_ mid-loop in OnData().
If the delegate callback triggered by OnWsFrame() then calls Write(),
it would also hit the null tcp_ crash.

Add null guards in:
- WsHandler::OnData: stop parsing loop when tcp_ becomes null
- WsHandler::Write: early return before frame encoding
- ProtocolHandler::WriteRaw: defensive fallback for all write paths

Fixes: nodejs#34833
Signed-off-by: piaoyingmin <[email protected]>
PR-URL: nodejs#64209
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>

BrotliCompress/Decompress.flush(kind) forwarded any value to the native
layer, causing a 100% CPU hang for kinds outside the brotli operation
range (e.g. Z_FINISH). Validate against [0, 3] and throw
ERR_OUT_OF_RANGE on invalid input.

Fixes: nodejs#63701
Signed-off-by: Ic3b3rg <[email protected]>
PR-URL: nodejs#63746
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Signed-off-by: Ic3b3rg <[email protected]>
PR-URL: nodejs#63746
Fixes: nodejs#63701
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Signed-off-by: Efe Karasakal <[email protected]>
PR-URL: nodejs#64275
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Jake Yuesong Li <[email protected]>

Rearm the stream's existing Timeout object instead of allocating a new
Timeout and a bound callback on every setTimeout() call. The HTTP
server disarms and rearms the keep-alive timeout twice per request, so
this saves two allocations and the associated async resource churn on
every request over a keep-alive connection.

The async resource is re-initialized on reuse, so async_hooks observes
the same init/destroy sequence as before.

A microbenchmark of the setTimeout(msecs)/setTimeout(0) cycle improves
by 2.2x (205.9ns to 92.8ns), and benchmark/http/simple.js
(type=buffer len=1024 chunks=1 chunkedEnc=0 c=50) improves by 3.70%
(t=2.15, 40 samples per binary with server and load generator pinned
to disjoint CPU sets).

Assisted-by: Claude Fable 5 (Claude Code)
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs#64254
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Minwoo Jung <[email protected]>

Original commit message:

    [wasm] Fix jump table slot overflow on x64 with CET enabled

    JumpTableAssembler::EmitJumpSlot for x64 was advancing the PC before
    checking if the target was reachable via a 32-bit displacement when CET
    was enabled. This caused a slot overflow when the far-jump fallback was
    triggered, as the second attempt to emit the slot would start at an
    incorrect offset.

    This CL ensures that the displacement check is performed before any
    instructions are emitted, making the function side-effect-free on
    failure. It also introduces kJumpTableSlotEntryMarkerSize to clarify
    the displacement calculation, following the pattern used on ARM64.

    Reported-by: Fabien Romano <[email protected]>

    TAG=agy
    [email protected]

    Fixed: 532112743
    Change-Id: Iaf6f15b51a66a45711e8556972ac0d353e6117c7
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8063803
    Reviewed-by: Jakob Kummerow <[email protected]>
    Commit-Queue: Clemens Backes <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#108556}

Refs: v8/v8@1158ae7
PR-URL: nodejs#64432
Fixes: nodejs#64424
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Richard Lau <[email protected]>