nodejs / nodejs/node

vm: eval cache mixes up script origins

Open
#65,866 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
122k
Forks
37.3k
Avg merge
4d 2h
Merged PRs (30d)
283

Description

Bug report

  • Node.js: v24.19.0, v26.8.1, v27.0.0-pre (local build)
  • Platform: Microsoft Windows NT 10.0.26200.0 x64
  • Subsystem: vm
// test.mjs
import assert from 'node:assert/strict';
import { Script } from 'node:vm';

const out = [];

function createScript(name) {
  return new Script(`globalThis.eval('import("node:fs")')`, {
    importModuleDynamically(specifier) {
      out.push(name);
      return import(specifier);
    },
  });
}

const a = createScript('A');
const b = createScript('B');

for (const script of [a, b, a]) {
  await script.runInThisContext();
}

assert.deepEqual(out, ['A', 'B', 'A']);

Running this example as node --experimental-vm-modules test.mjs will give different wrong answers between v24 and v26 because V8 removed delayed caching some time during those releases. However, running with --no-compilation-cache will pass the test assertion.

The bug is with V8. In deps/v8/src/codegen/compiler.cc, around the "cache lookup key" comment, indirect eval uses kNoSourcePosition (-1), and the cache key does not distinguish the originating script. This allows identical eval source text from different scripts in the same realm to produce a false positive cache hit.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the provided test.mjs under --experimental-vm-modules, then inspect deps/v8/src/codegen/compiler.cc around the "cache lookup key" comment. Trace the eval cache lookup and related tests to understand how script origins are represented. Done means the A/B/A assertion passes with compilation caching enabled while the existing no-compilation-cache behavior remains correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, javascript, node.js
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.