V8 Maglev JIT causes STATUS_STACK_BUFFER_OVERRUN (0xC0000409) on Windows 11 Insider build 26200

未确定源文件或测试。首先在 Windows 11 Insider build 26200 上使用 Node.js v25.8.0 重现崩溃，并比较默认执行与 --no-maglev 和 --no-turbofan 下的执行结果。完成标准是确定已确认的 Maglev/Windows 原因，并在不需要 --no-maglev 的情况下阻止 STATUS_STACK_BUFFER_OVERRUN。

What happened?

Node.js processes crash with exit code -1073740791 (0xC0000409 / STATUS_STACK_BUFFER_OVERRUN) within 20-70 seconds of startup when running a non-trivial application (WebSocket server with HTTP, Telegram bot polling, and plugin system) on Windows 11 Insider (Canary channel).

The crash is caused by V8's Maglev JIT compiler tier. Workaround: --no-maglev flag eliminates the crash entirely.

Reproduction

Environment:

• Node.js: v25.8.0
• V8: 14.1.146.11-node.20
• OS: Windows 11 Pro for Workstations, Insider Canary build 10.0.26200.0
• Arch: x64

Steps:

1. Run a long-lived Node.js application that uses fetch(), WebSocket, and timers on Windows 11 Insider build 26200
2. Process crashes with exit code -1073740791 (0xC0000409) within 20-70 seconds
3. No JavaScript stack trace — the crash is in native JIT-compiled code via __fastfail

Flags tested:

--no-maglev is the minimal workaround — disabling only the Maglev tier prevents the crash while keeping TurboFan and fetch() functional.

Additional context:

• A bare Node.js HTTP server (http.createServer) does NOT crash — the issue requires enough code to trigger Maglev optimization
• Crash bypasses Windows Error Reporting (__fastfail / SEH)
• Windows Event Viewer shows the Insider build has kernel-level instability (BlueScreen events, VIDEO_ENGINE_TIMEOUT_DETECTED), suggesting stricter CFG enforcement
• The same application runs without issues on Windows Server 2019 and stable Windows builds

Expected behavior

Node.js should not crash with STATUS_STACK_BUFFER_OVERRUN. Maglev-compiled code should respect Windows CFG/CET enforcement on Insider builds.

Workaround

Pass --no-maglev as a command-line flag (cannot be set via NODE_OPTIONS):

node --no-maglev app.js