Objects randomly become number when iterating over arrays

[xtexx]

Version

v22.13.1

Platform

CPU: Loongson-3 V0.4 V0.1 (8) @ 1.80 GHz (mips loongson)

Four different machines:

• Linux ybsbny 6.13.0-aosc-main #1 SMP PREEMPT Sat Jan 25 17:36:36 UTC 2025 mips64 GNU/Linux
• Linux Resonance 6.14.0-aosc-rc #1 SMP PREEMPT Tue Feb 4 06:42:48 UTC 2025 mips64 GNU/Linux
• Linux LoongUnion2 5.4.259-aosc-lemote #1 SMP PREEMPT Mon Oct 30 02:53:03 UTC 2023 mips64 GNU/Linux
• Linux Misaka23333 6.13.0-aosc-main #1 SMP PREEMPT Sat Jan 25 17:36:36 UTC 2025 mips64 GNU/Linux

What steps will reproduce the bug?

The reproducing script:

const arr = [];
while (true) {
    for (let i = 0; i < 100; i++) // [1]
        arr.push({
            s: 964136,
            i: 964225,
            a: "    return createFileDiagnostic(sourceFile, start, nodes.end - start, message, ...args);"
        });
    const brr = JSON.parse(JSON.stringify(arr));
    let cond = false;
    for (let r = 0; r < 2; r++) {
        for (let i = 0; i < arr.length; i++) {
            let a = arr[i];
            if ((typeof a) != 'object') {
                console.log(r, 'orig idx', a, i, arr.length);
                cond = true;
            }
        };
        for (a of arr) {
            if ((typeof a) != 'object') {
                console.log(r, 'orig of', a, arr.length);
                cond = true;
            }
        };
        for (let i = 0; i < brr.length; i++) {
            let a = brr[i];
            if ((typeof a) != 'object') {
                console.log(r, 'par idx', a, i, brr.length);
                cond = true;
            }
        };
        for (a of brr) {
            if ((typeof a) != 'object') {
                console.log(r, 'par of', a, brr.length);
                cond = true;
            }
        };
    }
    if (cond) break;
};

Run the script for several times. If it has been running for a while, stop it with CTRL+C and restart.

(ssh)root@LoongUnion2 [ ~ ] # time node poc.js 
0 orig idx 165 6307 6900
0 orig idx 165 6375 6900
0 orig of 165 6900
0 orig of 165 6900
1 orig idx 165 6307 6900
1 orig idx 165 6375 6900
1 orig of 165 6900
1 orig of 165 6900

real    0m0.804s        106.12%
user    0m0.810s
sys     0m0.043s
(ssh)root@Resonance [ ~ ] # time node poc.js
1 orig idx 73 2890 3100
1 orig of 73 3100

real    0m0.336s        104.22%
user    0m0.298s
sys     0m0.051s
(ssh)root@Misaka23333 [ ~ ] # time node poc.js
0 orig idx 186 9451 10600
0 orig of 186 10600
1 orig idx 186 9451 10600
1 orig of 186 10600

real    0m1.735s        106.58%
user    0m1.722s
sys     0m0.127s

Full test results: https://aosc.io/paste/detail?id=19f57df4-49e5-4bb3-b3e8-209a63b188c2

Changing 100 to 10000 at [1] makes the error appear faster:

(ssh)root@Misaka23333 [ ~ ] # time node poc.js
0 orig idx 24 33361 50000
0 orig of 24 50000
1 orig idx 24 33361 50000
1 orig of 24 50000

real    0m0.712s        131.57%
user    0m0.866s
sys     0m0.071s
(ssh)root@Misaka23333 [ ~ ] # time node poc.js
0 orig idx 243 113562 120000
0 orig of 243 120000
1 orig idx 243 113562 120000
1 orig of 243 120000

real    0m3.278s        142.84%
user    0m4.521s
sys     0m0.161s
(ssh)root@Misaka23333 [ ~ ] # time node poc.js
0 orig idx 127 31739 50000
0 orig idx 127 32341 50000
0 orig idx 127 32973 50000
0 orig idx 127 33050 50000
0 orig idx 127 33068 50000
0 orig idx 127 33069 50000
0 orig idx 127 33261 50000
0 orig idx 127 33317 50000
0 orig of 127 50000
0 orig of 127 50000
0 orig of 127 50000
0 orig of 127 50000
0 orig of 127 50000
0 orig of 127 50000
0 orig of 127 50000
0 orig of 127 50000
1 orig idx 127 31739 50000
1 orig idx 127 32341 50000
1 orig idx 127 32973 50000
1 orig idx 127 33050 50000
1 orig idx 127 33068 50000
1 orig idx 127 33069 50000
1 orig idx 127 33261 50000
1 orig idx 127 33317 50000
1 orig of 127 50000
1 orig of 127 50000
1 orig of 127 50000
1 orig of 127 50000
1 orig of 127 50000
1 orig of 127 50000
1 orig of 127 50000
1 orig of 127 50000

real    0m0.702s        135.94%
user    0m0.877s
sys     0m0.078s

Full test results: https://aosc.io/paste/detail?id=85ee7a40-57ef-492d-b09d-3defe3d11fc4

Another way that is sure to trigger this problem is, to build Forgejo v10.0.1 (and Webpack will fail).

How often does it reproduce? Is there a required condition?

idk, (almost) every time.
It seems to be not related to CPU usage (during my test, two machines are running other heavy jobs and one does not).

Most time when the error appear, the length of the array is close to some specific values.

Per test results above, serializing and parsing the array from/to JSON made it "stabler" (but still may be broken at chance). By writing serialized JSON to a file, I found that the JSON string also included those bad numbers. (:

According to the AOSC OS's package commit/building log, we last successfully built forgejo 9.0.0 with nodejs v20.18.0, and first find the build failure on forgejo 9.0.2 with nodejs v22.12.0. v22.10.0 is also broken.

What is the expected behavior? Why is that the expected behavior?

Values should not be changed and the program should not exit.

What do you see instead?

When iterating over a large array, some objects are turned into numbers (I have not seen types other than number).

Additional information

I have not seen this on amd64/loongarch64/arm64/riscv64/ppc64el (:

Not tested on other mips variants other than loongson.

[targos]

This is most likely a V8 issue. If it has already been fixed upstream, we could cherry-pick the fix to Node.js.