René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Deoptimization loop (\"wrong map\") in big.js Big.prototype.div makes code ~6x slower on v26, not on v24","articleBody":"### Version\n\nv26.11.1\n\n### Platform\n\n```text\nDarwin L1845 25.6.0 Darwin Kernel Version 25.6.0: Tue Aug 18 17:49:13 PDT 2026; root:xnu-12377.161.15.700.19~2/RELEASE_ARM64_T6000 arm64\n```\n\n### Subsystem\n\nv8 engine\n\n### What steps will reproduce the bug?\n\n```bash\nmkdir repro && cd repro\nnpm init -y && npm pkg set type=module\nnpm install big.js@7.0.1\n```\n\n`repro.mjs`:\n\n```js\nimport Big from 'big.js'\n\n// Deterministic PRNG (mulberry32)\nlet seed = Number(process.argv[2] ?? 1) >>> 0\nconst random = () => {\n  seed = (seed + 0x6d2b79f5) >>> 0\n  let t = seed\n  t = Math.imul(t ^ (t >>> 15), t | 1)\n  t ^= t + Math.imul(t ^ (t >>> 7), t | 61)\n  return ((t ^ (t >>> 14)) >>> 0) / 4294967296\n}\n\nlet sink = 0\nconst start = performance.now()\nfor (let i = 0; i \u003c 300000; i++) {\n  const a = Big((random() * 30).toFixed(2))\n  const b = Big((random() * 5 + 0.5).toFixed(i % 3))\n  sink += Number(a.times(b).div(i % 2 ? Big(1.255) : b.plus(1)).round(2))\n}\nconsole.log(`${process.version} took ${Math.round(performance.now() - start)} ms (${sink > 0})`)\n```\n\n```bash\nnode repro.mjs 2\nnode --trace-deopt repro.mjs 2 2>&1 | grep -c \"JSFunction P.div\"\n```\n\n### How often does it reproduce? Is there a required condition?\n\nDeterministic with seed 2 (6/6 runs on both v26.7.0 and v26.11.1). Whether the loop starts depends on\nthe input sequence: with seeds 1..12, seeds 2, 3, 7 and 9 trigger it on v26 and none trigger it on v24.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nP.div should deoptimize a few times, after which V8 should reoptimize it with updated feedback.\nThis is what happens on v24.21.0: 1-3 deopts of P.div for every seed, and every run takes ~1.0-1.1 s.\n\n### What do you see instead?\n\nOn v26, `P.div` is deoptimized thousands of times at the same bytecode offset with the same reason,\nand the run is ~6x slower:\n\n| | v24.21.0 | v26.7.0 | v26.11.1 |\n|---|---|---|---|\n| `node repro.mjs 1` | ~1,040 ms | ~1,030 ms | ~1,010 ms |\n| `node repro.mjs 2` | ~1,075 ms | **6,620–8,640 ms** | **~6,600 ms** |\n| `P.div` deopts, seed 2 | 2 | **~5,150** | **~5,600** |\n\nEvery deopt has the same signature (v26.11.1):\n\n```\n[bailout (kind: deopt-eager, reason: wrong map): begin. deoptimizing 0x3e332d0efef9 \u003cJSFunction P.div (sfi = 0x3e332d0ee969)>, 0x2cf238c84509 \u003cCode MAGLEV>, opt id 2, bytecode offset 447, deopt exit 39, FP to SP delta 240, caller SP 0x00016fb98c20, pc 0x000115b8ba88]\n```\n\nBytecode offset 447 is a `Dec` bytecode (`--rl`) in `r[--rl] \u003c bt[rl]` in big.js `div`\n(https://github.com/MikeMcl/big.js/blob/v7.0.1/big.mjs#L410):\n\n```\n10242 S> @  445 : 0b ea             Ldar r15\n         @  447 : 5a 4f             Dec FBV[79]\n         @  449 : c3                Star15\n10247 E> @  450 : 35 eb 50          GetKeyedProperty r14, FBV[80]\n```\n\nThe loop is not specific to Maglev. With `--no-maglev`, TurboFan code loops at the same offset with the same reason:\n\n| Flags (v26.11.1, seed 2) | `P.div` deopts | Deoptimized code | Time |\n|---|---|---|---|\n| (default) | 5,649 | Maglev | 6,614 ms |\n| `--no-maglev` | 855 | TurboFan, offset 447, `wrong map` | 6,850 ms |\n| `--no-maglev-osr` | 5,709 | Maglev | 6,621 ms |\n| `--no-turbofan` | 5,713 | Maglev | 6,640 ms |\n\n### Additional information\n\nWe noticed this through a performance smoke test in a calculation library that uses big.js\nfor all arithmetic. On v26 the test became ~30% slower and flaky in CI (GitHub Actions\nubuntu-latest, x64), while v22 and v24 were stable. In that test suite the same signature appears:\n~1,250 \"wrong map\" deopts of P.div at bytecode offset 447.\n\nThe repro above was measured only on macOS arm64; the CI symptom suggests Linux x64 is also affected,\nbut I did not verify the deopt trace there.\n\nPossibly related, but a different symptom: #66457 (Maglev OSR correctness bug, also v24.11/v26,\nalso repeated eager deopts of the same code). --no-maglev-osr does not help here.","author":{"url":"https://github.com/timoly","@type":"Person","name":"timoly"},"datePublished":"2026-10-14T06:25:04Z","url":"https://github.com/nodejs/node/issues/66717"}