bug in chromium 132 when iterating over very large objects (1 million keys)

It seems there is a bug in chrome 132 with very large objects (1 million keys).

  • chrome 132.0.6834.84
  • V8 13.2.152.27

Firefox works fine

Here is a minimal repro.

  • For some reason, the first time chrome loads the page, there are only 2 errors.
  • After I refresh, there are 3 errors.
<html>
  <script>
    const count = 1e6; // 1e5 => OK, 1e6 => ERROR

    const big = {};
    for (let i = 0; i < count; i++) {
      big[`key_${i}`] = { a: i, b: i * 2, c: i * 3 };
    }

    console.log('begin');

    try {
      for (let k in big) {
        if (big[k] === undefined) {
          throw new Error();
        }
      }
    } catch (e) {
      console.log(`for (k in big) => ERROR with count = ${count}`);
    }

    try {
      const keys = Object.keys(big);
      for (let k of keys) {
        if (big[k] === undefined) {
          throw new Error();
        }
      }
    } catch (e) {
      console.log(`Object.keys(big) => ERROR with count = ${count}`);
    }

    
    try {
      const keys = Object.getOwnPropertyNames(big);
      for (let k of keys) {
        if (big[k] === undefined) {
          throw new Error();
        }
      }
    } catch (e) {
      console.log(`Object.getOwnPropertyNames(big) => ERROR with count = ${count}`);
    }

    console.log('done');
  </script>
</html>