URL.canParse returns false for a valid non-ASCII host after optimisation (v20, v22) #67012

Version

v22.23.2 (also v20.20.2). Not reproducible on v24.22.1.

Platform

Linux x64 (Ubuntu 24.04)

Subsystem

url

What steps will reproduce the bug?

// repro.mjs
const idn = "https://münchen.example/zahlungen";
let firstFalse = -1;
for (let i = 0; i < 200000; i++) {
  URL.canParse(i % 2 ? "https://example.com/a" : idn);
  if (!URL.canParse(idn)) { firstFalse = i; break; }
}
let parses = true;
try { new URL(idn); } catch { parses = false; }
console.log(process.version, "URL.canParse(idn) first false at iteration", firstFalse, "new URL ok:", parses);

Run node repro.mjs. No dependencies.

How often does it reproduce? Is there a required condition?

Every time. The input must have a non-ASCII host. It starts after the call has been optimised.

What is the expected behavior? Why is that the expected behavior?

URL.canParse(idn) returns true on every call, because new URL(idn) succeeds on the same string.

What do you see instead?

Additional information

This looks like the non-ASCII variant of #48816 (the fast API path of URL.canParse). On v24 it does not reproduce, probably because of #58023 ("url: improve canParse() performance for non-onebyte strings"), which carries backport-requested-v22.x. If that is the fix, please treat this issue as a request for that backport to v22.x.

How we found it: zod 4.6 changed z.string().url() from new URL() to URL.canParse(). After that change, a test with an IDN host failed at random on Node 20 and 22.