[V8][TurboFan][Maglev] Sponsor request for dictionary super-load receiver fix

[*Feral*]

Hello V8 developers,

I found an observable JIT miscompilation in the dictionary-property load
optimization shared by TurboFan and Maglev.

When a named `super` load is specialized as `LoadDictionaryField`, the fast
path works while the cached dictionary entry remains a data property. If the
entry is later reconfigured as an accessor, the fallback calls the ordinary
`LoadIC` with the lookup-start object as its receiver. The getter therefore
observes the prototype object as `this`, rather than the original receiver.
The optimized function returns an incorrect value and remains optimized.

I reproduced this on V8 15.2.101 release and debug builds on macOS arm64. It
affects both TurboFan and Maglev. In the reproducer, the optimized load returns
`undefined` instead of `42`, and the getter observes `proto` instead of the
receiver.

The attached patch:

* preserves the original receiver and an explicit super-load mode through
  Simplified IR, Turboshaft, and Maglev;
* uses `LoadSuperIC` for the fallback of a `super` load while retaining
  `LoadIC` for ordinary loads; and
* adds separate TurboFan and Maglev regression tests.

Validation performed:

* full `arm64.debug.d8` build succeeded;
* both new regression tests passed with the V8 test runner;
* `mjsunit/maglev/dict-load`, `mjsunit/dictionary-properties`, and
  `mjsunit/dictionary-prototypes` passed; and
* `git cl presubmit --upload --force` completed with no warnings or errors.

The Google Individual CLA is signed for:

    Bowon Kang <rw7...@gmail.com>

I cannot upload the change to Gerrit directly because Chromium Gerrit ReAuth
requires a physical FIDO security key, which I am unable to use. Would a V8
committer be willing to sponsor and upload the attached patch on my behalf?
The patch preserves my author metadata and includes my V8 AUTHORS entry.

The local commit is:

    9b8352913d5ae30474e9dfbce5c42e550e8e5ac0
    [turbofan][maglev] Preserve receiver for dictionary super loads

The affected TurboFan path was introduced by:

    a6c78c1b70b059177ada935872bf7add1384e2d6
    [turbofan] Port dictionary load optimization to Turbofan

Thank you,
Bowon Kang

Attachment:
0001-turbofan-maglev-Preserve-receiver-for-dictionary-sup.patch

[Marja Hölttä]

Hi,

Thanks for sending the patch!

I skimmed it quickly, it looks legit (but I'll need to have a closer look to verify it). We'll figure out how we can take it in. The CLA looks fine, too.

You can always file bugs / vulnerabilities in https://issues.chromium.org/issues .

--
--
v8-dev mailing list
v8-...@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to v8-dev+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/v8-dev/CACRtacfw0jj1MK6fp1o93rWOGZUvaib1eVb1DUBb7ZTZJ-c_QQ%40mail.gmail.com.

--

Google Germany GmbH

Erika-Mann-Straße 33

80636 München

Geschäftsführer: Paul Manicle, Liana Sebastian.

Registergericht und -nummer: Hamburg, HRB 86891

Sitz der Gesellschaft: Hamburg

Diese E-Mail ist vertraulich. Falls sie diese fälschlicherweise erhalten haben sollten, leiten Sie diese bitte nicht an jemand anderes weiter, löschen Sie alle Kopien und Anhänge davon und lassen Sie mich bitte wissen, dass die E-Mail an die falsche Person gesendet wurde.

    

This e-mail is confidential. If you received this communication by mistake, please don't forward it to anyone else, please erase all copies and attachments, and please let me know that it has gone to the wrong person.

[*Feral*]

Hi Marja,

Thank you for taking a look and for confirming the CLA.

Please let me know if you need any additional information, changes, or testing from my side.

Best,
Bowon

2026년 7월 20일 (월) 오후 5:50, Marja Hölttä <ma...@chromium.org>님이 작성:

To view this discussion visit https://groups.google.com/d/msgid/v8-dev/CAED6dUDwJ346O%2BhEAPSJ0gh7ajQDtuFj2VCdeoD9s4uvEm%2BZrg%40mail.gmail.com.

[Jakob Kummerow]

FWIW, I believe the ReAuth requirement only applies to committers. You should be able to upload to Gerrit using a regular GMail account without physical Security Key. Please give that a try, it would be the easiest workflow both for you and for us.

[*Feral*]

Hi Jakob,

Thanks for the clarification. I tried again with my regular Gmail account, and the upload worked successfully.

The Gerrit CL is here:
https://chromium-review.googlesource.com/c/v8/v8/+/8123638

Thanks again for your help!

Best,
Bowon Kang

2026년 7월 20일 월요일 오후 6시 25분 56초 UTC+9에 Jakob Kummerow님이 작성: