[M150] [maglev] Skip stale maps in StoreMap alias invalidation [v8/v8 : refs/branch-heads/15.0]

0 views
Skip to first unread message

chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com (Gerrit)

unread,
Jul 24, 2026, 6:35:26 AM (22 hours ago) Jul 24
to Darius Mercadier, v8-s...@luci-project-accounts.iam.gserviceaccount.com, v8-re...@googlegroups.com
Attention needed from Darius Mercadier and Victor Gomes

chrome-che...@chops-service-accounts.iam.gserviceaccount.com has uploaded the change for review

Commit message

[M150] [maglev] Skip stale maps in StoreMap alias invalidation

Original change's description:
> [maglev] Skip stale maps in StoreMap alias invalidation
>
> Fixed: 528501127
> Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8019002
> Reviewed-by: Darius Mercadier <dmerc...@chromium.org>
> Commit-Queue: Victor Gomes <victo...@chromium.org>
> Commit-Queue: Darius Mercadier <dmerc...@chromium.org>
> Auto-Submit: Victor Gomes <victo...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#108302}

(cherry picked from commit 9068d5fc068f85d0eb723d9b63f15fb56c6db725)
Bug: 538442063,528501127
Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4

Change diff

diff --git a/src/maglev/maglev-known-node-aspects.cc b/src/maglev/maglev-known-node-aspects.cc
index fa5cc31..fc44406 100644
--- a/src/maglev/maglev-known-node-aspects.cc
+++ b/src/maglev/maglev-known-node-aspects.cc
@@ -344,7 +344,7 @@
   if (!node->is_transitioning()) return;
 
   if (NodeInfo* node_info = TryGetInfoFor(node->ValueInput().node())) {
-    if (node_info->possible_maps_are_known() &&
+    if (node_info->possible_maps_are_known() && !node_info->maps_are_stale() &&
         node_info->possible_maps().size() == 1) {
       compiler::MapRef old_map = node_info->possible_maps().at(0);
       auto MaybeAliases = [&](compiler::MapRef map) -> bool {
diff --git a/test/mjsunit/turbolev/regress-528501127.js b/test/mjsunit/turbolev/regress-528501127.js
new file mode 100644
index 0000000..8a8e17d
--- /dev/null
+++ b/test/mjsunit/turbolev/regress-528501127.js
@@ -0,0 +1,25 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbolev
+
+function f(a, b) {
+  let tr = (a.w * 1.5) | 0;
+  a.x = 1.1;
+  let t1 = b.x;
+  a.y = 2.2;
+  let t2 = b.x;
+  b.z = 3.3;
+  return tr + t1 + t2;
+}
+%PrepareFunctionForOptimization(f);
+{ let a = {w: 0.5}; let b = {w: 0.5}; b.x = 1.1; f(a, b); }
+%OptimizeFunctionOnNextCall(f);
+{ let a = {w: 0.5}; let b = {w: 0.5}; b.x = 1.1; f(a, b); }
+
+let o = {w: 0.5};
+f(o, o);
+assertEquals("w,x,y,z", Object.keys(o).join(","));
+assertEquals(2.2, o.y);
+assertEquals(3.3, o.z);

Change information

Files:
  • M src/maglev/maglev-known-node-aspects.cc
  • A test/mjsunit/turbolev/regress-528501127.js
Change size: S
Delta: 2 files changed, 26 insertions(+), 1 deletion(-)
Open in Gerrit

Related details

Attention is currently required from:
  • Darius Mercadier
  • Victor Gomes
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: newchange
Gerrit-Project: v8/v8
Gerrit-Branch: refs/branch-heads/15.0
Gerrit-Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4
Gerrit-Change-Number: 8139888
Gerrit-PatchSet: 2
Gerrit-Reviewer: Darius Mercadier <dmerc...@chromium.org>
Gerrit-Reviewer: Victor Gomes <victo...@chromium.org>
Gerrit-Attention: Darius Mercadier <dmerc...@chromium.org>
Gerrit-Attention: Victor Gomes <victo...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

Victor Gomes (Gerrit)

unread,
Jul 24, 2026, 7:19:39 AM (22 hours ago) Jul 24
to chrome-che...@chops-service-accounts.iam.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, Darius Mercadier, android-bu...@system.gserviceaccount.com, v8-re...@googlegroups.com, leszek...@chromium.org, dmercadi...@chromium.org, victorgo...@chromium.org, verwaes...@chromium.org, v8-m...@googlegroups.com
Attention needed from Darius Mercadier

Victor Gomes added 1 comment

Patchset-level comments
File-level comment, Patchset 2 (Latest):
Victor Gomes . resolved

Darius, PTAL!

Open in Gerrit

Related details

Attention is currently required from:
  • Darius Mercadier
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: refs/branch-heads/15.0
Gerrit-Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4
Gerrit-Change-Number: 8139888
Gerrit-PatchSet: 2
Gerrit-Reviewer: Darius Mercadier <dmerc...@chromium.org>
Gerrit-Reviewer: Victor Gomes <victo...@chromium.org>
Gerrit-Attention: Darius Mercadier <dmerc...@chromium.org>
Gerrit-Comment-Date: Fri, 24 Jul 2026 11:19:35 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Darius Mercadier (Gerrit)

unread,
Jul 24, 2026, 7:20:17 AM (22 hours ago) Jul 24
to chrome-che...@chops-service-accounts.iam.gserviceaccount.com, Victor Gomes, v8-s...@luci-project-accounts.iam.gserviceaccount.com, android-bu...@system.gserviceaccount.com, v8-re...@googlegroups.com, leszek...@chromium.org, dmercadi...@chromium.org, victorgo...@chromium.org, verwaes...@chromium.org, v8-m...@googlegroups.com

Darius Mercadier voted and added 1 comment

Votes added by Darius Mercadier

Code-Review+1
Commit-Queue+2

1 comment

Patchset-level comments
Darius Mercadier . resolved

lgtm

Open in Gerrit

Related details

Attention set is empty
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement satisfiedCode-Review
  • requirement satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: refs/branch-heads/15.0
Gerrit-Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4
Gerrit-Change-Number: 8139888
Gerrit-PatchSet: 2
Gerrit-Reviewer: Darius Mercadier <dmerc...@chromium.org>
Gerrit-Reviewer: Victor Gomes <victo...@chromium.org>
Gerrit-Comment-Date: Fri, 24 Jul 2026 11:20:12 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
satisfied_requirement
open
diffy

v8-scoped@luci-project-accounts.iam.gserviceaccount.com (Gerrit)

unread,
Jul 24, 2026, 8:01:52 AM (21 hours ago) Jul 24
to chrome-che...@chops-service-accounts.iam.gserviceaccount.com, Victor Gomes, Darius Mercadier, android-bu...@system.gserviceaccount.com, v8-re...@googlegroups.com, leszek...@chromium.org, dmercadi...@chromium.org, victorgo...@chromium.org, verwaes...@chromium.org, v8-m...@googlegroups.com

v8-s...@luci-project-accounts.iam.gserviceaccount.com submitted the change

Change information

Commit message:
[M150] [maglev] Skip stale maps in StoreMap alias invalidation

Original change's description:
> [maglev] Skip stale maps in StoreMap alias invalidation
>
> Fixed: 528501127
> Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8019002
> Reviewed-by: Darius Mercadier <dmerc...@chromium.org>
> Commit-Queue: Victor Gomes <victo...@chromium.org>
> Commit-Queue: Darius Mercadier <dmerc...@chromium.org>
> Auto-Submit: Victor Gomes <victo...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#108302}

(cherry picked from commit 9068d5fc068f85d0eb723d9b63f15fb56c6db725)
Bug: 538442063,528501127
Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4
Reviewed-by: Victor Gomes <victo...@chromium.org>
Commit-Queue: Darius Mercadier <dmerc...@chromium.org>
Reviewed-by: Darius Mercadier <dmerc...@chromium.org>
Cr-Commit-Position: refs/branch-heads/15.0@{#43}
Cr-Branched-From: 0c6c73eea6994260f0a1d88469708360ea60c660-refs/heads/15.0.245@{#1}
Cr-Branched-From: 03d64f40934c058cd1c6d7e5cead5b757a4faedd-refs/heads/main@{#107679}
Files:
  • M src/maglev/maglev-known-node-aspects.cc
  • A test/mjsunit/turbolev/regress-528501127.js
Change size: S
Delta: 2 files changed, 26 insertions(+), 1 deletion(-)
Branch: refs/branch-heads/15.0
Submit Requirements:
  • requirement satisfiedCode-Review: +1 by Darius Mercadier, +1 by Victor Gomes
Open in Gerrit
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: merged
Gerrit-Project: v8/v8
Gerrit-Branch: refs/branch-heads/15.0
Gerrit-Change-Id: Icce0566468bb46dfd352e05a105646ba3f3b9ad4
Gerrit-Change-Number: 8139888
Gerrit-PatchSet: 3
open
diffy
satisfied_requirement
Reply all
Reply to author
Forward
0 new messages