From bb9d116061464d8778989a71326b36d66a7fb718 Mon Sep 17 00:00:00 2001
From: Marja Hölttä <[email protected]>
Date: Wed, 02 Sep 2026 13:44:13 +0200
Subject: [PATCH] [maglev] Fix bailouts in BuildInlinedAllocation

Don't add all non-escaping uses upfront, since some of the stores might
bail out.

Fixed: 552832446
Change-Id: I18c267a76145e5d1d8e7a0898271e72e5f33e0a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8345768
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Marja Hölttä <[email protected]>
Cr-Commit-Position: refs/heads/main@{#109643}
---
diff --git a/src/maglev/maglev-reducer-inl.h b/src/maglev/maglev-reducer-inl.h
index 510da84..efe1746 100644
--- a/src/maglev/maglev-reducer-inl.h
+++ b/src/maglev/maglev-reducer-inl.h
@@ -958,7 +958,6 @@
   }
   InlinedAllocation* allocation =
       ExtendOrReallocateCurrentAllocationBlock(allocation_type, vobject);
-  AddNonEscapingUses(allocation, static_cast<int>(values.size()));
   StoreTaggedMode store_mode = StoreTaggedMode::kInitializing;
   compiler::OptionalScopeInfoRef scope_info;
   if (vobject->has_static_map() && vobject->map()->IsContextMap()) {
@@ -982,6 +981,7 @@
     }
     RETURN_IF_ABORT(BuildInitializeStore(desc, allocation, allocation_type,
                                          value, store_mode, maybe_assigned));
+    AddNonEscapingUses(allocation, 1);
   }
   if constexpr (ReducerBaseWithLoopEffectTracking<BaseT>) {
     if (base_->loop_effects()) {
diff --git a/test/mjsunit/maglev/regress-552832446.js b/test/mjsunit/maglev/regress-552832446.js
new file mode 100644
index 0000000..8cce055
--- /dev/null
+++ b/test/mjsunit/maglev/regress-552832446.js
@@ -0,0 +1,24 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(obj, ...args) {
+  obj['toString'](...args);
+}
+%PrepareFunctionForOptimization(f);
+
+function g(x) {
+  /1/.test(x);
+  for (let i = 0; i < x.length; ++i) {
+    for (let j = 0; j < 1; j++) {
+      x--;
+    }
+  }
+  f(true, x);
+}
+%PrepareFunctionForOptimization(g);
+g(1);
+%OptimizeMaglevOnNextCall(g);
+g(1);

diff --git a/test/mjsunit/maglev/regress-552832446.js b/test/mjsunit/maglev/regress-552832446.js
new file mode 100644
index 0000000..8cce055
--- /dev/null
+++ b/test/mjsunit/maglev/regress-552832446.js
@@ -0,0 +1,24 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(obj, ...args) {
+  obj['toString'](...args);
+}
+%PrepareFunctionForOptimization(f);
+
+function g(x) {
+  /1/.test(x);
+  for (let i = 0; i < x.length; ++i) {
+    for (let j = 0; j < 1; j++) {
+      x--;
+    }
+  }
+  f(true, x);
+}
+%PrepareFunctionForOptimization(g);
+g(1);
+%OptimizeMaglevOnNextCall(g);
+g(1);