PatchGap
Chrome · V8

CVE-2026-2649

Integer Overflow in V8
High watch CVSS 8.8 chrome Integer Overflow 📄 Reporter bug report 🔧 Commit mapped 🧬 Broken deopt/OSR bookkeeping and unsound escape analysis

Overview

High
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInteger overflow in V8
DescriptionInteger overflow in V8
ComponentV8
Bug ClassInteger Overflow
Action tierwatch — ub-class only — no demonstrated corruption path
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker481074858
Fix commit25613a3e9b82 (v8/v8) +7/-3
CWECWE-472
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedJunYoung Park(@candymate) of KAIST Hacking Lab
Reported2026-02-03 (per vendor advisory)
Fix landed2026-02-13 (public git)
Disclosed2026-02-18
Patch gap5 days — fix public in source before the advisory

Background

Turboshaft
V8’s newer optimizing compiler IR, used for both JavaScript and WebAssembly code generation, in which every operation is a node with a fixed-width input count.
`PhiOp`
the Turboshaft operation representing an SSA phi node that merges values from multiple predecessor blocks, one input per predecessor.
`input_count`
a narrow-width integer field (its exact type is referenced via decltype(PhiOp::input_count)) that stores how many inputs an operation has; a value exceeding its maximum silently truncates (integer overflow).
`CHECK` vs `DCHECK`
CHECK is a release-build runtime assertion that aborts the process, while DCHECK only runs in debug builds; the ordering of the two matters when both can be triggered by the same over-large input.

Root Cause Analysis

The original PhiOp constructor ran : Base(inputs), rep(rep) first and only afterward, inside the constructor body, executed the CHECK_LE(inputs.size(), std::numeric_limits<decltype(this->input_count)>::max()) that is meant to reject an over-large phi. Because the Base(inputs) base-class construction runs before the body, the number of inputs was already consumed and stored into the narrow input_count field (and any DCHECK inside Base could fire) before the guarding CHECK had a chance to run. As the removed comment states, this CHECK exists specifically to stop Wasm from passing too many inputs “e.g. as part of a br_table operation,” where a large branch table produces a phi with more predecessors than input_count can represent, so inputs.size() overflows the field.

The fix extracts the bound test into a static helper CheckPhiInputCount(inputs) and calls it as the argument to Base(...) (Base(CheckPhiInputCount(inputs))), so the CHECK evaluates before the base constructor stores the count. This guarantees the release-mode CHECK fires first (matching the commit subject “Hit CHECK before DCHECK when limiting Phi inputs”) rather than the truncation or a debug-only DCHECK masking the intended failure. The helper also corrects decltype(this->input_count) to decltype(PhiOp::input_count), since this is unavailable in the static context.

Key insight
The guard against an overflowing phi input count was placed in the constructor body, which runs after base-class initialization had already stored the truncated count; moving the CHECK into a static helper evaluated as the Base argument ensures the bound is enforced before the value is ever consumed.

Attack Path

  1. Craft an oversized branch structure An attacker supplies a WebAssembly module whose control flow (e.g. a br_table with an enormous target list) causes Turboshaft to build a PhiOp merging more predecessor values than input_count can hold.
  2. Reach `PhiOp` construction During (lazy or eager) Wasm compilation the builder constructs the PhiOp with inputs.size() exceeding std::numeric_limits<decltype(PhiOp::input_count)>::max().
  3. Overflow the count field (pre-patch) With the old ordering, Base(inputs) stores the count into the narrow input_count field where it truncates/overflows before the body’s CHECK runs, so the operation is created with an inconsistent input count. (inferred)
  4. Corrupted operation state The PhiOp then reports a smaller input_count than the inputs actually attached, leading to inconsistent input access downstream during compilation. (inferred)

Impact Assessment

An attacker able to run a crafted WebAssembly module can trigger an integer overflow in the phi input_count field during Turboshaft compilation in the renderer process; the advisory classifies this as an integer overflow in V8. The patch itself only demonstrates that the correct CHECK now fires (a controlled abort); any escalation to memory corruption from the truncated count is (inferred). The advisory does not report exploitation in the wild.

Files Changed

  • src/compiler/turboshaft/operations.h
  • test/filecheck/wasm/crash/regress-481074858.js

Audit Directions

  • Guards in constructor bodies after base init
    Look for validity CHECKs placed in a derived class’s constructor body when the value being validated is already consumed by a base-class initializer that runs first.
  • Narrow fixed-width count fields
    Audit operation/node types that store sizes in sub-size_t fields (like input_count) and confirm the size bound is enforced before any assignment or truncation, especially on Wasm-controlled input.
  • `br_table` and other unbounded-arity Wasm operations
    Trace paths where attacker-controlled Wasm structures (branch tables, large block signatures) determine phi/operation arity and verify limits are enforced at IR construction.

Patch

view commit
From 25613a3e9b8240326004e2c2f08954237eed21dc Mon Sep 17 00:00:00 2001
From: Manos Koukoutos <[email protected]>
Date: Fri, 13 Feb 2026 13:14:35 +0000
Subject: [PATCH] Hit CHECK before DCHECK when limiting Phi inputs

Bug: 481074858
Change-Id: I2c50ab1d2577d852745a9a62a5d3d30876ef3b91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7572506
Auto-Submit: Manos Koukoutos <[email protected]>
Reviewed-by: Clemens Backes <[email protected]>
Commit-Queue: Manos Koukoutos <[email protected]>
Cr-Commit-Position: refs/heads/main@{#105266}
---

diff --git a/src/compiler/turboshaft/operations.h b/src/compiler/turboshaft/operations.h
index 7ecda83..fe5247c 100644
--- a/src/compiler/turboshaft/operations.h
+++ b/src/compiler/turboshaft/operations.h
@@ -2601,11 +2601,15 @@
   }
 
   explicit PhiOp(base::Vector<const OpIndex> inputs, RegisterRepresentation rep)
-      : Base(inputs), rep(rep) {
+      : Base(CheckPhiInputCount(inputs)), rep(rep) {}
+
+  static base::Vector<const OpIndex> CheckPhiInputCount(
+      base::Vector<const OpIndex> inputs) {
     // We add an additional CHECK specifically for Phi, to prevent Wasm from
     // passing too many inputs, e.g. as part of a br_table operation.
     CHECK_LE(inputs.size(),
-             std::numeric_limits<decltype(this->input_count)>::max());
+             std::numeric_limits<decltype(PhiOp::input_count)>::max());
+    return inputs;
   }
 
   // Helpers to access loop phis forward/backedge. These should only be used for
diff --git a/test/filecheck/wasm/crash/regress-481074858.js b/test/filecheck/wasm/crash/regress-481074858.js
index b40966c..b8bc6c1 100644
--- a/test/filecheck/wasm/crash/regress-481074858.js
+++ b/test/filecheck/wasm/crash/regress-481074858.js
@@ -215,6 +215,6 @@
 
 // This should have failed either on lazy compilation or (if lazy compilation
 // was disabled) on compilation above.
-// CHECK: # {{Debug check||Check}} failed: input{{s.size\(\)|_count}} <= std::numeric_limits
+// CHECK: # Check failed: inputs.size() <= std::numeric_limits
 // CHECK-NOT: Results:
 print('Results: ' + result1 + ', ' + result2);
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/test/filecheck/wasm/crash/regress-481074858.js b/test/filecheck/wasm/crash/regress-481074858.js
index b40966c..b8bc6c1 100644
--- a/test/filecheck/wasm/crash/regress-481074858.js
+++ b/test/filecheck/wasm/crash/regress-481074858.js
@@ -215,6 +215,6 @@
 
 // This should have failed either on lazy compilation or (if lazy compilation
 // was disabled) on compilation above.
-// CHECK: # {{Debug check||Check}} failed: input{{s.size\(\)|_count}} <= std::numeric_limits
+// CHECK: # Check failed: inputs.size() <= std::numeric_limits
 // CHECK-NOT: Results:
 print('Results: ' + result1 + ', ' + result2);
Loading diff…

Original Bug Report

reported by [email protected]

V8: Integer Truncation in Turboshaft PhiOp input_count via WASM br_table

VULNERABILITY DETAILS

Summary

This is an integer truncation vulnerability in V8’s Turboshaft compiler when processing WASM br_table instructions. The Operation::input_count field is a uint16_t (max 65535), but multiple br_table instructions targeting the same merge block can produce more than 65535 predecessors. In release builds, this causes silent truncation leading to a mismatch between the stored input count and the actual graph structure, causing crashes during subsequent compiler phases.

Overview

The Operation base class in Turboshaft uses a uint16_t for input_count, limiting operations to 65535 inputs. However, when building the Turboshaft graph from WASM, the TurboshaftGraphBuildingInterface::MaybePhi() function creates phi nodes with one input per predecessor block. WASM br_table instructions can each have up to 65520 entries (kV8MaxWasmFunctionBrTableSize), and multiple br_tables in different branches can all target the same merge block. When two br_tables each have ~33000 entries targeting the same block, the total predecessors exceed the uint16_t maximum.

Detail

// src/compiler/turboshaft/operations.h:958
const uint16_t input_count;

// src/compiler/turboshaft/operations.h:1025-1029
explicit Operation(Opcode opcode, size_t input_count)
    : opcode(opcode), input_count(input_count) {
  DCHECK_LE(input_count,
            std::numeric_limits<decltype(this->input_count)>::max());
}

The input_count field is defined as uint16_t at line 958. The constructor at lines 1025-1029 includes a DCHECK that validates the input count doesn’t exceed the uint16_t maximum. However, this check is only enabled in debug builds.

The vulnerability is triggered through WASM br_table processing:

// src/wasm/wasm-limits.h:53
constexpr size_t kV8MaxWasmFunctionBrTableSize = 65'520;

Each br_table instruction can have up to 65520 entries. When processing br_table in Turboshaft:

// src/wasm/turboshaft-graph-interface.cc:700-707
int i = 0;
BranchTableIterator<ValidationTag> branch_iterator(decoder, imm);
while (branch_iterator.has_next()) {
  TSBlock* intermediate = intermediate_blocks[i];
  i++;
  __ Bind(intermediate);
  BrOrRet(decoder, branch_iterator.next());  // Called for each br_table entry
}

// src/wasm/turboshaft-graph-interface.cc:520-527
void BrOrRet(FullDecoder* decoder, uint32_t depth, uint32_t drop_values = 0) {
  if (depth == decoder->control_depth() - 1) {
    DoReturn(decoder, drop_values);
  } else {
    Control* target = decoder->control_at(depth);
    SetupControlFlowEdge(decoder, target->merge_block, drop_values);  // Adds predecessor
    __ Goto(target->merge_block);
  }
}

Each SetupControlFlowEdge call adds one predecessor to the target block, contributing one phi input.

When the target block is finalized, BindBlockAndGeneratePhis() calls MaybePhi():

// src/wasm/turboshaft-graph-interface.cc:6504-6512
OpIndex MaybePhi(base::Vector<const OpIndex> elements, ValueType type) {
  if (elements.empty()) return OpIndex::Invalid();
  for (size_t i = 1; i < elements.size(); i++) {
    if (elements[i] != elements[0]) {
      return __ Phi(elements, RepresentationFor(type));  // Creates PhiOp
    }
  }
  return elements[0];
}

When elements.size() (the predecessor count) exceeds 65535, the PhiOp constructor is called with an overflowing input_count:

  • Debug builds: DCHECK fails with “input_count <= std::numeric_limits<…>::max() (66002 vs. 65535)”
  • Release builds: input_count is silently truncated (e.g., 66002 → 466), causing:
    1. Storage is allocated correctly (using full count before truncation)
    2. All 66002 inputs are written to memory via OverwriteWith()
    3. But input_count field stores 466, so inputs() method returns a vector of size 466
    4. Graph structure expects 66002 predecessors but PhiOp reports only 466 inputs
    5. Mismatch causes logic errors during subsequent compiler phases (e.g., ResolvePhi in WasmLoweringPhase)
    6. Results in bad_optional_access exception when accessing missing/invalid data

Trigger Conditions

  1. Create a WASM function with a block that can receive many predecessors
  2. Use an if/else structure where each branch contains a br_table instruction
  3. Each br_table has ~33000 entries (within the 65520 per-table limit)
  4. All br_table entries target the same outer block
  5. Total predecessors = (br_table1 entries + 1) + (br_table2 entries + 1) > 65535
  6. Trigger Turboshaft compilation (via --no-liftoff or tier-up after many calls)
  7. When the outer block is bound, PhiOp creation causes the overflow

Version

Reproduced Version

  • main branch latest commit (2026/02/03): 169e50a4a4095f3bb859106c416cafb5fba49a30
  • V8 14.6.143

Bisect

  • Bisect suggests that the commit 2159da0c4eabb171cf5fdc436188cb585970480e introduces this bug.
commit 2159da0c4eabb171cf5fdc436188cb585970480e
Author: Peter Boström <[email protected]>
Date:   Mon Jan 29 11:45:19 2024 -0800

    Use std::optional for v8::base::Optional
    
    This file is no longer present in upstream base/optional.h which uses
    std::optional directly.
    
    Bug: chromium:1202909
    Change-Id: I5c73d91338ab7a593f33bc2837e3b6588aef77bc
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5246687
    Auto-Submit: Peter Boström <[email protected]>
    Commit-Queue: Michael Lippautz <[email protected]>
    Reviewed-by: Michael Lippautz <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#92073}

However, I suspect this commit c0115f5658ffff0c92f98278bd9a14df21845bc8 as the culprit.

commit c0115f5658ffff0c92f98278bd9a14df21845bc8
Author: Manos Koukoutos <[email protected]>
Date:   Thu Jul 6 20:16:20 2023 +0200

    [wasm][turboshaft] More control flow
    
    Implement
    - loops
    - br_if which branches into implicit return
    - br_table
    - multireturn
    
    Bug: v8:14108
    Change-Id: I40852a24524d3572511482b3ca996cb2fbacf3e4
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4663080
    Reviewed-by: Nico Hartmann <[email protected]>
    Commit-Queue: Manos Koukoutos <[email protected]>
    Reviewed-by: Matthias Liedtke <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#88733}

Reproduction Case

I prepared two versions of the PoC:

  • Version 1 (poc-v1.js): reproduces faster with --no-liftoff flag - this does not require loop to reach TurboFan optimization
  • Version 2 (poc-v2.js): reproduces without --no-liftoff flag - this requires loop to reach TurboFan optimization

Release Build

Use one of two versions of the PoC:

out/x64.release/d8 --no-liftoff poc-v1.js
out/x64.release/d8 poc-v2.js

Result with version 1:

=== WASM br_table phi overflow PoC ===
br_table size 1: 33000
br_table size 2: 33000
Expected total predecessors: 66002
uint16_t max: 65535
Overflow expected: true

Creating WASM module...
Binary size: 66070 bytes

Compiling with --no-liftoff to force Turboshaft...
Compilation succeeded

Instantiating...
Instance created

Calling test function...
bad_optional_access was thrown in -fno-exceptions modeReceived signal 6

==== C stack trace ===============================

out/x64.release/d8(_ZN2v84base5debug10StackTraceC1Ev+0x1e)[0x5d299d4f97ce]
out/x64.release/d8(+0x2fee71f)[0x5d299d4f971f]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x760d99245330]
/lib/x86_64-linux-gnu/libc.so.6(pthread_kill+0x11c)[0x760d9929eb2c]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x1e)[0x760d9924527e]
/lib/x86_64-linux-gnu/libc.so.6(abort+0xdf)[0x760d992288ff]
out/x64.release/d8(+0x31db932)[0x5d299d6e6932]
out/x64.release/d8(+0x16d13b2)[0x5d299bbdc3b2]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE10ResolvePhiIZNSO_22AssembleOutputGraphPhiERKNS2_5PhiOpEEUlNS2_7OpIndexEiiE_EEST_SS_OT_NS2_22RegisterRepresentationE+0x440)[0x5d299d18c910]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE22VisitOpNoMappingUpdateILb0EEENS2_7OpIndexESQ_PKNS2_5BlockE+0x7c2)[0x5d299d1712c2]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE14VisitBlockBodyILNSO_11CanHavePhisE1ELNSO_10ForCloningE0ELb0EEEvPKNS2_5BlockEi+0xbd)[0x5d299d16efcd]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE10VisitBlockILb0EEEvPKNS2_5BlockE+0x21d)[0x5d299d16e75d]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE14VisitAllBlocksILb0EEEvv+0xa0)[0x5d299d16e190]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft16CopyingPhaseImplIJNS2_19WasmLoweringReducerENS2_26MachineOptimizationReducerEEE3RunEPNS2_12PipelineDataERNS2_5GraphEPNS0_4ZoneEb+0x180)[0x5d299d16d9a0]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft8Pipeline3RunITkNS2_15TurboshaftPhaseENS2_17WasmLoweringPhaseEJEEEDaDpOT0_+0xc8)[0x5d299cb91bc8]
out/x64.release/d8(_ZN2v88internal8compiler8Pipeline16GenerateWasmCodeEPNS0_4wasm14CompilationEnvERNS1_19WasmCompilationDataEPNS3_20WasmDetectedFeaturesEPNS0_21DelayedCounterUpdatesE+0xf0e)[0x5d299cb8ff9e]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft32ExecuteTurboshaftWasmCompilationEPNS0_4wasm14CompilationEnvERNS1_19WasmCompilationDataEPNS3_20WasmDetectedFeaturesEPNS0_21DelayedCounterUpdatesE+0x12)[0x5d299d1e8b42]
out/x64.release/d8(_ZN2v88internal4wasm19WasmCompilationUnit18ExecuteCompilationEPNS1_14CompilationEnvEPKNS1_16WireBytesStorageEPNS0_21DelayedCounterUpdatesEPNS1_20WasmDetectedFeaturesE+0x2e0)[0x5d299c796650]
out/x64.release/d8(_ZN2v88internal4wasm11CompileLazyEPNS0_7IsolateEPNS1_12NativeModuleEi+0x249)[0x5d299c79a0c9]
out/x64.release/d8(_ZN2v88internal23Runtime_WasmCompileLazyEiPmPNS0_7IsolateE+0x16a)[0x5d299c6e61ea]
out/x64.release/d8(+0x2e89249)[0x5d299d394249]
[end of stack trace]
Aborted

Debug Build

Use one of two versions of the PoC:

out/x64.debug/d8 --no-liftoff poc-v1.js
out/x64.debug/d8 poc-v2.js

Result with version 1:

=== WASM br_table phi overflow PoC ===
br_table size 1: 33000
br_table size 2: 33000
Expected total predecessors: 66002
uint16_t max: 65535
Overflow expected: true

Creating WASM module...
Binary size: 66070 bytes

Compiling with --no-liftoff to force Turboshaft...
Compilation succeeded

Instantiating...
Instance created

Calling test function...


#
# Fatal error in ../../src/compiler/turboshaft/operations.h, line 1028
# Debug check failed: input_count <= std::numeric_limits<decltype(this->input_count)>::max() (66002 vs. 65535).
#
#
#
#FailureMessage Object: 0x7ffe59318f48
==== C stack trace ===============================

    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x29) [0x71e5c902f0d9]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libplatform.so(+0x4e29d) [0x71e5c8f9029d]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(V8_Fatal(char const*, int, char const*, ...)+0x205) [0x71e5c90032e5]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(+0x53b7c) [0x71e5c9002b7c]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(V8_Dcheck(char const*, int, char const*)+0x4d) [0x71e5c90033dd]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::Operation::Operation(v8::internal::compiler::turboshaft::Opcode, unsigned long)+0x80) [0x71e5c622e0f0]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::OperationT(unsigned long)+0x22) [0x71e5c623fcd2]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::OperationT(v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper)+0x31) [0x71e5c623fc71]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp::PhiOp(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x53) [0x71e5c623f9c3]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp& v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::New<v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::Graph*, unsigned long, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x82) [0x71e5c6240fb2]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp& v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::New<v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::Graph*, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x59) [0x71e5c6240e19]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp& v8::internal::compiler::turboshaft::Graph::Add<v8::internal::compiler::turboshaft::PhiOp, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x74) [0x71e5c6240b54]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>::Emit<v8::internal::compiler::turboshaft::PhiOp, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0xcd) [0x71e5c7d5393d]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x69) [0x71e5c7d53859]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>::ReducePhiHelper(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x145) [0x71e5c7d537b5]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x1c2) [0x71e5c7d535e2]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(auto v8::internal::compiler::turboshaft::UniformReducerAdapter<v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReducePhiContinuation::Reduce<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation) const+0x47) [0x71e5c7d53217]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::EmitProjectionReducer<v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReduceOperation<(v8::internal::compiler::turboshaft::Opcode)93, v8::internal::compiler::turboshaft::UniformReducerAdapter<v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReducePhiContinuation, v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x61) [0x71e5c7d53131]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(auto v8::internal::compiler::turboshaft::UniformReducerAdapter<v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x44) [0x71e5c7d53014]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::RequiredOptimizationReducer<v8::internal::compiler::turboshaft::EmitProjectionReducer<v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>>::ReducePhiHelper(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x5f) [0x71e5c7d52b2f]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::RequiredOptimizationReducer<v8::internal::compiler::turboshaft::EmitProjectionReducer<v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x1c2) [0x71e5c7d52a42]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>::ReduceIfReachablePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0xec) [0x71e5c7d5283c]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>::Phi(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x44) [0x71e5c7d51db4]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::TurboshaftGraphBuildingInterface::MaybePhi(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::wasm::ValueType)+0xe4) [0x71e5c7d77064]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::TurboshaftGraphBuildingInterface::BindBlockAndGeneratePhis(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>*, v8::internal::compiler::turboshaft::Block*, v8::internal::wasm::Merge<v8::internal::wasm::TurboshaftGraphBuildingInterface::Value>*, v8::internal::compiler::turboshaft::OpIndex*)+0x33b) [0x71e5c7d76e1b]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::TurboshaftGraphBuildingInterface::PopControl(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>*, v8::internal::wasm::TurboshaftGraphBuildingInterface::Control*)+0x285) [0x71e5c7d8b355]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::PopControl()+0x1bd) [0x71e5c7d899cd]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::DecodeEndImpl(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::TraceLine*, v8::internal::wasm::WasmOpcode)+0xa16) [0x71e5c7d89696]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::DecodeEnd(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>*, v8::internal::wasm::WasmOpcode)+0x6e) [0x71e5c7d66c1e]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::DecodeFunctionBody()+0x4b3) [0x71e5c7d4c1f3]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::Decode()+0x280) [0x71e5c7d43390]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::BuildTSGraph(v8::internal::compiler::turboshaft::PipelineData*, v8::internal::wasm::CompilationEnv*, v8::internal::wasm::WasmDetectedFeatures*, v8::internal::compiler::turboshaft::Graph&, v8::internal::wasm::FunctionBody const&, v8::internal::wasm::WireBytesStorage const*, std::__Cr::unique_ptr<v8::internal::wasm::AssumptionsJournal, std::__Cr::default_delete<v8::internal::wasm::AssumptionsJournal>>*, v8::internal::ZoneVector<v8::internal::WasmInliningPosition>*, int, v8::internal::wasm::WasmFunctionCoverageData*)+0x1f8) [0x71e5c7d417e8]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::Pipeline::GenerateWasmCode(v8::internal::wasm::CompilationEnv*, v8::internal::compiler::WasmCompilationData&, v8::internal::wasm::WasmDetectedFeatures*, v8::internal::DelayedCounterUpdates*)+0xa0c) [0x71e5c620260c]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::ExecuteTurboshaftWasmCompilation(v8::internal::wasm::CompilationEnv*, v8::internal::compiler::WasmCompilationData&, v8::internal::wasm::WasmDetectedFeatures*, v8::internal::DelayedCounterUpdates*)+0x53) [0x71e5c7d02923]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmCompilationUnit::ExecuteCompilation(v8::internal::wasm::CompilationEnv*, v8::internal::wasm::WireBytesStorage const*, v8::internal::DelayedCounterUpdates*, v8::internal::wasm::WasmDetectedFeatures*)+0x824) [0x71e5c562bc04]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::CompileLazy(v8::internal::Isolate*, v8::internal::wasm::NativeModule*, int)+0x2eb) [0x71e5c563251b]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(+0xba7008d) [0x71e5c547008d]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::Runtime_WasmCompileLazy(int, unsigned long*, v8::internal::Isolate*)+0x151) [0x71e5c546fb11]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(+0x8b93b57) [0x71e5c2593b57]
Trace/breakpoint trap

Credit Information

Reporter credit: JunYoung Park(@candymate) of KAIST Hacking Lab

View on issue tracker
Links in the report
On This Page