From a068030f517914f1f3f444fcb76c24f64c3e8f24 Mon Sep 17 00:00:00 2001
From: Victor Gomes <[email protected]>
Date: Thu, 26 Mar 2026 10:39:16 +0100
Subject: [PATCH] [maglev] Use transitive IsEscaping check for inlined allocations

Check if a virtual object is escaping transitively.

Rename non-transitive function to HasEscapeUses instead.

Fixed: 495751197
Change-Id: I1df519079515b522974708f5419a81b5cbee7ade
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7702700
Reviewed-by: Marja Hölttä <[email protected]>
Commit-Queue: Victor Gomes <[email protected]>
Cr-Commit-Position: refs/heads/main@{#106064}
---

diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc
index c9ecaeb..2e073a5 100644
--- a/src/maglev/maglev-graph-builder.cc
+++ b/src/maglev/maglev-graph-builder.cc
@@ -4649,19 +4649,20 @@
   CHECK(!result.IsDoneWithAbort());
 }
 
-namespace {
-bool IsEscaping(Graph* graph, InlinedAllocation* alloc) {
-  if (alloc->IsEscaping()) return true;
-  auto it = graph->allocations_elide_map().find(alloc);
-  if (it == graph->allocations_elide_map().end()) return false;
+bool MaglevGraphBuilder::IsEscaping(InlinedAllocation* alloc) {
+  if (alloc->HasEscapingUses()) return true;
+  auto it = graph_->allocations_elide_map().find(alloc);
+  if (it == graph_->allocations_elide_map().end()) return false;
   for (InlinedAllocation* inner_alloc : it->second) {
-    if (IsEscaping(graph, inner_alloc)) {
+    if (IsEscaping(inner_alloc)) {
       return true;
     }
   }
   return false;
 }
 
+namespace {
+
 bool VerifyIsNotEscaping(VirtualObjectList vos, InlinedAllocation* alloc) {
   for (VirtualObject* vo : vos) {
     if (vo->allocation() == alloc) continue;
@@ -4671,7 +4672,7 @@
       if (!nested_value->Is<InlinedAllocation>()) return true;
       ValueNode* nested_alloc = nested_value->Cast<InlinedAllocation>();
       if (nested_alloc == alloc) {
-        if (vo->allocation()->IsEscaping() ||
+        if (vo->allocation()->HasEscapingUses() ||
             !VerifyIsNotEscaping(vos, vo->allocation())) {
           escaped = true;
         }
@@ -4690,6 +4691,7 @@
   if (!v8_flags.maglev_object_tracking) return false;
   if (!receiver->Is<InlinedAllocation>()) return false;
   InlinedAllocation* alloc = receiver->Cast<InlinedAllocation>();
+  if (IsEscaping(alloc)) return false;
   if (mode == TrackObjectMode::kStore) {
     // If we have two objects A and B, such that A points to B (it contains B in
     // one of its field), we cannot change B without also changing A, even if
@@ -4698,7 +4700,6 @@
         graph_->allocations_elide_map().end()) {
       return false;
     }
-    if (alloc->IsEscaping()) return false;
     // Ensure object is escaped if we are within a try-catch block. This is
     // crucial because a deoptimization point inside the catch handler could
     // re-materialize objects differently, depending on whether the throw
@@ -4707,9 +4708,6 @@
     // the try-block started,  but for now, err on the side of caution and
     // always escape.
     if (IsInsideTryBlock()) return false;
-  } else {
-    DCHECK_EQ(mode, TrackObjectMode::kLoad);
-    if (IsEscaping(graph_, alloc)) return false;
   }
   // We don't support loop phis inside VirtualObjects, so any access inside a
   // loop should escape the object, except for objects that were created since
@@ -9397,7 +9395,7 @@
     VirtualObject* array = iterated_object->Cast<InlinedAllocation>()->object();
     // TODO(victorgomes): Remove this once we track changes in the inlined
     // allocated object.
-    if (iterated_object->Cast<InlinedAllocation>()->IsEscaping()) {
+    if (IsEscaping(iterated_object->Cast<InlinedAllocation>())) {
       FAIL("allocation is escaping, map could have been changed");
     }
     // TODO(victorgomes): This effectively disable the optimization for `for-of`
@@ -12553,7 +12551,7 @@
   }
   // TODO(victorgomes): We can probably loosen the IsNotEscaping requirement if
   // we keep track of the arguments object changes so far.
-  if (alloc->IsEscaping()) return {};
+  if (IsEscaping(alloc)) return {};
   VirtualObject* object = alloc->object();
   if (!object->has_static_map()) return {};
   // TODO(victorgomes): Support simple JSArray forwarding.
diff --git a/src/maglev/maglev-graph-builder.h b/src/maglev/maglev-graph-builder.h
index a0a8261..4be7e56 100644
--- a/src/maglev/maglev-graph-builder.h
+++ b/src/maglev/maglev-graph-builder.h
@@ -1514,6 +1514,7 @@
       ValueNode* object, ValueNode* callable,
       compiler::FeedbackSource feedback_source);
 
+  bool IsEscaping(InlinedAllocation* allocation);
   VirtualObject* GetObjectFromAllocation(InlinedAllocation* allocation);
   VirtualObject* GetModifiableObjectFromAllocation(
       InlinedAllocation* allocation);
diff --git a/src/maglev/maglev-ir.h b/src/maglev/maglev-ir.h
index f28dd09..51e9cd3 100644
--- a/src/maglev/maglev-ir.h
+++ b/src/maglev/maglev-ir.h
@@ -6119,7 +6119,7 @@
     DCHECK(!HasBeenAnalysed());
     non_escaping_use_count_ += n;
   }
-  bool IsEscaping() const {
+  bool HasEscapingUses() const {
     DCHECK(!HasBeenAnalysed());
     return use_count_ > non_escaping_use_count_;
   }
diff --git a/src/maglev/maglev-post-hoc-optimizations-processors.h b/src/maglev/maglev-post-hoc-optimizations-processors.h
index a774028..715cef1 100644
--- a/src/maglev/maglev-post-hoc-optimizations-processors.h
+++ b/src/maglev/maglev-post-hoc-optimizations-processors.h
@@ -382,7 +382,7 @@
       auto* alloc = it.first;
       if (alloc->HasBeenAnalysed()) continue;
       // Check if all its uses are non escaping.
-      if (alloc->IsEscaping()) {
+      if (alloc->HasEscapingUses()) {
         // Escape this allocation and all its dependencies.
         EscapeAllocation(graph, alloc, it.second);
       } else {
diff --git a/test/mjsunit/maglev/regress-495751197.js b/test/mjsunit/maglev/regress-495751197.js
new file mode 100644
index 0000000..b6e5bae
--- /dev/null
+++ b/test/mjsunit/maglev/regress-495751197.js
@@ -0,0 +1,47 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let do_transition = false;
+let marker = {x: 1.337};
+
+Object.defineProperty(Object.prototype, '_leak', {
+  get() {
+    if (do_transition) {
+      this[1][0] = marker;
+    }
+    return this;
+  },
+  configurable: true
+});
+
+function target(iter) {
+  return iter.next().value;
+}
+
+function inner() {
+  var leaked;
+  // Forces WithContext creation. _leak triggers the runtime call.
+  with (arguments) { leaked = _leak; }
+  return target.apply(null, arguments);
+}
+
+function outer() {
+  let a = [1.1, 2.2, 3.3];
+  let iter = a.values();
+  return inner(iter, a);
+}
+
+%PrepareFunctionForOptimization(target);
+%PrepareFunctionForOptimization(inner);
+%PrepareFunctionForOptimization(outer);
+
+outer(); outer(); outer();
+
+%OptimizeMaglevOnNextCall(outer);
+
+do_transition = true;
+let r = outer();
+assertFalse(typeof r === "number");

diff --git a/test/mjsunit/maglev/regress-495751197.js b/test/mjsunit/maglev/regress-495751197.js
new file mode 100644
index 0000000..b6e5bae
--- /dev/null
+++ b/test/mjsunit/maglev/regress-495751197.js
@@ -0,0 +1,47 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let do_transition = false;
+let marker = {x: 1.337};
+
+Object.defineProperty(Object.prototype, '_leak', {
+  get() {
+    if (do_transition) {
+      this[1][0] = marker;
+    }
+    return this;
+  },
+  configurable: true
+});
+
+function target(iter) {
+  return iter.next().value;
+}
+
+function inner() {
+  var leaked;
+  // Forces WithContext creation. _leak triggers the runtime call.
+  with (arguments) { leaked = _leak; }
+  return target.apply(null, arguments);
+}
+
+function outer() {
+  let a = [1.1, 2.2, 3.3];
+  let iter = a.values();
+  return inner(iter, a);
+}
+
+%PrepareFunctionForOptimization(target);
+%PrepareFunctionForOptimization(inner);
+%PrepareFunctionForOptimization(outer);
+
+outer(); outer(); outer();
+
+%OptimizeMaglevOnNextCall(outer);
+
+do_transition = true;
+let r = outer();
+assertFalse(typeof r === "number");