V8 is running with developer-only features enabled. Stability and security will suffer.
LateLoadElimination: Starting analysis
> ProcessBlock(B0)
> Process other op (id=7)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa3010265bd <JSFunction victim (sfi = 0x7aa30102645d)>]
> Process other op (id=11)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa30100c75d <NativeContext[308]>]
> Process other op (id=15)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 1]
> Process other op (id=17)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 0]
> ProcessLoad(21)
> MemoryContentTable: will insert MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=21
> Process other op (id=22)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa301026749 <Map[24](HOLEY_ELEMENTS)>]
> ProcessAssumeMap(25)
> ProcessLoad(27)
> MemoryContentTable: will insert MemoryAddress{base=0, index=<invalid OpIndex>, offset=12, elem_size_log2=0, size=4} with value=27
> Process other op (id=28)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa301026589 <JSFunction cbTransition (sfi = 0x7aa30102642d)>]
> Process other op (id=29)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#27)[Tagged, Word32, Smi]
> Process other op (id=30)
>> InvalidateAllNonAliasingInputs for Shift(#29, #15)[ShiftRightArithmeticShiftOutZeros, Word32]
> Process other op (id=36)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa301026531 <ScriptContext[7]>]
> Process other op (id=37)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 2]
> Process other op (id=38)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa300000011 <undefined>]
> Process other op (id=39)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa30100c6fd <JSGlobalProxy>]
> ProcessCall(40)
>> InvalidateAllNonAliasingInputs for Call(#28, #33, #39, #0, #38, #37, #17, #36)[JS:js-call:r1s2i7f1]
>> InvalidateIfAlias: recursively invalidating for FrameState inputs (FrameState id=33)
>> InvalidateMaybeAliasing
>>> Invalidating MemoryAddress{base=0, index=<invalid OpIndex>, offset=12, elem_size_log2=0, size=4}
>>> Invalidating MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4}
> Process other op (id=52)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#44)[Tagged, Word32, Smi]
> Process other op (id=53)
>> InvalidateAllNonAliasingInputs for Shift(#52, #15)[ShiftRightArithmeticShiftOutZeros, Word32]
> ProcessLoad(59)
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=59
> Process other op (id=60)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa301026865 <Map[24](HOLEY_ELEMENTS)>]
> ProcessAssumeMap(63)
> ProcessLoad(65)
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=12, elem_size_log2=0, size=4} with value=65
> Process other op (id=67)
>> InvalidateAllNonAliasingInputs for Branch(#66)[B2, B1, None]
> ProcessBlock(B1)
> Process other op (id=69)
>> InvalidateAllNonAliasingInputs for Constant()[word64: 0]
> ProcessBlock(B2)
> Process other op (id=71)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa30104ba89 <MakeBase map = 0x7aa301026749>]
> ProcessLoad(72)
> MemoryContentTable: will insert MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=72
>> Reusing existing key
> Process other op (id=74)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#72)[Tagged, Word64, HeapObject]
> ProcessChange(75)
> Process other op (id=76)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 1703936]
> Process other op (id=78)
>> InvalidateAllNonAliasingInputs for Goto()[B3, 0]
> ProcessBlock(B3)
> Process other op (id=81)
>> InvalidateAllNonAliasingInputs for Branch(#80)[B8, B4, None]
> ProcessBlock(B4)
> Process other op (id=83)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#65)[Tagged, Word32, Smi]
> Process other op (id=84)
>> InvalidateAllNonAliasingInputs for Shift(#83, #15)[ShiftRightArithmeticShiftOutZeros, Word32]
> Process other op (id=85)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa30102688d <Map[24](HOLEY_ELEMENTS)>]
> Process other op (id=86)
>> InvalidateAllNonAliasingInputs for Constant()[smi: 99]
> ProcessStore(87)
> MemoryContentTable: Invalidating based on 4, <invalid OpIndex>, 20
>> base is maybe-aliasing
>>> Invalidating everything maybe-aliasing at offset 20
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=20, elem_size_log2=0, size=4} with value=86
> ProcessStore(89)
> MemoryContentTable: Invalidating based on 4, <invalid OpIndex>, 0
>> base is maybe-aliasing
>>> Invalidating everything maybe-aliasing at offset 0
>>>> InvalidateAtOffset: not invalidating thanks for maps: MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4}
>>>> InvalidateAtOffset: invalidating MemoryAddress{base=4, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4}
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=85
>> Reusing existing key
>> Wiping all maps

> Process other op (id=93)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 7]
> ProcessLoad(94)
>> Found potential replacement at offset 72
>>> Confirming replacement
> ProcessAssumeMap(98)
> Process other op (id=100)
>> InvalidateAllNonAliasingInputs for OverflowCheckedBinop(#99, #84)[signed add, Word32]
> Process other op (id=101)
>> InvalidateAllNonAliasingInputs for Projection(#100)[0, Word32]
> Process other op (id=102)
>> InvalidateAllNonAliasingInputs for Projection(#100)[1, Word32]
> Process other op (id=106)
>> InvalidateAllNonAliasingInputs for OverflowCheckedBinop(#101, #101)[signed add, Word32]
> Process other op (id=107)
>> InvalidateAllNonAliasingInputs for Projection(#106)[0, Word32]
> Process other op (id=108)
>> InvalidateAllNonAliasingInputs for Projection(#106)[1, Word32]
> Process other op (id=110)
>> InvalidateAllNonAliasingInputs for Branch(#108)[B6, B5, False]
> ProcessBlock(B5)
> Process other op (id=112)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#107)[Word32, Tagged, Smi]
> Process other op (id=113)
>> InvalidateAllNonAliasingInputs for Goto()[B7, 0]
> ProcessBlock(B6)
> ProcessChange(114)
> Process other op (id=115)
>> InvalidateAllNonAliasingInputs for Constant()[word64: 12]
> ProcessAllocate(116) ==> Fresh non-aliasing object
> Process other op (id=117)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7aa300000515 <Map[12](HEAP_NUMBER_TYPE)>]
> ProcessStore(118)
> MemoryContentTable: Invalidating based on 116, <invalid OpIndex>, 0
>> base is non-aliasing
> MemoryContentTable: will insert MemoryAddress{base=116, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=117
>> Wiping all maps

> ProcessStore(119)
> MemoryContentTable: Invalidating based on 116, <invalid OpIndex>, 4
>> base is non-aliasing
> MemoryContentTable: will insert MemoryAddress{base=116, index=<invalid OpIndex>, offset=4, elem_size_log2=0, size=8} with value=114
> Process other op (id=121)
>> InvalidateAllNonAliasingInputs for Goto()[B7, 0]
> ProcessBlock(B7)
> Process other op (id=122)
>> InvalidateAllNonAliasingInputs for Phi(#112, #116)[Tagged]
> ProcessBlock(B8)
> Process other op (id=124)
>> InvalidateAllNonAliasingInputs for Constant()[word64: 0]
[test] 1107 status=41
[before] {"x":1337}
abort: Turboshaft's load elimination wrongly eliminated a Load

==== JS stack trace =========================================

    0: ExitFrame [pc: 0x5dab7dbb597d]
    1: victim [0x7aa3010265bd] [/home/mufeedvh/lle-map-bypass-work/exploratory-asem/poc_missing_property_wrong_result.js:~10] [pc=0x5dabdd9402c5](this=0x7aa30100c6fd <JSGlobalProxy>#0#,0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#,0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#,0x7aa301026589 <JSFunction cbTransition (sfi = 0x7aa30102642d)>#2#)
    2: /* anonymous */ [0x7aa3010264d1] [/home/mufeedvh/lle-map-bypass-work/exploratory-asem/poc_missing_property_wrong_result.js:38] [bytecode=0x7a9201000151 offset=304](this=0x7aa30100c6fd <JSGlobalProxy>#0#)
    3: InternalFrame [pc: 0x5dab7d96a627]
    4: EntryFrame [pc: 0x5dab7d96a36b]

==== Details ================================================

[0]: ExitFrame [pc: 0x5dab7dbb597d]
[1]: victim [0x7aa3010265bd] [/home/mufeedvh/lle-map-bypass-work/exploratory-asem/poc_missing_property_wrong_result.js:~10] [pc=0x5dabdd9402c5](this=0x7aa30100c6fd <JSGlobalProxy>#0#,0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#,0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#,0x7aa301026589 <JSFunction cbTransition (sfi = 0x7aa30102642d)>#2#) {
// optimized frame
--------- s o u r c e   c o d e ---------
function victim(x, y, cb) {\x0a  let s = x.x | 0;\x0a  let flag = cb(x) | 0;\x0a  let d = y.x | 0;\x0a  if (!(flag & 1)) return 0;\x0a  if (x == sentinel) return 0;\x0a  y.z = 99;\x0a  return (x.z === 99 ? 1000000 : 7) + s + d;\x0a}
-----------------------------------------
}
[2]: /* anonymous */ [0x7aa3010264d1] [/home/mufeedvh/lle-map-bypass-work/exploratory-asem/poc_missing_property_wrong_result.js:38] [bytecode=0x7a9201000151 offset=304](this=0x7aa30100c6fd <JSGlobalProxy>#0#) {
  // heap-allocated locals
  var sentinel = 0x7aa30104ba89 <MakeBase map = 0x7aa301026749>#3#
  var tx = 0x7aa30104e1c5 <ContextCell[const=0x7aa30104e1ad <MakeBase map = 0x7aa301026865>]>#4#
  var ty = 0x7aa30104e1f5 <ContextCell[const=0x7aa30104e1dd <MakeBase map = 0x7aa30102688d>]>#5#
  var target = 0x7aa30104e339 <ContextCell[const=0x7aa30104e321 <MakeBase map = 0x7aa30102688d>]>#6#
  var r = 0x7aa30002fffd <the_hole_value>
  // expression stack (top to bottom)
  [13] : 0x7aa30100c6fd <JSGlobalProxy>#0#
  [12] : 0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#
  [11] : 0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#
  [10] : 0x7aa301026589 <JSFunction cbTransition (sfi = 0x7aa30102642d)>#2#
  [09] : 0x7aa301026589 <JSFunction cbTransition (sfi = 0x7aa30102642d)>#2#
  [08] : 0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#
  [07] : 0x7aa301026589 <JSFunction cbTransition (sfi = 0x7aa30102642d)>#2#
  [06] : 0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#
  [05] : 0x7aa30104e321 <MakeBase map = 0x7aa30102688d>#1#
  [04] : 0x7aa3010265bd <JSFunction victim (sfi = 0x7aa30102645d)>#7#
  [03] : 0x7aa30104e195 <MakeBase map = 0x7aa30102688d>#8#
  [02] : 0x7aa30104e17d <MakeBase map = 0x7aa301026865>#9#
  [01] : 200
  [00] : 0x7aa300000011 <undefined>
--------- s o u r c e   c o d e ---------
function MakeBase(val) { this.x = val; }\x0aconst sentinel = new MakeBase(-1);\x0a\x0afunction cbTransition(o) {\x0a  o.y = 42;\x0a  return 1;\x0a}\x0a%NeverOptimizeFunction(cbTransition);\x0a\x0afunction victim(x, y, cb) {\x0a  let s = x.x | 0;\x0a  let flag = cb(x) | 0;\x0a  let d = y.x | 0;\x0a  if (!(flag & 1)) return 0;\x0a  if (x == s...

-----------------------------------------
}

[3]: InternalFrame [pc: 0x5dab7d96a627]
[4]: EntryFrame [pc: 0x5dab7d96a36b]
-- ObjectCacheKey --

 #0# 0x7aa30100c6fd: 0x7aa30100c6fd <JSGlobalProxy>
 #1# 0x7aa30104e321: 0x7aa30104e321 <MakeBase map = 0x7aa30102688d>
                 x: 1337
                 y: 42
                 z: 99
 #2# 0x7aa301026589: 0x7aa301026589 <JSFunction cbTransition (sfi = 0x7aa30102642d)>
 #3# 0x7aa30104ba89: 0x7aa30104ba89 <MakeBase map = 0x7aa301026749>
                 x: -1
 #4# 0x7aa30104e1c5: 0x7aa30104e1c5 <ContextCell[const=0x7aa30104e1ad <MakeBase map = 0x7aa301026865>]>
 #5# 0x7aa30104e1f5: 0x7aa30104e1f5 <ContextCell[const=0x7aa30104e1dd <MakeBase map = 0x7aa30102688d>]>
 #6# 0x7aa30104e339: 0x7aa30104e339 <ContextCell[const=0x7aa30104e321 <MakeBase map = 0x7aa30102688d>]>
 #7# 0x7aa3010265bd: 0x7aa3010265bd <JSFunction victim (sfi = 0x7aa30102645d)>
 #8# 0x7aa30104e195: 0x7aa30104e195 <MakeBase map = 0x7aa30102688d>
                 x: 299
                 y: 42
                 z: 99
 #9# 0x7aa30104e17d: 0x7aa30104e17d <MakeBase map = 0x7aa301026865>
                 x: 199
                 y: 42
=====================