V8 is running with developer-only features enabled. Stability and security will suffer.
LateLoadElimination: Starting analysis
> ProcessBlock(B0)
> Process other op (id=7)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x781901026341 <JSFunction victim (sfi = 0x7819010261e1)>]
> Process other op (id=11)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x78190100c75d <NativeContext[308]>]
> Process other op (id=15)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 1]
> Process other op (id=17)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 0]
> ProcessLoad(21)
> MemoryContentTable: will insert MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=21
> Process other op (id=22)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7819010264f5 <Map[24](HOLEY_ELEMENTS)>]
> ProcessAssumeMap(25)
> ProcessLoad(27)
> MemoryContentTable: will insert MemoryAddress{base=0, index=<invalid OpIndex>, offset=12, elem_size_log2=0, size=4} with value=27
> Process other op (id=28)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x78190102630d <JSFunction cbTransition (sfi = 0x7819010261b1)>]
> Process other op (id=29)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#27)[Tagged, Word32, Smi]
> Process other op (id=30)
>> InvalidateAllNonAliasingInputs for Shift(#29, #15)[ShiftRightArithmeticShiftOutZeros, Word32]
> Process other op (id=36)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x7819010262b5 <ScriptContext[7]>]
> Process other op (id=37)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 2]
> Process other op (id=38)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x781900000011 <undefined>]
> Process other op (id=39)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x78190100c6fd <JSGlobalProxy>]
> ProcessCall(40)
>> InvalidateAllNonAliasingInputs for Call(#28, #33, #39, #0, #38, #37, #17, #36)[JS:js-call:r1s2i7f1]
>> InvalidateIfAlias: recursively invalidating for FrameState inputs (FrameState id=33)
>> InvalidateMaybeAliasing
>>> Invalidating MemoryAddress{base=0, index=<invalid OpIndex>, offset=12, elem_size_log2=0, size=4}
>>> Invalidating MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4}
> Process other op (id=52)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#44)[Tagged, Word32, Smi]
> Process other op (id=53)
>> InvalidateAllNonAliasingInputs for Shift(#52, #15)[ShiftRightArithmeticShiftOutZeros, Word32]
> ProcessLoad(59)
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=59
> Process other op (id=60)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x781901026615 <Map[24](HOLEY_ELEMENTS)>]
> ProcessAssumeMap(63)
> ProcessLoad(65)
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=12, elem_size_log2=0, size=4} with value=65
> Process other op (id=67)
>> InvalidateAllNonAliasingInputs for Branch(#66)[B2, B1, None]
> ProcessBlock(B1)
> Process other op (id=69)
>> InvalidateAllNonAliasingInputs for Constant()[word64: 0]
> ProcessBlock(B2)
> Process other op (id=71)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x78190104b9e5 <MakeBase map = 0x7819010264f5>]
> ProcessLoad(72)
> MemoryContentTable: will insert MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=72
>> Reusing existing key
> Process other op (id=74)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#72)[Tagged, Word64, HeapObject]
> ProcessChange(75)
> Process other op (id=76)
>> InvalidateAllNonAliasingInputs for Constant()[word32: 1703936]
> Process other op (id=78)
>> InvalidateAllNonAliasingInputs for Goto()[B3, 0]
> ProcessBlock(B3)
> Process other op (id=81)
>> InvalidateAllNonAliasingInputs for Branch(#80)[B8, B4, None]
> ProcessBlock(B4)
> Process other op (id=83)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#65)[Tagged, Word32, Smi]
> Process other op (id=84)
>> InvalidateAllNonAliasingInputs for Shift(#83, #15)[ShiftRightArithmeticShiftOutZeros, Word32]
> Process other op (id=85)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x78190102663d <Map[24](HOLEY_ELEMENTS)>]
> Process other op (id=86)
>> InvalidateAllNonAliasingInputs for Constant()[smi: 99]
> ProcessStore(87)
> MemoryContentTable: Invalidating based on 4, <invalid OpIndex>, 20
>> base is maybe-aliasing
>>> Invalidating everything maybe-aliasing at offset 20
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=20, elem_size_log2=0, size=4} with value=86
> ProcessStore(89)
> MemoryContentTable: Invalidating based on 4, <invalid OpIndex>, 0
>> base is maybe-aliasing
>>> Invalidating everything maybe-aliasing at offset 0
>>>> InvalidateAtOffset: not invalidating thanks for maps: MemoryAddress{base=0, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4}
>>>> InvalidateAtOffset: invalidating MemoryAddress{base=4, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4}
> MemoryContentTable: will insert MemoryAddress{base=4, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=85
>> Reusing existing key
>> Wiping all maps

> ProcessLoad(93)
>> Found potential replacement at offset 72
>>> Confirming replacement
> ProcessAssumeMap(97)
> ProcessLoad(98)
> MemoryContentTable: will insert MemoryAddress{base=0, index=<invalid OpIndex>, offset=16, elem_size_log2=0, size=4} with value=98
> Process other op (id=99)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#98)[Tagged, Word32, Smi]
> Process other op (id=100)
>> InvalidateAllNonAliasingInputs for Shift(#99, #15)[ShiftRightArithmeticShiftOutZeros, Word32]
> Process other op (id=102)
>> InvalidateAllNonAliasingInputs for OverflowCheckedBinop(#101, #100)[signed add, Word32]
> Process other op (id=103)
>> InvalidateAllNonAliasingInputs for Projection(#102)[0, Word32]
> Process other op (id=104)
>> InvalidateAllNonAliasingInputs for Projection(#102)[1, Word32]
> Process other op (id=108)
>> InvalidateAllNonAliasingInputs for OverflowCheckedBinop(#103, #103)[signed add, Word32]
> Process other op (id=109)
>> InvalidateAllNonAliasingInputs for Projection(#108)[0, Word32]
> Process other op (id=110)
>> InvalidateAllNonAliasingInputs for Projection(#108)[1, Word32]
> Process other op (id=112)
>> InvalidateAllNonAliasingInputs for Branch(#110)[B6, B5, False]
> ProcessBlock(B5)
> Process other op (id=114)
>> InvalidateAllNonAliasingInputs for TaggedBitcast(#109)[Word32, Tagged, Smi]
> Process other op (id=115)
>> InvalidateAllNonAliasingInputs for Goto()[B7, 0]
> ProcessBlock(B6)
> ProcessChange(116)
> Process other op (id=117)
>> InvalidateAllNonAliasingInputs for Constant()[word64: 12]
> ProcessAllocate(118) ==> Fresh non-aliasing object
> Process other op (id=119)
>> InvalidateAllNonAliasingInputs for Constant()[heap object: 0x781900000515 <Map[12](HEAP_NUMBER_TYPE)>]
> ProcessStore(120)
> MemoryContentTable: Invalidating based on 118, <invalid OpIndex>, 0
>> base is non-aliasing
> MemoryContentTable: will insert MemoryAddress{base=118, index=<invalid OpIndex>, offset=0, elem_size_log2=0, size=4} with value=119
>> Wiping all maps

> ProcessStore(121)
> MemoryContentTable: Invalidating based on 118, <invalid OpIndex>, 4
>> base is non-aliasing
> MemoryContentTable: will insert MemoryAddress{base=118, index=<invalid OpIndex>, offset=4, elem_size_log2=0, size=8} with value=116
> Process other op (id=123)
>> InvalidateAllNonAliasingInputs for Goto()[B7, 0]
> ProcessBlock(B7)
> Process other op (id=124)
>> InvalidateAllNonAliasingInputs for Phi(#114, #118)[Tagged]
> ProcessBlock(B8)
> Process other op (id=126)
>> InvalidateAllNonAliasingInputs for Constant()[word64: 0]
[test] 1142 status=41
[before] {"x":1337}
abort: Turboshaft's load elimination wrongly eliminated a Load

==== JS stack trace =========================================

    0: ExitFrame [pc: 0x5f5ab3c8997d]
    1: victim [0x781901026341] [/home/mufeedvh/poc_loose_receiver.js:~6] [pc=0x5f5ae00002c9](this=0x78190100c6fd <JSGlobalProxy>#0#,0x78190104e299 <MakeBase map = 0x78190102663d>#1#,0x78190104e299 <MakeBase map = 0x78190102663d>#1#,0x78190102630d <JSFunction cbTransition (sfi = 0x7819010261b1)>#2#)
    2: /* anonymous */ [0x781901026255] [/home/mufeedvh/poc_loose_receiver.js:31] [bytecode=0x7eb8010000e5 offset=304](this=0x78190100c6fd <JSGlobalProxy>#0#)
    3: InternalFrame [pc: 0x5f5ab3a3e627]
    4: EntryFrame [pc: 0x5f5ab3a3e36b]

==== Details ================================================

[0]: ExitFrame [pc: 0x5f5ab3c8997d]
[1]: victim [0x781901026341] [/home/mufeedvh/poc_loose_receiver.js:~6] [pc=0x5f5ae00002c9](this=0x78190100c6fd <JSGlobalProxy>#0#,0x78190104e299 <MakeBase map = 0x78190102663d>#1#,0x78190104e299 <MakeBase map = 0x78190102663d>#1#,0x78190102630d <JSFunction cbTransition (sfi = 0x7819010261b1)>#2#) {
// optimized frame
--------- s o u r c e   c o d e ---------
function victim(x, y, cb) {\x0a  let s = x.x | 0;\x0a  let flag = cb(x) | 0;\x0a  let d = y.x | 0;\x0a  if (!(flag & 1)) return 0;\x0a  if (x == sentinel) return 0;  // loose equality, try CheckReceiver path\x0a  y.z = 99;\x0a  return s + d + (x.y | 0);\x0a}
-----------------------------------------
}
[2]: /* anonymous */ [0x781901026255] [/home/mufeedvh/poc_loose_receiver.js:31] [bytecode=0x7eb8010000e5 offset=304](this=0x78190100c6fd <JSGlobalProxy>#0#) {
  // heap-allocated locals
  var sentinel = 0x78190104b9e5 <MakeBase map = 0x7819010264f5>#3#
  var tx = 0x78190104e121 <ContextCell[const=0x78190104e109 <MakeBase map = 0x781901026615>]>#4#
  var ty = 0x78190104e151 <ContextCell[const=0x78190104e139 <MakeBase map = 0x78190102663d>]>#5#
  var target = 0x78190104e2b1 <ContextCell[const=0x78190104e299 <MakeBase map = 0x78190102663d>]>#6#
  var r = 0x78190002fffd <the_hole_value>
  // expression stack (top to bottom)
  [13] : 0x78190100c6fd <JSGlobalProxy>#0#
  [12] : 0x78190104e299 <MakeBase map = 0x78190102663d>#1#
  [11] : 0x78190104e299 <MakeBase map = 0x78190102663d>#1#
  [10] : 0x78190102630d <JSFunction cbTransition (sfi = 0x7819010261b1)>#2#
  [09] : 0x78190102630d <JSFunction cbTransition (sfi = 0x7819010261b1)>#2#
  [08] : 0x78190104e299 <MakeBase map = 0x78190102663d>#1#
  [07] : 0x78190102630d <JSFunction cbTransition (sfi = 0x7819010261b1)>#2#
  [06] : 0x78190104e299 <MakeBase map = 0x78190102663d>#1#
  [05] : 0x78190104e299 <MakeBase map = 0x78190102663d>#1#
  [04] : 0x781901026341 <JSFunction victim (sfi = 0x7819010261e1)>#7#
  [03] : 0x78190104e0f1 <MakeBase map = 0x78190102663d>#8#
  [02] : 0x78190104e0d9 <MakeBase map = 0x781901026615>#9#
  [01] : 200
  [00] : 0x781900000011 <undefined>
--------- s o u r c e   c o d e ---------
function MakeBase(val) { this.x = val; }\x0aconst sentinel = new MakeBase(-1);\x0afunction cbTransition(o) { o.y = 42; return 1; }\x0a%NeverOptimizeFunction(cbTransition);\x0a\x0afunction victim(x, y, cb) {\x0a  let s = x.x | 0;\x0a  let flag = cb(x) | 0;\x0a  let d = y.x | 0;\x0a  if (!(flag & 1)) return 0;\x0a  if (x == sentin...

-----------------------------------------
}

[3]: InternalFrame [pc: 0x5f5ab3a3e627]
[4]: EntryFrame [pc: 0x5f5ab3a3e36b]
-- ObjectCacheKey --

 #0# 0x78190100c6fd: 0x78190100c6fd <JSGlobalProxy>
 #1# 0x78190104e299: 0x78190104e299 <MakeBase map = 0x78190102663d>
                 x: 1337
                 y: 42
                 z: 99
 #2# 0x78190102630d: 0x78190102630d <JSFunction cbTransition (sfi = 0x7819010261b1)>
 #3# 0x78190104b9e5: 0x78190104b9e5 <MakeBase map = 0x7819010264f5>
                 x: -1
 #4# 0x78190104e121: 0x78190104e121 <ContextCell[const=0x78190104e109 <MakeBase map = 0x781901026615>]>
 #5# 0x78190104e151: 0x78190104e151 <ContextCell[const=0x78190104e139 <MakeBase map = 0x78190102663d>]>
 #6# 0x78190104e2b1: 0x78190104e2b1 <ContextCell[const=0x78190104e299 <MakeBase map = 0x78190102663d>]>
 #7# 0x781901026341: 0x781901026341 <JSFunction victim (sfi = 0x7819010261e1)>
 #8# 0x78190104e0f1: 0x78190104e0f1 <MakeBase map = 0x78190102663d>
                 x: 299
                 y: 42
                 z: 99
 #9# 0x78190104e0d9: 0x78190104e0d9 <MakeBase map = 0x781901026615>
                 x: 199
                 y: 42
=====================