OLDEST AFFECTED STABLE RELEASE
==============================

Result
------

Oldest affected V8 stable line: V8 12.7
First affected desktop Chrome Stable:
  Linux:        127.0.6533.72
  Windows/Mac:  127.0.6533.72/73
Release date: 2024-07-23

First Chrome 127 Linux Stable record
------------------------------------

Chrome: 127.0.6533.72
Chromium: 9755e24ca85aa18ffa16c743f660a3d914902775
Embedded V8: 5c5f3d841901cb78a4e130d38d081d03f82f1e36
Embedded V8 version: 12.7.224.16

Source-history validation
-------------------------

Introducing commit:
  bc1263ec361c9d364438d66bf5cd311304eaee38
  [maglev] Inline ArrayIteratorPrototypeNext
  2024-05-23
  refs/heads/main@{#94042}

git merge-base --is-ancestor \
  bc1263ec361c9d364438d66bf5cd311304eaee38 \
  5c5f3d841901cb78a4e130d38d081d03f82f1e36

Result: exit 0. The introducing commit is present in the exact V8 revision
embedded in the first Chrome 127 Linux Stable build. That revision contains
TryReduceArrayIteratorPrototypeNext and its inlined-allocation map trust.

Runtime validation
------------------

Artifact: official Chrome for Testing headless-shell 127.0.6533.72, linux64
V8 runtime flags: none
Native syntax: none
Memory-corruption API: not exposed or used
Outer Chromium process sandbox: --no-sandbox, for local container operation

The adapted inlined-local trigger produced addrof and fakeobj, constructed a
fake packed-double JSArray, read real carrier and victim headers, and changed
victim[0] from 11.11 to 1337.1337 through an arbitrary 64-bit cage write.

Fresh renderer reliability: 20/20 passed, 0 failed.

Unaffected control
------------------

Final Chrome 126 Linux Stable: 126.0.6478.182
Embedded V8: 556665385d5cdc2a0793b977d373da88091a7208
Embedded V8 version: 12.6.228.28

The introducing commit is not an ancestor of this revision, and
TryReduceArrayIteratorPrototypeNext is absent from maglev-graph-builder.cc.

Sources
-------

ChromiumDash fetch_releases API, Stable/Linux/milestone 127 and 126.
Chrome Releases, "Stable Channel Update for Desktop", 2024-07-23.
V8 git history and source tree at the exact embedded revisions above.
