From 8b490a9690b859346a68a3d2a7008b4e1852c3ea Mon Sep 17 00:00:00 2001
From: Marja Hölttä <marja@chromium.org>
Date: Tue, 04 Mar 2025 14:32:21 +0100
Subject: [PATCH] [turbofan] Fix TransitionElementsKindOrCheckMap

Take into account that TransitionElementsKindOrCheckMap might change the
map of an aliasing object.

h/t dmercadier@ for figuring out the fix.

Bug: 400052777
Change-Id: I07ac56058591619736dcc2d8f7355a7a34ecbbc7
Fixed: 400052777
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6321930
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#99049}
---

diff --git a/src/compiler/node-properties.cc b/src/compiler/node-properties.cc
index b5c27ee..6e2ef92 100644
--- a/src/compiler/node-properties.cc
+++ b/src/compiler/node-properties.cc
@@ -458,6 +458,9 @@
               ElementsTransitionWithMultipleSourcesOf(effect->op()).target()};
           return result;
         }
+        // `receiver` and `object` might alias, so
+        // TransitionElementsKindOrCheckMaps might change receiver's map.
+        result = kUnreliableMaps;
         break;
       }
       case IrOpcode::kJSCreate: {
diff --git a/test/mjsunit/compiler/regress-400052777.js b/test/mjsunit/compiler/regress-400052777.js
new file mode 100644
index 0000000..198462d
--- /dev/null
+++ b/test/mjsunit/compiler/regress-400052777.js
@@ -0,0 +1,31 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --no-always-turbofan
+
+function main() {
+  function f0(v2, v3) {
+    // TransitionElementsKindOrCheckMap: PACKED_SMI -> HOLEY_DOUBLE_ELEMENTS
+    var v4 = v3[0];
+
+    // TransitionElementsKindOrCheckMap: HOLEY_DOUBLE_ELEMENTS -> HOLEY_ELEMENTS
+    var v5 = v2[0];
+
+    // If v2 == v3, v3 doesn't have HOLEY_DOUBLE_ELEMENTS anymore.
+    Array.prototype.indexOf.call(v3);
+  }
+  %PrepareFunctionForOptimization(f0);
+
+  const holey = new Array(1);
+  holey[0] = 'tagged'; // HOLEY_ELEMENTS
+  f0(holey, [1]);
+
+  const holey_double = new Array(1);
+  holey_double[0] = 0.1; // HOLEY_DOUBLE_ELEMENTS
+
+  %OptimizeFunctionOnNextCall(f0);
+  f0(holey_double, holey_double);
+}
+main();
+main();

diff --git a/test/mjsunit/compiler/regress-400052777.js b/test/mjsunit/compiler/regress-400052777.js
new file mode 100644
index 0000000..198462d
--- /dev/null
+++ b/test/mjsunit/compiler/regress-400052777.js
@@ -0,0 +1,31 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --no-always-turbofan
+
+function main() {
+  function f0(v2, v3) {
+    // TransitionElementsKindOrCheckMap: PACKED_SMI -> HOLEY_DOUBLE_ELEMENTS
+    var v4 = v3[0];
+
+    // TransitionElementsKindOrCheckMap: HOLEY_DOUBLE_ELEMENTS -> HOLEY_ELEMENTS
+    var v5 = v2[0];
+
+    // If v2 == v3, v3 doesn't have HOLEY_DOUBLE_ELEMENTS anymore.
+    Array.prototype.indexOf.call(v3);
+  }
+  %PrepareFunctionForOptimization(f0);
+
+  const holey = new Array(1);
+  holey[0] = 'tagged'; // HOLEY_ELEMENTS
+  f0(holey, [1]);
+
+  const holey_double = new Array(1);
+  holey_double[0] = 0.1; // HOLEY_DOUBLE_ELEMENTS
+
+  %OptimizeFunctionOnNextCall(f0);
+  f0(holey_double, holey_double);
+}
+main();
+main();