VULNERABILITY DETAILS

Summary

This is an integer truncation vulnerability in V8’s Turboshaft compiler when processing WASM br_table instructions. The Operation::input_count field is a uint16_t (max 65535), but multiple br_table instructions targeting the same merge block can produce more than 65535 predecessors. In release builds, this causes silent truncation leading to a mismatch between the stored input count and the actual graph structure, causing crashes during subsequent compiler phases.

Overview

The Operation base class in Turboshaft uses a uint16_t for input_count, limiting operations to 65535 inputs. However, when building the Turboshaft graph from WASM, the TurboshaftGraphBuildingInterface::MaybePhi() function creates phi nodes with one input per predecessor block. WASM br_table instructions can each have up to 65520 entries (kV8MaxWasmFunctionBrTableSize), and multiple br_tables in different branches can all target the same merge block. When two br_tables each have ~33000 entries targeting the same block, the total predecessors exceed the uint16_t maximum.

Detail

// src/compiler/turboshaft/operations.h:958
const uint16_t input_count;

// src/compiler/turboshaft/operations.h:1025-1029
explicit Operation(Opcode opcode, size_t input_count)
    : opcode(opcode), input_count(input_count) {
  DCHECK_LE(input_count,
            std::numeric_limits<decltype(this->input_count)>::max());
}

The input_count field is defined as uint16_t at line 958. The constructor at lines 1025-1029 includes a DCHECK that validates the input count doesn’t exceed the uint16_t maximum. However, this check is only enabled in debug builds.

The vulnerability is triggered through WASM br_table processing:

// src/wasm/wasm-limits.h:53
constexpr size_t kV8MaxWasmFunctionBrTableSize = 65'520;

Each br_table instruction can have up to 65520 entries. When processing br_table in Turboshaft:

// src/wasm/turboshaft-graph-interface.cc:700-707
int i = 0;
BranchTableIterator<ValidationTag> branch_iterator(decoder, imm);
while (branch_iterator.has_next()) {
  TSBlock* intermediate = intermediate_blocks[i];
  i++;
  __ Bind(intermediate);
  BrOrRet(decoder, branch_iterator.next());  // Called for each br_table entry
}

// src/wasm/turboshaft-graph-interface.cc:520-527
void BrOrRet(FullDecoder* decoder, uint32_t depth, uint32_t drop_values = 0) {
  if (depth == decoder->control_depth() - 1) {
    DoReturn(decoder, drop_values);
  } else {
    Control* target = decoder->control_at(depth);
    SetupControlFlowEdge(decoder, target->merge_block, drop_values);  // Adds predecessor
    __ Goto(target->merge_block);
  }
}

Each SetupControlFlowEdge call adds one predecessor to the target block, contributing one phi input.

When the target block is finalized, BindBlockAndGeneratePhis() calls MaybePhi():

// src/wasm/turboshaft-graph-interface.cc:6504-6512
OpIndex MaybePhi(base::Vector<const OpIndex> elements, ValueType type) {
  if (elements.empty()) return OpIndex::Invalid();
  for (size_t i = 1; i < elements.size(); i++) {
    if (elements[i] != elements[0]) {
      return __ Phi(elements, RepresentationFor(type));  // Creates PhiOp
    }
  }
  return elements[0];
}

When elements.size() (the predecessor count) exceeds 65535, the PhiOp constructor is called with an overflowing input_count:

• Debug builds: DCHECK fails with “input_count <= std::numeric_limits<…>::max() (66002 vs. 65535)”
• Release builds: input_count is silently truncated (e.g., 66002 → 466), causing:
  1. Storage is allocated correctly (using full count before truncation)
  2. All 66002 inputs are written to memory via OverwriteWith()
  3. But input_count field stores 466, so inputs() method returns a vector of size 466
  4. Graph structure expects 66002 predecessors but PhiOp reports only 466 inputs
  5. Mismatch causes logic errors during subsequent compiler phases (e.g., ResolvePhi in WasmLoweringPhase)
  6. Results in bad_optional_access exception when accessing missing/invalid data

Trigger Conditions

1. Create a WASM function with a block that can receive many predecessors
2. Use an if/else structure where each branch contains a br_table instruction
3. Each br_table has ~33000 entries (within the 65520 per-table limit)
4. All br_table entries target the same outer block
5. Total predecessors = (br_table1 entries + 1) + (br_table2 entries + 1) > 65535
6. Trigger Turboshaft compilation (via --no-liftoff or tier-up after many calls)
7. When the outer block is bound, PhiOp creation causes the overflow

Version

Reproduced Version

• main branch latest commit (2026/02/03): 169e50a4a4095f3bb859106c416cafb5fba49a30
• V8 14.6.143

Bisect

• Bisect suggests that the commit 2159da0c4eabb171cf5fdc436188cb585970480e introduces this bug.

commit 2159da0c4eabb171cf5fdc436188cb585970480e
Author: Peter Boström <pbos@chromium.org>
Date:   Mon Jan 29 11:45:19 2024 -0800

    Use std::optional for v8::base::Optional
    
    This file is no longer present in upstream base/optional.h which uses
    std::optional directly.
    
    Bug: chromium:1202909
    Change-Id: I5c73d91338ab7a593f33bc2837e3b6588aef77bc
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5246687
    Auto-Submit: Peter Boström <pbos@chromium.org>
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#92073}

However, I suspect this commit c0115f5658ffff0c92f98278bd9a14df21845bc8 as the culprit.

commit c0115f5658ffff0c92f98278bd9a14df21845bc8
Author: Manos Koukoutos <manoskouk@chromium.org>
Date:   Thu Jul 6 20:16:20 2023 +0200

    [wasm][turboshaft] More control flow
    
    Implement
    - loops
    - br_if which branches into implicit return
    - br_table
    - multireturn
    
    Bug: v8:14108
    Change-Id: I40852a24524d3572511482b3ca996cb2fbacf3e4
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4663080
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
    Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#88733}

Reproduction Case

I prepared two versions of the PoC:

• Version 1 (poc-v1.js): reproduces faster with --no-liftoff flag - this does not require loop to reach TurboFan optimization
• Version 2 (poc-v2.js): reproduces without --no-liftoff flag - this requires loop to reach TurboFan optimization

Release Build

Use one of two versions of the PoC:

out/x64.release/d8 --no-liftoff poc-v1.js
out/x64.release/d8 poc-v2.js

Result with version 1:

=== WASM br_table phi overflow PoC ===
br_table size 1: 33000
br_table size 2: 33000
Expected total predecessors: 66002
uint16_t max: 65535
Overflow expected: true

Creating WASM module...
Binary size: 66070 bytes

Compiling with --no-liftoff to force Turboshaft...
Compilation succeeded

Instantiating...
Instance created

Calling test function...
bad_optional_access was thrown in -fno-exceptions modeReceived signal 6

==== C stack trace ===============================

out/x64.release/d8(_ZN2v84base5debug10StackTraceC1Ev+0x1e)[0x5d299d4f97ce]
out/x64.release/d8(+0x2fee71f)[0x5d299d4f971f]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x760d99245330]
/lib/x86_64-linux-gnu/libc.so.6(pthread_kill+0x11c)[0x760d9929eb2c]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x1e)[0x760d9924527e]
/lib/x86_64-linux-gnu/libc.so.6(abort+0xdf)[0x760d992288ff]
out/x64.release/d8(+0x31db932)[0x5d299d6e6932]
out/x64.release/d8(+0x16d13b2)[0x5d299bbdc3b2]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE10ResolvePhiIZNSO_22AssembleOutputGraphPhiERKNS2_5PhiOpEEUlNS2_7OpIndexEiiE_EEST_SS_OT_NS2_22RegisterRepresentationE+0x440)[0x5d299d18c910]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE22VisitOpNoMappingUpdateILb0EEENS2_7OpIndexESQ_PKNS2_5BlockE+0x7c2)[0x5d299d1712c2]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE14VisitBlockBodyILNSO_11CanHavePhisE1ELNSO_10ForCloningE0ELb0EEEvPKNS2_5BlockEi+0xbd)[0x5d299d16efcd]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE10VisitBlockILb0EEEvPKNS2_5BlockE+0x21d)[0x5d299d16e75d]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft12GraphVisitorINS2_19WasmLoweringReducerINS2_26MachineOptimizationReducerINS2_21EmitProjectionReducerINS2_20AssemblerOpInterfaceINS2_11ReducerBaseINS2_12GraphEmitterINS2_11StackBottomINS2_9AssemblerIJS3_S4_S5_EEENS_4base3tmp5list1IJS3_S4_S5_S6_S7_S8_S9_EEEEEEEEEEEEEEEEEE14VisitAllBlocksILb0EEEvv+0xa0)[0x5d299d16e190]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft16CopyingPhaseImplIJNS2_19WasmLoweringReducerENS2_26MachineOptimizationReducerEEE3RunEPNS2_12PipelineDataERNS2_5GraphEPNS0_4ZoneEb+0x180)[0x5d299d16d9a0]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft8Pipeline3RunITkNS2_15TurboshaftPhaseENS2_17WasmLoweringPhaseEJEEEDaDpOT0_+0xc8)[0x5d299cb91bc8]
out/x64.release/d8(_ZN2v88internal8compiler8Pipeline16GenerateWasmCodeEPNS0_4wasm14CompilationEnvERNS1_19WasmCompilationDataEPNS3_20WasmDetectedFeaturesEPNS0_21DelayedCounterUpdatesE+0xf0e)[0x5d299cb8ff9e]
out/x64.release/d8(_ZN2v88internal8compiler10turboshaft32ExecuteTurboshaftWasmCompilationEPNS0_4wasm14CompilationEnvERNS1_19WasmCompilationDataEPNS3_20WasmDetectedFeaturesEPNS0_21DelayedCounterUpdatesE+0x12)[0x5d299d1e8b42]
out/x64.release/d8(_ZN2v88internal4wasm19WasmCompilationUnit18ExecuteCompilationEPNS1_14CompilationEnvEPKNS1_16WireBytesStorageEPNS0_21DelayedCounterUpdatesEPNS1_20WasmDetectedFeaturesE+0x2e0)[0x5d299c796650]
out/x64.release/d8(_ZN2v88internal4wasm11CompileLazyEPNS0_7IsolateEPNS1_12NativeModuleEi+0x249)[0x5d299c79a0c9]
out/x64.release/d8(_ZN2v88internal23Runtime_WasmCompileLazyEiPmPNS0_7IsolateE+0x16a)[0x5d299c6e61ea]
out/x64.release/d8(+0x2e89249)[0x5d299d394249]
[end of stack trace]
Aborted

Debug Build

Use one of two versions of the PoC:

out/x64.debug/d8 --no-liftoff poc-v1.js
out/x64.debug/d8 poc-v2.js

Result with version 1:

=== WASM br_table phi overflow PoC ===
br_table size 1: 33000
br_table size 2: 33000
Expected total predecessors: 66002
uint16_t max: 65535
Overflow expected: true

Creating WASM module...
Binary size: 66070 bytes

Compiling with --no-liftoff to force Turboshaft...
Compilation succeeded

Instantiating...
Instance created

Calling test function...


#
# Fatal error in ../../src/compiler/turboshaft/operations.h, line 1028
# Debug check failed: input_count <= std::numeric_limits<decltype(this->input_count)>::max() (66002 vs. 65535).
#
#
#
#FailureMessage Object: 0x7ffe59318f48
==== C stack trace ===============================

    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x29) [0x71e5c902f0d9]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libplatform.so(+0x4e29d) [0x71e5c8f9029d]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(V8_Fatal(char const*, int, char const*, ...)+0x205) [0x71e5c90032e5]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(+0x53b7c) [0x71e5c9002b7c]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8_libbase.so(V8_Dcheck(char const*, int, char const*)+0x4d) [0x71e5c90033dd]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::Operation::Operation(v8::internal::compiler::turboshaft::Opcode, unsigned long)+0x80) [0x71e5c622e0f0]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::OperationT(unsigned long)+0x22) [0x71e5c623fcd2]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::OperationT(v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper)+0x31) [0x71e5c623fc71]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp::PhiOp(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x53) [0x71e5c623f9c3]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp& v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::New<v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::Graph*, unsigned long, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x82) [0x71e5c6240fb2]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp& v8::internal::compiler::turboshaft::OperationT<v8::internal::compiler::turboshaft::PhiOp>::New<v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::Graph*, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x59) [0x71e5c6240e19]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::PhiOp& v8::internal::compiler::turboshaft::Graph::Add<v8::internal::compiler::turboshaft::PhiOp, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x74) [0x71e5c6240b54]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>::Emit<v8::internal::compiler::turboshaft::PhiOp, v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::internal::compiler::turboshaft::ShadowyOpIndexVectorWrapper, v8::internal::compiler::turboshaft::RegisterRepresentation)+0xcd) [0x71e5c7d5393d]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x69) [0x71e5c7d53859]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>::ReducePhiHelper(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x145) [0x71e5c7d537b5]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x1c2) [0x71e5c7d535e2]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(auto v8::internal::compiler::turboshaft::UniformReducerAdapter<v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReducePhiContinuation::Reduce<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation) const+0x47) [0x71e5c7d53217]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::EmitProjectionReducer<v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReduceOperation<(v8::internal::compiler::turboshaft::Opcode)93, v8::internal::compiler::turboshaft::UniformReducerAdapter<v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReducePhiContinuation, v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x61) [0x71e5c7d53131]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(auto v8::internal::compiler::turboshaft::UniformReducerAdapter<v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x44) [0x71e5c7d53014]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::RequiredOptimizationReducer<v8::internal::compiler::turboshaft::EmitProjectionReducer<v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>>::ReducePhiHelper(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x5f) [0x71e5c7d52b2f]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::RequiredOptimizationReducer<v8::internal::compiler::turboshaft::EmitProjectionReducer<v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>>>::ReducePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x1c2) [0x71e5c7d52a42]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::OpIndex v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>::ReduceIfReachablePhi<v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation>(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0xec) [0x71e5c7d5283c]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::AssemblerOpInterface<v8::internal::compiler::turboshaft::ReducerBase<v8::internal::compiler::turboshaft::GraphEmitter<v8::internal::compiler::turboshaft::StackBottom<v8::internal::compiler::turboshaft::Assembler<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer>, v8::base::tmp::list1<v8::internal::compiler::turboshaft::SelectLoweringReducer, v8::internal::compiler::turboshaft::DataViewLoweringReducer, v8::internal::compiler::turboshaft::VariableReducer, v8::internal::compiler::turboshaft::EmitProjectionReducer, v8::internal::compiler::turboshaft::AssemblerOpInterface, v8::internal::compiler::turboshaft::ReducerBase, v8::internal::compiler::turboshaft::GraphEmitter>>>>>::Phi(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::compiler::turboshaft::RegisterRepresentation)+0x44) [0x71e5c7d51db4]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::TurboshaftGraphBuildingInterface::MaybePhi(v8::base::Vector<v8::internal::compiler::turboshaft::OpIndex const>, v8::internal::wasm::ValueType)+0xe4) [0x71e5c7d77064]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::TurboshaftGraphBuildingInterface::BindBlockAndGeneratePhis(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>*, v8::internal::compiler::turboshaft::Block*, v8::internal::wasm::Merge<v8::internal::wasm::TurboshaftGraphBuildingInterface::Value>*, v8::internal::compiler::turboshaft::OpIndex*)+0x33b) [0x71e5c7d76e1b]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::TurboshaftGraphBuildingInterface::PopControl(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>*, v8::internal::wasm::TurboshaftGraphBuildingInterface::Control*)+0x285) [0x71e5c7d8b355]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::PopControl()+0x1bd) [0x71e5c7d899cd]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::DecodeEndImpl(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::TraceLine*, v8::internal::wasm::WasmOpcode)+0xa16) [0x71e5c7d89696]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::DecodeEnd(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>*, v8::internal::wasm::WasmOpcode)+0x6e) [0x71e5c7d66c1e]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::DecodeFunctionBody()+0x4b3) [0x71e5c7d4c1f3]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmFullDecoder<v8::internal::wasm::Decoder::NoValidationTag, v8::internal::wasm::TurboshaftGraphBuildingInterface, (v8::internal::wasm::DecodingMode)0>::Decode()+0x280) [0x71e5c7d43390]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::BuildTSGraph(v8::internal::compiler::turboshaft::PipelineData*, v8::internal::wasm::CompilationEnv*, v8::internal::wasm::WasmDetectedFeatures*, v8::internal::compiler::turboshaft::Graph&, v8::internal::wasm::FunctionBody const&, v8::internal::wasm::WireBytesStorage const*, std::__Cr::unique_ptr<v8::internal::wasm::AssumptionsJournal, std::__Cr::default_delete<v8::internal::wasm::AssumptionsJournal>>*, v8::internal::ZoneVector<v8::internal::WasmInliningPosition>*, int, v8::internal::wasm::WasmFunctionCoverageData*)+0x1f8) [0x71e5c7d417e8]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::Pipeline::GenerateWasmCode(v8::internal::wasm::CompilationEnv*, v8::internal::compiler::WasmCompilationData&, v8::internal::wasm::WasmDetectedFeatures*, v8::internal::DelayedCounterUpdates*)+0xa0c) [0x71e5c620260c]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::compiler::turboshaft::ExecuteTurboshaftWasmCompilation(v8::internal::wasm::CompilationEnv*, v8::internal::compiler::WasmCompilationData&, v8::internal::wasm::WasmDetectedFeatures*, v8::internal::DelayedCounterUpdates*)+0x53) [0x71e5c7d02923]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::WasmCompilationUnit::ExecuteCompilation(v8::internal::wasm::CompilationEnv*, v8::internal::wasm::WireBytesStorage const*, v8::internal::DelayedCounterUpdates*, v8::internal::wasm::WasmDetectedFeatures*)+0x824) [0x71e5c562bc04]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::wasm::CompileLazy(v8::internal::Isolate*, v8::internal::wasm::NativeModule*, int)+0x2eb) [0x71e5c563251b]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(+0xba7008d) [0x71e5c547008d]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(v8::internal::Runtime_WasmCompileLazy(int, unsigned long*, v8::internal::Isolate*)+0x151) [0x71e5c546fb11]
    /home/candymate/repos/v8-latest/v8/out/x64.debug/libv8.so(+0x8b93b57) [0x71e5c2593b57]
Trace/breakpoint trap

Credit Information

Reporter credit: JunYoung Park(@candymate) of KAIST Hacking Lab