From effbf0fc9555ec832149d9884396b9c2f75a46e1 Mon Sep 17 00:00:00 2001
From: Victor Gomes <victorgomes@chromium.org>
Date: Mon, 03 Aug 2026 09:57:06 +0200
Subject: [PATCH] [maglev] Only infer a field type from a stable field map

The class map recorded in a descriptor array is only a valid source of
type information when it is stable and a stability dependency is
installed: for an unstable map the GC widens the field type to Any
without deoptimizing dependent code.

Fixed: 541926503
Change-Id: I14c738f44613fdf403e188c7092fda2a59a0515c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8182709
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108990}
---
diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc
index 9a81b79..6cf54d1 100644
--- a/src/maglev/maglev-graph-builder.cc
+++ b/src/maglev/maglev-graph-builder.cc
@@ -113,9 +113,9 @@
   }
 };
 
-NodeType NodeTypeFromAccessInfo(
-    compiler::JSHeapBroker* broker,
-    const compiler::PropertyAccessInfo& access_info) {
+NodeType NodeTypeFromAccessInfo(compiler::JSHeapBroker* broker,
+                                const compiler::PropertyAccessInfo& access_info,
+                                compiler::OptionalMapRef stable_field_map) {
   if (access_info.field_representation().IsSmi()) {
     return NodeType::kSmi;
   }
@@ -124,8 +124,8 @@
     return NodeType::kHeapNumber;
   }
 
-  if (access_info.field_map().has_value()) {
-    return StaticTypeForMap(access_info.field_map().value(), broker);
+  if (stable_field_map.has_value()) {
+    return StaticTypeForMap(stable_field_map.value(), broker);
   }
 
   const auto type = access_info.field_type();
@@ -4466,13 +4466,14 @@
         {heap_number}, static_cast<int>(offsetof(HeapNumber, value_)));
   }
 
-  const auto node_type = NodeTypeFromAccessInfo(this->broker(), access_info);
   compiler::OptionalMapRef stable_field_map;
   if (access_info.field_representation().IsHeapObject() &&
       access_info.field_map().has_value() &&
       access_info.field_map().value().is_stable()) {
     stable_field_map = access_info.field_map();
   }
+  const auto node_type =
+      NodeTypeFromAccessInfo(this->broker(), access_info, stable_field_map);
   ValueNode* value;
   GET_VALUE_OR_ABORT(
       value, BuildLoadTaggedField(load_source, field_index.offset(), node_type,
diff --git a/test/mjsunit/maglev/regress-541926503.js b/test/mjsunit/maglev/regress-541926503.js
new file mode 100644
index 0000000..11ec072
--- /dev/null
+++ b/test/mjsunit/maglev/regress-541926503.js
@@ -0,0 +1,42 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --maglev
+
+const getInt32 = DataView.prototype.getInt32;
+
+function read(holder) {
+  return getInt32.call(holder.x, 0, true);
+}
+
+function Holder(x) {
+  this.x = x;
+}
+
+const a = new DataView(new ArrayBuffer(16));
+const b = new DataView(new ArrayBuffer(16));
+a.p = 1;
+b.p = 2;
+
+// `Holder.x` learns the DataView map of `a` and `b` as its class field type.
+const holder = new Holder(a);
+holder.x = b;
+
+// Generalizing `p` to double makes that map unstable.
+a.p = 1.5;
+
+%PrepareFunctionForOptimization(read);
+read(holder);
+read(holder);
+%OptimizeMaglevOnNextCall(read);
+read(holder);
+
+// The last instance migrates away, so the class map dies and the GC widens the
+// field type to Any without invalidating the optimized code.
+b.p = 2.5;
+gc();
+gc();
+
+holder.x = {a: 1, b: 2, c: 3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9};
+assertThrows(() => read(holder), TypeError);

diff --git a/test/mjsunit/maglev/regress-541926503.js b/test/mjsunit/maglev/regress-541926503.js
new file mode 100644
index 0000000..11ec072
--- /dev/null
+++ b/test/mjsunit/maglev/regress-541926503.js
@@ -0,0 +1,42 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --maglev
+
+const getInt32 = DataView.prototype.getInt32;
+
+function read(holder) {
+  return getInt32.call(holder.x, 0, true);
+}
+
+function Holder(x) {
+  this.x = x;
+}
+
+const a = new DataView(new ArrayBuffer(16));
+const b = new DataView(new ArrayBuffer(16));
+a.p = 1;
+b.p = 2;
+
+// `Holder.x` learns the DataView map of `a` and `b` as its class field type.
+const holder = new Holder(a);
+holder.x = b;
+
+// Generalizing `p` to double makes that map unstable.
+a.p = 1.5;
+
+%PrepareFunctionForOptimization(read);
+read(holder);
+read(holder);
+%OptimizeMaglevOnNextCall(read);
+read(holder);
+
+// The last instance migrates away, so the class map dies and the GC widens the
+// field type to Any without invalidating the optimized code.
+b.p = 2.5;
+gc();
+gc();
+
+holder.x = {a: 1, b: 2, c: 3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9};
+assertThrows(() => read(holder), TypeError);