From 00f6ecd8a7cca6911789a11b7a7b01aaf41f925b Mon Sep 17 00:00:00 2001
From: Leszek Swirski <leszeks@chromium.org>
Date: Tue, 05 May 2026 12:38:04 +0200
Subject: [PATCH] [maglev] Fix deopt literals IdentityMap race during GC

Maglev used an IdentityMap to store deoptimization literals, assigning
IDs based on the map's size. During concurrent GC, ThinString
shortcutting could merge previously distinct string pointers, causing
the map to rehash and shrink. This led to corrupted IDs and subsequent
out-of-bounds writes in DeoptimizationLiteralArray.

This CL implements an optimized hybrid approach:
1. Pair the IdentityMap cache with ZoneVectors to preserve original
   insertion order.
2. Populate the DeoptimizationLiteralArray from the vectors.
3. Safely canonicalize vector handles using Maglev's persistent
   CanonicalHandlesMap.
4. Optimize compiler::Ref overloads to bypass redundant lookups.

We also improve V8's runtime testing infrastructure by fixing
OptimizeMaglevOnNextCall's registration in runtime.h to support
variable arguments, enabling native concurrent Maglev testing in JS.

A robust randomized concurrent regression test is added to verify.

TAG=agy
CONV=8a5b0da0-ce00-46ee-83f5-9a341372b6f7

Fixed: 508811474
Change-Id: I69bffdbe6736552e273480c8cf23de25af112739
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7816278
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107059}
---

diff --git a/src/maglev/maglev-code-generator.cc b/src/maglev/maglev-code-generator.cc
index 0db6476..f7fa432 100644
--- a/src/maglev/maglev-code-generator.cc
+++ b/src/maglev/maglev-code-generator.cc
@@ -1207,12 +1207,17 @@
       LocalIsolate* local_isolate, MaglevAssembler* masm,
       FrameTranslationBuilder* translation_array_builder,
       IdentityMap<int, base::DefaultAllocationPolicy>* protected_deopt_literals,
-      IdentityMap<int, base::DefaultAllocationPolicy>* deopt_literals)
+      IdentityMap<int, base::DefaultAllocationPolicy>* deopt_literals,
+      ZoneVector<IndirectHandle<TrustedObject>>*
+          protected_deopt_literals_vector,
+      ZoneVector<IndirectHandle<Object>>* deopt_literals_vector)
       : local_isolate_(local_isolate),
         masm_(masm),
         translation_array_builder_(translation_array_builder),
         protected_deopt_literals_(protected_deopt_literals),
         deopt_literals_(deopt_literals),
+        protected_deopt_literals_vector_(protected_deopt_literals_vector),
+        deopt_literals_vector_(deopt_literals_vector),
         object_ids_(10) {}
 
   void BuildEagerDeopt(EagerDeoptInfo* deopt_info) {
@@ -1713,7 +1718,14 @@
         protected_deopt_literals_->FindOrInsert(obj);
     if (!res.already_exists) {
       DCHECK_EQ(0, *res.entry);
-      *res.entry = protected_deopt_literals_->size() - 1;
+      IndirectHandle<TrustedObject> canonical =
+          masm_->code_gen_state()
+              ->compilation_info()
+              ->broker()
+              ->CanonicalPersistentHandle(obj);
+      protected_deopt_literals_vector_->push_back(canonical);
+      *res.entry =
+          static_cast<int>(protected_deopt_literals_vector_->size() - 1);
     }
     return *res.entry;
   }
@@ -1722,13 +1734,25 @@
     IdentityMapFindResult<int> res = deopt_literals_->FindOrInsert(obj);
     if (!res.already_exists) {
       DCHECK_EQ(0, *res.entry);
-      *res.entry = deopt_literals_->size() - 1;
+      IndirectHandle<Object> canonical = masm_->code_gen_state()
+                                             ->compilation_info()
+                                             ->broker()
+                                             ->CanonicalPersistentHandle(obj);
+      deopt_literals_vector_->push_back(canonical);
+      *res.entry = static_cast<int>(deopt_literals_vector_->size() - 1);
     }
     return *res.entry;
   }
 
   int GetDeoptLiteral(compiler::HeapObjectRef ref) {
-    return GetDeoptLiteral(*ref.object());
+    IdentityMapFindResult<int> res =
+        deopt_literals_->FindOrInsert(*ref.object());
+    if (!res.already_exists) {
+      DCHECK_EQ(0, *res.entry);
+      deopt_literals_vector_->push_back(ref.object());
+      *res.entry = static_cast<int>(deopt_literals_vector_->size() - 1);
+    }
+    return *res.entry;
   }
 
   LocalIsolate* local_isolate_;
@@ -1736,6 +1760,8 @@
   FrameTranslationBuilder* translation_array_builder_;
   IdentityMap<int, base::DefaultAllocationPolicy>* protected_deopt_literals_;
   IdentityMap<int, base::DefaultAllocationPolicy>* deopt_literals_;
+  ZoneVector<IndirectHandle<TrustedObject>>* protected_deopt_literals_vector_;
+  ZoneVector<IndirectHandle<Object>>* deopt_literals_vector_;
 
   static const int kNotDuplicated = -1;
   std::vector<intptr_t> object_ids_;
@@ -1758,6 +1784,8 @@
       graph_(graph),
       protected_deopt_literals_(isolate->heap()->heap()),
       deopt_literals_(isolate->heap()->heap()),
+      protected_deopt_literals_vector_(compilation_info->zone()),
+      deopt_literals_vector_(compilation_info->zone()),
       retained_maps_(isolate->heap()),
       is_context_specialized_(
           compilation_info->specialize_to_function_context()),
@@ -1837,17 +1865,19 @@
 void MaglevCodeGenerator::RecordInlinedFunctions() {
   // The inlined functions should be the first literals.
   DCHECK_EQ(0u, deopt_literals_.size());
+  DCHECK_EQ(0u, deopt_literals_vector_.size());
   for (OptimizedCompilationInfo::InlinedFunctionHolder& inlined :
        graph_->inlined_functions()) {
     IdentityMapFindResult<int> res =
         deopt_literals_.FindOrInsert(inlined.shared_info);
     if (!res.already_exists) {
       DCHECK_EQ(0, *res.entry);
-      *res.entry = deopt_literals_.size() - 1;
+      deopt_literals_vector_.push_back(inlined.shared_info);
+      *res.entry = static_cast<int>(deopt_literals_vector_.size() - 1);
     }
     inlined.RegisterInlinedFunctionId(*res.entry);
   }
-  inlined_function_count_ = static_cast<int>(deopt_literals_.size());
+  inlined_function_count_ = static_cast<int>(deopt_literals_vector_.size());
 }
 
 void MaglevCodeGenerator::EmitDeferredCode() {
@@ -1872,7 +1902,8 @@
 
   MaglevFrameTranslationBuilder translation_builder(
       local_isolate_, &masm_, &frame_translation_builder_,
-      &protected_deopt_literals_, &deopt_literals_);
+      &protected_deopt_literals_, &deopt_literals_,
+      &protected_deopt_literals_vector_, &deopt_literals_vector_);
 
   // Deoptimization exits must be as small as possible, since their count grows
   // with function size. These labels are an optimization which extracts the
@@ -2098,10 +2129,10 @@
       static_cast<uint32_t>(graph_->inlined_functions().size());
   DirectHandle<ProtectedDeoptimizationLiteralArray> protected_literals =
       local_isolate->factory()->NewProtectedFixedArray(
-          static_cast<uint32_t>(protected_deopt_literals_.size()));
+          static_cast<uint32_t>(protected_deopt_literals_vector_.size()));
   DirectHandle<DeoptimizationLiteralArray> literals =
       local_isolate->factory()->NewDeoptimizationLiteralArray(
-          static_cast<uint32_t>(deopt_literals_.size()));
+          static_cast<uint32_t>(deopt_literals_vector_.size()));
   DirectHandle<TrustedPodArray<InliningPosition>> inlining_positions =
       TrustedPodArray<InliningPosition>::New(local_isolate,
                                              inlined_functions_size);
@@ -2110,22 +2141,14 @@
 
   Tagged<ProtectedDeoptimizationLiteralArray> raw_protected_literals =
       *protected_literals;
-  {
-    IdentityMap<int, base::DefaultAllocationPolicy>::IteratableScope iterate(
-        &protected_deopt_literals_);
-    for (auto it = iterate.begin(); it != iterate.end(); ++it) {
-      raw_protected_literals->set(*it.entry(),
-                                  TrustedCast<TrustedObject>(it.key()));
-    }
+  for (size_t i = 0; i < protected_deopt_literals_vector_.size(); ++i) {
+    raw_protected_literals->set(static_cast<int>(i),
+                                *protected_deopt_literals_vector_[i]);
   }
 
   Tagged<DeoptimizationLiteralArray> raw_literals = *literals;
-  {
-    IdentityMap<int, base::DefaultAllocationPolicy>::IteratableScope iterate(
-        &deopt_literals_);
-    for (auto it = iterate.begin(); it != iterate.end(); ++it) {
-      raw_literals->set(*it.entry(), it.key());
-    }
+  for (size_t i = 0; i < deopt_literals_vector_.size(); ++i) {
+    raw_literals->set(static_cast<int>(i), *deopt_literals_vector_[i]);
   }
 
   for (uint32_t i = 0; i < inlined_functions_size; i++) {
diff --git a/src/maglev/maglev-code-generator.h b/src/maglev/maglev-code-generator.h
index db7bca8..c0c3855 100644
--- a/src/maglev/maglev-code-generator.h
+++ b/src/maglev/maglev-code-generator.h

diff --git a/test/mjsunit/maglev/maglev-508811474.js b/test/mjsunit/maglev/maglev-508811474.js
new file mode 100644
index 0000000..16d240d
--- /dev/null
+++ b/test/mjsunit/maglev/maglev-508811474.js
@@ -0,0 +1,47 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+function makeSeqString(bigInt) {
+  return bigInt.toString();
+}
+
+let x = 2512n;
+let s0 = makeSeqString(x);
+let s1 = makeSeqString(x);
+let s2 = makeSeqString(x);
+let s3 = makeSeqString(x);
+
+%InternalizeString(s0);
+%InternalizeString(s1);
+%InternalizeString(s2);
+%InternalizeString(s3);
+
+function opt(x) {
+  let o = {};
+  o[s0] = -x;
+  o[s1] = -x;
+  o[s2] = -x;
+  o[s3] = -x;
+  return o;
+}
+
+%PrepareFunctionForOptimization(opt);
+opt(1234n);
+%OptimizeMaglevOnNextCall(opt, "concurrent");
+opt(1234n);
+
+// Use a randomized delay (1-30ms) to scan the timing spectrum.
+// This makes the test highly robust and machine-independent, as it has a
+// high chance of hitting the microscopic race window on any CPU.
+// This delay is intentionally randomized to maximize the chance of flakily
+// catching issues on different machines and CI buildbots.
+const delay = Math.floor(Math.random() * 30) + 1;
+print("Using random delay: " + delay + " ms");
+
+const start = performance.now();
+while (performance.now() - start < delay) {}
+
+gc({type: "major"});