## Affected Optimizations

Case ID: `R002 MUL-ONE`
Reduction / optimization:
  `Float64Mul(x, 1.0) -> x`.
Unsound FTZ assumption:
  Runtime multiplication materializes the subnormal under FTZ; deleting the multiply
  preserves raw bits.
V8 source locations:
  `v8/src/compiler/machine-operator-reducer.cc:651`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:633`.

Case ID: `R003 MUL-NEGONE`
Reduction / optimization:
  `Float64Mul(x, -1.0) -> Float64Neg(x)`.
Unsound FTZ assumption:
  Runtime multiply flushes before sign handling; optimized sign-bit negation preserves a raw
  subnormal payload.
V8 source locations:
  `v8/src/compiler/machine-operator-reducer.cc:655`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:641`.

Case ID: `R004 ADD-NEGZERO`
Reduction / optimization:
  `Float64Add(x, -0.0) -> x`.
Unsound FTZ assumption:
  Runtime addition under FTZ can materialize signed zero; identity reduction preserves the
  raw subnormal.
V8 source locations:
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:703`.

Case ID: `R007 MAGLEV-F64ARRAY-STORE-CONVERT`
Reduction / optimization:
  Maglev checked-number to Float64 typed-array store conversion.
Unsound FTZ assumption:
  Maglev's optimized typed-array store path materializes/preserves different raw bits than
  baseline/TurboFan under FTZ.
V8 source locations:
  `v8/src/maglev/maglev-graph-builder.cc:5474`; `v8/src/maglev/maglev-reducer-inl.h:2785`;
  `v8/src/maglev/maglev-reducer-inl.h:2789`; `v8/src/maglev/maglev-graph-optimizer.cc:2355`;
  `v8/src/maglev/maglev-ir.cc:2143`; `v8/src/maglev/maglev-ir.cc:7943`.

Case ID: `R008 MAGLEV-F64MINMAX-DAZ-TIE`
Reduction / optimization:
  Maglev `Float64Min` / `Float64Max` tie handling.
Unsound FTZ assumption:
  A negative denormal compares equal to zero under DAZ, but the tie path can still select
  raw sign/subnormal bits.
V8 source locations:
  `v8/src/maglev/maglev-reducer-inl.h:3884`; `v8/src/maglev/x64/maglev-ir-x64.cc:930`.

Case ID: `R012 SUB-POSZERO`
Reduction / optimization:
  `Float64Sub(x, +0.0) -> x`.
Unsound FTZ assumption:
  Runtime subtraction flushes a subnormal input; identity reduction preserves raw bits.
V8 source locations:
  `v8/src/compiler/machine-operator-reducer.cc:616`;
  `v8/src/compiler/machine-operator-reducer.cc:618`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:696`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:699`.

Case ID: `R022 MATH-ASIN-FTZ-ZERO`
Reduction / optimization:
  `Math.asin(x)` / `NumberAsin` lowering.
Unsound FTZ assumption:
  Libm-style identity result near zero is treated as raw IEEE subnormal instead of
  FTZ-materialized zero.
V8 source locations:
  `v8/src/compiler/js-call-reducer.cc:5586`;
  `v8/src/compiler/representation-change.cc:1818`;
  `v8/src/compiler/simplified-lowering.cc:3616`.

Case ID: `R023 MATH-ASINH-FTZ-ZERO`
Reduction / optimization:
  `Math.asinh(x)` / `NumberAsinh` lowering.
Unsound FTZ assumption:
  Same zero-materialization mismatch for near-zero subnormal results.
V8 source locations:
  `v8/src/compiler/js-call-reducer.cc:5588`;
  `v8/src/compiler/representation-change.cc:1819`;
  `v8/src/compiler/simplified-lowering.cc:3617`.

Case ID: `R024 MATH-ATAN-FTZ-ZERO`
Reduction / optimization:
  `Math.atan(x)` / `NumberAtan` lowering.
Unsound FTZ assumption:
  Same zero-materialization mismatch for near-zero subnormal results.
V8 source locations:
  `v8/src/compiler/js-call-reducer.cc:5590`;
  `v8/src/compiler/representation-change.cc:1821`;
  `v8/src/compiler/simplified-lowering.cc:3618`.

Case ID: `R025 MATH-ATANH-FTZ-ZERO`
Reduction / optimization:
  `Math.atanh(x)` / `NumberAtanh` lowering.
Unsound FTZ assumption:
  Same zero-materialization mismatch for near-zero subnormal results.
V8 source locations:
  `v8/src/compiler/js-call-reducer.cc:5592`;
  `v8/src/compiler/representation-change.cc:1823`;
  `v8/src/compiler/simplified-lowering.cc:3619`.

Case ID: `R033 MATH-SINH-FTZ-ZERO`
Reduction / optimization:
  `Math.sinh(x)` / `NumberSinh` lowering.
Unsound FTZ assumption:
  Same zero-materialization mismatch for near-zero subnormal results.
V8 source locations:
  `v8/src/compiler/js-call-reducer.cc:5624`;
  `v8/src/compiler/representation-change.cc:1860`;
  `v8/src/compiler/simplified-lowering.cc:3630`.

Case ID: `R048 FLOAT64DIV-NEGONE`
Reduction / optimization:
  `Float64Div(x, -1.0) -> Float64Neg(x)`.
Unsound FTZ assumption:
  Runtime division DAZes/flushes the input; optimized sign-bit negation preserves the
  subnormal payload.
V8 source locations:
  `v8/src/compiler/machine-operator-reducer.cc:691`;
  `v8/src/compiler/machine-operator-reducer.cc:694`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:654`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:658`.

Case ID: `R049 FLOAT64SUB-NEGZERO-TO-NEG`
Reduction / optimization:
  `Float64Sub(-0.0, x) -> Float64Neg(x)`.
Unsound FTZ assumption:
  Runtime subtraction DAZes the input and materializes signed zero; optimized negation
  preserves a raw subnormal.
V8 source locations:
  `v8/src/compiler/machine-operator-reducer.cc:642`;
  `v8/src/compiler/machine-operator-reducer.cc:644`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:738`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:748`.

Case ID: `R050 TYPEDARRAY-LOAD-STORE-SPECULATIVE-TONUMBER`
Reduction / optimization:
  `SpeculativeToNumber(Float32Array/Float64Array load)` removal before same-format
  typed-array stores.
Unsound FTZ assumption:
  Baseline materializes the typed-array load as a JS Number under FTZ; optimized copy/store
  keeps raw storage bits.
V8 source locations:
  `v8/src/compiler/js-native-context-specialization.cc:4329`;
  `v8/src/compiler/js-native-context-specialization.cc:4363`;
  `v8/src/compiler/js-native-context-specialization.cc:4374`;
  `v8/src/compiler/js-native-context-specialization.cc:4412`;
  `v8/src/compiler/typed-optimization.cc:744`; `v8/src/compiler/typed-optimization.cc:749`.

Case ID: `R052 CONTEXT-INT32-CHECKNUMBERFITSINT32`
Reduction / optimization:
  `CheckNumberFitsInt32` context-cell typing/lowering.
Unsound FTZ assumption:
  A subnormal JS Number is accepted through an int32-specialized path and later reused as
  raw Float64 rather than an FTZ-materialized zero.
V8 source locations:
  `v8/src/compiler/js-context-specialization.cc:455`;
  `v8/src/compiler/js-context-specialization.cc:458`;
  `v8/src/compiler/property-access-builder.cc:174`;
  `v8/src/compiler/typed-optimization.cc:292`; `v8/src/compiler/operation-typer.cc:1370`;
  `v8/src/compiler/simplified-lowering.cc:528`;
  `v8/src/compiler/simplified-lowering.cc:4119`;
  `v8/src/compiler/turboshaft/graph-builder.cc:962`;
  `v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h:517`.

Case ID: `R053 DATAVIEW-F64-OP-STORE-MATERIALIZATION`
Reduction / optimization:
  DataView `getFloat64` value flows through a Float64 operation and into `setFloat64`; the
  PoC uses the unary-neg operation variant.
Unsound FTZ assumption:
  Baseline materializes the operation result as `-0` under FTZ; optimized DataView lowering
  stores the raw negative-subnormal operation bits.
V8 source locations:
  `v8/src/compiler/js-call-reducer.cc:5512`; `v8/src/compiler/js-call-reducer.cc:5545`;
  `v8/src/compiler/js-call-reducer.cc:9321`; `v8/src/compiler/js-call-reducer.cc:9411`;
  `v8/src/compiler/js-call-reducer.cc:9467`; `v8/src/compiler/js-call-reducer.cc:9473`;
  `v8/src/compiler/turboshaft/dataview-lowering-reducer.h:58`;
  `v8/src/compiler/turboshaft/dataview-lowering-reducer.h:96`.

Case ID: `R054 TYPE-CONSUMER-GUARDED-VALUE-REUSE`
Reduction / optimization:
  `TypedOptimization` replaces `SpeculativeToNumber(Phi(...))` after FTZ-accepted
  type/predicate guards.
Unsound FTZ assumption:
  A guard that is true under FTZ zero semantics lets optimized code reuse the guarded raw
  Float64 value without an FTZ-equivalent materialization barrier.
V8 source locations:
  `v8/src/compiler/typed-optimization.cc:744`;
  `v8/src/compiler/simplified-lowering.cc:4480`;
  `v8/src/compiler/simplified-lowering.cc:3541`;
  `v8/src/compiler/simplified-lowering.cc:4585`;
  `v8/src/compiler/simplified-lowering.cc:4615`;
  `v8/src/compiler/turboshaft/graph-builder.cc:896`;
  `v8/src/compiler/turboshaft/graph-builder.cc:917`;
  `v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h:758`;
  `v8/src/compiler/js-call-reducer.cc:8736`; `v8/src/compiler/js-call-reducer.cc:8750`.

Case ID: `R060 MAGLEV-FLOAT64-MINMAX-SAME-INPUT-IDENTITY`
Reduction / optimization:
  Maglev `Float64Min(x, x)` / `Float64Max(x, x) -> x`.
Unsound FTZ assumption:
  Executing min/max under FTZ can materialize a subnormal as zero; same-input identity
  preserves raw bits.
V8 source locations:
  `v8/src/maglev/maglev-reducer-inl.h:3495`; `v8/src/maglev/maglev-reducer-inl.h:3503`;
  `v8/src/maglev/maglev-reducer-inl.h:3535`; `v8/src/maglev/maglev-reducer-inl.h:3543`;
  `v8/src/maglev/maglev-graph-optimizer.cc:3013`;
  `v8/src/maglev/maglev-graph-optimizer.cc:3020`; `v8/src/maglev/maglev-reducer-inl.h:3901`;
  `v8/src/maglev/maglev-reducer-inl.h:3878`.

Case ID: `R061 MAGLEV-TURBOLEV-FLOAT64-CONTEXT-CELL-MATERIALIZATION`
Reduction / optimization:
  `StoreFloat64ContextCell` / Float64 context-cell reuse.
Unsound FTZ assumption:
  Baseline context-cell materialization stores `-0`; optimized Maglev/Turbolev preserves raw
  negative subnormal bits.
V8 source locations:
  `v8/src/maglev/maglev-graph-builder.cc:2943`;
  `v8/src/maglev/maglev-graph-builder.cc:3010`; `v8/src/maglev/maglev-ir.h:9487`;
  `v8/src/maglev/maglev-ir.cc:4261`;
  `v8/src/compiler/turboshaft/turbolev-graph-builder.cc:3582`.

Case ID: `R063 MAGLEV-TURBOLEV-INLINED-OBJECT-HEAPNUMBER-MATERIALIZATION`
Reduction / optimization:
  Raw Float64Array load flows through an inlined object field before a Float64 observer. The
  PoC uses the loop-write object-field variant.
Unsound FTZ assumption:
  Baseline FTZ materializes the object-field value as zero; optimized object-field lowering
  can forward the raw negative subnormal through the object field and back into the
  JavaScript value passed to `Math.max(v)`.
V8 source locations:
  `v8/src/maglev/maglev-reducer-inl.h:700`; `v8/src/maglev/maglev-reducer-inl.h:794`;
  `v8/src/maglev/maglev-graph-builder.cc:4602`;
  `v8/src/maglev/maglev-graph-builder.cc:4817`; `v8/src/maglev/maglev-ir.h:6440`;
  `v8/src/maglev/maglev-ir.h:8660`; `v8/src/maglev/maglev-ir.h:9218`;
  `v8/src/compiler/turboshaft/turbolev-graph-builder.cc:3460`;
  `v8/src/compiler/turboshaft/turbolev-graph-builder.cc:3635`.

Case ID: `R064 MAGLEV-TURBOLEV-FUTURE-FLOAT64-PHI-UNTAGGING-MATERIALIZATION`
Reduction / optimization:
  Feature-gated Maglev Float64 phi untagging in the attached DCHECK command; matching
  Turbolev-future value-divergence evidence is part of the same source area.
Unsound FTZ assumption:
  Baseline FTZ materializes the phi-fed typed-array value as zero; Maglev-future phi
  untagging removes the tagged materialization boundary and keeps the raw negative subnormal
  that later reaches `Math.max(v)` and the `RangeType::New` DCHECK.
V8 source locations:
  `v8/src/maglev/maglev-compiler.cc:204`;
  `v8/src/maglev/maglev-phi-representation-selector.cc:609`;
  `v8/src/maglev/maglev-phi-representation-selector.cc:900`;
  `v8/src/maglev/maglev-phi-representation-selector.cc:1523`;
  `v8/src/compiler/turboshaft/turbolev-graph-builder.cc:5011`;
  `v8/src/compiler/turboshaft/turbolev-graph-builder.cc:5117`;
  `v8/src/compiler/turboshaft/turbolev-graph-builder.cc:6702`.

Case ID: `R069 WASM-FLOAT64-ROUND-CONSTANT-EXPRESSION`
Reduction / optimization:
  Wasm optimized-tier `f64.ceil` / `f64.floor` constant-expression folding.
Unsound FTZ assumption:
  Liftoff baseline executes rounding under FTZ; optimized Wasm folds as though the subnormal
  input remained an IEEE nonzero value. The negative `f64.floor` variant produces the
  value used by the `Math.max(v)` DCHECK PoC.
V8 source locations:
  `v8/src/wasm/wasm-opcodes.h:215`; `v8/src/wasm/wasm-opcodes.h:216`;
  `v8/src/wasm/turboshaft-graph-interface.cc:7704`;
  `v8/src/wasm/turboshaft-graph-interface.cc:7712`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:436`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:447`;
  `v8/src/compiler/turboshaft/machine-optimization-reducer.h:448`;
  `v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h:3729`;
  `v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h:3795`;
  `v8/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h:2245`;
  `v8/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h:2251`.

Case ID: `P002 UNARY-NEG`
Reduction / optimization:
  Unary `-x` lowered to Float64 sign-bit negation.
Unsound FTZ assumption:
  Runtime unary numeric materialization can observe signed zero under FTZ; optimized
  sign-bit operation preserves raw negative-subnormal bits.
V8 source locations:
  `v8/src/compiler/js-typed-lowering.cc:628`; `v8/src/compiler/js-typed-lowering.cc:632`;
  `v8/src/compiler/js-typed-lowering.cc:635`;
  `v8/src/compiler/turboshaft/graph-builder.cc:709`;
  `v8/src/maglev/maglev-graph-builder.cc:7631`;
  `v8/src/maglev/maglev-graph-builder.cc:1771`; `v8/src/maglev/x64/maglev-ir-x64.cc:856`.

Case ID: `P003 MAGLEV-TAGGED-F64-BOUNDARY`
Reduction / optimization:
  Maglev tagged-F64 call/return/value boundary materialization.
Unsound FTZ assumption:
  A raw untagged Float64 path and a tagged JS-value materialization boundary disagree for
  subnormal values under FTZ.
V8 source locations:
  `v8/src/maglev/maglev-reducer-inl.h:1172`; `v8/src/maglev/maglev-reducer-inl.h:1245`;
  `v8/src/maglev/maglev-reducer-inl.h:1254`; `v8/src/maglev/maglev-ir.cc:5602`.