[turboshaft] Fix Load Elimination bug when overwritting maps

DadaIsCrazy · V8 LUCI CQ · commit 66c754d2ddda · 2024-05-15T10:36:17.000Z
So far, LateLoadElimination was assuming that maps would never change after a AssumeMap. However, it can happen that a map is updated in-place with a regular Store (typically, because of a transitioning store). Bug: 42202729 Change-Id: I31e453324645fb91dcf870db12d49f0de64d0ad8 Fixed: 340663085 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5537918 Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#93912}
diff --git a/src/compiler/turboshaft/late-load-elimination-reducer.cc b/src/compiler/turboshaft/late-load-elimination-reducer.cc
@@ -356,16 +356,22 @@ void LateLoadEliminationAnalyzer::ProcessStore(OpIndex op_idx,
     return;
   }
 
-  OpIndex value = store.value();
-
   // Updating the known stored values.
   if (!invalidate_maybe_aliasing) memory_.Invalidate(store);
   memory_.Insert(store);
 
   // Updating aliases if the value stored was known as non-aliasing.
+  OpIndex value = store.value();
   if (non_aliasing_objects_.HasKeyFor(value)) {
     non_aliasing_objects_.Set(value, false);
   }
+
+  // If we just stored a map, invalidate the maps for this base.
+  if (store.offset == HeapObject::kMapOffset && !store.index().valid()) {
+    if (object_maps_.HasKeyFor(store.base())) {
+      object_maps_.Set(store.base(), MapMaskAndOr{});
+    }
+  }
 }
 
 // Since we only loosely keep track of what can or can't alias, we assume that
diff --git a/test/mjsunit/compiler/regress-340663085.js b/test/mjsunit/compiler/regress-340663085.js
@@ -0,0 +1,29 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(b) {
+  var v1 = {};
+  v1.prop0 = 1;
+
+  var v2 = {};
+  v2.prop0 = 1;
+
+  if (b) {
+    v2 = v1;
+  }
+
+  (function (v3) {
+    v3.prop0;
+    v2.a = 11;
+    v2.b = 12;
+    v3.x = 21;
+    v2.y = 22;
+  })(v1);
+
+  return v2.x;
+}
+
+assertEquals(undefined, f());
+assertEquals(21, f(true));
+assertEquals(21, f(true));
