Zero-initialize proxy padding

joyeecheung · V8 LUCI CQ · commit edeb0a4fa181 · 2026-03-16T10:48:02.000-07:00
So that snapshots with proxies can be reproducible. Refs: nodejs/node#61898 Change-Id: I01fac5e18c73cd482a1ae63750dbadf42a12e08a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7666243 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105830}
diff --git a/src/builtins/builtins-proxy-gen.cc b/src/builtins/builtins-proxy-gen.cc
@@ -63,6 +63,10 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kTargetOffset, target);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kHandlerOffset, handler);
   StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kFlagsOffset, flags);
+#if TAGGED_SIZE_8_BYTES
+  StoreObjectFieldNoWriteBarrier(proxy, JSProxy::kPaddingOffset,
+                                 Int32Constant(0));
+#endif
 
   return CAST(proxy);
 }
diff --git a/src/heap/factory.cc b/src/heap/factory.cc
@@ -4041,6 +4041,9 @@ Handle<JSProxy> Factory::NewJSProxy(DirectHandle<JSReceiver> target,
   result->set_target(*target, SKIP_WRITE_BARRIER);
   result->set_handler(*handler, SKIP_WRITE_BARRIER);
   result->set_flags(JSProxy::IsRevocableBit::encode(revocable));
+#if TAGGED_SIZE_8_BYTES
+  result->set_padding(0);
+#endif
   return handle(result, isolate());
 }
 

Original file line number	Diff line number	Diff line change
`@@ -4041,6 +4041,9 @@ Handle<JSProxy> Factory::NewJSProxy(DirectHandle<JSReceiver> target,`
`4041`	`4041`	`result->set_target(*target, SKIP_WRITE_BARRIER);`
`4042`	`4042`	`result->set_handler(*handler, SKIP_WRITE_BARRIER);`
`4043`	`4043`	`result->set_flags(JSProxy::IsRevocableBit::encode(revocable));`
	`4044`	`+#if TAGGED_SIZE_8_BYTES`
	`4045`	`+ result->set_padding(0);`
	`4046`	`+#endif`
`4044`	`4047`	`return handle(result, isolate());`
`4045`	`4048`	`}`
`4046`	`4049`