Files
codex/codex-rs/code-mode-runtime
Kevin Liu aaa2cabfbc Disable V8 optimization paths affected by array sort bugs (#45760)
## Why

The pinned V8 can inline `Array.prototype.sort` with incompatible element kinds when a comparator mutates the array, allowing an object to be stored in an integer-elements array.

## What changed

Disable Maglev, Turbolev, and TurboFan array builtin inlining during code-mode runtime initialization until the V8 artifacts include the upstream fix.

## Testing

Add an integration regression test that requests top-tier and Maglev optimization, checks element kinds after comparator mutation, and verifies ordinary numeric sorting still returns `[1,2,3]`.

GitOrigin-RevId: cea38e920245d6a133a5263118dc664fb3e61838
2026-09-15 18:52:15 +00:00
..