• Nico Hartmann's avatar
    [turbofan] Push BigInt truncation over addition and heap constants · 99df710d
    Nico Hartmann authored
    This change implements lowering of speculative BigInt addition as well as
    BigInt heap constants to corresponding int64 versions, if they are used in
    a context where the result is truncated to the least significant 64 bits
    (e.g. using asUintN). The JSHeapBroker is extended to provide access to the
    BigInt's least significant digit during concurrent compilation. The BigInt
    context (required to introduce correct conversions) is recognized in the
    RepresentationChanger by either the output type propagated downward or the
    TypeCheckKind propagated upward. This is necessary, because the TypeCheckKind
    may only be set by nodes that may potentially deopt (and sit in the effect
    chain). This is the case for SpeculativeBigIntAdd, but not for BigIntAsUintN.
    
    This CL contains a simple fix to prevent int64-lowered BigInts to flow into
    state values as the deoptimizer cannot handle them yet. A more sophisticated
    solution to allow the deoptimizer to materialize truncated BigInts will be
    added in a following CL.
    
    Bug: v8:9407
    Change-Id: I96a293e9077962f53e5f199857644f004e3ae56e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1684183
    Commit-Queue: Nico Hartmann <nicohartmann@google.com>
    Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
    Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
    Reviewed-by: 's avatarMaya Lekova <mslekova@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#62665}
    99df710d
bigint-negate.js 556 Bytes