[maglev] Two Float64 fixes

Fix requesting an Int32 from a tagged value that was already converted
to Float64 (because it was on one side of Number feedback but was itself
a Smi), and DoubleRegister locations in deopts.

Bug: v8:7700
Change-Id: I01615a6c520c9e086f3544c2656aa04bf3fc1eaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3660254Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80698}

src/maglev/maglev-code-generator.cc

@@ -529,7 +529,7 @@ class MaglevCodeGeneratorImpl final {
       const compiler::AllocatedOperand& operand =
           compiler::AllocatedOperand::cast(input_location.operand());
       ValueRepresentation repr = value->properties().value_representation();
-      if (operand.IsRegister()) {
+      if (operand.IsAnyRegister()) {
         EmitDeoptStoreRegister(operand, repr);
       } else {
         EmitDeoptStoreStackSlot(operand, repr);

src/maglev/maglev-graph-builder.h

@@ -366,7 +366,16 @@ class MaglevGraphBuilder {
       case ValueRepresentation::kInt32:
         return value;
       case ValueRepresentation::kFloat64:
-        // We should not be able to request an Int32 from a Float64 input.
+        // We should not be able to request an Int32 from a Float64 input,
+        // unless it's an unboxing of a tagged value or a conversion from int32.
+        if (value->Is<CheckedFloat64Unbox>()) {
+          // TODO(leszeks): Maybe convert the CheckedFloat64Unbox to
+          // ChangeInt32ToFloat64 with this CheckedSmiUntag as the input.
+          return AddNewConversionNode<CheckedSmiUntag>(reg,
+                                                       value->input(0).node());
+        } else if (value->Is<ChangeInt32ToFloat64>()) {
+          return value->input(0).node();
+        }
         UNREACHABLE();
     }
     UNREACHABLE();