[maglev] Deopt on binops/cmpops with no feedback

Emit an unconditional deopt if a BinOp/CompareOp has insufficient
feedback, rather than emitting a generic op.

Bug: v8:7700
Change-Id: I3e47d82716a8fe7832cc179e949d689b9aef14e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3867731
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82885}

src/maglev/maglev-graph-builder.cc

@@ -357,6 +357,10 @@ template <Operation kOperation>
 void MaglevGraphBuilder::VisitBinaryOperation() {
   FeedbackNexus nexus = FeedbackNexusForOperand(1);
   switch (nexus.GetBinaryOperationFeedback()) {
+    case BinaryOperationHint::kNone:
+      EmitUnconditionalDeopt(
+          DeoptimizeReason::kInsufficientTypeFeedbackForBinaryOperation);
+      return;
     case BinaryOperationHint::kSignedSmall:
       if (BinaryOperationHasInt32FastPath<kOperation>()) {
         BuildInt32BinaryOperationNode<kOperation>();
@@ -387,6 +391,10 @@ template <Operation kOperation>
 void MaglevGraphBuilder::VisitBinarySmiOperation() {
   FeedbackNexus nexus = FeedbackNexusForOperand(1);
   switch (nexus.GetBinaryOperationFeedback()) {
+    case BinaryOperationHint::kNone:
+      EmitUnconditionalDeopt(
+          DeoptimizeReason::kInsufficientTypeFeedbackForBinaryOperation);
+      return;
     case BinaryOperationHint::kSignedSmall:
       if (BinaryOperationHasInt32FastPath<kOperation>()) {
         BuildInt32BinarySmiOperationNode<kOperation>();
@@ -465,6 +473,10 @@ template <Operation kOperation>
 void MaglevGraphBuilder::VisitCompareOperation() {
   FeedbackNexus nexus = FeedbackNexusForOperand(1);
   switch (nexus.GetCompareOperationFeedback()) {
+    case CompareOperationHint::kNone:
+      EmitUnconditionalDeopt(
+          DeoptimizeReason::kInsufficientTypeFeedbackForCompareOperation);
+      return;
     case CompareOperationHint::kSignedSmall:
       if (BinaryOperationHasInt32FastPath<kOperation>()) {
         ValueNode *left, *right;