[deoptimizer] Relax a CHECK

The condition was too strong since we never store Smis into
{previously_materialized_objects}.

Bug: chromium:1094132
Change-Id: I680eb7f175f12d3c44882fd8a9eff0d062eda55f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241517
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68317}

src/deoptimizer/deoptimizer.cc

@@ -3983,24 +3983,30 @@ void TranslatedState::StoreMaterializedValuesAndDeopt(JavaScriptFrame* frame) {
 
     CHECK(value_info->IsMaterializedObject());
 
-    // Skip duplicate objects (i.e., those that point to some
-    // other object id).
+    // Skip duplicate objects (i.e., those that point to some other object id).
     if (value_info->object_index() != i) continue;
 
+    Handle<Object> previous_value(previously_materialized_objects->get(i),
+                                  isolate_);
     Handle<Object> value(value_info->GetRawValue(), isolate_);
 
-    if (!value.is_identical_to(marker)) {
-      if (previously_materialized_objects->get(i) == *marker) {
+    if (value.is_identical_to(marker)) {
+      DCHECK_EQ(*previous_value, *marker);
+    } else {
+      if (*previous_value == *marker) {
         if (value->IsSmi()) {
           value = isolate()->factory()->NewHeapNumber(value->Number());
         }
         previously_materialized_objects->set(i, *value);
         value_changed = true;
       } else {
-        CHECK(previously_materialized_objects->get(i) == *value);
+        CHECK(*previous_value == *value ||
+              (previous_value->IsHeapNumber() && value->IsSmi() &&
+               previous_value->Number() == value->Number()));
       }
     }
   }
+
   if (new_store && value_changed) {
     materialized_store->Set(stack_frame_pointer_,
                             previously_materialized_objects);

test/mjsunit/compiler/regress-1094132.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function prettyPrinted() {}
+
+function formatFailureText() {
+  if (expectedText.length <= 40 && foundText.length <= 40) {
+    message += ": expected <" + expectedText + "> found <" + foundText + ">";
+    message += ":\nexpected:\n" + expectedText + "\nfound:\n" + foundText;
+  }
+}
+
+function fail(expectedText, found, name_opt) {
+  formatFailureText(expectedText, found, name_opt);
+  if (!a[aProps[i]][aProps[i]]) { }
+}
+
+function deepEquals(a, b) {
+  if (a === 0) return 1 / a === 1 / b;
+  if (typeof a !== typeof a) return false;
+  if (typeof a !== "object" && typeof a !== "function") return false;
+  if (objectClass !== classOf()) return false;
+  if (objectClass === "RegExp") { }
+}
+
+function assertEquals() {
+  if (!deepEquals()) {
+    fail(prettyPrinted(), undefined, undefined);
+  }
+}
+
+({y: {}, x: 0.42});
+
+function gaga() {
+  return {gx: bar.arguments[0], hx: baz.arguments[0]};
+}
+
+function baz() {
+  return gaga();
+}
+
+function bar(obj) {
+  return baz(obj.y);
+}
+
+function foo() {
+  bar({y: {}, x: 42});
+  try { assertEquals() } catch (e) {}
+  try { assertEquals() } catch (e) {}
+  assertEquals();
+}
+
+%PrepareFunctionForOptimization(prettyPrinted);
+%PrepareFunctionForOptimization(formatFailureText);
+%PrepareFunctionForOptimization(fail);
+%PrepareFunctionForOptimization(deepEquals);
+%PrepareFunctionForOptimization(assertEquals);
+%PrepareFunctionForOptimization(gaga);
+%PrepareFunctionForOptimization(baz);
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(foo);
+try { foo() } catch (e) {}
+%OptimizeFunctionOnNextCall(foo);
+try { foo() } catch (e) {}
+%PrepareFunctionForOptimization(prettyPrinted);
+%PrepareFunctionForOptimization(formatFailureText);
+%PrepareFunctionForOptimization(fail);
+%PrepareFunctionForOptimization(deepEquals);
+%PrepareFunctionForOptimization(assertEquals);
+%PrepareFunctionForOptimization(gaga);
+%PrepareFunctionForOptimization(baz);
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+try { foo() } catch (e) {}