Fixes lost TypeError for BigInts

The optimized code for String.charCodeAt(BigInt.asUintN(64, 10n)) did
not throw a TypeError due to how lowering of CheckBounds triggers
RepresentationChanger.

Bug: chromium:1038573
Change-Id: Ie0f9ca95de5af5fd3701841ab169e11ccc77216c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1986003
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65632}

src/compiler/representation-change.cc

@@ -159,6 +159,15 @@ Node* RepresentationChanger::GetRepresentationFor(
     return TypeError(node, output_rep, output_type, use_info.representation());
   }
 
+  // Rematerialize any truncated BigInt if user is not expecting a BigInt.
+  if (output_type.Is(Type::BigInt()) &&
+      output_rep == MachineRepresentation::kWord64 &&
+      use_info.type_check() != TypeCheckKind::kBigInt) {
+    node =
+        InsertConversion(node, simplified()->ChangeUint64ToBigInt(), use_node);
+    output_rep = MachineRepresentation::kTaggedPointer;
+  }
+
   // Handle the no-op shortcuts when no checking is necessary.
   if (use_info.type_check() == TypeCheckKind::kNone ||
       output_rep != MachineRepresentation::kWord32) {
@@ -175,15 +184,6 @@ Node* RepresentationChanger::GetRepresentationFor(
     }
   }
 
-  // Rematerialize any truncated BigInt if user is not expecting a BigInt.
-  if (output_type.Is(Type::BigInt()) &&
-      output_rep == MachineRepresentation::kWord64 &&
-      use_info.type_check() != TypeCheckKind::kBigInt) {
-    node =
-        InsertConversion(node, simplified()->ChangeUint64ToBigInt(), use_node);
-    output_rep = MachineRepresentation::kTaggedPointer;
-  }
-
   switch (use_info.representation()) {
     case MachineRepresentation::kTaggedSigned:
       DCHECK(use_info.type_check() == TypeCheckKind::kNone ||

test/mjsunit/regress/regress-1038573.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+(function(){
+  function f(x) {
+    return "abcd".charCodeAt(BigInt.asUintN(64, 10n));
+  }
+
+  %PrepareFunctionForOptimization(f);
+  try { f(1); } catch(e) {}
+  try { f(1); } catch(e) {}
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(f, TypeError);
+})();
+
+
+(function(){
+  function f(x) {
+    return "abcd".charCodeAt(BigInt.asUintN(2, 10n));
+  }
+
+  %PrepareFunctionForOptimization(f);
+  try { f(1); } catch(e) {}
+  try { f(1); } catch(e) {}
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(f, TypeError);
+})();