[turbofan] Make BigInt operations kNoThrow again

A previous CL removed the kNoThrow flags from both
SpeculativeBigIntAdd and SpeculativeBigIntSubtract. This introduced a
bug, because the JSTypeHintLowering phase, where these operators are
introduced during inlining, does not support the generation of throwing
operators.

Since these operators always deoptimize in case of an error, instead of
throwing the exception directly, it is safe to mark them as kNoThrow.

Bug: chromium:1091461
No-Try: true
No-Tree-Checks: true
Change-Id: I551616b0c462647574e5af8824d9ed7b3252659d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235113
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68254}

src/compiler/js-type-hint-lowering.h

@@ -72,6 +72,7 @@ class JSTypeHintLowering {
                                          Node* control) {
       DCHECK_NOT_NULL(effect);
       DCHECK_NOT_NULL(control);
+      DCHECK(value->op()->HasProperty(Operator::kNoThrow));
       return LoweringResult(LoweringResultKind::kSideEffectFree, value, effect,
                             control);
     }

src/compiler/simplified-operator.cc

@@ -1507,15 +1507,16 @@ const Operator* SimplifiedOperatorBuilder::CheckFloat64Hole(
 const Operator* SimplifiedOperatorBuilder::SpeculativeBigIntAdd(
     BigIntOperationHint hint) {
   return new (zone()) Operator1<BigIntOperationHint>(
-      IrOpcode::kSpeculativeBigIntAdd, Operator::kFoldable,
+      IrOpcode::kSpeculativeBigIntAdd, Operator::kFoldable | Operator::kNoThrow,
       "SpeculativeBigIntAdd", 2, 1, 1, 1, 1, 0, hint);
 }
 
 const Operator* SimplifiedOperatorBuilder::SpeculativeBigIntSubtract(
     BigIntOperationHint hint) {
   return new (zone()) Operator1<BigIntOperationHint>(
-      IrOpcode::kSpeculativeBigIntSubtract, Operator::kFoldable,
-      "SpeculativeBigIntSubtract", 2, 1, 1, 1, 1, 0, hint);
+      IrOpcode::kSpeculativeBigIntSubtract,
+      Operator::kFoldable | Operator::kNoThrow, "SpeculativeBigIntSubtract", 2,
+      1, 1, 1, 1, 0, hint);
 }
 
 const Operator* SimplifiedOperatorBuilder::SpeculativeBigIntNegate(

test/mjsunit/regress/regress-1091461.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a, b) {
+  let x = a + b;
+}
+function test() {
+  try {
+    foo(1n, 1n);
+  } catch (e) {}
+}
+
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(test);
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();