[turbofan] No speculative BigInt operations on 32 bit architectures

Bug: chromium:1254191, v8:9407
Change-Id: Ieb22063dad1ea8dfde359662d0330e689b6b2e05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193547Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77177}

src/compiler/js-type-hint-lowering.cc

@@ -153,6 +153,7 @@ class JSSpeculativeBinopBuilder final {
   }
 
   const Operator* SpeculativeBigIntOp(BigIntOperationHint hint) {
+    DCHECK(jsgraph()->machine()->Is64());
     switch (op_->opcode()) {
       case IrOpcode::kJSAdd:
         return simplified()->SpeculativeBigIntAdd(hint);
@@ -206,6 +207,7 @@ class JSSpeculativeBinopBuilder final {
   }
 
   Node* TryBuildBigIntBinop() {
+    DCHECK(jsgraph()->machine()->Is64());
     BigIntOperationHint hint;
     if (GetBinaryBigIntOperationHint(&hint)) {
       const Operator* op = SpeculativeBigIntOp(hint);
@@ -321,12 +323,15 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceUnaryOperation(
           jsgraph()->SmiConstant(-1), effect, control, slot);
       node = b.TryBuildNumberBinop();
       if (!node) {
+        if (jsgraph()->machine()->Is64()) {
           if (GetBinaryOperationHint(slot) == BinaryOperationHint::kBigInt) {
-          const Operator* op = jsgraph()->simplified()->SpeculativeBigIntNegate(
+            const Operator* op =
+                jsgraph()->simplified()->SpeculativeBigIntNegate(
                     BigIntOperationHint::kBigInt);
             node = jsgraph()->graph()->NewNode(op, operand, effect, control);
           }
         }
+      }
       break;
     }
     default:
@@ -403,10 +408,12 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
       }
       if (op->opcode() == IrOpcode::kJSAdd ||
           op->opcode() == IrOpcode::kJSSubtract) {
+        if (jsgraph()->machine()->Is64()) {
           if (Node* node = b.TryBuildBigIntBinop()) {
             return LoweringResult::SideEffectFree(node, node, control);
           }
         }
+      }
       break;
     }
     default:

test/mjsunit/compiler/bigint-add-no-deopt-loop.js

@@ -24,7 +24,9 @@ assertEquals(testAdd(6n, 2n), 8n);
 assertOptimized(testAdd);
 
 assertThrows(() => testAdd(big, big), RangeError);
-assertUnoptimized(testAdd);
+if (%Is64Bit()) {
+  assertUnoptimized(testAdd);
+}
 
 testAdd(30n, -50n);
 testAdd(23n, 5n);

test/mjsunit/regress/regress-1016450.js

@@ -26,4 +26,6 @@ assertEquals(17n, f(2n));
 assertEquals(16n, f(1n));
 assertOptimized(f);
 assertEquals(15n, f(0));
-assertUnoptimized(f);
+if (%Is64Bit()) {
+  assertUnoptimized(f);
+}

test/mjsunit/regress/regress-1073440.js

@@ -25,7 +25,9 @@ assertEquals(foo(1), 0);
 assertOptimized(foo);
 %PrepareFunctionForOptimization(foo);
 assertEquals(foo(2), 1);
-assertUnoptimized(foo);
+if (%Is64Bit()) {
+  assertUnoptimized(foo);
+}
 // Check that we learned something and do not loop deoptimizations.
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(foo(1), 0);

test/mjsunit/regress/regress-1254191.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function f(a) {
+  let x = -1n;
+  if (!a) {
+    x = a;
+  }
+  x|0;
+}
+
+%PrepareFunctionForOptimization(f);
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(true), TypeError);

test/mjsunit/regress/regress-9441.js

@@ -14,7 +14,9 @@ assertEquals(-1n, foo(1n, 2n));
 assertEquals(1n, foo(2n, 1n));
 assertOptimized(foo);
 assertThrows(() => foo(2n, undefined));
-assertUnoptimized(foo);
+if (%Is64Bit()) {
+    assertUnoptimized(foo);
+}
 %PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(-1n, foo(1n, 2n));