[TurboFan] Add missing BigInt case in RepresentationChanger

Bug: chromium:1212583
Change-Id: I6cce7e419b108a0d30cf4d9d9bb0ba304fb0803e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922249Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74864}

src/compiler/representation-change.cc

@@ -797,12 +797,12 @@ Node* RepresentationChanger::MakeTruncatedInt32Constant(double value) {
   return jsgraph()->Int32Constant(DoubleToInt32(value));
 }
 
-Node* RepresentationChanger::InsertUnconditionalDeopt(Node* node,
-                                                      DeoptimizeReason reason) {
+Node* RepresentationChanger::InsertUnconditionalDeopt(
+    Node* node, DeoptimizeReason reason, const FeedbackSource& feedback) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   effect =
-      jsgraph()->graph()->NewNode(simplified()->CheckIf(reason),
+      jsgraph()->graph()->NewNode(simplified()->CheckIf(reason, feedback),
                                   jsgraph()->Int32Constant(0), effect, control);
   Node* unreachable = effect = jsgraph()->graph()->NewNode(
       jsgraph()->common()->Unreachable(), effect, control);
@@ -1119,8 +1119,8 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
     if (!CanBeTaggedPointer(output_rep) &&
         output_rep != MachineRepresentation::kWord64) {
       DCHECK(!output_type.Equals(Type::BigInt()));
-      Node* unreachable =
-          InsertUnconditionalDeopt(use_node, DeoptimizeReason::kNotABigInt);
+      Node* unreachable = InsertUnconditionalDeopt(
+          use_node, DeoptimizeReason::kNotABigInt, use_info.feedback());
       return jsgraph()->graph()->NewNode(
           jsgraph()->common()->DeadValue(MachineRepresentation::kWord64),
           unreachable);
@@ -1230,8 +1230,11 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
     if (output_type.Is(Type::BigInt())) {
       return node;
     } else {
-      return TypeError(node, output_rep, output_type,
-                       MachineRepresentation::kWord64);
+      Node* unreachable = InsertUnconditionalDeopt(
+          use_node, DeoptimizeReason::kNotABigInt, use_info.feedback());
+      return jsgraph()->graph()->NewNode(
+          jsgraph()->common()->DeadValue(MachineRepresentation::kWord64),
+          unreachable);
     }
   } else {
     return TypeError(node, output_rep, output_type,

src/compiler/representation-change.h

@@ -400,7 +400,8 @@ class V8_EXPORT_PRIVATE RepresentationChanger final {
                                     Node* use_node);
   Node* InsertConversion(Node* node, const Operator* op, Node* use_node);
   Node* InsertTruncateInt64ToInt32(Node* node);
-  Node* InsertUnconditionalDeopt(Node* node, DeoptimizeReason reason);
+  Node* InsertUnconditionalDeopt(Node* node, DeoptimizeReason reason,
+                                 const FeedbackSource& feedback = {});
 
   JSGraph* jsgraph() const { return jsgraph_; }
   Isolate* isolate() const;

test/mjsunit/regress/regress-1212583.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+async function f(a, b) {
+  let x = 0xfffffffff;
+  if (b == 5) {
+    x = 0xffffffff1;
+  }
+  let y = Math.max(0xffffffff2, x);
+  return BigInt.asUintN(1, y);
+};
+
+%PrepareFunctionForOptimization(f);
+assertThrowsAsync(f(1, 2), TypeError);
+%OptimizeFunctionOnNextCall(f);
+assertThrowsAsync(f(1, 2), TypeError);
+if (%Is64Bit()) assertUnoptimized(f);
+%PrepareFunctionForOptimization(f);
+assertThrowsAsync(f(1, 2), TypeError);
+%OptimizeFunctionOnNextCall(f);
+assertThrowsAsync(f(1, 2), TypeError);
+assertOptimized(f);