[compiler] Bug in GetOwnFastDataPropertyFromHeap representation handling

The bugfix yesterday missed a case (CL
https://chromium.googlesource.com/v8/v8/+/758816f4388704d82442769163b371c1b64aac86).

A better approach is to compute the ideal representation of the
value, then check if it can be in-place changed to the
recorded representation.

Bug: chromium:1226988, v8:7790
Change-Id: I90e58b8efb83892c033693a1a0f946b3059a330c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3011162
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75615}

src/compiler/heap-refs.cc

@@ -589,9 +589,13 @@ base::Optional<ObjectRef> GetOwnFastDataPropertyFromHeap(
     // Since we don't have a guarantee that {constant} is the correct value of
     // the property, we use the expected {representation} to weed out the most
     // egregious types of wrong values.
-    if (!constant->FitsRepresentation(representation)) {
-      TRACE_BROKER_MISSING(
-          broker, "Mismatch between representation and value in " << holder);
+    Representation constant_representation =
+        constant->OptimalRepresentation(broker->isolate());
+    if (!constant_representation.CanBeInPlaceChangedTo(representation)) {
+      TRACE_BROKER_MISSING(broker,
+                           "Mismatched representation for "
+                               << holder << ". Expected " << representation
+                               << ", have: " << constant_representation);
       return {};
     }
   }

src/objects/property-details.h

@@ -514,6 +514,8 @@ inline PropertyConstness GeneralizeConstness(PropertyConstness a,
   return a == PropertyConstness::kMutable ? PropertyConstness::kMutable : b;
 }
 
+V8_EXPORT_PRIVATE std::ostream& operator<<(
+    std::ostream& os, const Representation& representation);
 V8_EXPORT_PRIVATE std::ostream& operator<<(
     std::ostream& os, const PropertyAttributes& attributes);
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,

src/objects/property.cc

@@ -14,6 +14,27 @@
 namespace v8 {
 namespace internal {
 
+std::ostream& operator<<(std::ostream& os,
+                         const Representation& representation) {
+  switch (representation.kind()) {
+    case Representation::kNone:
+      return os << "none";
+    case Representation::kSmi:
+      return os << "smi";
+    case Representation::kDouble:
+      return os << "double";
+    case Representation::kHeapObject:
+      return os << "heap-object";
+    case Representation::kTagged:
+      return os << "tagged";
+    case Representation::kWasmValue:
+      return os << "wasm-value";
+    case Representation::kNumRepresentations:
+      UNREACHABLE();
+  }
+  UNREACHABLE();
+}
+
 std::ostream& operator<<(std::ostream& os,
                          const PropertyAttributes& attributes) {
   os << "[";

test/mjsunit/compiler/regress-1226988.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turboprop
+var __v_0 = {
+  x: 2,
+  y: 1
+};
+function __f_0() {}
+function __f_1() {
+  for (var __v_1 = 0; __v_1 < 100000; __v_1++) {
+    var __v_2 = __v_0.x + __f_0();
+  }
+  var __v_3 = [{
+    x: 2.5,
+    y: 1
+  }];
+}
+__f_1();
+__f_1();