[turbofan] Fix a rare false positive in SLVerifier

Bug: chromium:1309769, v8:12619
Change-Id: I880c7326f2ec91f1aa985d6b7ed67f8f5afc074b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548897
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79608}

src/compiler/simplified-lowering.cc

@@ -2931,7 +2931,9 @@ class RepresentationSelector {
             is_asuintn ? Type::UnsignedBigInt64() : Type::SignedBigInt64());
         if (lower<T>()) {
           if (p.bits() == 0) {
-            DeferReplacement(node, jsgraph_->ZeroConstant());
+            DeferReplacement(
+                node, InsertTypeOverrideForVerifier(Type::UnsignedBigInt63(),
+                                                    jsgraph_->ZeroConstant()));
           } else if (p.bits() == 64) {
             DeferReplacement(node, node->InputAt(0));
           } else {

test/mjsunit/regress/regress-1309769.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a, b, c) {
+  let x = BigInt.asUintN(0, a + b);
+  return BigInt.asUintN(64, x + c);
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(1n, foo(9n, 2n, 1n));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1n, foo(9n, 2n, 1n));