From f478546b185648816b4663e4ae486ca580a90aff Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <syg@chromium.org>
Date: Mon, 2 May 2022 19:09:01 +0000
Subject: [PATCH] Revert "[Temporal] Fix Calendar.prototype.fields CSA"

This reverts commit 89600314321296672377c91ed8f9fa50c2ecf4a9.

Reason for revert: UBSAN errors in GC tests
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/21069/overview

Original change's description:
> [Temporal] Fix Calendar.prototype.fields CSA
>
> Use LoadAndUntagToWord32ObjectField instead of LoadObjectField<Uint32T>
> to load the flag since it is defined as
>  flags: SmiTagged<JSTemporalCalendarFlags>;
>
> Otherwise LoadObjectField<Uint32T> will load the zero part when
> v8_enable_pointer_compression = false
>
> Add unit tests to intl (because the problem only show up on calendar
> other than non iso8601.
>
> Cq-Include-Trybots: luci.v8.try:v8_linux_mipsel_compile_rel,v8_linux_mips64el_compile_rel
>
>
> Bug: v8:12848
> Change-Id: I44b685af99dc9820dfa228447e2b42ae0a82464c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3617388
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80314}

Bug: v8:12848
Change-Id: I3a8af8acbbdfc5d0f5386f2a9d50d62b9f422fb8
Cq-Include-Trybots: luci.v8.try:v8_linux_mipsel_compile_rel,v8_linux_mips64el_compile_rel
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3620837
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80317}
---
 src/builtins/builtins-temporal-gen.cc |  4 ++--
 test/intl/temporal/calendar/fields.js | 24 ------------------------
 2 files changed, 2 insertions(+), 26 deletions(-)
 delete mode 100644 test/intl/temporal/calendar/fields.js

diff --git a/src/builtins/builtins-temporal-gen.cc b/src/builtins/builtins-temporal-gen.cc
index 98c947ab7e..eaa2eade1c 100644
--- a/src/builtins/builtins-temporal-gen.cc
+++ b/src/builtins/builtins-temporal-gen.cc
@@ -106,8 +106,8 @@ TNode<JSArray> TemporalBuiltinsAssembler::CalendarFieldsArrayFromIterable(
     // Notice this spec text is in the Chapter 15 of the #sup part not #sec
     // part.
     // 7. If calendar.[[Identifier]] is "iso8601", then
-    const TNode<Int32T> flags = LoadAndUntagToWord32ObjectField(
-        calendar, JSTemporalCalendar::kFlagsOffset);
+    const TNode<Uint32T> flags =
+        LoadObjectField<Uint32T>(calendar, JSTemporalCalendar::kFlagsOffset);
     // calendar is "iso8601" while the index of calendar is 0
     const TNode<IntPtrT> index = Signed(
         DecodeWordFromWord32<JSTemporalCalendar::CalendarIndexBits>(flags));
diff --git a/test/intl/temporal/calendar/fields.js b/test/intl/temporal/calendar/fields.js
deleted file mode 100644
index e3a4c7d746..0000000000
--- a/test/intl/temporal/calendar/fields.js
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2022 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-//
-// Flags: --harmony-temporal
-
-assertEquals(["year"],
-    (new Temporal.Calendar("iso8601")).fields(["year"]));
-
-assertEquals(["month", "year"],
-    (new Temporal.Calendar("iso8601")).fields(["month", "year"]));
-
-assertEquals(["year", "era", "eraYear"],
-    (new Temporal.Calendar("japanese")).fields(["year"]));
-
-assertEquals(["month", "year", "era", "eraYear"],
-    (new Temporal.Calendar("japanese")).fields(["month", "year"]));
-
-assertEquals(["year", "era", "eraYear"],
-    (new Temporal.Calendar("roc")).fields(["year"]));
-
-assertThrows(
-    () => (new Temporal.Calendar("japanese")).fields(["hello", "world"]),
-    RangeError);