From f7a328b4cded8663090c2a6b1437f587ef4109d0 Mon Sep 17 00:00:00 2001
From: Leszek Swirski <leszeks@chromium.org>
Date: Fri, 14 Oct 2022 11:27:20 +0200
Subject: [PATCH] [maglev] Fix OOB element load deopt loop

Only emit the deopting bounds check for element loads that have
STANDARD_LOAD feedback.

Bug: v8:7700
Change-Id: I80a2d2319379e0560e4d1e4defdec663bdcbfb0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952135
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83709}
---
 src/maglev/maglev-graph-builder.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc
index 243d62d0b5..cab34d4772 100644
--- a/src/maglev/maglev-graph-builder.cc
+++ b/src/maglev/maglev-graph-builder.cc
@@ -1473,6 +1473,12 @@ bool MaglevGraphBuilder::TryBuildElementAccess(
     return false;
   }
 
+  // TODO(leszeks): Add non-deopting bounds check (has to support undefined
+  // values).
+  if (feedback.keyed_mode().load_mode() != STANDARD_LOAD) {
+    return false;
+  }
+
   // TODO(victorgomes): Add fast path for loading from HeapConstant.
   // TODO(victorgomes): Add fast path for loading from String.