From 41d0351e57bb9282c5b2239e28865ac590c87e9d Mon Sep 17 00:00:00 2001
From: Darius Mercadier <dmercadier@chromium.org>
Date: Tue, 29 Sep 2026 13:00:10 +0200
Subject: [PATCH] [turbolev] Preserve phi type during loop peeling

Fixed: 567177599
Change-Id: I43e124b40eab9861516cc7247a9f3bd86b23d81b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8486007
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#110155}
---
diff --git a/src/maglev/maglev-ir.h b/src/maglev/maglev-ir.h
index 90b50ef..ef6e647 100644
--- a/src/maglev/maglev-ir.h
+++ b/src/maglev/maglev-ir.h
@@ -10129,10 +10129,14 @@
   // TODO(jgruber): More intuitive constructors, if possible.
   Phi(uint64_t bitfield, MergePointInterpreterFrameState* merge_state,
       interpreter::Register owner)
+      : Phi(bitfield, merge_state, owner, NodeType::kUnknown) {}
+
+  Phi(uint64_t bitfield, MergePointInterpreterFrameState* merge_state,
+      interpreter::Register owner, NodeType type)
       : Base(bitfield),
         owner_(owner),
         merge_state_(merge_state),
-        type_(NodeType::kUnknown),
+        type_(type),
         post_loop_type_(NodeType::kUnknown) {
     DCHECK_NOT_NULL(merge_state);
   }
diff --git a/src/maglev/maglev-loop-peeler.cc b/src/maglev/maglev-loop-peeler.cc
index 7c5bd34..12edbec 100644
--- a/src/maglev/maglev-loop-peeler.cc
+++ b/src/maglev/maglev-loop-peeler.cc
@@ -711,8 +711,8 @@
       for (Phi* phi : *block->phis()) {
         DCHECK(!phi->is_exception_phi());
         int input_count = phi->input_count();
-        Phi* clone_phi = NodeBase::New<Phi>(zone(), input_count,
-                                            dst_block->state(), phi->owner());
+        Phi* clone_phi = NodeBase::New<Phi>(
+            zone(), input_count, dst_block->state(), phi->owner(), phi->type());
         for (int i = 0; i < input_count; ++i) {
           clone_phi->set_input(i, Remap(ctx.value_map, phi->input(i).node()));
         }
@@ -876,7 +876,7 @@
       // what CloneBodySubgraph seeds into value_map for the header phis.
       DCHECK_EQ(Remap(ctx.value_map, phi), phi->forward_edge());
       Phi* pem_phi = NodeBase::New<Phi>(zone(), 2 * exit_edge_count, pem_state,
-                                        phi->owner());
+                                        phi->owner(), phi->type());
       for (int idx = 0; idx < exit_edge_count; ++idx) {
         pem_phi->set_input(2 * idx, phi->forward_edge());
         pem_phi->set_input(2 * idx + 1, phi);
@@ -1252,8 +1252,9 @@
 
   // Create a new loop phi for each header phi and collect the rewires.
   for (auto& [old_phi, pem_phi] : ctx.header_phi_to_pem_phi) {
-    Phi* loop_phi = NodeBase::New<Phi>(
-        zone(), kPhiInputCount, old_phi->merge_state(), old_phi->owner());
+    Phi* loop_phi =
+        NodeBase::New<Phi>(zone(), kPhiInputCount, old_phi->merge_state(),
+                           old_phi->owner(), old_phi->type());
     // Slot 0 takes the peeled clone of the back-edge value (via value_map);
     // slot 1 the original back-edge value. If the back-edge value is itself a
     // header phi (a recursive loop phi), slot 1 still points at the old phi
diff --git a/test/mjsunit/turbolev/regress-567177599.js b/test/mjsunit/turbolev/regress-567177599.js
new file mode 100644
index 0000000..9ed14c0
--- /dev/null
+++ b/test/mjsunit/turbolev/regress-567177599.js
@@ -0,0 +1,36 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbolev
+
+var loop_value = 1.2;
+var exit_value = 2.5;
+loop_value = 1.4;
+exit_value = 1.5;
+
+const box = {value: 1.2};
+const input = {[Symbol.toPrimitive]() { return box.value; }};
+
+function store(n, input) {
+  let value = 1.1;
+  let sum = 0;
+  while (n-- > 0) {
+    sum += value;
+    value = +input;
+    loop_value = value;
+  }
+  exit_value = value;
+  return sum;
+}
+
+%PrepareFunctionForOptimization(store);
+store(3, input);
+
+%OptimizeFunctionOnNextCall(store);
+store(3, input);
+
+box.value = 42;
+store(3, input);
+assertEquals(42, exit_value);
+assertFalse(%IsSmi(exit_value));

diff --git a/test/mjsunit/turbolev/regress-567177599.js b/test/mjsunit/turbolev/regress-567177599.js
new file mode 100644
index 0000000..9ed14c0
--- /dev/null
+++ b/test/mjsunit/turbolev/regress-567177599.js
@@ -0,0 +1,36 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbolev
+
+var loop_value = 1.2;
+var exit_value = 2.5;
+loop_value = 1.4;
+exit_value = 1.5;
+
+const box = {value: 1.2};
+const input = {[Symbol.toPrimitive]() { return box.value; }};
+
+function store(n, input) {
+  let value = 1.1;
+  let sum = 0;
+  while (n-- > 0) {
+    sum += value;
+    value = +input;
+    loop_value = value;
+  }
+  exit_value = value;
+  return sum;
+}
+
+%PrepareFunctionForOptimization(store);
+store(3, input);
+
+%OptimizeFunctionOnNextCall(store);
+store(3, input);
+
+box.value = 42;
+store(3, input);
+assertEquals(42, exit_value);
+assertFalse(%IsSmi(exit_value));