From 330a25ad001ee1ac3b7a2176a1f175cee2592a5f Mon Sep 17 00:00:00 2001
From: Victor Gomes <victorgomes@chromium.org>
Date: Wed, 15 Apr 2026 10:29:16 +0200
Subject: [PATCH] [turbofan] Fix and simplify additive safe integer optimization

This CL simplifies the speculative optimization for additive safe
integers and introduces a safer margin for feedback ranges to prevent
overflow.

* Simplify optimization logic: Always perform the operation when the feedback is `AdditiveSafeInteger`, rather than relying on statically proving one side. This simplifies the operation typer and avoids range mistakes.
* Prevent bounds overflow: Introduce tighter feedback bounds (`kMaxAdditiveSafeIntegerFeedback` and `kMinAdditiveSafeIntegerFeedback` at ±2^51). This safer margin ensures that adding two minimum values together will no longer exceed the safe integer range.
* Update tests: Adjust `test/mjsunit/additive-safe-int-feedback.js` to reflect the newly introduced ranges.

Fixed: 499659070
Change-Id: Ic16dbb644b310bed24b169fed90c6637cac10daa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7748026
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#106492}
---

diff --git a/src/builtins/builtins-number-tsa.cc b/src/builtins/builtins-number-tsa.cc
index b9c5daf..8bf79e8 100644
--- a/src/builtins/builtins-number-tsa.cc
+++ b/src/builtins/builtins-number-tsa.cc
@@ -94,11 +94,11 @@
 
     BIND(if_int);
     {
-      // Check if AdditiveSafeInteger: (value - kMinAdditiveSafeInteger) >> 53
-      // == 0
-      V<Word64> shifted_value =
-          Word64ShiftRightLogical(Word64Sub(value_i64, kMinAdditiveSafeInteger),
-                                  kAdditiveSafeIntegerBitLength);
+      // Check if AdditiveSafeIntegerFeedback: (value -
+      // kMinAdditiveSafeIntegerFeedback) >> 51 == 0
+      V<Word64> shifted_value = Word64ShiftRightLogical(
+          Word64Sub(value_i64, kMinAdditiveSafeIntegerFeedback),
+          kAdditiveSafeIntegerFeedbackBitLength);
       GOTO_IF_NOT(Word64Equal(shifted_value, 0), if_fail);
       return value_i64;
     }
diff --git a/src/codegen/code-stub-assembler.cc b/src/codegen/code-stub-assembler.cc
index 30f47be..e95cd98 100644
--- a/src/codegen/code-stub-assembler.cc
+++ b/src/codegen/code-stub-assembler.cc
@@ -7186,10 +7186,11 @@
          if_failed);
 
   BIND(&if_int64);
-  // Check if AdditiveSafeInteger: (value - kMinAdditiveSafeInteger) >> 53 == 0
-  TNode<Int64T> shifted_value =
-      Word64Shr(Int64Sub(value_int64, Int64Constant(kMinAdditiveSafeInteger)),
-                Uint64Constant(kAdditiveSafeIntegerBitLength));
+  // Check if AdditiveSafeIntegerFeedback: (value -
+  // kMinAdditiveSafeIntegerFeedback) >> 51 == 0
+  TNode<Int64T> shifted_value = Word64Shr(
+      Int64Sub(value_int64, Int64Constant(kMinAdditiveSafeIntegerFeedback)),
+      Uint64Constant(kAdditiveSafeIntegerFeedbackBitLength));
   GotoIfNot(Word64Equal(shifted_value, Int64Constant(0)), if_failed);
   return UncheckedCast<AdditiveSafeIntegerT>(value_int64);
 }
diff --git a/src/common/globals.h b/src/common/globals.h
index a795221..e3ded06 100644
--- a/src/common/globals.h
+++ b/src/common/globals.h
@@ -2133,29 +2133,30 @@
 #endif  // V8_ENABLE_UNDEFINED_DOUBLE
 
 // ES6 section 20.1.2.6 Number.MAX_SAFE_INTEGER
-constexpr uint64_t kMaxSafeIntegerUint64 = 9007199254740991;  // 2^53-1
-static_assert(kMaxSafeIntegerUint64 == (uint64_t{1} << 53) - 1);
+constexpr uint64_t kMaxSafeIntegerUint64 = (uint64_t{1} << 53) - 1;  // 2^53-1
 constexpr double kMaxSafeInteger = static_cast<double>(kMaxSafeIntegerUint64);
 // ES6 section 21.1.2.8 Number.MIN_SAFE_INTEGER
 constexpr double kMinSafeInteger = -kMaxSafeInteger;
 
 constexpr double kMaxUInt32Double = double{kMaxUInt32};
 
-constexpr int64_t kMaxAdditiveSafeInteger = 4503599627370495;  // 2^52 - 1
-static_assert(kMaxAdditiveSafeInteger == (int64_t{1} << 52) - 1);
-constexpr int64_t kMinAdditiveSafeInteger = -4503599627370496;  // - 2^52
-static_assert(kMinAdditiveSafeInteger == -(int64_t{1} << 52));
-constexpr int kAdditiveSafeIntegerBitLength = 53;
-// Number of bits to shift left before addition to detect potential overflow.
-constexpr int kAdditiveSafeIntegerShift = 64 - kAdditiveSafeIntegerBitLength;
-
+constexpr int64_t kMaxAdditiveSafeInteger = (int64_t{1} << 52) - 1;  // 2^52 - 1
+constexpr int64_t kMinAdditiveSafeInteger =
+    -(int64_t{1} << 52) + 1;  // - (2^52 - 1)
 static_assert(kMaxAdditiveSafeInteger + kMaxAdditiveSafeInteger <=
               kMaxSafeInteger);
-// kMinAdditiveSafeInteger + kMinAdditiveSafeInteger would overflow the integer
-// safe addition.
-static_assert(kMinAdditiveSafeInteger + (kMinAdditiveSafeInteger + 1) >=
+static_assert(kMinAdditiveSafeInteger + kMinAdditiveSafeInteger >=
               kMinSafeInteger);
 
+constexpr int64_t kMaxAdditiveSafeIntegerFeedback =
+    (int64_t{1} << 51) - 1;  // 2^51 - 1
+constexpr int64_t kMinAdditiveSafeIntegerFeedback =
+    -(int64_t{1} << 51);  // - 2^51
+constexpr int kAdditiveSafeIntegerFeedbackBitLength = 52;
+// Number of bits to shift left before addition to detect potential overflow.
+constexpr int kAdditiveSafeIntegerFeedbackShift =
+    64 - kAdditiveSafeIntegerFeedbackBitLength;
+
 // The order of this enum has to be kept in sync with the predicates below.
 enum class VariableMode : uint8_t {
   // User declared variables:
diff --git a/src/compiler/operation-typer.cc b/src/compiler/operation-typer.cc
index d28d90c..d297650 100644
--- a/src/compiler/operation-typer.cc
+++ b/src/compiler/operation-typer.cc
@@ -719,22 +719,12 @@
 }
 
 Type OperationTyper::SpeculativeAdditiveSafeIntegerAdd(Type lhs, Type rhs) {
-  Type result = SpeculativeNumberAdd(lhs, rhs);
-  if (lhs.Is(cache_->kAdditiveSafeInteger) ||
-      rhs.Is(cache_->kAdditiveSafeInteger)) {
-    return Type::Intersect(result, cache_->kAdditiveSafeInteger, zone());
-  }
-  return result;
+  return SpeculativeNumberAdd(lhs, rhs);
 }
 
 Type OperationTyper::SpeculativeAdditiveSafeIntegerSubtract(Type lhs,
                                                             Type rhs) {
-  Type result = SpeculativeNumberSubtract(lhs, rhs);
-  if (lhs.Is(cache_->kAdditiveSafeInteger) ||
-      rhs.Is(cache_->kAdditiveSafeInteger)) {
-    return Type::Intersect(result, cache_->kAdditiveSafeInteger, zone());
-  }
-  return result;
+  return SpeculativeNumberSubtract(lhs, rhs);
 }
 
 Type OperationTyper::SpeculativeSmallIntegerAdd(Type lhs, Type rhs) {
diff --git a/src/compiler/representation-change.cc b/src/compiler/representation-change.cc
index 23ad745..cfc1cf3 100644
--- a/src/compiler/representation-change.cc
+++ b/src/compiler/representation-change.cc
@@ -1011,7 +1011,7 @@
       op = machine()->ChangeFloat64ToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
       if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
-        if (output_type.Is(cache_->kAdditiveSafeInteger)) {
+        if (output_type.Is(cache_->kAdditiveSafeIntegerFeedback)) {
           op = machine()->TruncateFloat64ToWord32();
         } else {
           op = simplified()->CheckedFloat64ToAdditiveSafeInteger(
@@ -1045,7 +1045,7 @@
       op = machine()->ChangeFloat64ToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
       if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
-        if (output_type.Is(cache_->kAdditiveSafeInteger)) {
+        if (output_type.Is(cache_->kAdditiveSafeIntegerFeedback)) {
           op = machine()->TruncateFloat64ToWord32();
         } else {
           op = simplified()->CheckedFloat64ToAdditiveSafeInteger(
@@ -1086,7 +1086,7 @@
           CheckTaggedInputMode::kAdditiveSafeInteger, use_info.feedback());
     } else if (use_info.truncation().IsUsedAsWord32()) {
       if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
-        if (output_type.Is(cache_->kAdditiveSafeInteger)) {
+        if (output_type.Is(cache_->kAdditiveSafeIntegerFeedback)) {
           op = simplified()->TruncateNumberOrOddballToWord32();
         } else {
           op = simplified()->CheckedTruncateTaggedToWord32(
@@ -1281,8 +1281,8 @@
           int64_t const iv = static_cast<int64_t>(fv);
           if (static_cast<double>(iv) == fv) {
             if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
-              if (iv < kMinAdditiveSafeInteger ||
-                  kMaxAdditiveSafeInteger < iv ||
+              if (iv < kMinAdditiveSafeIntegerFeedback ||
+                  kMaxAdditiveSafeIntegerFeedback < iv ||
                   (iv == 0 && std::signbit(fv))) {
                 Node* unreachable = InsertUnconditionalDeopt(
                     use_node, DeoptimizeReason::kNotAdditiveSafeInteger,
@@ -1372,7 +1372,7 @@
     if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
       // float32 -> float64 -> int64
       node = InsertChangeFloat32ToFloat64(node);
-      if (output_type.Is(cache_->kAdditiveSafeInteger)) {
+      if (output_type.Is(cache_->kAdditiveSafeIntegerFeedback)) {
         op = machine()->ChangeFloat64ToInt64();
       } else {
         op = simplified()->CheckedFloat64ToAdditiveSafeInteger(
@@ -1406,7 +1406,7 @@
     }
   } else if (output_rep == MachineRepresentation::kFloat64) {
     if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
-      if (output_type.Is(cache_->kAdditiveSafeInteger)) {
+      if (output_type.Is(cache_->kAdditiveSafeIntegerFeedback)) {
         op = machine()->ChangeFloat64ToInt64();
       } else {
         op = simplified()->CheckedFloat64ToAdditiveSafeInteger(
@@ -1454,7 +1454,7 @@

diff --git a/test/mjsunit/additive-safe-int-feedback.js b/test/mjsunit/additive-safe-int-feedback.js
index 7530b9f..aabdb83 100644
--- a/test/mjsunit/additive-safe-int-feedback.js
+++ b/test/mjsunit/additive-safe-int-feedback.js
@@ -5,8 +5,8 @@
 // Flags: --allow-natives-syntax --additive-safe-int-feedback
 // Flags: --turbofan
 
-const maxAdditiveSafeInteger = 4503599627370495; // 2^52 - 1
-const minAdditiveSafeInteger = - 4503599627370496; // - 2^52
+const maxAdditiveSafeInteger = 2251799813685247; // 2^52 - 1
+const minAdditiveSafeInteger = - 2251799813685248; // - 2^51
 
 // If one of the inputs is a constant in the additive safe range,
 // we can use AdditiveSafeInteger.
@@ -89,8 +89,15 @@
     assertEquals(1231234567891, foo(1231234567890, 1));
     assertOptimized(foo);
 
-    // We don't deopt in overflow.
+    // We deopt in overflow.
     assertEquals(maxAdditiveSafeInteger + 1, foo(maxAdditiveSafeInteger, 1));
+    assertUnoptimized(foo);
+
+    // Re-optimize to continue test.
+    %PrepareFunctionForOptimization(foo);
+    assertEquals(1231234567891, foo(1231234567890, 1));
+    %OptimizeFunctionOnNextCall(foo);
+    assertEquals(1231234567891, foo(1231234567890, 1));
     assertOptimized(foo);
 
     // Don't deopt with doubles.
@@ -300,6 +307,13 @@
 
     // And we cannot deopt by overflowing the first one.
     assertEquals(maxAdditiveSafeInteger + 2, foo(maxAdditiveSafeInteger, 1));
+    assertUnoptimized(foo);
+
+    // Re-optimize to continue test.
+    %PrepareFunctionForOptimization(foo);
+    assertEquals(1231234567892, foo(1231234567890, 1));
+    %OptimizeFunctionOnNextCall(foo);
+    assertEquals(1231234567892, foo(1231234567890, 1));
     assertOptimized(foo);
 
     // Don't deopt with doubles.