[maglev] Invert polymorphic access chaining conditions.

LeszekSwirski · V8 LUCI CQ · commit 5b4749d75854 · 2025-10-13T02:58:53.000-07:00
IsOffsetAPolymorphicContinuationInterrupt should return _true_ at merge points etc., not _false_ Bug: 450495091 Change-Id: Ic17ce83ef68d88edaf0ab9c615c5db5cdfde912f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7035734 Commit-Queue: Marja Hölttä <marja@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#103082}
diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc
@@ -6978,7 +6978,7 @@ MaglevGraphBuilder::FindContinuationForPolymorphicPropertyLoadImpl() {
         // TODO(leszeks): I guess we could split that merge if we wanted to,
         // introducing a new merge that has the polymorphic loads+calls on one
         // side and the generic call on the other.
-        if (IsOffsetAMergePoint(offset)) return false;
+        if (IsOffsetAMergePoint(offset)) return true;
 
         // We currently can't continue a polymorphic load across a peeled
         // loop header -- not because of any actual semantic reason, a peeled
@@ -6989,7 +6989,7 @@ MaglevGraphBuilder::FindContinuationForPolymorphicPropertyLoadImpl() {
         // JumpLoop rather than loop header, and then this continuation code
         // would work. Only for the first peeled iteration though, not for
         // speeling.
-        if (loop_headers_to_peel_.Contains(offset)) return false;
+        if (loop_headers_to_peel_.Contains(offset)) return true;
 
         // Loop peeling should be the only reason there was no merge point for a
         // loop header.
@@ -7004,8 +7004,8 @@ MaglevGraphBuilder::FindContinuationForPolymorphicPropertyLoadImpl() {
         // strict nesting of handlers (since the first polymorphic call would
         // be inside the handler range, but the second polymorphic load after it
         // in linear scan order would be outside of the handler range).
-        if (offset >= next_handler_change) return false;
-        return true;
+        if (offset >= next_handler_change) return true;
+        return false;
       };
 
   // Skip GetNamedProperty.
