[wasm][turbofan] Fix br_on_non_null typing

jakobkummerow · V8 LUCI CQ · commit bc82a5617da4 · 2024-09-19T21:21:56.000Z
This is a follow up to crrev.com/c/5826664: rather than dropping the TypeGuard entirely, we must insert it in the right position. Fixed: 368241691 Change-Id: I80ac9c2c2ba060a39fd46d52aff661e4d2a4608a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5872855 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#96195}
diff --git a/src/wasm/graph-builder-interface.cc b/src/wasm/graph-builder-interface.cc
@@ -1206,14 +1206,15 @@ class WasmGraphBuildingInterface {
 
   void BrOnNonNull(FullDecoder* decoder, const Value& ref_object, Value* result,
                    uint32_t depth, bool /* drop_null_on_fallthrough */) {
-    result->node = ref_object.node;
     SsaEnv* false_env = ssa_env_;
     SsaEnv* true_env = Split(decoder->zone(), false_env);
     false_env->SetNotMerged();
     std::tie(false_env->control, true_env->control) =
         builder_->BrOnNull(ref_object.node, ref_object.type);
     builder_->SetControl(false_env->control);
     ScopedSsaEnv scoped_env(this, true_env);
+    // Make sure the TypeGuard has the right Control dependency.
+    SetAndTypeNode(result, builder_->TypeGuard(ref_object.node, result->type));
     BrOrRet(decoder, depth);
   }
 
diff --git a/test/mjsunit/regress/wasm/regress-368241691.js b/test/mjsunit/regress/wasm/regress-368241691.js
@@ -0,0 +1,43 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let builder = new WasmModuleBuilder();
+
+let struct0 = builder.addStruct([makeField(kWasmI32, true)]);
+let return_struct0 = builder.addType(makeSig([], [wasmRefType(struct0)]));
+
+builder.addFunction("makeStruct", return_struct0)
+  .exportFunc()
+  .addBody([
+    kExprI32Const, 42,
+    kGCPrefix, kExprStructNew, struct0,
+  ]);
+
+let callee = builder.addFunction("callee", makeSig([wasmRefType(struct0)], [kWasmI32]))
+  .addBody([
+    kExprLocalGet, 0,
+    kGCPrefix, kExprStructGet, struct0, 0,
+  ]);
+
+builder.addFunction("main", makeSig([wasmRefNullType(struct0)], [kWasmI32]))
+  .exportFunc()
+  .addBody([
+    kExprBlock, return_struct0,
+      kExprLocalGet, 0,
+      kExprBrOnNonNull, 0,
+      kExprUnreachable,
+    kExprEnd,
+    kExprCallFunction, callee.index,
+  ]);
+
+let instance = builder.instantiate();
+let obj = instance.exports.makeStruct();
+
+instance.exports.main(obj);
+%WasmTierUpFunction(instance.exports.main);
+assertEquals(42, instance.exports.main(obj));
