[compiler][wasm] Fix TypeGuard on br_on_cast with null type

Liedtke · V8 LUCI CQ · commit c42a07ffeaf5 · 2024-08-30T16:04:12.000Z
Similar pattern to https://crrev.com/c/5826664 . Fixed: 361862737 Change-Id: I59c3cea5d572423aa06583a1448bf7486213a233 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5829361 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#95899}
diff --git a/src/wasm/graph-builder-interface.cc b/src/wasm/graph-builder-interface.cc
@@ -1858,8 +1858,13 @@ class WasmGraphBuildingInterface {
         // and BrOnNull interacts with the values on the stack.
         // TODO(14034): The compiler shouldn't have to access the stack used by
         // the decoder ideally.
+        // Note: This TypeGuard doesn't add any new type information but we need
+        // a non-const Value that we can return to the decoder for
+        // value_on_branch. The clean solution would be to emit the TypeGuard
+        // with the branch-type in the effect edge of the branch and use
+        // value_on_branch->type as type there.
         SetAndTypeNode(value_on_branch,
-                       builder_->TypeGuard(object.node, value_on_branch->type));
+                       builder_->TypeGuard(object.node, object.type));
         return BrOnNull(decoder, object, br_depth, true, value_on_branch);
       case HeapType::kAny:
         // Any may never need a cast as it is either implicitly convertible or
