From 2ba409389cf020e0b4890395724fd6f603445d6b Mon Sep 17 00:00:00 2001
From: Manos Koukoutos <manoskouk@chromium.org>
Date: Wed, 2 Mar 2022 08:49:54 +0000
Subject: [PATCH] [turbofan] Fix optimization of traps after if-nodes

A TrapUnless after an IfTrue, and conversely, a TrapIf after an IfFalse,
should not optimize away the respective Branch node.

Bug: v8:12624
Change-Id: I250b2f84c38295ca35e440589901ed5a58bb4e75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3500303
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79349}
---
 src/compiler/branch-elimination.cc         |  6 ++-
 test/mjsunit/regress/wasm/regress-12624.js | 51 ++++++++++++++++++++++
 2 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 test/mjsunit/regress/wasm/regress-12624.js

diff --git a/src/compiler/branch-elimination.cc b/src/compiler/branch-elimination.cc
index a127d54572..e331d4960e 100644
--- a/src/compiler/branch-elimination.cc
+++ b/src/compiler/branch-elimination.cc
@@ -265,8 +265,10 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
       //      |                              |
       //   <subgraph1>                     <subgraph1>
       // (and symmetrically for TrapUnless.)
-      if ((control_input->opcode() == IrOpcode::kIfTrue ||
-           control_input->opcode() == IrOpcode::kIfFalse) &&
+      if (((trapping_condition &&
+            control_input->opcode() == IrOpcode::kIfTrue) ||
+           (!trapping_condition &&
+            control_input->opcode() == IrOpcode::kIfFalse)) &&
           control_input->UseCount() == 1) {
         Node* branch = NodeProperties::GetControlInput(control_input);
         DCHECK_EQ(branch->opcode(), IrOpcode::kBranch);
diff --git a/test/mjsunit/regress/wasm/regress-12624.js b/test/mjsunit/regress/wasm/regress-12624.js
new file mode 100644
index 0000000000..ddb9da17d5
--- /dev/null
+++ b/test/mjsunit/regress/wasm/regress-12624.js
@@ -0,0 +1,51 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-gc --no-liftoff
+
+// Under certain conditions, the following subgraph was not optimized correctly:
+// cond
+//  |  \
+//  |   Branch
+//  |   /    \
+//  | IfTrue  IfFalse
+//  |   |
+// TrapUnless
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+var builder = new WasmModuleBuilder();
+
+builder.addGlobal(kWasmI32, true, WasmInitExpr.I32Const(1));
+
+builder.addFunction("main", kSig_i_i)
+  .addBody([
+    kExprLocalGet, 0,
+    kExprIf, kWasmI32,
+      kExprUnreachable,
+    kExprElse,
+      kExprLoop, kWasmVoid,
+        kExprBlock, kWasmVoid,
+          kExprLocalGet, 0,
+          kExprIf, kWasmVoid,
+            kExprLocalGet, 0,
+            kExprBrIf, 1,
+            kExprI32Const, 7,
+            kExprLocalSet, 0,
+          kExprEnd,
+          kExprGlobalGet, 0,
+          kExprIf, kWasmVoid,
+            kExprI32Const, 0, kExprReturn,
+          kExprEnd,
+          kExprBr, 1,
+        kExprEnd,
+      kExprEnd,
+      kExprI32Const, 0,
+    kExprEnd,
+    kExprLocalGet, 0,
+    kExprI32DivU])
+  .exportFunc();
+
+let instance = builder.instantiate();
+assertEquals(0, instance.exports.main(0));