[wasm-gc] Fix TF scheduling of inlined call_ref sequence

For the branching control flow structure we set up for feedback-directed
inlining-capable `call_ref` sequences, we have to manually take care of
the "instance cache nodes" in the SSA environment.

Drive-by: improve Runtime_WasmTierUpFunction to process type feedback,
making it usable for the included regression test.

Fixed: v8:13230
Change-Id: I06a449ad73af90b96d0cc15c3cb9a0e4bed87be6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3859326
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82749}

src/runtime/runtime-test-wasm.cc

@@ -428,10 +428,7 @@ RUNTIME_FUNCTION(Runtime_WasmTierUpFunction) {
   DCHECK_EQ(2, args.length());
   Handle<WasmInstanceObject> instance = args.at<WasmInstanceObject>(0);
   int function_index = args.smi_value_at(1);
-  auto* native_module = instance->module_object().native_module();
-  wasm::GetWasmEngine()->CompileFunction(isolate, native_module, function_index,
-                                         wasm::ExecutionTier::kTurbofan);
-  CHECK(!native_module->compilation_state()->failed());
+  wasm::TierUpNowForTesting(isolate, *instance, function_index);
   return ReadOnlyRoots(isolate).undefined_value();
 }
 

src/wasm/graph-builder-interface.cc

@@ -770,6 +770,15 @@ class WasmGraphBuildingInterface {
     ssa_env_->effect = effect;
     builder_->SetEffectControl(effect, control);
 
+    // Each of the {DoCall} helpers above has created a reload of the instance
+    // cache nodes. Rather than merging all of them into a Phi here, just
+    // let them get DCE'ed and perform a single reload after the merge.
+    if (decoder->module_->initial_pages != decoder->module_->maximum_pages) {
+      // The invoked function could have used grow_memory, so we need to
+      // reload mem_size and mem_start.
+      LoadContextIntoSsa(ssa_env_, decoder);
+    }
+
     for (uint32_t i = 0; i < sig->return_count(); i++) {
       std::vector<TFNode*> phi_args;
       for (int j = 0; j < num_cases; j++) {

src/wasm/module-compiler.cc

@@ -1485,6 +1485,17 @@ void TriggerTierUp(WasmInstanceObject instance, int func_index) {
   compilation_state->AddTopTierPriorityCompilationUnit(tiering_unit, priority);
 }
 
+void TierUpNowForTesting(Isolate* isolate, WasmInstanceObject instance,
+                         int func_index) {
+  if (FLAG_wasm_speculative_inlining) {
+    TransitiveTypeFeedbackProcessor process(instance, func_index);
+  }
+  auto* native_module = instance.module_object().native_module();
+  wasm::GetWasmEngine()->CompileFunction(isolate, native_module, func_index,
+                                         wasm::ExecutionTier::kTurbofan);
+  CHECK(!native_module->compilation_state()->failed());
+}
+
 namespace {
 
 void RecordStats(CodeT codet, Counters* counters) {

src/wasm/module-compiler.h

@@ -92,6 +92,9 @@ void ThrowLazyCompilationError(Isolate* isolate,
 // triggered, we instead increase the priority with exponential back-off.
 V8_EXPORT_PRIVATE void TriggerTierUp(WasmInstanceObject instance,
                                      int func_index);
+// Synchronous version of the above.
+void TierUpNowForTesting(Isolate* isolate, WasmInstanceObject instance,
+                         int func_index);
 
 template <typename Key, typename Hash>
 class WrapperQueue {

test/mjsunit/regress/wasm/regress-13230.js

@@ -0,0 +1,30 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --experimental-wasm-gc
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let builder = new WasmModuleBuilder();
+
+builder.addMemory(1, 2, false, false);
+
+let callee = builder.addFunction('callee', kSig_v_v).addBody([kExprNop]);
+
+builder.addDeclarativeElementSegment([callee.index]);
+
+let main_func = builder.addFunction('main', kSig_v_v).exportFunc().addBody([
+  kExprRefFunc, callee.index,
+  kExprCallRef,
+  kExprI32Const, 0,
+  kExprI32LoadMem, 0, 0,
+  kExprDrop,
+]);
+
+let instance = builder.instantiate();
+let main = instance.exports.main;
+
+for (let i = 0; i < 20; i++) main();
+%WasmTierUpFunction(instance, main_func.index);
+main();