[maglev] Tag merges to loop phis and call inputs

Bug: v8:7700
Change-Id: I61246df3a13f8beb91979591455b3d63357ed220
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599477
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80099}

src/maglev/maglev-graph-builder.cc

@@ -761,7 +761,7 @@ void MaglevGraphBuilder::BuildCallFromRegisterList(
     call->set_arg(arg_index++, undefined_constant);
   }
   for (int i = 0; i < args.register_count(); ++i) {
-    call->set_arg(arg_index++, current_interpreter_frame_.get(args[i]));
+    call->set_arg(arg_index++, GetTaggedValue(args[i]));
   }
 
   SetAccumulator(call);

src/maglev/maglev-interpreter-frame-state.h

@@ -503,6 +503,7 @@ class MergePointInterpreterFrameState {
 #ifdef DEBUG
     DCHECK_NULL(result->input(0).node());
 #endif
+    unmerged = EnsureTagged(compilation_unit, unmerged);
     result->set_input(0, unmerged);
   }