[wasm] Fix DCHECK in MergeValuesInto for reference types.

R=titzer@chromium.org
TEST=mjsunit/regress/regress-9165
BUG=v8:9165

Change-Id: If6d7d56bf164a85675590e69bf9857c11fc1b218
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578463Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60969}

src/wasm/graph-builder-interface.cc

@@ -692,7 +692,9 @@ class WasmGraphBuildingInterface {
       Value& val = stack_values[i];
       Value& old = (*merge)[i];
       DCHECK_NOT_NULL(val.node);
-      DCHECK(val.type == old.type || val.type == kWasmVar);
+      DCHECK(val.type == kWasmVar ||
+             ValueTypes::MachineRepresentationFor(val.type) ==
+                 ValueTypes::MachineRepresentationFor(old.type));
       old.node = first ? val.node
                        : builder_->CreateOrMergeIntoPhi(
                              ValueTypes::MachineRepresentationFor(old.type),

src/wasm/value-type.h

@@ -299,6 +299,7 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return MachineRepresentation::kFloat64;
       case kWasmAnyRef:
       case kWasmAnyFunc:
+      case kWasmNullRef:
       case kWasmExceptRef:
         return MachineRepresentation::kTaggedPointer;
       case kWasmS128:

test/mjsunit/mjsunit.status

@@ -354,6 +354,7 @@
   'regress/regress-crbug-816961': [SKIP],
   'regress/wasm/*': [SKIP],
   'regress/regress-8947': [SKIP],
+  'regress/regress-9165': [SKIP],
   'regress/regress-v8-9106': [SKIP],
   'wasm/*': [SKIP],
 

test/mjsunit/regress/regress-9165.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+let kSig_r_i = makeSig([kWasmI32], [kWasmAnyRef]);
+
+(function TestMergeOfAnyFuncIntoAnyRef() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("merge", kSig_r_i)
+      .addLocals({anyref_count: 1, anyfunc_count: 1})
+      .addBody([
+        kExprGetLocal, 0,
+        kExprI32Eqz,
+        kExprIf, kWasmAnyRef,
+          kExprGetLocal, 1,
+        kExprElse,
+          kExprGetLocal, 2,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  assertEquals(null, instance.exports.merge(0));
+  assertEquals(null, instance.exports.merge(1));
+})();
+
+(function TestMergeOfAnyFuncIntoNullRef() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("merge", kSig_r_i)
+      .addLocals({anyfunc_count: 1})
+      .addBody([
+        kExprGetLocal, 0,
+        kExprI32Eqz,
+        kExprIf, kWasmAnyRef,
+          kExprRefNull,
+        kExprElse,
+          kExprGetLocal, 1,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  assertEquals(null, instance.exports.merge(0));
+  assertEquals(null, instance.exports.merge(1));
+})();