[wasm] Do not create TF nodes during verification

BUG=chromium:654377
TEST=mjsunit/regress/wasm/regression-654377
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2403013002
Cr-Commit-Position: refs/heads/master@{#40246}

src/wasm/ast-decoder.cc

@@ -1440,9 +1440,13 @@ class WasmFullDecoder : public WasmDecoder {
               WasmOpcodes::TypeName(old.type), WasmOpcodes::TypeName(val.type));
         return;
       }
-      old.node =
-          first ? val.node : CreateOrMergeIntoPhi(old.type, target->control,
-                                                  old.node, val.node);
+      if (builder_) {
+        old.node =
+            first ? val.node : CreateOrMergeIntoPhi(old.type, target->control,
+                                                    old.node, val.node);
+      } else {
+        old.node = nullptr;
+      }
     }
   }
 
@@ -1599,6 +1603,7 @@ class WasmFullDecoder : public WasmDecoder {
 
   TFNode* CreateOrMergeIntoPhi(LocalType type, TFNode* merge, TFNode* tnode,
                                TFNode* fnode) {
+    DCHECK_NOT_NULL(builder_);
     if (builder_->IsPhiWithMerge(tnode, merge)) {
       builder_->AppendToPhi(tnode, fnode);
     } else if (tnode != fnode) {

test/mjsunit/regress/wasm/regression-654377.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, 1, false);
+  builder.addFunction("foo", kSig_i_v)
+    .addBody([
+              kExprI32Const, 00,
+              kExprMemorySize,
+              kExprBrIf, 00,
+              kExprMemorySize,
+              kExprBr, 0xe7, 0xd2, 0xf2, 0xff, 0x1d
+              ])
+              .exportFunc();
+  assertThrows(function() { builder.instantiate(); });
+})();