[maglev] Only assign rax to exception accumulator if not dead

Check whether the exception phi for the accumulator (i.e. the exception
message object) is dead, and don't assign rax to it if yes. Note that
maglev node liveness can differ from bytecode liveness, since the
bytecode accumulator could have been considered "live" just because of a
move to a (dead) register.

Bug: v8:7700
Change-Id: If1384284f6f55a565e2ae94e5e7a32455fdedb93
Fixed: chromium:1359382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892353
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83197}

src/maglev/maglev-code-generator.cc

@@ -477,6 +477,7 @@ class ExceptionHandlerTrampolineBuilder {
                    const CompactInterpreterFrameState* register_frame) {
     for (Phi* phi : *block->phis()) {
       DCHECK_EQ(phi->input_count(), 0);
+      if (!phi->has_valid_live_range()) continue;
       if (phi->owner() == interpreter::Register::virtual_accumulator()) {
         // If the accumulator is live, then it is the exception object located
         // at kReturnRegister0. This is also the first phi in the list.
@@ -484,7 +485,6 @@ class ExceptionHandlerTrampolineBuilder {
         save_accumulator_ = true;
         continue;
       }
-      if (!phi->has_valid_live_range()) continue;
       ValueNode* value = register_frame->GetValueOf(phi->owner(), unit);
       DCHECK_NOT_NULL(value);
       switch (value->properties().value_representation()) {

src/maglev/maglev-regalloc.cc

@@ -388,7 +388,8 @@ void StraightForwardRegisterAllocator::AllocateRegisters() {
         // the exception message object.
         Phi* phi = block->phis()->first();
         DCHECK_EQ(phi->input_count(), 0);
-        if (phi->owner() == interpreter::Register::virtual_accumulator()) {
+        if (phi->owner() == interpreter::Register::virtual_accumulator() &&
+            !phi->is_dead()) {
           phi->result().SetAllocated(ForceAllocate(kReturnRegister0, phi));
           if (FLAG_trace_maglev_regalloc) {
             printing_visitor_->Process(phi, ProcessingState(block_it_));

test/mjsunit/maglev/regress/regress-1359382.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function foo() {
+  try {
+    throw null;
+  } catch (x) {
+  } finally {
+    return;
+  }
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeMaglevOnNextCall(foo);
+foo();