[turbofan] Ensure nodes without kNoThrow have only IfSuccess or IfException uses.

This adds an IfSuccess control use in three places:

- in the lowering of isinstance,
- in wasm BuildTrapCode,
- in wasm BuildJavaScriptToNumber,
- WasmGrowMemory is marked as kNoThrow.

BUG=

Review-Url: https://codereview.chromium.org/2226163004
Cr-Commit-Position: refs/heads/master@{#38531}

src/compiler/js-typed-lowering.cc

@@ -1264,17 +1264,20 @@ Reduction JSTypedLowering::ReduceJSInstanceOf(Node* node) {
   Node* if_is_proxy = graph()->NewNode(common()->IfTrue(), branch_is_proxy);
   Node* e_is_proxy = effect;
 
-  Node* runtime_has_in_proto_chain = control = graph()->NewNode(
-      common()->Merge(2), if_is_access_check_needed, if_is_proxy);
+  control = graph()->NewNode(common()->Merge(2), if_is_access_check_needed,
+                             if_is_proxy);
   effect = graph()->NewNode(common()->EffectPhi(2), e_is_access_check_needed,
                             e_is_proxy, control);
 
   // If we need an access check or the object is a Proxy, make a runtime call
   // to finish the lowering.
-  Node* bool_result_runtime_has_in_proto_chain_case = graph()->NewNode(
+  Node* runtimecall = graph()->NewNode(
       javascript()->CallRuntime(Runtime::kHasInPrototypeChain), r.left(),
       prototype, context, frame_state, effect, control);
 
+  Node* runtimecall_control =
+      graph()->NewNode(common()->IfSuccess(), runtimecall);
+
   control = graph()->NewNode(common()->IfFalse(), branch_is_proxy);
 
   Node* object_prototype = effect = graph()->NewNode(
@@ -1310,16 +1313,14 @@ Reduction JSTypedLowering::ReduceJSInstanceOf(Node* node) {
   loop_object_map->ReplaceInput(1, load_object_map);
   loop->ReplaceInput(1, control);
 
-  control = graph()->NewNode(common()->Merge(3), runtime_has_in_proto_chain,
+  control = graph()->NewNode(common()->Merge(3), runtimecall_control,
                              if_eq_proto, if_null_proto);
-  effect = graph()->NewNode(common()->EffectPhi(3),
-                            bool_result_runtime_has_in_proto_chain_case,
-                            e_eq_proto, e_null_proto, control);
+  effect = graph()->NewNode(common()->EffectPhi(3), runtimecall, e_eq_proto,
+                            e_null_proto, control);
 
   Node* result = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 3),
-      bool_result_runtime_has_in_proto_chain_case, jsgraph()->TrueConstant(),
-      jsgraph()->FalseConstant(), control);
+      common()->Phi(MachineRepresentation::kTagged, 3), runtimecall,
+      jsgraph()->TrueConstant(), jsgraph()->FalseConstant(), control);
 
   if (if_is_smi != nullptr) {
     DCHECK_NOT_NULL(e_is_smi);

src/compiler/wasm-compiler.cc

@@ -249,8 +249,8 @@ class WasmTrapHelper : public ZoneObject {
 
       Node* node = graph()->NewNode(
           common()->Call(desc), static_cast<int>(arraysize(inputs)), inputs);
-      *control_ptr = node;
       *effect_ptr = node;
+      *control_ptr = graph()->NewNode(common()->IfSuccess(), node);
     }
     if (false) {
       // End the control flow with a throw
@@ -1662,7 +1662,7 @@ Node* WasmGraphBuilder::BuildGrowMemory(Node* input) {
   Runtime::FunctionId function_id = Runtime::kWasmGrowMemory;
   const Runtime::Function* function = Runtime::FunctionForId(function_id);
   CallDescriptor* desc = Linkage::GetRuntimeCallDescriptor(
-      jsgraph()->zone(), function_id, function->nargs, Operator::kNoProperties,
+      jsgraph()->zone(), function_id, function->nargs, Operator::kNoThrow,
       CallDescriptor::kNoFlags);
   Node** control_ptr = control_;
   Node** effect_ptr = effect_;
@@ -1678,7 +1678,6 @@ Node* WasmGraphBuilder::BuildGrowMemory(Node* input) {
       *control_ptr};
   Node* node = graph()->NewNode(jsgraph()->common()->Call(desc),
                                 static_cast<int>(arraysize(inputs)), inputs);
-  *control_ptr = node;
   *effect_ptr = node;
   node = BuildChangeSmiToInt32(node);
   return node;
@@ -2229,8 +2228,8 @@ Node* WasmGraphBuilder::BuildJavaScriptToNumber(Node* node, Node* context,
   Node* result = graph()->NewNode(jsgraph()->common()->Call(desc), stub_code,
                                   node, context, effect, control);
 
-  *control_ = result;
   *effect_ = result;
+  *control_ = graph()->NewNode(jsgraph()->common()->IfSuccess(), result);
 
   return result;
 }