[turbofan] Insert unreachable node after unconditional deopt.

This inserts unreachable node after uncoditional deopt in bit-to-word
conversion and wires it as an input to the dead-value.

This fixes a problem, where a floating  dead-value was inserted by a change
of bit-to-word (which always fails because bit cannot be converted to word).
Without the unrachable node (which this CL inserts in the effect chain after
deopt), the dead value was scheduled before the uncoditional deoptimization
and crash at runtime.

Unfortunately, I do not know how to construct a test that does not end up in
an infinite loop.

Bug: chromium:878805
Change-Id: Ia03060949f6a9b914807f5614fadcf2271911998
Reviewed-on: https://chromium-review.googlesource.com/1196663Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55770}

src/compiler/representation-change.cc

@@ -607,14 +607,17 @@ Node* RepresentationChanger::MakeTruncatedInt32Constant(double value) {
   return jsgraph()->Int32Constant(DoubleToInt32(value));
 }
 
-void RepresentationChanger::InsertUnconditionalDeopt(Node* node,
-                                                     DeoptimizeReason reason) {
+Node* RepresentationChanger::InsertUnconditionalDeopt(Node* node,
+                                                      DeoptimizeReason reason) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* deopt =
+  effect =
       jsgraph()->graph()->NewNode(simplified()->CheckIf(reason),
                                   jsgraph()->Int32Constant(0), effect, control);
-  NodeProperties::ReplaceEffectInput(node, deopt);
+  Node* unreachable = effect = jsgraph()->graph()->NewNode(
+      jsgraph()->common()->Unreachable(), effect, control);
+  NodeProperties::ReplaceEffectInput(node, effect);
+  return unreachable;
 }
 
 Node* RepresentationChanger::GetWord32RepresentationFor(
@@ -655,9 +658,11 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
       CHECK(Truncation::Any(kIdentifyZeros)
                 .IsLessGeneralThan(use_info.truncation()));
       CHECK_NE(use_info.type_check(), TypeCheckKind::kNone);
-      InsertUnconditionalDeopt(use_node, DeoptimizeReason::kNotASmi);
+      Node* unreachable =
+          InsertUnconditionalDeopt(use_node, DeoptimizeReason::kNotASmi);
       return jsgraph()->graph()->NewNode(
-          jsgraph()->common()->DeadValue(MachineRepresentation::kWord32), node);
+          jsgraph()->common()->DeadValue(MachineRepresentation::kWord32),
+          unreachable);
     }
   } else if (output_rep == MachineRepresentation::kFloat64) {
     if (output_type.Is(Type::Signed32())) {

src/compiler/representation-change.h

@@ -338,7 +338,7 @@ class RepresentationChanger final {
   Node* InsertChangeTaggedToFloat64(Node* node);
   Node* InsertChangeUint32ToFloat64(Node* node);
   Node* InsertConversion(Node* node, const Operator* op, Node* use_node);
-  void InsertUnconditionalDeopt(Node* node, DeoptimizeReason reason);
+  Node* InsertUnconditionalDeopt(Node* node, DeoptimizeReason reason);
 
   JSGraph* jsgraph() const { return jsgraph_; }
   Isolate* isolate() const { return isolate_; }