[turbofan] fix nondeterminism in mksnapshot

This CL fixes two unrelated issues in Turbofan that contributed to
non-determinism:
- Most importantly, external references included their address in the
  node hash, but they're unpredictable due to ASLR. Fix by only looking
  at the lowest bits assuming a 4K page size.
- BranchElimination didn't properly trigger revisits for the
  IfTrue/IfFalse projections.

Bug: chromium:1046815
Change-Id: I9ba3535cc748890708e4638017e245a3f4e2a7d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2069332
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66445}

src/codegen/external-reference.cc

@@ -910,6 +910,11 @@ bool operator!=(ExternalReference lhs, ExternalReference rhs) {
 }
 
 size_t hash_value(ExternalReference reference) {
+  if (FLAG_predictable) {
+    // Avoid ASLR non-determinism in predictable mode. For this, just take the
+    // lowest 12 bit corresponding to a 4K page size.
+    return base::hash<Address>()(reference.address() & 0xfff);
+  }
   return base::hash<Address>()(reference.address());
 }
 

src/compiler/branch-elimination.cc

@@ -157,6 +157,11 @@ Reduction BranchElimination::ReduceBranch(Node* node) {
     return Replace(dead());
   }
   SimplifyBranchCondition(node);
+  // Trigger revisits of the IfTrue/IfFalse projections, since they depend on
+  // the branch condition.
+  for (Node* const use : node->uses()) {
+    Revisit(use);
+  }
   return TakeConditionsFromFirstControl(node);
 }