[wasm][eh] Fix merge with phi in delegate

We always built a new Phi node for the delegate merge, which is
incorrect when the target block's exception is already a Phi. Use
CreateOrMergeIntoPhi instead.

R=clemensb@chromium.org

Bug: v8:11472
Change-Id: I8af3ab07d536ddfe247ace04cc844207d32adb99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707167Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72874}

src/compiler/wasm-compiler.cc

@@ -525,6 +525,7 @@ Node* WasmGraphBuilder::Merge(unsigned count, Node** controls) {
 Node* WasmGraphBuilder::Phi(wasm::ValueType type, unsigned count,
                             Node** vals_and_control) {
   DCHECK(IrOpcode::IsMergeOpcode(vals_and_control[count]->opcode()));
+  DCHECK_EQ(vals_and_control[count]->op()->ControlInputCount(), count);
   return graph()->NewNode(
       mcgraph()->common()->Phi(type.machine_representation(), count), count + 1,
       vals_and_control);

src/wasm/graph-builder-interface.cc

@@ -740,9 +740,9 @@ class WasmGraphBuildingInterface {
         target_try->exception = block->try_info->exception;
       } else {
         DCHECK_EQ(target_try->catch_env->state, SsaEnv::kMerged);
-        TFNode* inputs[] = {target_try->exception, block->try_info->exception,
-                            target_try->catch_env->control};
-        target_try->exception = builder_->Phi(kWasmAnyRef, 2, inputs);
+        target_try->exception = builder_->CreateOrMergeIntoPhi(
+            MachineRepresentation::kTagged, target_try->catch_env->control,
+            target_try->exception, block->try_info->exception);
       }
     }
     current_catch_ = block->previous_catch;

test/mjsunit/regress/wasm/regress-11472.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --experimental-wasm-eh
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function Regress11472() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let throw_fn = builder.addFunction('throw', kSig_v_v)
+      .addBody([kExprNop])
+      .exportFunc();
+  builder.addFunction('test', kSig_i_ii)
+      .addBody([
+        kExprTry, kWasmI32,
+          kExprCallFunction, throw_fn.index,
+          kExprCallFunction, throw_fn.index,
+          kExprTry, kWasmI32,
+            kExprCallFunction, throw_fn.index,
+            kExprI32Const, 1,
+          kExprDelegate, 0,
+        kExprCatchAll,
+          kExprI32Const, 2,
+        kExprEnd,
+      ]).exportFunc();
+  instance = builder.instantiate();
+})();