[wasm][decoder] Update merge values for one-armed if blocks

R=ahaas@chromium.org

Change-Id: Iea0fe775eb8c101200fe41e5e188bbdc85c03df7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1856000Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64272}

src/wasm/graph-builder-interface.cc

@@ -213,7 +213,10 @@ class WasmGraphBuildingInterface {
     if (block->is_onearmed_if()) {
       // Merge the else branch into the end merge.
       SetEnv(block->false_env);
-      MergeValuesInto(decoder, block, &block->end_merge);
+      DCHECK_EQ(block->start_merge.arity, block->end_merge.arity);
+      Value* values =
+          block->start_merge.arity > 0 ? &block->start_merge[0] : nullptr;
+      MergeValuesInto(decoder, block, &block->end_merge, values);
     }
     // Now continue with the merged environment.
     SetEnv(block->end_env);
@@ -694,7 +697,8 @@ class WasmGraphBuildingInterface {
     }
   }
 
-  void MergeValuesInto(FullDecoder* decoder, Control* c, Merge<Value>* merge) {
+  void MergeValuesInto(FullDecoder* decoder, Control* c, Merge<Value>* merge,
+                       Value* values) {
     DCHECK(merge == &c->start_merge || merge == &c->end_merge);
 
     SsaEnv* target = c->end_env;
@@ -703,13 +707,8 @@ class WasmGraphBuildingInterface {
 
     if (merge->arity == 0) return;
 
-    uint32_t avail =
-        decoder->stack_size() - decoder->control_at(0)->stack_depth;
-    DCHECK_GE(avail, merge->arity);
-    uint32_t start = avail >= merge->arity ? 0 : merge->arity - avail;
-    Value* stack_values = decoder->stack_value(merge->arity);
-    for (uint32_t i = start; i < merge->arity; ++i) {
-      Value& val = stack_values[i];
+    for (uint32_t i = 0; i < merge->arity; ++i) {
+      Value& val = values[i];
       Value& old = (*merge)[i];
       DCHECK_NOT_NULL(val.node);
       DCHECK(val.type == kWasmBottom ||
@@ -722,6 +721,17 @@ class WasmGraphBuildingInterface {
     }
   }
 
+  void MergeValuesInto(FullDecoder* decoder, Control* c, Merge<Value>* merge) {
+#ifdef DEBUG
+    uint32_t avail =
+        decoder->stack_size() - decoder->control_at(0)->stack_depth;
+    DCHECK_GE(avail, merge->arity);
+#endif
+    Value* stack_values =
+        merge->arity > 0 ? decoder->stack_value(merge->arity) : nullptr;
+    MergeValuesInto(decoder, c, merge, stack_values);
+  }
+
   void Goto(FullDecoder* decoder, SsaEnv* from, SsaEnv* to) {
     DCHECK_NOT_NULL(to);
     switch (to->state) {

test/mjsunit/wasm/multi-value.js

@@ -231,6 +231,27 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(instance.exports.main(0, 3), 3);
 })();
 
+(function MultiIfParamOneArmedTest() {
+  print("MultiIfParamOneArmedTest");
+  let builder = new WasmModuleBuilder();
+  let sig_i_i = builder.addType(kSig_i_i);
+
+  builder.addFunction("main", kSig_i_i)
+    .addBody([
+      kExprLocalGet, 0,
+      kExprLocalGet, 0,
+      kExprIf, sig_i_i,
+      kExprI32Const, 5,
+      kExprI32Add,
+      kExprEnd])
+    .exportAs("main");
+
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  assertEquals(instance.exports.main(0), 0);
+  assertEquals(instance.exports.main(1), 6);
+})();
+
 (function MultiResultTest() {
   print("MultiResultTest");
   let builder = new WasmModuleBuilder();