[turbofan] Restrict add folding

..to the case where the intermediary add is unused.

Bug: chromium:967186
Change-Id: I8ff95e71fbad88b9b1544f375303eb5400377631
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632071Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61875}

src/compiler/machine-operator-reducer.cc

@@ -754,7 +754,7 @@ Reduction MachineOperatorReducer::ReduceInt32Add(Node* node) {
   // (x + Int32Constant(a)) + Int32Constant(b)) => x + Int32Constant(a + b)
   if (m.right().HasValue() && m.left().IsInt32Add()) {
     Int32BinopMatcher n(m.left().node());
-    if (n.right().HasValue()) {
+    if (n.right().HasValue() && m.OwnsInput(m.left().node())) {
       node->ReplaceInput(1, Int32Constant(base::AddWithWraparound(
                                 m.right().Value(), n.right().Value())));
       node->ReplaceInput(0, n.left().node());
@@ -775,7 +775,7 @@ Reduction MachineOperatorReducer::ReduceInt64Add(Node* node) {
   // (x + Int64Constant(a)) + Int64Constant(b)) => x + Int64Constant(a + b)
   if (m.right().HasValue() && m.left().IsInt64Add()) {
     Int64BinopMatcher n(m.left().node());
-    if (n.right().HasValue()) {
+    if (n.right().HasValue() && m.OwnsInput(m.left().node())) {
       node->ReplaceInput(1, Int64Constant(base::AddWithWraparound(
                                 m.right().Value(), n.right().Value())));
       node->ReplaceInput(0, n.left().node());

src/compiler/node-matchers.h

@@ -254,6 +254,15 @@ struct BinopMatcher : public NodeMatcher {
   bool IsFoldable() const { return left().HasValue() && right().HasValue(); }
   bool LeftEqualsRight() const { return left().node() == right().node(); }
 
+  bool OwnsInput(Node* input) {
+    for (Node* use : input->uses()) {
+      if (use != node()) {
+        return false;
+      }
+    }
+    return true;
+  }
+
  protected:
   void SwapInputs() {
     std::swap(left_, right_);