[wasm] Use the right control input for the diamond in GrowMemory.

The fuzzer found out that "start" is not always a good control input
for a diamond.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2295173002
Cr-Commit-Position: refs/heads/master@{#39046}

src/compiler/wasm-compiler.cc

@@ -1675,6 +1675,8 @@ Node* WasmGraphBuilder::BuildGrowMemory(Node* input) {
           jsgraph()->Uint32Constant(wasm::WasmModule::kMaxMemPages)),
       BranchHint::kTrue);
 
+  check_input_range.Chain(*control_);
+
   Runtime::FunctionId function_id = Runtime::kWasmGrowMemory;
   const Runtime::Function* function = Runtime::FunctionForId(function_id);
   CallDescriptor* desc = Linkage::GetRuntimeCallDescriptor(

src/wasm/wasm-macro-gen.h

@@ -579,6 +579,12 @@ class LocalDeclEncoder {
 #define WASM_I32_REINTERPRET_F32(x) x, kExprI32ReinterpretF32
 #define WASM_I64_REINTERPRET_F64(x) x, kExprI64ReinterpretF64
 
+//------------------------------------------------------------------------------
+// Memory Operations.
+//------------------------------------------------------------------------------
+#define WASM_GROW_MEMORY(x) x, kExprGrowMemory
+#define WASM_MEMORY_SIZE kExprMemorySize
+
 //------------------------------------------------------------------------------
 // Simd Operations.
 //------------------------------------------------------------------------------

test/cctest/wasm/test-run-wasm-module.cc

@@ -256,3 +256,18 @@ TEST(Run_WasmModule_Serialization) {
     new_ctx->Exit();
   }
 }
+
+TEST(Run_WasmModule_GrowMemoryInIf) {
+  TestSignatures sigs;
+  v8::base::AccountingAllocator allocator;
+  Zone zone(&allocator);
+  WasmModuleBuilder* builder = new (&zone) WasmModuleBuilder(&zone);
+  uint16_t f_index = builder->AddFunction();
+  WasmFunctionBuilder* f = builder->FunctionAt(f_index);
+  f->SetSignature(sigs.i_v());
+  ExportAsMain(f);
+  byte code[] = {WASM_IF_ELSE(WASM_I32V(0), WASM_GROW_MEMORY(WASM_I32V(1)),
+                              WASM_I32V(12))};
+  f->EmitCode(code, sizeof(code));
+  TestModule(&zone, builder, 12);
+}