[wasm] Revisit removed Store node inputs in escape analysis

The stored value might be an allocation that can be removed once the
Store node is removed. We need to revisit this node manually because
inputs in a node removed with ReplaceWithValue are not revisited
automatically.

Bug: v8:11510
Change-Id: I57cb8955a3e2f7143474ad7ced9d946e6d1cc18e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277880Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77899}

src/compiler/wasm-escape-analysis.cc

@@ -44,6 +44,12 @@ Reduction WasmEscapeAnalysis::ReduceAllocateRaw(Node* node) {
     Node* use = edge.from();
     DCHECK(!use->IsDead());
     DCHECK_EQ(use->opcode(), IrOpcode::kStoreToObject);
+    // The value stored by this StoreToObject node might be another allocation
+    // which has no more uses. Therefore we have to revisit it. Note that this
+    // will not happen automatically: ReplaceWithValue does not trigger revisits
+    // of former inputs of the replaced node.
+    Node* stored_value = NodeProperties::GetValueInput(use, 2);
+    Revisit(stored_value);
     ReplaceWithValue(use, mcgraph_->Dead(), NodeProperties::GetEffectInput(use),
                      mcgraph_->Dead());
     use->Kill();

test/mjsunit/wasm/gc-optimizations.js

@@ -318,7 +318,7 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(value_0 + value_1, instance.exports.main());
 })();
 
-(function EscapeAnalysis() {
+(function EscapeAnalysisWithLoadElimination() {
   print(arguments.callee.name);
 
   let builder = new WasmModuleBuilder();
@@ -343,6 +343,36 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(42, instance.exports.main(42));
 })();
 
+(function EscapeAnalysisWithInterveningEffect() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+  let struct1 = builder.addStruct([makeField(kWasmI32, true)]);
+  let struct2 = builder.addStruct([makeField(wasmOptRefType(struct1), true)]);
+
+  let nop = builder.addFunction("nop", kSig_v_v).addBody([]);
+
+  // TF should eliminate both allocations in this function, despite the
+  // intervening effectful call.
+  builder.addFunction("main", kSig_i_i)
+    .addBody([
+      kExprLocalGet, 0,
+      kGCPrefix, kExprRttCanon, struct1,
+      kGCPrefix, kExprStructNewWithRtt, struct1,
+
+      kExprCallFunction, nop.index,
+
+      kGCPrefix, kExprRttCanon, struct2,
+      kGCPrefix, kExprStructNewWithRtt, struct2,
+
+      kExprLocalGet, 0,
+      kExprReturn])
+    .exportFunc();
+
+  let instance = builder.instantiate({});
+  assertEquals(42, instance.exports.main(42));
+})();
+
 (function AllocationFolding() {
   print(arguments.callee.name);
   var builder = new WasmModuleBuilder();