[turbofan] Do not optimize Trap with siblings inside If

Trying to optimize in such case breaks down the optimization, as we
end up with potentially non-eliminatable nodes that depend on the dead
IfTrue/IfFalse node.
Drive-by: Clean up dead nodes with {Kill()}.

Bug: v8:11510, chromium:1255354

Change-Id: Ia89fe6c243974c3c2abac6ad80bd4677a935f637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3200073Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77211}

src/compiler/branch-elimination.cc

@@ -222,6 +222,7 @@ bool BranchElimination::TryPullTrapIntoMerge(Node* node) {
     merge->ReplaceInput(i, new_merge_inputs[i]);
   }
   ReplaceWithValue(node, dead(), dead(), merge);
+  node->Kill();
   Revisit(merge);
 
   return true;
@@ -252,8 +253,8 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
   if (from_input.LookupCondition(condition, &previous_branch,
                                  &condition_value)) {
     if (condition_value == trapping_condition) {
-      // Special case: Trap directly inside a branch. Replace the branch with
-      // the trap.
+      // Special case: Trap directly inside a branch without sibling nodes.
+      // Replace the branch with the trap.
       //    condition  control              condition  control
       //     |   \      /                        \      /
       //     |    Branch                          TrapIf
@@ -265,7 +266,8 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
       //   <subgraph1>                     <subgraph1>
       // (and symmetrically for TrapUnless.)
       if ((control_input->opcode() == IrOpcode::kIfTrue ||
-           control_input->opcode() == IrOpcode::kIfFalse)) {
+           control_input->opcode() == IrOpcode::kIfFalse) &&
+          control_input->UseCount() == 1) {
         Node* branch = NodeProperties::GetControlInput(control_input);
         DCHECK_EQ(branch->opcode(), IrOpcode::kBranch);
         if (condition == NodeProperties::GetValueInput(branch, 0)) {
@@ -279,6 +281,9 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
                              NodeProperties::GetControlInput(branch));
           ReplaceWithValue(node, dead(), dead(), dead());
           ReplaceWithValue(other_if_branch, node, node, node);
+          other_if_branch->Kill();
+          control_input->Kill();
+          branch->Kill();
           return Changed(node);
         }
       }

test/mjsunit/regress/wasm/regress-1255354.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --no-liftoff
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var builder = new WasmModuleBuilder();
+
+builder.addMemory(1, 1, /* exported = */ false);
+
+builder.addFunction("main", kSig_i_i).addBody([
+    kExprLocalGet, 0,
+    kExprIf, kWasmI32,
+      kExprLocalGet, 0,
+    kExprElse,
+      kExprI32Const, 42, // value
+      kExprI32Const, 0,  // index
+      kExprI32StoreMem, 0, 0,
+      kExprI32Const, 11,
+      kExprLocalGet, 0,
+      kExprI32DivS,
+    kExprEnd
+  ]).exportFunc();
+
+var instance = builder.instantiate({});