[wasm] Do not create TF nodes during verification

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone/zone-containers.h"
@@ skipping 1422 matching lines @@
 
     for (unsigned i = 0; i < c->merge.arity; i++) {
       Value& val = GetMergeValueFromStack(c, i);
       Value& old =
           c->merge.arity == 1 ? c->merge.vals.first : c->merge.vals.array[i];
       if (val.type != old.type) {
         error(pc_, pc_, "type error in merge[%d] (expected %s, got %s)", i,
               WasmOpcodes::TypeName(old.type), WasmOpcodes::TypeName(val.type));
         return;
       }
-      old.node =
-          first ? val.node : CreateOrMergeIntoPhi(old.type, target->control,
-                                                  old.node, val.node);
+      if (builder_) {
+        old.node =
+            first ? val.node : CreateOrMergeIntoPhi(old.type, target->control,
+                                                    old.node, val.node);
+      } else {
+        old.node = nullptr;
+      }
     }
   }
 
   void SetEnv(const char* reason, SsaEnv* env) {
 #if DEBUG
     if (FLAG_trace_wasm_decoder) {
       char state = 'X';
       if (env) {
         switch (env->state) {
           case SsaEnv::kReached:
@@ skipping 136 matching lines @@
         break;
       }
       default:
         UNREACHABLE();
     }
     return from->Kill();
   }
 
   TFNode* CreateOrMergeIntoPhi(LocalType type, TFNode* merge, TFNode* tnode,
                                TFNode* fnode) {
+    DCHECK_NOT_NULL(builder_);
     if (builder_->IsPhiWithMerge(tnode, merge)) {
       builder_->AppendToPhi(tnode, fnode);
     } else if (tnode != fnode) {
       uint32_t count = builder_->InputCount(merge);
       TFNode** vals = builder_->Buffer(count);
       for (uint32_t j = 0; j < count - 1; j++) vals[j] = tnode;
       vals[count - 1] = fnode;
       return builder_->Phi(type, count, vals, merge);
     }
     return tnode;
@@ skipping 324 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   WasmFullDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8