[wasm] Fix ToNumber conversion

src/compiler/wasm-compiler.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/wasm-compiler.h"
 
 #include <memory>
 
 #include "src/isolate-inl.h"
 
@@ skipping 2358 matching lines @@
     case wasm::kAstF64:
       return BuildChangeFloat64ToTagged(node);
     case wasm::kAstStmt:
       return jsgraph()->UndefinedConstant();
     default:
       UNREACHABLE();
       return nullptr;
   }
 }
 
-Node* WasmGraphBuilder::BuildJavaScriptToNumber(Node* node, Node* context,
-                                                Node* effect, Node* control) {
+Node* WasmGraphBuilder::BuildJavaScriptToNumber(Node* node, Node* context) {
   Callable callable = CodeFactory::ToNumber(jsgraph()->isolate());
   CallDescriptor* desc = Linkage::GetStubCallDescriptor(
       jsgraph()->isolate(), jsgraph()->zone(), callable.descriptor(), 0,
       CallDescriptor::kNoFlags, Operator::kNoProperties);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
 
   Node* result = graph()->NewNode(jsgraph()->common()->Call(desc), stub_code,
-                                  node, context, effect, control);
+                                  node, context, *effect_, *control_);
 
   *effect_ = result;
 
   return result;
 }
 
 bool CanCover(Node* value, IrOpcode::Value opcode) {
   if (value->opcode() != opcode) return false;
   bool first = true;
   for (Edge const edge : value->use_edges()) {
@@ skipping 99 matching lines @@
 
   Node* merge = graph()->NewNode(common->Merge(2), if_not_smi, if_smi);
   Node* phi = graph()->NewNode(common->Phi(MachineRepresentation::kFloat64, 2),
                                vnot_smi, vfrom_smi, merge);
 
   return phi;
 }
 
 Node* WasmGraphBuilder::FromJS(Node* node, Node* context,
                                wasm::LocalType type) {
+  DCHECK_NE(wasm::kAstStmt, type);
+
   // Do a JavaScript ToNumber.
-  Node* num = BuildJavaScriptToNumber(node, context, *effect_, *control_);
+  Node* num = BuildJavaScriptToNumber(node, context);
 
   // Change representation.
   SimplifiedOperatorBuilder simplified(jsgraph()->zone());
   num = BuildChangeTaggedToFloat64(num);
 
   switch (type) {
     case wasm::kAstI32: {
       num = graph()->NewNode(jsgraph()->machine()->TruncateFloat64ToWord32(),
                              num);
       break;
     }
     case wasm::kAstS128:
     case wasm::kAstI64:
       // Throw a TypeError. The native context is good enough here because we
       // only throw a TypeError.
       return BuildCallToRuntime(Runtime::kWasmThrowTypeError, jsgraph(),
                                 jsgraph()->isolate()->native_context(), nullptr,
                                 0, effect_, *control_);
     case wasm::kAstF32:
       num = graph()->NewNode(jsgraph()->machine()->TruncateFloat64ToFloat32(),
                              num);
       break;
     case wasm::kAstF64:
       break;
-    case wasm::kAstStmt:
-      num = jsgraph()->Int32Constant(0);
-      break;
     default:
       UNREACHABLE();
       return nullptr;
   }
   return num;
 }
 
 Node* WasmGraphBuilder::BuildChangeInt32ToSmi(Node* value) {
   if (jsgraph()->machine()->Is64()) {
     value = graph()->NewNode(jsgraph()->machine()->ChangeInt32ToInt64(), value);
@@ skipping 232 matching lines @@
     // is only needed if the target is a constructor to throw a TypeError, if
     // the target is a native function, or if the target is a callable JSObject,
     // which can only be constructed by the runtime.
     args[pos++] = HeapConstant(isolate->native_context());
     args[pos++] = *effect_;
     args[pos++] = *control_;
 
     call = graph()->NewNode(jsgraph()->common()->Call(desc), pos, args);
   }
 
+  *effect_ = call;
+
   // Convert the return value back.
-  Node* ret;
-  Node* val =
-      FromJS(call, HeapConstant(isolate->native_context()),
-             sig->return_count() == 0 ? wasm::kAstStmt : sig->GetReturn());
-  Node* pop_size = jsgraph()->Int32Constant(0);
-    ret = graph()->NewNode(jsgraph()->common()->Return(), pop_size, val, call,
-                           start);
+  Node* i32_zero = jsgraph()->Int32Constant(0);
+  Node* val = sig->return_count() == 0
+                  ? i32_zero
+                  : FromJS(call, HeapConstant(isolate->native_context()),
+                           sig->GetReturn());
+  Node* ret = graph()->NewNode(jsgraph()->common()->Return(), i32_zero, val,
+                               *effect_, start);
 
   MergeControlToEnd(jsgraph(), ret);
 }
 
 Node* WasmGraphBuilder::MemBuffer(uint32_t offset) {
   DCHECK(module_ && module_->instance);
   if (offset == 0) {
     if (!mem_buffer_) {
       mem_buffer_ = jsgraph()->RelocatableIntPtrConstant(
           reinterpret_cast<uintptr_t>(module_->instance->mem_start),
@@ skipping 728 matching lines @@
                       Smi::FromInt(instruction.instr_offset));
     fn_protected->set(Code::kTrapDataSize * i + Code::kTrapLandingOffset,
                       Smi::FromInt(instruction.landing_offset));
   }
   return fn_protected;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8