Simplify branch hint instrumentation (#8624)

The previous branch hint instrumentation logic would introduce a scratch
local to hold the condition so it could be passed into both the logging
function and the original branching instruction. The de-instrumentation
pass would then need to find this local and attempt to undo the data
flow change. Simplify all of this by having the logging function return
the condition value so it can interpose between the condition and the
branch without any new locals. De-instrumentation can now just replace
the call to the log function with its condition parameter.

To allow further simplification, also change the order of parameters to
the logging function so the condition value is the first parameter. This
ensures that we don't need to introduce a scratch local even when the
condition is a `pop`, because the pop will remain the leftmost leaf
expression in the catch body.

Author: tlively

scripts/fuzz_opt.py

@@ -2281,7 +2281,7 @@ def handle(self, wasm):
         for line in out.splitlines():
             if line.startswith(LOG_BRANCH_PREFIX):
                 # (1:-1 strips away the '[', ']' at the edges)
-                _, _, id_, hint, actual = line[1:-1].split(' ')
+                _, _, actual, hint, id_ = line[1:-1].split(' ')
                 all_ids.add(id_)
                 if hint != actual:
                     # This hint was misleading.
@@ -2443,7 +2443,7 @@ def handle(self, wasm):
                 continue
             for line in group:
                 if line.startswith(LOG_BRANCH_PREFIX):
-                    _, _, id_, hint, actual = line[1:-1].split(' ')
+                    _, _, actual, hint, id_ = line[1:-1].split(' ')
                     hint = int(hint)
                     actual = int(actual)
                     assert hint in (0, 1)

scripts/fuzz_shell.js

@@ -400,8 +400,9 @@ var baseImports = {
       });
     },
 
-    'log-branch': (id, expected, actual) => {
-      console.log(`[LoggingExternalInterface log-branch ${id} ${expected} ${actual}]`);
+    'log-branch': (actual, expected, id) => {
+      console.log(`[LoggingExternalInterface log-branch ${actual} ${expected} ${id}]`);
+      return actual;
     },
   },
   // Emscripten support.