[turbofan] Add missing HasValue check in BitfieldCheck::Detect

The value of a node was accessed without prior HasValue check. With
WebAssembly this node is not guaranteed to be a value.

R=mslekova@chromium.org

Change-Id: I62170183f3940a04b0550dfbb78cb49d2f5d7f72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504250
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70833}

src/compiler/machine-operator-reducer.cc

@@ -1659,7 +1659,7 @@ struct BitfieldCheck {
       Uint32BinopMatcher eq(node);
       if (eq.left().IsWord32And()) {
         Uint32BinopMatcher mand(eq.left().node());
-        if (mand.right().HasValue()) {
+        if (mand.right().HasValue() && eq.right().HasValue()) {
           BitfieldCheck result{mand.left().node(), mand.right().Value(),
                                eq.right().Value(), false};
           if (mand.left().IsTruncateInt64ToInt32()) {

test/unittests/compiler/machine-operator-reducer-unittest.cc

@@ -838,6 +838,16 @@ TEST_F(MachineOperatorReducerTest, Word32AndWithBitFields) {
   }
 }
 
+TEST_F(MachineOperatorReducerTest, Word32AndWithIncorrectBitField) {
+  Reduction const r = Reduce(graph()->NewNode(
+      machine()->Word32And(), Parameter(0),
+      graph()->NewNode(machine()->Word32Equal(),
+                       graph()->NewNode(machine()->Word32And(), Parameter(0),
+                                        Int32Constant(4)),
+                       Parameter(0))));
+  ASSERT_FALSE(r.Changed());
+}
+
 // -----------------------------------------------------------------------------
 // Word32Or