[atomics] Fix I64CmpExchg for narrow width operations

Change-Id: I1cf8d697b5a4408fb75332dc39be12c0a2ee0e5a
Bug: v8:8202, v8:6532
Reviewed-on: https://chromium-review.googlesource.com/1240907
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56254}

src/compiler/int64-lowering.cc

@@ -940,8 +940,15 @@ void Int64Lowering::LowerNode(Node* node) {
                                  machine()->Word32AtomicPairCompareExchange());
         ReplaceNodeWithProjections(node);
       } else {
-        LowerWord64AtomicNarrowOp(node,
-                                  machine()->Word32AtomicCompareExchange(type));
+        DCHECK(type == MachineType::Uint32() || type == MachineType::Uint16() ||
+               type == MachineType::Uint8());
+        Node* old_value = node->InputAt(2);
+        node->ReplaceInput(2, GetReplacementLow(old_value));
+        Node* new_value = node->InputAt(3);
+        node->ReplaceInput(3, GetReplacementLow(new_value));
+        NodeProperties::ChangeOp(node,
+                                 machine()->Word32AtomicCompareExchange(type));
+        ReplaceNode(node, node, graph()->NewNode(common()->Int32Constant(0)));
       }
       break;
     }

test/mjsunit/wasm/atomics.js

@@ -432,3 +432,33 @@ function TestStore(func, buffer, value, size) {
   assertThrows(() => GetAtomicBinOpFunction(kExprI32AtomicSub16U, 3, 0),
       WebAssembly.CompileError);
 })();
+
+function CmpExchgLoop(opcode, alignment) {
+  print("TestI64AtomicCompareExchangeLoop" + alignment);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "imported_mem", 0, 2, "shared");
+  builder.addFunction("main", makeSig([kWasmI32], []))
+      .addLocals({i64_count: 2})
+      .addBody([
+        kExprLoop, kWasmStmt,
+          kExprGetLocal, 0,
+          kExprGetLocal, 1,
+          kExprGetLocal, 2,
+          kAtomicPrefix, opcode, alignment, 0,
+          kExprGetLocal, 1,
+          kExprI64Ne,
+          kExprBrIf, 0,
+          kExprEnd
+      ])
+      .exportFunc();
+  let mem = new WebAssembly.Memory({initial: 2, maximum: 2, shared: true});
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {imported_mem: mem}});
+}
+
+(function TestAtomicCompareExchgLoop() {
+  CmpExchgLoop(kExprI64AtomicCompareExchange, 3);
+  CmpExchgLoop(kExprI64AtomicCompareExchange32U, 2);
+  CmpExchgLoop(kExprI64AtomicCompareExchange16U, 1);
+  CmpExchgLoop(kExprI64AtomicCompareExchange8U, 0);
+})();

test/mjsunit/wasm/wasm-constants.js

@@ -371,6 +371,10 @@ let kExprI32AtomicExchange16U = 0x44;
 let kExprI32AtomicCompareExchange = 0x48
 let kExprI32AtomicCompareExchange8U = 0x4a
 let kExprI32AtomicCompareExchange16U = 0x4b
+let kExprI64AtomicCompareExchange = 0x49
+let kExprI64AtomicCompareExchange8U = 0x4c;
+let kExprI64AtomicCompareExchange16U = 0x4d;
+let kExprI64AtomicCompareExchange32U = 0x4e;
 
 let kTrapUnreachable          = 0;
 let kTrapMemOutOfBounds       = 1;