[wasm-simd][scalar-lowering] Fix lowering for unsigned average

Small int nodes are stored in sign-extended form, for unsigned average,
mask away the top bits before performing operation.

Bug: v8:10507
Change-Id: I04d3be5758e6ee3fd946adca0943b2874910b4cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2405751
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69892}

src/compiler/simd-scalar-lowering.cc

@@ -2058,11 +2058,18 @@ void SimdScalarLowering::LowerNode(Node* node) {
       Node** rep_right = GetReplacementsWithType(node->InputAt(1), rep_type);
       int num_lanes = NumLanes(rep_type);
       Node** rep_node = zone()->NewArray<Node*>(num_lanes);
+      // Nodes are stored signed, so mask away the top bits.
       // rounding_average(left, right) = (left + right + 1) >> 1
+      const int bit_mask = num_lanes == 16 ? kMask8 : kMask16;
       for (int i = 0; i < num_lanes; ++i) {
+        Node* mask_left = graph()->NewNode(machine()->Word32And(), rep_left[i],
+                                           mcgraph_->Int32Constant(bit_mask));
+        Node* mask_right =
+            graph()->NewNode(machine()->Word32And(), rep_right[i],
+                             mcgraph_->Int32Constant(bit_mask));
         Node* left_plus_right_plus_one = graph()->NewNode(
             machine()->Int32Add(),
-            graph()->NewNode(machine()->Int32Add(), rep_left[i], rep_right[i]),
+            graph()->NewNode(machine()->Int32Add(), mask_left, mask_right),
             mcgraph_->Int32Constant(1));
         rep_node[i] =
             graph()->NewNode(machine()->Word32Shr(), left_plus_right_plus_one,