[liftoff][ia32] Fix AtomicStore register spilling

If we need a byte register, but {src} is none, we should definitely use
another register.

R=ahaas@chromium.org

Bug: chromium:1048241
Fixed: chromium:1048241
Change-Id: I3396826986e1823250ad6855b84f4b05faaf3b90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2036073Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66095}

src/wasm/baseline/ia32/liftoff-assembler-ia32.h

@@ -450,15 +450,17 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
   pinned = pinned | LiftoffRegList::ForRegs(dst_addr, src, offset_reg);
 
   // Ensure that {src} is a valid and otherwise unused register.
-  if (!src_candidates.has(src) || cache_state()->is_used(src)) {
-    // If there is an unused candidate register, use that. Otherwise, spill
-    // other uses of {src}.
-    if (cache_state()->has_unused_register(src_candidates, pinned)) {
+  if (!src_candidates.has(src) || cache_state_.is_used(src)) {
+    // If there are no unused candidate registers, but {src} is a candidate,
+    // then spill other uses of {src}. Otherwise spill any candidate register
+    // and use that.
+    if (!cache_state_.has_unused_register(src_candidates, pinned) &&
+        src_candidates.has(src)) {
+      SpillRegister(src);
+    } else {
       Register safe_src = GetUnusedRegister(src_candidates, pinned).gp();
       mov(safe_src, src_gp);
       src_gp = safe_src;
-    } else {
-      SpillRegister(src);
     }
   }
 

test/mjsunit/regress/wasm/regress-1048241.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+const sig = makeSig([kWasmF64, kWasmI64, kWasmI32, kWasmF64], []);
+builder.addFunction(undefined, sig).addBody([
+  kExprI32Const, 0x00,                               // -
+  kExprI32Const, 0x00,                               // -
+  kExprI32Const, 0x00,                               // -
+  kAtomicPrefix, kExprI32AtomicXor16U, 0x01, 0x00,   // -
+  kAtomicPrefix, kExprI32AtomicStore8U, 0x00, 0x00,  // -
+]);
+builder.instantiate();