Revert "[wasm-simd] Fix i32x4.extadd_pairwise_i16x8_u codegen"

This reverts commit 1a69d8d8.

Reason for revert: Fails on nosse: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux/41365/overview

Original change's description:
> [wasm-simd] Fix i32x4.extadd_pairwise_i16x8_u codegen
>
> It did not handle the case where dst == src. We switch the registers
> used around to write to scratch first and ensure we don't overwrite dst.
>
> Bug: chromium:1187831
> Change-Id: Idf447aa1a3eff3920f2dfa3e0ec11efae37778cd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762425
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73521}

Bug: chromium:1187831
Change-Id: I40d360b16338ef52e7e4327d4166c194ee950827
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773802
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73522}

src/codegen/ia32/macro-assembler-ia32.cc

@@ -1230,12 +1230,12 @@ void TurboAssembler::I32x4ExtAddPairwiseI16x8U(XMMRegister dst, XMMRegister src,
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope avx_scope(this, AVX);
     // src = |a|b|c|d|e|f|g|h| (low)
-    // scratch = |0|a|0|c|0|e|0|g|
-    vpsrld(tmp, src, 16);
-    // dst = |0|b|0|d|0|f|0|h|
-    vpblendw(dst, src, tmp, 0xAA);
+    // dst = |0|a|0|c|0|e|0|g|
+    vpsrld(dst, src, 16);
+    // scratch = |0|b|0|d|0|f|0|h|
+    vpblendw(tmp, src, dst, 0xAA);
     // dst = |a+b|c+d|e+f|g+h|
-    vpaddd(dst, tmp, dst);
+    vpaddd(dst, dst, tmp);
   } else if (CpuFeatures::IsSupported(SSE4_1)) {
     CpuFeatureScope sse_scope(this, SSE4_1);
     // There is a potentially better lowering if we get rip-relative constants,

src/codegen/x64/macro-assembler-x64.cc

@@ -2660,12 +2660,12 @@ void TurboAssembler::I32x4ExtAddPairwiseI16x8U(XMMRegister dst,
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope avx_scope(this, AVX);
     // src = |a|b|c|d|e|f|g|h| (low)
-    // scratch = |0|a|0|c|0|e|0|g|
-    vpsrld(kScratchDoubleReg, src, 16);
-    // dst = |0|b|0|d|0|f|0|h|
-    vpblendw(dst, src, kScratchDoubleReg, 0xAA);
+    // dst = |0|a|0|c|0|e|0|g|
+    vpsrld(dst, src, 16);
+    // scratch = |0|b|0|d|0|f|0|h|
+    vpblendw(kScratchDoubleReg, src, dst, 0xAA);
     // dst = |a+b|c+d|e+f|g+h|
-    vpaddd(dst, kScratchDoubleReg, dst);
+    vpaddd(dst, dst, kScratchDoubleReg);
   } else if (CpuFeatures::IsSupported(SSE4_1)) {
     CpuFeatureScope sse_scope(this, SSE4_1);
     // There is a potentially better lowering if we get rip-relative constants,

test/mjsunit/regress/wasm/regress-1187831.js

-// Copyright 2021 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --wasm-staging
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-const builder = new WasmModuleBuilder();
-builder.addMemory(16, 32, false, true);
-builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
-builder.addType(makeSig([], []));
-builder.setTableBounds(1, 1);
-builder.addElementSegment(0, 0, false, [0]);
-// Generate function 1 (out of 1).
-builder.addFunction(undefined, 0 /* sig */)
-  .addBodyWithEnd([
-// signature: i_iii
-// body:
-kExprI32Const, 0x03,  // i32.const
-kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
-kExprI32Const, 0x00,  // i32.const
-kSimdPrefix, kExprI8x16ReplaceLane, 0x00,  // i8x16.replace_lane
-kSimdPrefix, kExprI32x4ExtAddPairwiseI16x8U,  // i32x4.extadd_pairwise_i16x8_u
-kSimdPrefix, kExprI8x16ExtractLaneU, 0x00,  // i8x16.extract_lane_u
-kExprEnd,  // end @15
-]);
-builder.addExport('main', 0);
-const instance = builder.instantiate();
-assertEquals(3, instance.exports.main(1, 2, 3));