[wasm][liftoff] Fix index in the initialization of locals

There was a bug that only the last local with a reference type got
initialized to null, all other locals kept the initial value of 0. This
CL fixes this bug.

Additionally this CL optimizes the code slightly. Before this CL, the
null reference was loaded from the instance for every local with
reference type. Now the null reference is cached after the first load
and then used for all other locals.

R=thibaudm@chromium.org

Bug: chromium:1167587
Change-Id: Ic11fc76b650e6daa029491154744fc132778f70d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2632695
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72139}

src/wasm/baseline/liftoff-compiler.cc

@@ -695,13 +695,17 @@ class LiftoffCompiler {
 
     if (FLAG_experimental_liftoff_extern_ref) {
       // Initialize all reference type locals with ref.null.
-      for (uint32_t param_idx = num_params; param_idx < __ num_locals();
-           ++param_idx) {
-        ValueType type = decoder->local_type(param_idx);
+      Register null_ref_reg = no_reg;
+      for (uint32_t local_index = num_params; local_index < __ num_locals();
+           ++local_index) {
+        ValueType type = decoder->local_type(local_index);
         if (type.is_reference_type()) {
-          LiftoffRegister result = __ GetUnusedRegister(kGpReg, {});
-          LoadNullValue(result.gp(), {});
-          __ Spill(__ cache_state()->stack_state.back().offset(), result, type);
+          if (null_ref_reg == no_reg) {
+            null_ref_reg = __ GetUnusedRegister(kGpReg, {}).gp();
+            LoadNullValue(null_ref_reg, {});
+          }
+          __ Spill(__ cache_state()->stack_state[local_index].offset(),
+                   LiftoffRegister(null_ref_reg), type);
         }
       }
     }

test/mjsunit/wasm/externref.js

@@ -206,15 +206,18 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function testExternRefLocalDefaultValue() {
   print(arguments.callee.name);
-  const builder = new WasmModuleBuilder();
-  builder.addFunction('main', kSig_r_v)
-      .addBody([kExprLocalGet, 0])
-      .addLocals(kWasmExternRef, 1)
-      .exportFunc();
+  const numLocals = 3;
+  for (let i = 0; i < numLocals; ++i) {
+    const builder = new WasmModuleBuilder();
+    builder.addFunction('main', kSig_r_v)
+        .addBody([kExprLocalGet, i])
+        .addLocals(kWasmExternRef, numLocals)
+        .exportFunc();
 
-  const instance = builder.instantiate();
+    const instance = builder.instantiate();
 
-  assertEquals(null, instance.exports.main());
+    assertEquals(null, instance.exports.main());
+  }
 })();
 
 (function testImplicitReturnNullAsExternRef() {