[wasm-simd] Fix i32x4.extadd_pairwise_i16x8_u codegen

It did not handle the case where dst == src. We switch the registers
used around to write to scratch first and ensure we don't overwrite dst.

Bug: chromium:1187831
Change-Id: Idf447aa1a3eff3920f2dfa3e0ec11efae37778cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762425Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73521}

src/codegen/ia32/macro-assembler-ia32.cc

@@ -1230,12 +1230,12 @@ void TurboAssembler::I32x4ExtAddPairwiseI16x8U(XMMRegister dst, XMMRegister src,
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope avx_scope(this, AVX);
     // src = |a|b|c|d|e|f|g|h| (low)
-    // dst = |0|a|0|c|0|e|0|g|
-    vpsrld(dst, src, 16);
-    // scratch = |0|b|0|d|0|f|0|h|
-    vpblendw(tmp, src, dst, 0xAA);
+    // scratch = |0|a|0|c|0|e|0|g|
+    vpsrld(tmp, src, 16);
+    // dst = |0|b|0|d|0|f|0|h|
+    vpblendw(dst, src, tmp, 0xAA);
     // dst = |a+b|c+d|e+f|g+h|
-    vpaddd(dst, dst, tmp);
+    vpaddd(dst, tmp, dst);
   } else if (CpuFeatures::IsSupported(SSE4_1)) {
     CpuFeatureScope sse_scope(this, SSE4_1);
     // There is a potentially better lowering if we get rip-relative constants,

src/codegen/x64/macro-assembler-x64.cc

@@ -2660,12 +2660,12 @@ void TurboAssembler::I32x4ExtAddPairwiseI16x8U(XMMRegister dst,
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope avx_scope(this, AVX);
     // src = |a|b|c|d|e|f|g|h| (low)
-    // dst = |0|a|0|c|0|e|0|g|
-    vpsrld(dst, src, 16);
-    // scratch = |0|b|0|d|0|f|0|h|
-    vpblendw(kScratchDoubleReg, src, dst, 0xAA);
+    // scratch = |0|a|0|c|0|e|0|g|
+    vpsrld(kScratchDoubleReg, src, 16);
+    // dst = |0|b|0|d|0|f|0|h|
+    vpblendw(dst, src, kScratchDoubleReg, 0xAA);
     // dst = |a+b|c+d|e+f|g+h|
-    vpaddd(dst, dst, kScratchDoubleReg);
+    vpaddd(dst, kScratchDoubleReg, dst);
   } else if (CpuFeatures::IsSupported(SSE4_1)) {
     CpuFeatureScope sse_scope(this, SSE4_1);
     // There is a potentially better lowering if we get rip-relative constants,

test/mjsunit/regress/wasm/regress-1187831.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+builder.addType(makeSig([], []));
+builder.setTableBounds(1, 1);
+builder.addElementSegment(0, 0, false, [0]);
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */)
+  .addBodyWithEnd([
+// signature: i_iii
+// body:
+kExprI32Const, 0x03,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kExprI32Const, 0x00,  // i32.const
+kSimdPrefix, kExprI8x16ReplaceLane, 0x00,  // i8x16.replace_lane
+kSimdPrefix, kExprI32x4ExtAddPairwiseI16x8U,  // i32x4.extadd_pairwise_i16x8_u
+kSimdPrefix, kExprI8x16ExtractLaneU, 0x00,  // i8x16.extract_lane_u
+kExprEnd,  // end @15
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(3, instance.exports.main(1, 2, 3));