[wasm-simd][ia32] Fix instruction operand constraints for ext mul

Ext mul's codegen assumes that all inputs are in registers, but the
instruction-selector wasn't the correct constraints. The codegen for ext
mul is slightly complicated so we chose to restrict the inputs to be
registers rather than changing codegen.

Bug: chromium:1165966,v8:11262
Change-Id: I5d4eb56d17a4d0a2927b089dbf74362c7e7ff4fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2626711Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72073}

src/compiler/backend/ia32/instruction-selector-ia32.cc

@@ -331,6 +331,16 @@ void VisitRROSimd(InstructionSelector* selector, Node* node,
                    g.UseRegister(node->InputAt(1)));
   }
 }
+void VisitRRRSimd(InstructionSelector* selector, Node* node,
+                  ArchOpcode opcode) {
+  IA32OperandGenerator g(selector);
+  InstructionOperand dst = selector->IsSupported(AVX)
+                               ? g.DefineAsRegister(node)
+                               : g.DefineSameAsFirst(node);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  InstructionOperand operand1 = g.UseRegister(node->InputAt(1));
+  selector->Emit(opcode, dst, operand0, operand1);
+}
 
 void VisitRRISimd(InstructionSelector* selector, Node* node,
                   ArchOpcode opcode) {
@@ -2247,23 +2257,27 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(I64x2Add)                              \
   V(I64x2Sub)                              \
   V(I64x2Eq)                               \
-  V(I64x2ExtMulLowI32x4S)                  \
-  V(I64x2ExtMulHighI32x4S)                 \
-  V(I64x2ExtMulLowI32x4U)                  \
-  V(I64x2ExtMulHighI32x4U)                 \
   V(I32x4DotI16x8S)                        \
-  V(I32x4ExtMulLowI16x8S)                  \
-  V(I32x4ExtMulHighI16x8S)                 \
-  V(I32x4ExtMulLowI16x8U)                  \
-  V(I32x4ExtMulHighI16x8U)                 \
   V(I16x8RoundingAverageU)                 \
-  V(I16x8ExtMulLowI8x16S)                  \
-  V(I16x8ExtMulHighI8x16S)                 \
-  V(I16x8ExtMulLowI8x16U)                  \
-  V(I16x8ExtMulHighI8x16U)                 \
   V(I16x8Q15MulRSatS)                      \
   V(I8x16RoundingAverageU)
 
+// These opcodes require all inputs to be registers because the codegen is
+// simpler with all registers.
+#define SIMD_BINOP_RRR(V)  \
+  V(I64x2ExtMulLowI32x4S)  \
+  V(I64x2ExtMulHighI32x4S) \
+  V(I64x2ExtMulLowI32x4U)  \
+  V(I64x2ExtMulHighI32x4U) \
+  V(I32x4ExtMulLowI16x8S)  \
+  V(I32x4ExtMulHighI16x8S) \
+  V(I32x4ExtMulLowI16x8U)  \
+  V(I32x4ExtMulHighI16x8U) \
+  V(I16x8ExtMulLowI8x16S)  \
+  V(I16x8ExtMulHighI8x16S) \
+  V(I16x8ExtMulLowI8x16U)  \
+  V(I16x8ExtMulHighI8x16U)
+
 #define SIMD_UNOP_LIST(V)   \
   V(F32x4Sqrt)              \
   V(F32x4SConvertI32x4)     \
@@ -2656,6 +2670,14 @@ SIMD_BINOP_UNIFIED_SSE_AVX_LIST(VISIT_SIMD_BINOP_UNIFIED_SSE_AVX)
 #undef VISIT_SIMD_BINOP_UNIFIED_SSE_AVX
 #undef SIMD_BINOP_UNIFIED_SSE_AVX_LIST
 
+#define VISIT_SIMD_BINOP_RRR(OPCODE)                    \
+  void InstructionSelector::Visit##OPCODE(Node* node) { \
+    VisitRRRSimd(this, node, kIA32##OPCODE);            \
+  }
+SIMD_BINOP_RRR(VISIT_SIMD_BINOP_RRR)
+#undef VISIT_SIMD_BINOP_RRR
+#undef SIMD_BINOP_RRR
+
 // TODO(v8:9198): SSE requires operand1 to be a register as we don't have memory
 // alignment yet. For AVX, memory operands are fine, but can have performance
 // issues if not aligned to 16/32 bytes (based on load size), see SDM Vol 1,

test/mjsunit/regress/wasm/regress-1165966.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+// This test case is simplified slightly from a fuzzer-generated test case. It
+// causes spills for one of the inputs to kExprI64x2ExtMulHighI32x4U, which the
+// codegen incorrectly assumes will always be a register.
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, kSig_i_v)
+  .addLocals(kWasmI64, 1)
+  .addBodyWithEnd([
+// signature: i_v
+// body:
+kExprI32Const, 0x00,  // i32.const
+kExprI32Const, 0x00,  // i32.const
+kExprI32Const, 0x00,  // i32.const
+kExprSelectWithType, 0x01, 0x7f,  // select
+kExprMemoryGrow, 0x00,  // memory.grow
+kExprI32Const, 0xb0, 0xde, 0xc9, 0x03,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kExprI32Const, 0x00,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kExprI32Const, 0xb0, 0xe0, 0xc0, 0x01,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kSimdPrefix, kExprI64x2ExtMulHighI32x4U, 0x01,  // i64x2.extmul_high_i32x4_u
+kSimdPrefix, kExprF32x4Le,  // f32x4.le
+kSimdPrefix, kExprI32x4ExtractLane, 0x00,  // i32x4.extract_lane
+kExprI32DivS,  // i32.div_s
+kExprEnd,  // end @41
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertThrows(
+  () => instance.exports.main(),
+  WebAssembly.RuntimeError,
+  "divide by zero");

test/mjsunit/wasm/wasm-module-builder.js

@@ -693,6 +693,7 @@ let kExprI64x2ShrU = 0xcd;
 let kExprI64x2Add = 0xce;
 let kExprI64x2Sub = 0xd1;
 let kExprI64x2Mul = 0xd5;
+let kExprI64x2ExtMulHighI32x4U = 0xd7;
 let kExprF32x4Abs = 0xe0;
 let kExprF32x4Neg = 0xe1;
 let kExprF32x4Sqrt = 0xe3;