[Liftoff] Fix i32.eqz on ia32

Ensure that for setcc, we only use a byte register as destination
register.

R=titzer@chromium.org

Bug: v8:6600, chromium:800756
Change-Id: Ie33f3faf602e7eda845205ba0ed2d9966460fd54
Reviewed-on: https://chromium-review.googlesource.com/860640Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50508}

src/wasm/baseline/ia32/liftoff-assembler-ia32.h

@@ -323,9 +323,16 @@ void LiftoffAssembler::emit_i32_shr(Register dst, Register lhs, Register rhs) {
 }
 
 void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  Register tmp_byte_reg = dst;
+  // Only the lower 4 registers can be addressed as 8-bit registers.
+  if (!dst.is_byte_register()) {
+    LiftoffRegList pinned = LiftoffRegList::ForRegs(src);
+    tmp_byte_reg = GetUnusedRegister(liftoff::kByteRegs, pinned).gp();
+  }
+
   test(src, src);
-  setcc(zero, dst);
-  movzx_b(dst, dst);
+  setcc(zero, tmp_byte_reg);
+  movzx_b(dst, tmp_byte_reg);
 }
 
 void LiftoffAssembler::emit_i32_clz(Register dst, Register src) {

test/mjsunit/regress/wasm/regress-800756.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction(undefined, kSig_i_iii).addBody([
+  kExprI32Const, 0,         // i32.const 0
+  kExprI32LoadMem8S, 0, 0,  // i32.load8_s offset=0 align=0
+  kExprI32Eqz,              // i32.eqz
+]);
+builder.instantiate();