[arm] Change fp_fixed registers to be allocatable registers

fp_fixed1 and fp_fixed2 are used by the S8x16Shuffle operation. They
need to be allocatable, so that they can be correctly marked as fixed
and spilled as required. The previous value of fp_fixed2, d29, is not in
the list of allocatable double registers, and not marked as fixed
appropriately.

One fix could be to extend the list of allocatable double registers, but
there is a comment there saying that the list is kept even-length to
make stack alignment easier. So rather than messing with that, we
instead change what fp_fixed1 and fp_fixed2 is, since S8x16Shuffle is
the only user, this is a simpler change.

Bug: chromium:1070078
Change-Id: Id7de9b256bad2cfb11b0f06b66eb80a48ff7827c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161565Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67372}

src/codegen/arm64/register-arm64.h

@@ -470,8 +470,9 @@ ALIAS_REGISTER(Register, padreg, x31);
 // Keeps the 0 double value.
 ALIAS_REGISTER(VRegister, fp_zero, d15);
 // MacroAssembler fixed V Registers.
-ALIAS_REGISTER(VRegister, fp_fixed1, d28);
-ALIAS_REGISTER(VRegister, fp_fixed2, d29);
+// d29 is not part of ALLOCATABLE_DOUBLE_REGISTERS, so use 27 and 28.
+ALIAS_REGISTER(VRegister, fp_fixed1, d27);
+ALIAS_REGISTER(VRegister, fp_fixed2, d28);
 
 // MacroAssembler scratch V registers.
 ALIAS_REGISTER(VRegister, fp_scratch, d30);

test/mjsunit/regress/wasm/regress-1070078.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+// Generate function 1 (out of 4).
+builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
+  // signature: i_iii
+  // body:
+  kExprI32Const, 0x00,  // i32.const
+  kExprMemoryGrow, 0x00,  // memory.grow
+  kExprI32Const, 0xd3, 0xe7, 0x03,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kExprI32Const, 0x84, 0x80, 0xc0, 0x05,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kExprI32Const, 0x84, 0x81, 0x80, 0xc8, 0x01,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kExprI32Const, 0x19,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kSimdPrefix, kExprS8x16Shuffle,
+  0x00, 0x00, 0x17, 0x00, 0x04, 0x04, 0x04, 0x04,
+  0x04, 0x10, 0x01, 0x00, 0x04, 0x04, 0x04, 0x04,  // s8x16.shuffle
+  kSimdPrefix, kExprS8x16Shuffle,
+  0x04, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // s8x16.shuffle
+  kSimdPrefix, kExprI16x8LeU,  // i16x8.le_u
+  kSimdPrefix, kExprS1x4AnyTrue,  // s1x4.any_true
+  kExprMemoryGrow, 0x00,  // memory.grow
+  kExprDrop,
+  kExprEnd,  // end @233
+]);
+builder.addExport('main', 0);
+builder.instantiate();

test/mjsunit/wasm/wasm-module-builder.js

@@ -469,14 +469,19 @@ let kExprI64AtomicCompareExchange32U = 0x4e;
 // Simd opcodes.
 let kExprS128LoadMem = 0x00;
 let kExprS128StoreMem = 0x01;
+let kExprS8x16Shuffle = 0x03;
+let kExprI8x16Splat = 0x04;
 let kExprI16x8Splat = 0x08;
 let kExprI32x4Splat = 0x0c;
 let kExprF32x4Splat = 0x12;
+let kExprI8x16LtU = 0x1b;
+let kExprI16x8LeU = 0x29;
 let kExprI32x4Eq = 0x2c;
 let kExprS1x16AnyTrue = 0x52;
 let kExprS1x8AnyTrue = 0x63;
 let kExprI16x8ShrS = 0x66;
 let kExprS1x4AllTrue = 0x75;
+let kExprS1x4AnyTrue = 0x74;
 let kExprI32x4Add = 0x79;
 let kExprF32x4Min = 0x9e;
 let kExprS8x16LoadSplat = [0xc2, 0x1];