[codegen] Fix places where we explicitly rely on movl

This partially reverts https://crrev.com/c/2649032
The previous CL was a bit too aggressive in replaceing movl with Move
which does sign extension for int32.

We can only safely replace movl if the input is in the [0, 2**31] range.


Bug: chromium:1220855
Change-Id: I6c29db1acd7de6b03ffaf802a868b6a531252bc0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2975860Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75304}

src/compiler/backend/x64/code-generator-x64.cc

@@ -3605,7 +3605,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 
         uint8_t bmask = static_cast<uint8_t>(0xff << shift);
         uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
-        __ Move(tmp, mask);
+        __ movl(tmp, Immediate(mask));
         __ Movd(tmp_simd, tmp);
         __ Pshufd(tmp_simd, tmp_simd, uint8_t{0});
         __ Pand(dst, tmp_simd);
@@ -3721,7 +3721,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 
         uint8_t bmask = 0xff >> shift;
         uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
-        __ Move(tmp, mask);
+        __ movl(tmp, Immediate(mask));
         __ Movd(tmp_simd, tmp);
         __ Pshufd(tmp_simd, tmp_simd, byte{0});
         __ Pand(dst, tmp_simd);
@@ -4956,7 +4956,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           if (value == 0) {
             __ xorl(dst, dst);
           } else {
-            __ Move(dst, value);
+            __ movl(dst, Immediate(value));
           }
         }
         break;
@@ -5120,11 +5120,10 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       } else {
         DCHECK(destination->IsFPStackSlot());
         if (src.type() == Constant::kFloat32) {
-          __ Move(dst, bit_cast<uint32_t>(src.ToFloat32()));
+          __ movl(dst, Immediate(bit_cast<uint32_t>(src.ToFloat32())));
         } else {
           DCHECK_EQ(src.type(), Constant::kFloat64);
-          __ movq(kScratchRegister, src.ToFloat64().AsUint64());
-          __ movq(dst, kScratchRegister);
+          __ Move(dst, src.ToFloat64().AsUint64());
         }
       }
       return;

test/mjsunit/regress/regress-crbug-1220855.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging --liftoff --no-wasm-tier-up
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1, false, true);
+builder.addFunction('test', makeSig([kWasmI32], [kWasmI64]))
+    .addBody([
+      ...wasmI32Const(1 << 30),  // pages to grow
+      kExprMemoryGrow, 0,        // returns -1
+      kExprI64UConvertI32        // asserts that the i32 is zero extended
+    ])
+    .exportFunc();
+const instance = builder.instantiate();
+instance.exports.test();