[compiler] Fix spilling for fixed SIMD registers

If a fixed register is defined for an input, we did only spill the
sibling SIMD register if the other sibling was allocated. This is not
correct. If only the sibling is in use (e.g. s1 colliding with q0) we
also have to spill that sibling.

R=mslekova@chromium.org

Bug: chromium:1283042, v8:12330
Change-Id: I6a22eaf461774a0b4603ec3ff17062134a528161
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359615Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78483}

src/compiler/backend/mid-tier-register-allocator.cc

@@ -2557,7 +2557,15 @@ void SinglePassRegisterAllocator::ReserveFixedRegister(
     // If register is in-use by a different virtual register, spill it now.
     // TODO(rmcilroy): Consider moving to a unconstrained register instead of
     // spilling.
-    SpillRegisterAndPotentialSimdSibling(reg, rep);
+    SpillRegister(reg);
+  }
+  // Also potentially spill the "sibling SIMD register" on architectures where a
+  // SIMD register aliases two FP registers.
+  if (!kSimpleFPAliasing && rep == MachineRepresentation::kSimd128) {
+    if (!IsFreeOrSameVirtualRegister(reg.simdSibling(), virtual_register) &&
+        !DefinedAfter(virtual_register, instr_index, pos)) {
+      SpillRegister(reg.simdSibling());
+    }
   }
   MarkRegisterUse(reg, rep, pos);
 }

test/mjsunit/mjsunit.status

@@ -1465,6 +1465,7 @@
   'regress/wasm/regress-1271244': [SKIP],
   'regress/wasm/regress-1271538': [SKIP],
   'regress/wasm/regress-1282224': [SKIP],
+  'regress/wasm/regress-1283042': [SKIP],
 }],  # no_simd_hardware == True
 
 ##############################################################################

test/mjsunit/regress/wasm/regress-1283042.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-liftoff --turbo-force-mid-tier-regalloc
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+builder.addFunction(undefined, kSig_i_iii)
+  .addBody([
+    ...wasmS128Const(new Array(16).fill(0)),        // s128.const
+    kSimdPrefix, kExprF64x2ConvertLowI32x4U, 0x01,  // f64x2.convert_low_i32x4_u
+    kSimdPrefix, kExprI64x2UConvertI32x4Low, 0x01,  // i64x2.convert_i32x4_low_u
+    kSimdPrefix, kExprI64x2BitMask, 0x01,           // i64x2.bitmask
+    ...wasmF64Const(0),                             // f64.const
+    kNumericPrefix, kExprI32SConvertSatF64,         // i32.trunc_sat_f64_s
+    ...wasmI32Const(0),                             // i32.const
+    kExprCallFunction, 0,                           // call
+    kExprDrop,                                      // drop
+    ...wasmI32Const(0),                             // i32.const
+    ...wasmI64Const(0),                             // i64.const
+    kExprI64StoreMem16, 0x00, 0x00,                 // i64.store16
+    ...wasmF32Const(0),                             // f32.const
+    kExprF32Sqrt,                                   // f32.sqrt
+    kExprI32UConvertF32,                            // i32.trunc_f32_u
+]);
+builder.toModule();