[liftoff] Fix PopToModifiableRegister

PopToModifiableRegister did not check the {pinned} list, so it could
return a register which was already used for another (temporary) value.
This CL fixes that, and adds a little optimization which gives more
freedom to the choice of spilling and has a chance to avoid a register
mode.

R=jkummerow@chromium.org

Bug: chromium:1337221
Change-Id: Ifc02321038713ff03e8f8e7db78dde33f70ec847
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3707287Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81255}

src/wasm/baseline/liftoff-assembler.h

@@ -483,11 +483,12 @@ class LiftoffAssembler : public TurboAssembler {
   LiftoffRegister PopToModifiableRegister(LiftoffRegList pinned = {}) {
     ValueKind kind = cache_state_.stack_state.back().kind();
     LiftoffRegister reg = PopToRegister(pinned);
-    if (cache_state()->is_free(reg)) return reg;
+    if (cache_state()->is_free(reg) && !pinned.has(reg)) return reg;
 
-    pinned.set(reg);
     LiftoffRegister new_reg = GetUnusedRegister(reg.reg_class(), pinned);
-    Move(new_reg, reg, kind);
+    // {new_reg} could be equal to {reg}, but it's unused by the stack now.
+    // Also, {reg} still holds the previous value, even if it was spilled.
+    if (new_reg != reg) Move(new_reg, reg, kind);
     return new_reg;
   }