[Liftoff][ia32] Fix i64 sign extension on non-byte register

The {movsx_b} instruction can only take byte registers (or operands) as
source. Ensure that for i8 sign extensions to i64, the src register is
moved to a temporary byte register first, similar to the same operation
on i32 a few lines above.

R=ahaas@chromium.org

Bug: chromium:918149, v8:6600
Change-Id: I17bc942127baee57279a7fc0caac9d82bd7c6bfb
Reviewed-on: https://chromium-review.googlesource.com/c/1394555Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58542}

src/wasm/baseline/ia32/liftoff-assembler-ia32.h

@@ -1448,7 +1448,9 @@ void LiftoffAssembler::emit_i32_signextend_i16(Register dst, Register src) {
 
 void LiftoffAssembler::emit_i64_signextend_i8(LiftoffRegister dst,
                                               LiftoffRegister src) {
-  movsx_b(dst.low_gp(), src.low_gp());
+  Register byte_reg = liftoff::GetTmpByteRegister(this, src.low_gp());
+  if (byte_reg != src.low_gp()) mov(byte_reg, src.low_gp());
+  movsx_b(dst.low_gp(), byte_reg);
   liftoff::SignExtendI32ToI64(this, dst);
 }
 

test/mjsunit/regress/wasm/regress-918149.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig =
+    builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI64]));
+builder.addFunction('main', sig).addBody([kExprI64Const, 1, kExprI64SExtendI8]);
+builder.instantiate();