[wasm-simd][ia32] Fix f32x4.min AVX implementation

The AVX implementation does not have dst == input(0), so the vminps call
was wrong. The intention is to compare the 2 input operands.

Bug: chromium:1081030
Change-Id: Id54074327a6aca4b75988fc9d85beccfeabfc791
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2194471Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67786}

src/compiler/backend/ia32/code-generator-ia32.cc

@@ -2336,11 +2336,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kAVXF32x4Min: {
       CpuFeatureScope avx_scope(tasm(), AVX);
       XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src0 = i.InputSimd128Register(0);
       Operand src1 = i.InputOperand(1);
       // See comment above for correction of minps.
       __ movups(kScratchDoubleReg, src1);
       __ vminps(kScratchDoubleReg, kScratchDoubleReg, dst);
-      __ vminps(dst, dst, src1);
+      __ vminps(dst, src0, src1);
       __ vorps(dst, dst, kScratchDoubleReg);
       __ vcmpneqps(kScratchDoubleReg, dst, dst);
       __ vorps(dst, dst, kScratchDoubleReg);

test/mjsunit/regress/wasm/regress-1081030.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
+  // signature: i_iii
+  // body:
+  kExprF32Const, 0xf8, 0xf8, 0xf8, 0xf8,
+  kSimdPrefix, kExprF32x4Splat,         // i8x16.splat
+  kExprF32Const, 0xf8, 0xf8, 0xf8, 0xf8,
+  kSimdPrefix, kExprF32x4Splat,         // i8x16.splat
+  kSimdPrefix, kExprF32x4Min, 0x01,     // f32x4.min
+  kSimdPrefix, kExprS1x4AnyTrue, 0x01,  // s1x4.any_true
+  kExprEnd,                             // end @16
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main(1, 2, 3));

test/mjsunit/wasm/wasm-module-builder.js

@@ -481,7 +481,8 @@ let kExprS1x16AnyTrue = 0x62;
 let kExprS1x16AllTrue = 0x63;
 let kExprI8x16Add = 0x6e;
 let kExprI16x8ShrS = [0x8c, 01];
-let kExprF32x4Min = [0xe8, 01];
+let kExprS1x4AnyTrue = 0xa2;
+let kExprF32x4Min = 0xe8;
 
 // Compilation hint constants.
 let kCompilationHintStrategyDefault = 0x00;