[wasm][liftoff] Fix a register reuse corner case

Fixed: chromium:1366399
Change-Id: I652ba7ddf3665143562b3ee6d60cde017bfc9e8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3913126
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83395}

src/wasm/baseline/liftoff-compiler.cc

@@ -1503,9 +1503,11 @@ class LiftoffCompiler {
         __ MergeFullStackWith(c->label_state, *__ cache_state());
         __ emit_jump(c->label.get());
       }
-      // Merge the else state into the end state.
+      // Merge the else state into the end state. Set this state as the current
+      // state first so helper functions know which registers are in use.
       __ bind(c->else_state->label.get());
-      __ MergeFullStackWith(c->label_state, c->else_state->state);
+      __ cache_state()->Steal(c->else_state->state);
+      __ MergeFullStackWith(c->label_state, *__ cache_state());
       __ cache_state()->Steal(c->label_state);
     } else if (c->reachable()) {
       // No merge yet at the end of the if, but we need to create a merge for
@@ -1517,9 +1519,11 @@ class LiftoffCompiler {
                                c->stack_depth + c->num_exceptions);
       __ MergeFullStackWith(c->label_state, *__ cache_state());
       __ emit_jump(c->label.get());
-      // Merge the else state into the end state.
+      // Merge the else state into the end state. Set this state as the current
+      // state first so helper functions know which registers are in use.
       __ bind(c->else_state->label.get());
-      __ MergeFullStackWith(c->label_state, c->else_state->state);
+      __ cache_state()->Steal(c->else_state->state);
+      __ MergeFullStackWith(c->label_state, *__ cache_state());
       __ cache_state()->Steal(c->label_state);
     } else {
       // No merge needed, just continue with the else state.