[wasm][liftoff] Zero-extend result of atomic.add

R=clemensb@chromium.org

Fix: chromium:1045737
Change-Id: I0e27b8ff6ab09078a2f63f955e6123e1003ed889
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020768Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65998}

src/wasm/baseline/x64/liftoff-assembler-x64.h

@@ -393,10 +393,12 @@ void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
     case StoreType::kI32Store8:
     case StoreType::kI64Store8:
       xaddb(dst_op, value.gp());
+      movzxbq(value.gp(), value.gp());
       break;
     case StoreType::kI32Store16:
     case StoreType::kI64Store16:
       xaddw(dst_op, value.gp());
+      movzxwq(value.gp(), value.gp());
       break;
     case StoreType::kI32Store:
     case StoreType::kI64Store32:

test/mjsunit/regress/wasm/regress-1045737.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging --liftoff --no-wasm-tier-up
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
+  // signature: i_iii
+  // body:
+  kExprI32Const, 0x00, kExprI64Const, 0xc2, 0xe6, 0x00, kAtomicPrefix,
+  kExprI64AtomicAdd8U, 0x00, 0xb6, 0x0e, kExprF32SConvertI64,
+  kExprI32SConvertF32,
+  kExprEnd,  // @14
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(instance.exports.main(1, 2, 3), 0);
+})();