[wasm][liftoff] Fix handling of register pairs in clear_used

R=clemensb@chromium.org

Bug: chromium:1202736
Change-Id: Id4056ba60fdaa5d5fbe2099ef0823da70a28e6ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2853601
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74234}

src/wasm/baseline/liftoff-assembler.h

@@ -341,6 +341,11 @@ class LiftoffAssembler : public TurboAssembler {
     }
 
     void clear_used(LiftoffRegister reg) {
+      if (reg.is_pair()) {
+        clear_used(reg.low());
+        clear_used(reg.high());
+        return;
+      }
       register_use_count[reg.liftoff_code()] = 0;
       used_registers.clear(reg);
     }

test/mjsunit/regress/wasm/regress-1202736.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1, false, true);
+builder.addType(
+    makeSig([kWasmF64, kWasmI32, kWasmI32, kWasmF64, kWasmF32], [kWasmI64]));
+builder.addFunction(undefined, 0 /* sig */)
+  .addLocals(kWasmI64, 1)
+  .addBodyWithEnd([
+// signature: l_diidf
+// body:
+kExprLoop, 0x7e,  // loop @3 i64
+  kExprI64Const, 0x01,  // i64.const
+  kExprEnd,  // end @7
+kExprBlock, 0x7f,  // block @8 i32
+  kExprLocalGet, 0x05,  // local.get
+  kExprLocalSet, 0x05,  // local.set
+  kExprI32Const, 0x00,  // i32.const
+  kExprEnd,  // end @16
+kExprLocalGet, 0x05,  // local.get
+kExprLocalGet, 0x05,  // local.get
+kAtomicPrefix, kExprI64AtomicCompareExchange, 0x00, 0x04,
+kExprI64GtS,  // i64.gt_s
+kExprDrop,  // drop
+kExprI64Const, 0x01,  // i64.const
+kExprEnd,  // end @29
+]);
+const instance = builder.instantiate();