[compiler,x64] Fix AssembleReturn for multiple returns

Change-Id: I9d226483a7f8cd82ef42eba56d9a069b16d622fc
Bug: chromium:1133701
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2449978
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70378}

src/compiler/backend/x64/code-generator-x64.cc

@@ -4606,16 +4606,16 @@ void CodeGenerator::AssembleReturn(InstructionOperand* additional_pop_count) {
 
   unwinding_info_writer_.MarkBlockWillExit();
 
-  // We might need rcx and rdx for scratch.
+  // We might need rcx and r10 for scratch.
   DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & rcx.bit());
-  DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & rdx.bit());
+  DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & r10.bit());
   int parameter_count =
       static_cast<int>(call_descriptor->StackParameterCount());
   X64OperandConverter g(this, nullptr);
   Register pop_reg = additional_pop_count->IsImmediate()
                          ? rcx
                          : g.ToRegister(additional_pop_count);
-  Register scratch_reg = pop_reg == rcx ? rdx : rcx;
+  Register scratch_reg = pop_reg == rcx ? r10 : rcx;
   Register argc_reg =
       additional_pop_count->IsImmediate() ? pop_reg : scratch_reg;
 #ifdef V8_NO_ARGUMENTS_ADAPTOR

test/cctest/compiler/test-multiple-return.cc

@@ -131,14 +131,13 @@ std::shared_ptr<wasm::NativeModule> AllocateNativeModule(Isolate* isolate,
   return native_module;
 }
 
+template <int kMinParamCount, int kMaxParamCount>
 void TestReturnMultipleValues(MachineType type) {
   const int kMaxCount = 20;
-  const int kMaxParamCount = 9;
-  // Use 9 parameters as a regression test or https://crbug.com/838098.
-  for (int param_count : {2, kMaxParamCount}) {
+  for (int param_count : {kMinParamCount, kMaxParamCount}) {
     for (int count = 0; count < kMaxCount; ++count) {
-      printf("\n==== type = %s, count = %d ====\n\n\n",
-             MachineReprToString(type.representation()), count);
+      printf("\n==== type = %s, parameter_count = %d, count = %d ====\n\n\n",
+             MachineReprToString(type.representation()), param_count, count);
       v8::internal::AccountingAllocator allocator;
       Zone zone(&allocator, ZONE_NAME);
       CallDescriptor* desc =
@@ -230,8 +229,15 @@ void TestReturnMultipleValues(MachineType type) {
 
 }  // namespace
 
+// Use 9 parameters as a regression test or https://crbug.com/838098.
 #define TEST_MULTI(Type, type) \
-  TEST(ReturnMultiple##Type) { TestReturnMultipleValues(type); }
+  TEST(ReturnMultiple##Type) { TestReturnMultipleValues<2, 9>(type); }
+
+// Create a frame larger than UINT16_MAX to force TF to use an extra register
+// when popping the frame.
+TEST(TestReturnMultipleValuesLargeFrame) {
+  TestReturnMultipleValues<20000, 20000>(MachineType::Int32());
+}
 
 TEST_MULTI(Int32, MachineType::Int32())
 #if (!V8_TARGET_ARCH_32_BIT)