[wasm] Fix Liftoff stack check inspection

The call to "GetSpilledRegistersForInspection" was invalidated by the
call to "GetUnusedRegister" a few lines below.

R=clemensb@chromium.org

Bug: v8:10957
Change-Id: I1e0110d9b28ca23a2a8b9ff4b4c39143bfbe5510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2466118
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70478}

src/wasm/baseline/liftoff-compiler.cc

@@ -508,6 +508,7 @@ class LiftoffCompiler {
     if (!FLAG_wasm_stack_checks || !env_->runtime_exception_support) return;
     LiftoffRegList regs_to_save = __ cache_state()->used_registers;
     SpilledRegistersForInspection* spilled_regs = nullptr;
+    Register limit_address = __ GetUnusedRegister(kGpReg, {}).gp();
     if (V8_UNLIKELY(for_debugging_)) {
       regs_to_save = {};
       spilled_regs = GetSpilledRegistersForInspection();
@@ -516,7 +517,6 @@ class LiftoffCompiler {
         position, regs_to_save, spilled_regs,
         RegisterDebugSideTableEntry(DebugSideTableBuilder::kAssumeSpilling)));
     OutOfLineCode& ool = out_of_line_code_.back();
-    Register limit_address = __ GetUnusedRegister(kGpReg, {}).gp();
     LOAD_INSTANCE_FIELD(limit_address, StackLimitAddress, kSystemPointerSize);
     __ StackCheck(ool.label.get(), limit_address);
     __ bind(ool.continuation.get());

test/inspector/debugger/wasm-regress-10957-expected.txt

+Regress 10957
+Instantiate
+Finished!
+7

test/inspector/debugger/wasm-regress-10957.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Regress 10957');
+
+var builder = new WasmModuleBuilder();
+let pause = builder.addImport('imports', 'pause', kSig_v_v);
+let sig = makeSig([kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+let f = builder.addFunction('f', sig)
+  .addBody([
+      kExprLocalGet, 0,
+      kExprLocalGet, 1,
+      kExprLocalGet, 2,
+      kExprLocalGet, 3,
+      kExprLocalGet, 4,
+      kExprLocalGet, 5,
+      kExprLocalGet, 6,
+      kExprI32Add,
+      kExprI32Add,
+      kExprI32Add,
+      kExprI32Add,
+      kExprI32Add,
+      kExprI32Add,
+  ]);
+
+builder.addFunction('main', kSig_i_v)
+    .addBody([
+        kExprCallFunction, pause,
+        kExprI32Const, 1,
+        kExprI32Const, 1,
+        kExprI32Const, 1,
+        kExprI32Const, 1,
+        kExprI32Const, 1,
+        kExprI32Const, 1,
+        kExprI32Const, 1,
+        kExprCallFunction, f.index])
+  .exportFunc();
+
+var module_bytes = builder.toArray();
+
+function instantiate(bytes, imports) {
+  var buffer = new ArrayBuffer(bytes.length);
+  var view = new Uint8Array(buffer);
+  for (var i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+  const module = new WebAssembly.Module(buffer);
+  return new WebAssembly.Instance(module, imports);
+}
+
+(async function Regress10957() {
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Instantiate');
+  const code =
+      `let instance = (${instantiate})(${JSON.stringify(module_bytes)}, {'imports': {'pause': () => { %ScheduleBreak() } }});
+      instance.exports.main();
+  `;
+  Protocol.Runtime.evaluate({'expression': code}).then(message =>
+      InspectorTest.logMessage(message.result.result.value));
+  await Protocol.Debugger.oncePaused();
+  Protocol.Debugger.resume();
+
+  InspectorTest.log('Finished!');
+  InspectorTest.completeTest();
+})();