[wasm][arm][liftoff] Fix another GetUnusedRegister

Fixed: chromium:1340488
Change-Id: Id3da10dd13256dfc15a6fef4dc412b5d30ccc8cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3735126Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81455}

src/wasm/baseline/arm/liftoff-assembler-arm.h

@@ -1379,18 +1379,37 @@ void LiftoffAssembler::LoadReturnStackSlot(LiftoffRegister dst, int offset,
   liftoff::Load(this, dst, src, kind);
 }
 
+class CacheStatePreservingTempRegister {
+ public:
+  CacheStatePreservingTempRegister(LiftoffAssembler& assm) : assm_(assm) {}
+
+  ~CacheStatePreservingTempRegister() {
+    if (must_pop_) assm_.Pop(reg_);
+  }
+
+  Register Get() {
+    DCHECK_EQ(reg_, no_reg);  // This implementation supports only one register.
+    if (assm_.cache_state()->has_unused_register(kGpReg)) {
+      reg_ = assm_.cache_state()->unused_register(kGpReg).gp();
+    } else {
+      reg_ = r0;
+      assm_.Push(reg_);
+      must_pop_ = true;
+    }
+    return reg_;
+  }
+
+ private:
+  Register reg_ = no_reg;
+  LiftoffAssembler& assm_;
+  bool must_pop_ = false;
+};
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueKind kind) {
   DCHECK_NE(dst_offset, src_offset);
-  bool must_pop = false;
-  Register scratch = no_reg;
-  if (cache_state()->has_unused_register(kGpReg)) {
-    scratch = cache_state()->unused_register(kGpReg).gp();
-  } else {
-    scratch = r0;
-    Push(scratch);
-    must_pop = true;
-  }
+  CacheStatePreservingTempRegister temp(*this);
+  Register scratch = temp.Get();
   const int kRegSize = 4;
   DCHECK_EQ(0, SlotSizeForType(kind) % kRegSize);
   int words = SlotSizeForType(kind) / kRegSize;
@@ -1407,9 +1426,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
       str(scratch, liftoff::GetStackSlot(dst_offset - words * kRegSize));
     }
   }
-  if (must_pop) {
-    Pop(scratch);
-  }
 }
 
 void LiftoffAssembler::Move(Register dst, Register src, ValueKind kind) {
@@ -1445,14 +1461,15 @@ void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueKind kind) {
 void LiftoffAssembler::Spill(int offset, WasmValue value) {
   RecordUsedSpillOffset(offset);
   MemOperand dst = liftoff::GetStackSlot(offset);
-  UseScratchRegisterScope temps(this);
+  UseScratchRegisterScope assembler_temps(this);
+  CacheStatePreservingTempRegister liftoff_temp(*this);
   Register src = no_reg;
   // The scratch register will be required by str if multiple instructions
   // are required to encode the offset, and so we cannot use it in that case.
   if (!ImmediateFitsAddrMode2Instruction(dst.offset())) {
-    src = GetUnusedRegister(kGpReg, {}).gp();
+    src = liftoff_temp.Get();
   } else {
-    src = temps.Acquire();
+    src = assembler_temps.Acquire();
   }
   switch (value.type().kind()) {
     case kI32:

test/mjsunit/regress/wasm/regress-crbug-1340488.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var bytes = [
+  0,   97,  115, 109, 1,   0,   0,   0,   1,  11,  2,   96,  2,   126, 124,
+  1,   126, 96,  0,   1,   124, 3,   2,   1,  0,   4,   5,   1,   112, 1,
+  6,   6,   10,  114, 1,   112, 4,   244, 2,  127, 118, 126, 31,  125, 1,
+  124, 2,   126, 2,   64,  2,   127, 3,   64, 2,   124, 3,   127, 65,  0,
+  65,  0,   13,  3,   33,  142, 1,   65,  0,  13,  0,   65,  0,   11,  65,
+  0,   13,  2,   34,  143, 1,   34,  241, 2,  34,  191, 2,   34,  242, 2,
+  34,  208, 2,   33,  144, 1,   2,   127, 65, 0,   4,   64,  65,  0,   13,
+  5,   11,  65,  0,   11,  33,  145, 1,   65, 0,   17,  1,   0,   11,  33,
+  139, 4,   65,  0,   13,  0,   11,  12,  1,  11,  13,  0,   11,  66,  128,
+  127, 34,  189, 3,   65,  0,   13,  0,   34, 199, 3,   11,  11
+];
+var module = new WebAssembly.Module(new Uint8Array(bytes));
+new WebAssembly.Instance(module);