[Liftoff] Fix registers spilling

The method {SpillAllRegisters} should really just spill registers, and
not also constants. Also, since more code is inlined into that method
now, we can optimize it to update register use counters only once in
the end, since no used register should be left after executing this
method.

R=titzer@chromium.org

Bug: v8:6600, chromium:802244
Change-Id: I737a1a87f8e912151062224952c4f5dffd43f802
Reviewed-on: https://chromium-review.googlesource.com/868022Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50644}

src/wasm/baseline/liftoff-assembler.cc

@@ -369,11 +369,13 @@ void LiftoffAssembler::SpillLocals() {
 }
 
 void LiftoffAssembler::SpillAllRegisters() {
-  // TODO(clemensh): Don't update use counters in the loop, just reset them
-  // afterwards.
   for (uint32_t i = 0, e = cache_state_.stack_height(); i < e; ++i) {
-    Spill(i);
+    auto& slot = cache_state_.stack_state[i];
+    if (!slot.is_reg()) continue;
+    Spill(i, slot.reg());
+    slot.MakeStack();
   }
+  cache_state_.reset_used_registers();
 }
 
 void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
@@ -425,9 +427,7 @@ void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
   stack_transfers.Execute();
 
   // Reset register use counters.
-  cache_state_.used_registers = {};
-  memset(cache_state_.register_use_count, 0,
-         sizeof(cache_state_.register_use_count));
+  cache_state_.reset_used_registers();
 
   // Fill the wasm context into the right register.
   compiler::LinkageLocation context_loc =

src/wasm/baseline/liftoff-assembler.h

@@ -175,6 +175,11 @@ class LiftoffAssembler : public TurboAssembler {
 
     bool is_free(LiftoffRegister reg) const { return !is_used(reg); }
 
+    void reset_used_registers() {
+      used_registers = {};
+      memset(register_use_count, 0, sizeof(register_use_count));
+    }
+
     LiftoffRegister GetNextSpillReg(LiftoffRegList candidates,
                                     LiftoffRegList pinned = {}) {
       LiftoffRegList unpinned = candidates.MaskOut(pinned);

test/mjsunit/regress/wasm/regress-802244.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_v_iii).addBody([
+  kExprI32Const, 0x41,  // i32.const 0x41
+  kExprLoop, 0x7c,      // loop f64
+  kExprGetLocal, 0x00,  // get_local 0
+  kExprGetLocal, 0x01,  // get_local 1
+  kExprBrIf, 0x01,      // br_if depth=1
+  kExprGetLocal, 0x00,  // get_local 0
+  kExprI32Rol,          // i32.rol
+  kExprBrIf, 0x00,      // br_if depth=0
+  kExprUnreachable,     // unreachable
+  kExprEnd,             // end
+  kExprUnreachable,     // unreachable
+]);
+builder.instantiate();