[wasm-simd] Add regression test for i64x2.shr_s bug

This test uses a i64x2.shr_s to shift a v128 with all bits set by 1,
resulting in v128 with all bits set (no change). This value is then
dropped, and param[2] (3), is returned.

Without the fix, -1 is returned, since i64x2.shr_s overwrites the
register for param[2] with 0xffffffff.

Bug: v8:10752
Bug: chromium:1111522
Change-Id: I0310bf6039be780a6738689069cdbcfa3a24bbdb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335779
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69233}

test/mjsunit/regress/wasm/regress-1111522.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Regression test to exercise Liftoff's i64x2.shr_s codegen, which back up rcx
+// to a scratch register, and immediately overwrote the backup, then later
+// restoring the incorrect value. See https://crbug.com/v8/10752 and
+// https://crbug.com/1111522 for more.
+const builder = new WasmModuleBuilder();
+// i64x2.shr_s shifts a v128 (with all bits set), by 1, then drops the result.
+// The function returns param 2, which should be unmodified.
+builder.addFunction(undefined, kSig_i_iii).addBodyWithEnd([
+  kSimdPrefix, kExprS128Const, ...new Array(16).fill(0xff),
+  kExprI32Const, 0x01,
+  kSimdPrefix, kExprI64x2ShrS, 0x01,
+  kExprDrop,
+  kExprLocalGet, 0x02,
+  kExprEnd,
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(3, instance.exports.main(1, 2, 3));

test/mjsunit/wasm/wasm-module-builder.js

@@ -485,6 +485,7 @@ let kExprV8x16AllTrue = 0x63;
 let kExprI8x16Add = 0x6e;
 let kExprI16x8ShrS = [0x8c, 0x01];
 let kExprV32x4AnyTrue = 0xa2;
+let kExprI64x2ShrS = 0xcc;
 let kExprF32x4Min = 0xe8;
 
 // Compilation hint constants.