[Liftoff][arm] Leave scratch register to the assembler

In {Assembler::and_} we might need to use the scratch register. Thus use
a free LiftoffRegister instead to emit i32 popcnt.

R=ahaas@chromium.org
CC=george.wort@arm.com

Bug: chromium:918284
Change-Id: Ia814899bf6e33dd4989fd09329542b4bc09b48df
Reviewed-on: https://chromium-review.googlesource.com/c/1405036Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58723}

src/wasm/baseline/arm/liftoff-assembler-arm.h

@@ -682,10 +682,9 @@ bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
 bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
   {
     UseScratchRegisterScope temps(this);
-    LiftoffRegList pinned;
-    pinned.set(dst);
-    Register scratch = GetUnusedRegister(kGpReg, pinned).gp();
-    Register scratch_2 = temps.Acquire();
+    LiftoffRegList pinned = LiftoffRegList::ForRegs(dst);
+    Register scratch = pinned.set(GetUnusedRegister(kGpReg, pinned)).gp();
+    Register scratch_2 = GetUnusedRegister(kGpReg, pinned).gp();
     // x = x - ((x & (0x55555555 << 1)) >> 1)
     and_(scratch, src, Operand(0xaaaaaaaa));
     sub(dst, src, Operand(scratch, LSR, 1));

test/mjsunit/regress/wasm/regress-918284.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_i)
+  .addLocals({i32_count: 7})
+  .addBody([
+    kExprI32Const, 0,
+    kExprIf, kWasmI32,   // @11 i32
+      kExprI32Const, 0,
+    kExprElse,   // @15
+      kExprI32Const, 1,
+      kExprEnd,   // @18
+    kExprTeeLocal, 0,
+    kExprI32Popcnt
+]);
+builder.instantiate();