[maglev] Drop register values before adding them to the free list

This fixes the ordering of DCHECKs which expect the value to not be in
the free list yet when it is dropped.

Bug: v8:7700
Change-Id: Ifb85d0e20cfe5c083d1f2bc971817143265fdc7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610444
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80218}

src/maglev/maglev-regalloc.cc

@@ -760,11 +760,12 @@ void StraightForwardRegisterAllocator::AllocateSpillSlot(ValueNode* node) {
 }
 
 template <typename RegisterT>
-RegisterT RegisterFrameState<RegisterT>::FreeSomeRegister() {
+void StraightForwardRegisterAllocator::FreeSomeRegister(
+    RegisterFrameState<RegisterT>& registers) {
   int furthest_use = 0;
   RegisterT best = RegisterT::no_reg();
-  for (RegisterT reg : used()) {
-    ValueNode* value = GetValue(reg);
+  for (RegisterT reg : registers.used()) {
+    ValueNode* value = registers.GetValue(reg);
     // The cheapest register to clear is a register containing a value that's
     // contained in another register as well.
     if (value->num_registers() > 1) {
@@ -778,16 +779,16 @@ RegisterT RegisterFrameState<RegisterT>::FreeSomeRegister() {
     }
   }
   DCHECK(best.is_valid());
-  free_.set(best);
-  return best;
+  DropRegisterValue(registers, best);
+  registers.AddToFree(best);
 }
 
 void StraightForwardRegisterAllocator::FreeSomeGeneralRegister() {
-  DropRegisterValue(general_registers_.FreeSomeRegister());
+  return FreeSomeRegister(general_registers_);
 }
 
 void StraightForwardRegisterAllocator::FreeSomeDoubleRegister() {
-  DropRegisterValue(double_registers_.FreeSomeRegister());
+  return FreeSomeRegister(double_registers_);
 }
 compiler::AllocatedOperand StraightForwardRegisterAllocator::AllocateRegister(
     ValueNode* node) {

src/maglev/maglev-regalloc.h

@@ -57,7 +57,7 @@ class RegisterFrameState {
 
   RegisterT TakeFirstFree() { return free_.PopFirst(); }
   void RemoveFromFree(RegisterT reg) { free_.clear(reg); }
-  RegisterT FreeSomeRegister();
+  void AddToFree(RegisterT reg) { free_.set(reg); }
 
   void FreeRegistersUsedBy(ValueNode* node) {
     RegList list = node->ClearRegisters<RegisterT>();
@@ -141,6 +141,8 @@ class StraightForwardRegisterAllocator {
   void SpillAndClearRegisters();
 
   void FreeRegistersUsedBy(ValueNode* node);
+  template <typename RegisterT>
+  void FreeSomeRegister(RegisterFrameState<RegisterT>& registers);
   void FreeSomeGeneralRegister();
   void FreeSomeDoubleRegister();
 

test/mjsunit/maglev/lots-of-registers.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-stress-opt
+
+function foo() {
+  var x0 = 0;
+  var x1 = 1;
+  var x2 = 2;
+  var x3 = 3;
+  var x4 = 4;
+  var x5 = 5;
+  var x6 = 6;
+  var x7 = 7;
+  var x8 = 8;
+  var x9 = 9;
+  var x10 = 10;
+  var x11 = 11;
+  var x12 = 12;
+  var x13 = 13;
+  var x14 = 14;
+  var x15 = 15;
+  var x16 = 16;
+  var x17 = 17;
+  var x18 = 18;
+  var x19 = 19;
+  var x20 = 20;
+  var x21 = 21;
+  var x22 = 22;
+  var x23 = 23;
+  var x24 = 24;
+  var x25 = 25;
+  var x26 = 26;
+  var x27 = 27;
+  var x28 = 28;
+  var x29 = 29;
+  var x30 = 30;
+  var x31 = 31;
+  var x32 = 32;
+  var x33 = 33;
+  var x34 = 34;
+  var x35 = 35;
+  var x36 = 36;
+  var x37 = 37;
+  var x38 = 38;
+  var x39 = 39;
+
+  return x0 + x1 + x2 + x3 + x4 + x5 + x6 + x7 + x8 + x9 +
+      x10 + x11 + x12 + x13 + x14 + x15 + x16 + x17 + x18 + x19 +
+      x20 + x21 + x22 + x23 + x24 + x25 + x26 + x27 + x28 + x29 +
+      x30 + x31 + x32 + x33 + x34 + x35 + x36 + x37 + x38 + x39;
+}
+
+%PrepareFunctionForOptimization(foo);
+print(foo());
+print(foo());
+%OptimizeMaglevOnNextCall(foo);
+print(foo());