Cherry-pick c4e675b. rdar://problem/111066972

    B3 Select instruction truncates vector operands
    https://bugs.webkit.org/show_bug.cgi?id=257842
    rdar://108643371

    Reviewed by Mark Lam, Justin Michaud and Yusuke Suzuki.

    Fixes a bug where we would generate a double-precision conditional
    move when lowering the Select B3 instruction on vector operands.
    Since vector-sized conditional move isn't widely supported, we
    transform the Select into a branch and moves during Air lowering
    when the operands are vectors.

    * JSTests/wasm/stress/simd-select.js: Added.
    * Source/JavaScriptCore/b3/B3LowerToAir.cpp:

    Canonical link: https://commits.webkit.org/264996@main

Identifier: 259548.840@safari-7615.3.9.10-branch

JSTests/wasm/stress/simd-select.js

@@ -0,0 +1,51 @@
+//@ requireOptions("--useWebAssemblySIMD=1")
+//@ skip if !$isSIMDPlatform
+import { instantiate } from "../wabt-wrapper.js"
+import * as assert from "../assert.js"
+
+let wat = `
+(module
+    (func (export "test_lower") (param i32 i32) (result i32) (local v128 v128)
+        v128.const i32x4 1 1 1 1
+        local.set 2
+        v128.const i32x4 2 2 2 2
+        local.set 3
+
+        local.get 2
+        local.get 3
+        local.get 0
+        local.get 1
+        i32.eq
+        select
+
+        i32x4.extract_lane 0
+    )
+
+    (func (export "test_upper") (param i32 i32) (result i32) (local v128 v128)
+        v128.const i32x4 1 1 1 1
+        local.set 2
+        v128.const i32x4 2 2 2 2
+        local.set 3
+
+        local.get 2
+        local.get 3
+        local.get 0
+        local.get 1
+        i32.eq
+        select
+
+        i32x4.extract_lane 3
+    )
+)
+`
+
+async function test() {
+    const instance = await instantiate(wat, {}, { simd: true });
+    const { test_lower, test_upper } = instance.exports;
+    assert.eq(test_lower(42, 42), 1);
+    assert.eq(test_lower(42, 43), 2);
+    assert.eq(test_upper(42, 42), 1);
+    assert.eq(test_upper(42, 43), 2);
+}
+
+assert.asyncTest(test())

Source/JavaScriptCore/b3/B3LowerToAir.cpp

@@ -4306,6 +4306,26 @@ class LowerToAir {
         }
 
         case Select: {
+            if (m_value->type().isVector()) {
+                // Conditional moves aren't available for vectors on currently
+                // supported architectures, so we lower vector Select to a
+                // branching construct.
+
+                auto ifTrueBlock = newBlock();
+                Air::BasicBlock* beginBlock;
+                Air::BasicBlock* doneBlock;
+                splitBlock(beginBlock, doneBlock);
+
+                append(Air::MoveVector, tmp(m_value->child(2)), tmp(m_value));
+                append(createBranch(m_value->child(0)));
+                beginBlock->setSuccessors(ifTrueBlock, doneBlock);
+
+                ifTrueBlock->append(Air::MoveVector, m_value, tmp(m_value->child(1)), tmp(m_value));
+                ifTrueBlock->append(Air::Jump, m_value);
+                ifTrueBlock->setSuccessors(doneBlock);
+                return;
+            }
+
             MoveConditionallyConfig config;
             if (m_value->type().isInt()) {
                 config.moveConditionally32 = MoveConditionally32;