Merge pull request from GHSA-xm67-587q-r2vw

This commit fixes an off-by-one error in the subtraction of indices when
shuffling a vector with itself. Lanes 16-and-above are mapped to select
from the first vector since the first and second element are the same,
but the subtraction was with 15 rather than 16 by accident.

cranelift/codegen/src/isa/x64/lower/isle.rs

@@ -752,7 +752,7 @@ impl Context for IsleContext<'_, '_, MInst, X64Backend> {
     fn shuffle_0_31_mask(&mut self, mask: &VecMask) -> VCodeConstant {
         let mask = mask
             .iter()
-            .map(|&b| if b > 15 { b.wrapping_sub(15) } else { b })
+            .map(|&b| if b > 15 { b.wrapping_sub(16) } else { b })
             .map(|b| if b > 15 { 0b10000000 } else { b })
             .collect();
         self.lower_ctx

cranelift/filetests/filetests/isa/x64/simd-lane-access-compile.clif

@@ -101,7 +101,8 @@ block0:
 ;   addb %al, (%rax)
 ;   addb %al, (%rax)
 ;   addb %al, (%rax)
-;   addb %al, (%rcx, %rax)
+;   addb %al, (%rbx)
+;   addl %eax, (%rax)
 ;   addb %al, (%rax)
 ;   addb %al, (%rax)
 ;   addb %al, (%rax)

cranelift/filetests/filetests/runtests/simd-shuffle.clif

@@ -19,3 +19,10 @@ block0(v0: i8x16, v1: i8x16):
     return v2
 }
 ; run: %shuffle_zeros([1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16], [17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32]) == [4 1 0 0 5 7 13 12 24 14 25 5 3 0 18 6]
+
+function %shuffle1(i8x16) -> i8x16 {
+block0(v0: i8x16):
+    v1 = shuffle v0, v0, [8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23]
+    return v1
+}
+; run: %shuffle1([0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15]) == [8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7]