Bug 1626233 - Fix multi-value calls with Ion r=lth

This patch fixes a couple bugs in WasmIonCompile for multi-value calls:

 * Stack result areas were not being correctly aligned

 * GVN would consider MWasmDerivedPointer instances to be equivalent if
   they had the same base pointer but different offsets

Differential Revision: https://phabricator.services.mozilla.com/D68989

--HG--
extra : moz-landing-system : lando

js/src/jit/MIR.h

@@ -11824,7 +11824,8 @@ class MWasmDerivedPointer : public MUnaryInstruction,
   AliasSet getAliasSet() const override { return AliasSet::None(); }
 
   bool congruentTo(const MDefinition* ins) const override {
-    return congruentIfOperandsEqual(ins);
+    return congruentIfOperandsEqual(ins) &&
+           ins->toWasmDerivedPointer()->offset() == offset();
   }
 
   ALLOW_CLONE(MWasmDerivedPointer)

js/src/jit/StackSlotAllocator.h

@@ -67,17 +67,17 @@ class StackSlotAllocator {
   void allocateStackArea(LStackArea* alloc) {
     uint32_t size = alloc->size();
 
+    MOZ_ASSERT(size % 4 == 0);
     switch (alloc->alignment()) {
       case 8:
-        if (height_ % 8 != 0) {
+        if ((height_ + size) % 8 != 0) {
           addAvailableSlot(height_ += 4);
         }
         break;
       default:
         MOZ_CRASH("unexpected stack results area alignment");
     }
-    MOZ_ASSERT(height_ % alloc->alignment() == 0);
-    MOZ_ASSERT(size % 4 == 0);
+    MOZ_ASSERT((height_ + size) % alloc->alignment() == 0);
 
     height_ += size;
     alloc->setBase(height_);