Fix crash-bug in code generation for case independent 16 bit backreferences.

src/regexp-macro-assembler-ia32.cc

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 259 matching lines @@
   // uncaptured. In either case succeed immediately.
   __ j(equal, &fallthrough);
 
   if (mode_ == ASCII) {
     Label success;
     Label fail;
     Label loop_increment;
     // Save register contents to make the registers available below.
     __ push(edi);
     __ push(backtrack_stackpointer());
-    // After this, the eax, ebx, ecx, edx and edi registers are available.
+    // After this, the eax, ecx, and edi registers are available.
 
     __ add(edx, Operand(esi));  // Start of capture
     __ add(edi, Operand(esi));  // Start of text to match against capture.
     __ add(ebx, Operand(edi));  // End of text to match against capture.
 
     Label loop;
     __ bind(&loop);
     __ movzx_b(eax, Operand(edi, 0));
     __ cmpb_al(Operand(edx, 0));
     __ j(equal, &loop_increment);
@@ skipping 50 matching lines @@
 
     // Set byte_length.
     __ mov(Operand(esp, 3 * kPointerSize), ebx);
     // Set byte_offset2.
     // Found by adding negative string-end offset of current position (edi)
     // to String** offset of end of string.
     __ mov(ecx, Operand(ebp, kInputEndOffset));
     __ add(edi, Operand(ecx));
     __ mov(Operand(esp, 2 * kPointerSize), edi);
     // Set byte_offset1.
-    // Start of capture, where eax already holds string-end negative offset.
-    __ add(eax, Operand(ecx));
-    __ mov(Operand(esp, 1 * kPointerSize), eax);
+    // Start of capture, where edx already holds string-end negative offset.
+    __ add(edx, Operand(ecx));
+    __ mov(Operand(esp, 1 * kPointerSize), edx);
     // Set buffer. Original String** parameter to regexp code.
     __ mov(eax, Operand(ebp, kInputBuffer));
     __ mov(Operand(esp, 0 * kPointerSize), eax);
 
     Address function_address = FUNCTION_ADDR(&CaseInsensitiveCompareUC16);
     CallCFunction(function_address, four_arguments);
     // Pop original values before reacting on result value.
     __ pop(ebx);
     __ pop(backtrack_stackpointer());
     __ pop(edi);
@@ skipping 608 matching lines @@
 void RegExpMacroAssemblerIA32::WriteStackPointerToRegister(int reg) {
   __ mov(register_location(reg), backtrack_stackpointer());
 }
 
 
 // Private methods:
 
 
 static unibrow::Mapping<unibrow::Ecma262Canonicalize> canonicalize;
 
-
 RegExpMacroAssemblerIA32::Result RegExpMacroAssemblerIA32::Execute(
     Code* code,
     Address* input,
     int start_offset,
     int end_offset,
     int* output,
     bool at_start) {
   typedef int (*matcher)(Address*, int, int, int*, int, void*);
   matcher matcher_func = FUNCTION_CAST<matcher>(code->entry());
 
@@ skipping 250 matching lines @@
 
 
 void RegExpMacroAssemblerIA32::LoadConstantBufferAddress(Register reg,
                                                          ArraySlice* buffer) {
   __ mov(reg, buffer->array());
   __ add(Operand(reg), Immediate(buffer->base_offset()));
 }
 
 #undef __
 }}  // namespace v8::internal