Fix aliasing problem in inlined stores on x64 and ia32. The receiver...

src/ia32/codegen-ia32.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 8899 matching lines @@
 
     // The initial (invalid) offset has to be large enough to force a 32-bit
     // instruction encoding to allow patching with an arbitrary offset.  Use
     // kMaxInt (minus kHeapObjectTag).
     int offset = kMaxInt;
     __ mov(FieldOperand(receiver.reg(), offset), value.reg());
     __ mov(result.reg(), Operand(value.reg()));
 
     // Allocate scratch register for write barrier.
     Result scratch = allocator()->Allocate();
-    ASSERT(scratch.is_valid() &&
-           result.is_valid() &&
-           receiver.is_valid() &&
-           value.is_valid());
+    ASSERT(scratch.is_valid());
 
     // The write barrier clobbers all input registers, so spill the
     // receiver and the value.
     frame_->Spill(receiver.reg());
     frame_->Spill(value.reg());
 
+    // If the receiver and the value share a register allocate a new
+    // register for the receiver.
+    if (receiver.reg().is(value.reg())) {
+      receiver = allocator()->Allocate();
+      ASSERT(receiver.is_valid());
+      __ mov(receiver.reg(), Operand(value.reg()));
+    }
+
     // Update the write barrier. To save instructions in the inlined
     // version we do not filter smis.
     Label skip_write_barrier;
     __ InNewSpace(receiver.reg(), value.reg(), equal, &skip_write_barrier);
     int delta_to_record_write = masm_->SizeOfCodeGeneratedSince(&patch_site);
     __ lea(scratch.reg(), Operand(receiver.reg(), offset));
     __ RecordWriteHelper(receiver.reg(), scratch.reg(), value.reg());
     if (FLAG_debug_code) {
       __ mov(receiver.reg(), Immediate(BitCast<int32_t>(kZapValue)));
       __ mov(value.reg(), Immediate(BitCast<int32_t>(kZapValue)));
@@ skipping 4963 matching lines @@
   masm.GetCode(&desc);
   // Call the function from C++.
   return FUNCTION_CAST<MemCopyFunction>(buffer);
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32