Fix aliasing problem in inlined stores on x64 and ia32. The receiver...

src/x64/codegen-x64.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 8033 matching lines @@
 
     // The initial (invalid) offset has to be large enough to force a 32-bit
     // instruction encoding to allow patching with an arbitrary offset.  Use
     // kMaxInt (minus kHeapObjectTag).
     int offset = kMaxInt;
     __ movq(FieldOperand(receiver.reg(), offset), value.reg());
     __ movq(result.reg(), value.reg());
 
     // Allocate scratch register for write barrier.
     Result scratch = allocator()->Allocate();
-    ASSERT(scratch.is_valid() &&
-           result.is_valid() &&
-           receiver.is_valid() &&
-           value.is_valid());
+    ASSERT(scratch.is_valid());
 
     // The write barrier clobbers all input registers, so spill the
     // receiver and the value.
     frame_->Spill(receiver.reg());
     frame_->Spill(value.reg());
 
+    // If the receiver and the value share a register allocate a new
+    // register for the receiver.
+    if (receiver.reg().is(value.reg())) {
+      receiver = allocator()->Allocate();
+      ASSERT(receiver.is_valid());
+      __ movq(receiver.reg(), value.reg());
+    }
+
     // Update the write barrier. To save instructions in the inlined
     // version we do not filter smis.
     Label skip_write_barrier;
     __ InNewSpace(receiver.reg(), value.reg(), equal, &skip_write_barrier);
     int delta_to_record_write = masm_->SizeOfCodeGeneratedSince(&patch_site);
     __ lea(scratch.reg(), Operand(receiver.reg(), offset));
     __ RecordWriteHelper(receiver.reg(), scratch.reg(), value.reg());
     if (FLAG_debug_code) {
       __ movq(receiver.reg(), BitCast<int64_t>(kZapValue), RelocInfo::NONE);
       __ movq(value.reg(), BitCast<int64_t>(kZapValue), RelocInfo::NONE);
@@ skipping 4351 matching lines @@
 #undef __
 
 void RecordWriteStub::Generate(MacroAssembler* masm) {
   masm->RecordWriteHelper(object_, addr_, scratch_);
   masm->ret(0);
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64