Fix fuzzer-found error where left and right were the same register in bitops.

src/ia32/virtual-frame-ia32.h

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 121 matching lines @@
   void ForgetElements(int count);
 
   // Spill all values from the frame to memory.
   inline void SpillAll();
 
   // Spill all occurrences of a specific register from the frame.
   void Spill(Register reg) {
     if (is_used(reg)) SpillElementAt(register_location(reg));
   }
 
+  // Make the two registers distinct and spill them.  Returns the second
+  // register.  If the registers were not distinct then it returns the new
+  // second register.
+  Result MakeDistinctAndSpilled(Result* left, Result* right) {
+    Spill(left->reg());
+    Spill(right->reg());
+    if (left->reg().is(right->reg())) {
+      RegisterAllocator* allocator = cgen()->allocator();
+      Result fresh = allocator->Allocate();
+      ASSERT(fresh.is_valid());
+      masm()->mov(fresh.reg(), right->reg());
+      return fresh;
+    }
+    return *right;
+  }
+
   // Spill all occurrences of an arbitrary register if possible.  Return the
   // register spilled or no_reg if it was not possible to free any register
   // (ie, they all have frame-external references).
   Register SpillAnyRegister();
 
   // Spill the top element of the frame.
   void SpillTop() { SpillElementAt(element_count() - 1); }
 
   // Sync the range of elements in [begin, end] with memory.
   void SyncRange(int begin, int end);
@@ skipping 466 matching lines @@
   inline bool Equals(VirtualFrame* other);
 
   // Classes that need raw access to the elements_ array.
   friend class FrameRegisterState;
   friend class JumpTarget;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_IA32_VIRTUAL_FRAME_IA32_H_