Fix fuzzer-found error where left and right were the same register in bitops.

src/ia32/codegen-ia32.cc

Index: src/ia32/codegen-ia32.cc
===================================================================
--- src/ia32/codegen-ia32.cc	(revision 5230)
+++ src/ia32/codegen-ia32.cc	(working copy)
@@ -1055,6 +1055,7 @@
       : op_(op), dst_(dst), left_(left), right_(right),
         left_info_(left_info), right_info_(right_info), mode_(mode) {
     set_comment("[ DeferredInlineBinaryOperation");
+    ASSERT(!left.is(right));
   }
 
   virtual void Generate();
@@ -1844,16 +1845,15 @@
     frame_->Spill(eax);
     frame_->Spill(edx);
     // DeferredInlineBinaryOperation requires all the registers that it is
-    // told about to be spilled.
-    frame_->Spill(left->reg());
-    frame_->Spill(right->reg());
+    // told about to be spilled and distinct.
+    Result distinct_right = frame_->MakeDistinctAndSpilled(left, right);
 
     // Check that left and right are smi tagged.
     DeferredInlineBinaryOperation* deferred =
         new DeferredInlineBinaryOperation(op,
                                           (op == Token::DIV) ? eax : edx,
                                           left->reg(),
-                                          right->reg(),
+                                          distinct_right.reg(),
                                           left_type_info,
                                           right_type_info,
                                           overwrite_mode);
@@ -1946,7 +1946,8 @@
     // We will modify right, it must be spilled.
     frame_->Spill(ecx);
     // DeferredInlineBinaryOperation requires all the registers that it is told
-    // about to be spilled.
+    // about to be spilled and distinct.  We know that right is ecx and left is
+    // not ecx.
     frame_->Spill(left->reg());
 
     // Use a fresh answer register to avoid spilling the left operand.
@@ -2021,8 +2022,7 @@
   right->ToRegister();
   // DeferredInlineBinaryOperation requires all the registers that it is told
   // about to be spilled.
-  frame_->Spill(left->reg());
-  frame_->Spill(right->reg());
+  Result distinct_right = frame_->MakeDistinctAndSpilled(left, right);
   // A newly allocated register answer is used to hold the answer.  The
   // registers containing left and right are not modified so they don't
   // need to be spilled in the fast case.
@@ -2034,7 +2034,7 @@
       new DeferredInlineBinaryOperation(op,
                                         answer.reg(),
                                         left->reg(),
-                                        right->reg(),
+                                        distinct_right.reg(),
                                         left_type_info,
                                         right_type_info,
                                         overwrite_mode);