Fixed remaining bugs in COW-regexp-results.

src/x64/codegen-x64.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4815 matching lines @@
     }
   }
   __ Push(Smi::FromInt(size_));
   __ CallRuntime(Runtime::kAllocateInNewSpace, 1);
   if (!target_.is(rax)) {
     __ movq(target_, rax);
   }
   for (int i = kNumRegs - 1; i >= 0; i--) {
     if (registers_to_save_ & (1 << i)) {
       Register save_register = { i };
-      __ push(save_register);
+      __ pop(save_register);
     }
   }
 }
 
 
 void CodeGenerator::VisitRegExpLiteral(RegExpLiteral* node) {
   Comment cmnt(masm_, "[ RegExp Literal");
 
   // Retrieve the literals array and check the allocated entry.  Begin
   // with a writable copy of the function of this activation in a
@@ skipping 1794 matching lines @@
     // which is either an unmodified JSRegExpResult or null. Anything not having
     // the unmodified JSRegExpResult map is returned unmodified.
     // This also ensures that elements are fast.
 
     __ movq(rdx, ContextOperand(rsi, Context::GLOBAL_INDEX));
     __ movq(rdx, FieldOperand(rdx, GlobalObject::kGlobalContextOffset));
     __ movq(rdx, ContextOperand(rdx, Context::REGEXP_RESULT_MAP_INDEX));
     __ cmpq(rdx, FieldOperand(rax, HeapObject::kMapOffset));
     __ j(not_equal, &done);
 
+    if (FLAG_debug_code) {
+      // Check that object really has empty properties array, as the map
+      // should guarantee.
+      __ CompareRoot(FieldOperand(rax, JSObject::kPropertiesOffset),
+                     Heap::kEmptyFixedArrayRootIndex);
+      __ Check(equal, "JSRegExpResult: default map but non-empty properties.");
+    }
+
     DeferredAllocateInNewSpace* allocate_fallback =
         new DeferredAllocateInNewSpace(JSRegExpResult::kSize,
                                        rbx,
                                        rdx.bit() | rax.bit());
 
     // All set, copy the contents to a new object.
     __ AllocateInNewSpace(JSRegExpResult::kSize,
                           rbx,
                           no_reg,
                           no_reg,
@@ skipping 12 matching lines @@
       }
       __ movq(rcx, FieldOperand(rax, i + kPointerSize));
 
       STATIC_ASSERT(JSObject::kElementsOffset % (2 * kPointerSize) == 0);
       if (i == JSObject::kElementsOffset) {
         // If the elements array isn't empty, make it copy-on-write
         // before copying it.
         Label empty;
         __ CompareRoot(rdx, Heap::kEmptyFixedArrayRootIndex);
         __ j(equal, &empty);
-        ASSERT(!Heap::InNewSpace(Heap::fixed_cow_array_map()));
         __ LoadRoot(kScratchRegister, Heap::kFixedCOWArrayMapRootIndex);
         __ movq(FieldOperand(rdx, HeapObject::kMapOffset), kScratchRegister);
         __ bind(&empty);
       }
       __ movq(FieldOperand(rbx, i), rdx);
       __ movq(FieldOperand(rbx, i + kPointerSize), rcx);
     }
     __ movq(rax, rbx);
 
     __ bind(&done);
@@ skipping 6158 matching lines @@
 #undef __
 
 void RecordWriteStub::Generate(MacroAssembler* masm) {
   masm->RecordWriteHelper(object_, addr_, scratch_);
   masm->ret(0);
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64