Arm fix: incorrect register used in CompareObjectType

src/arm/builtins-arm.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 536 matching lines @@
   //  -- sp[...]: constructor arguments
   // -----------------------------------
 
   if (FLAG_debug_code) {
     // The array construct code is only set for the builtin and internal
     // Array functions which always have a map.
     // Initial map for the builtin Array function should be a map.
     __ ldr(r3, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
     __ tst(r3, Operand(kSmiTagMask));
     __ Assert(ne, "Unexpected initial map for Array function");
-    __ CompareObjectType(r1, r3, r4, MAP_TYPE);
+    __ CompareObjectType(r3, r3, r4, MAP_TYPE);
     __ Assert(eq, "Unexpected initial map for Array function");
 
     if (FLAG_optimize_constructed_arrays) {
       // We should either have undefined in r2 or a valid jsglobalpropertycell
       Label okay_here;
       Handle<Object> undefined_sentinel(
           masm->isolate()->heap()->undefined_value(), masm->isolate());
       Handle<Map> global_property_cell_map(
           masm->isolate()->heap()->global_property_cell_map());
       __ cmp(r2, Operand(undefined_sentinel));
@@ skipping 1324 matching lines @@
   __ bind(&dont_adapt_arguments);
   __ Jump(r3);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_ARM