Fix embedded new-space pointer in LCmpObjectEqAndBranch.

src/x64/lithium-codegen-x64.cc

Index: src/x64/lithium-codegen-x64.cc
diff --git a/src/x64/lithium-codegen-x64.cc b/src/x64/lithium-codegen-x64.cc
index 02a1539e7f902ad24308f1f355d3819df751eb25..2edfa07051695478aebdae185942aaf08cfe0abf 100644
--- a/src/x64/lithium-codegen-x64.cc
+++ b/src/x64/lithium-codegen-x64.cc
@@ -2082,9 +2082,11 @@ void LCodeGen::DoCmpObjectEqAndBranch(LCmpObjectEqAndBranch* instr) {
   int true_block = chunk_->LookupDestination(instr->true_block_id());
 
   if (instr->right()->IsConstantOperand()) {
-    __ Cmp(left, ToHandle(LConstantOperand::cast(instr->right())));
+    Handle<Object> right = ToHandle(LConstantOperand::cast(instr->right()));
+    __ CmpObject(left, right);
   } else {
-    __ cmpq(left, ToRegister(instr->right()));
+    Register right = ToRegister(instr->right());
+    __ cmpq(left, right);
   }
   EmitBranch(true_block, false_block, equal);
 }
@@ -4953,15 +4955,7 @@ void LCodeGen::DoCheckInstanceType(LCheckInstanceType* instr) {
 void LCodeGen::DoCheckFunction(LCheckFunction* instr) {
   Register reg = ToRegister(instr->value());
   Handle<JSFunction> target = instr->hydrogen()->target();
-  ALLOW_HANDLE_DEREF(isolate(), "using raw address");
-  if (isolate()->heap()->InNewSpace(*target)) {
-    Handle<JSGlobalPropertyCell> cell =
-        isolate()->factory()->NewJSGlobalPropertyCell(target);
-    __ movq(kScratchRegister, cell, RelocInfo::GLOBAL_PROPERTY_CELL);
-    __ cmpq(reg, Operand(kScratchRegister, 0));
-  } else {
-    __ Cmp(reg, target);
-  }
+  __ CmpHeapObject(reg, target);

[mvstanton, 2013/05/23 13:09:14]

Nice that you could refactor this code...how about the one in 32bit though? I
see it in ARM too (lithium-codegen-arm.cc)

[Michael Starzinger, 2013/05/23 13:13:51]

As discussed offline: Yes, I agree, ia32 should use the same pattern, but it
currently decides at LChunkBuilder time. And with parallel compilation the
location might change. This should be cleaned up as well. As for ARM, the bug
doesn't exists there so that's also up for a follow-up CL, this should be kept a
clean bug-fix.

   DeoptimizeIf(not_equal, instr->environment());
 }