A64: Fix WrapReceiver corrupting receiver register

src/a64/lithium-codegen-a64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5629 matching lines @@
     __ Tbnz(result, SharedFunctionInfo::kNative, &done);
   }
 
   // Normal function. Replace undefined or null with global receiver.
   __ JumpIfRoot(receiver, Heap::kNullValueRootIndex, &global_object);
   __ JumpIfRoot(receiver, Heap::kUndefinedValueRootIndex, &global_object);
 
   // Deoptimize if the receiver is not a JS object.
   __ JumpIfSmi(receiver, &deopt);
   __ CompareObjectType(receiver, result, result, FIRST_SPEC_OBJECT_TYPE);
+  __ Mov(result, receiver);
   __ B(ge, &done);
   // Otherwise, fall through to deopt.
 
   __ Bind(&deopt);
   Deoptimize(instr->environment());
 
   __ Bind(&global_object);
-  // We could load directly into the result register here, but the additional
-  // branches required are likely to be more time consuming than one additional
-  // move.
-  __ Ldr(receiver, FieldMemOperand(function, JSFunction::kContextOffset));
-  __ Ldr(receiver, ContextMemOperand(receiver, Context::GLOBAL_OBJECT_INDEX));
-  __ Ldr(receiver,
-         FieldMemOperand(receiver, GlobalObject::kGlobalReceiverOffset));
+  __ Ldr(result, FieldMemOperand(function, JSFunction::kContextOffset));
+  __ Ldr(result, ContextMemOperand(result, Context::GLOBAL_OBJECT_INDEX));
+  __ Ldr(result, FieldMemOperand(result, GlobalObject::kGlobalReceiverOffset));
 
   __ Bind(&done);
-  __ Mov(result, receiver);
 }
 
 
 void LCodeGen::DoLoadFieldByIndex(LLoadFieldByIndex* instr) {
   Register object = ToRegister(instr->object());
   Register index = ToRegister(instr->index());
   Register result = ToRegister(instr->result());
 
   __ AssertSmi(index);
 
@@ skipping 10 matching lines @@
   __ Bind(&out_of_object);
   __ Ldr(result, FieldMemOperand(object, JSObject::kPropertiesOffset));
   // Index is equal to negated out of object property index plus 1.
   __ Sub(result, result, Operand::UntagSmiAndScale(index, kPointerSizeLog2));
   __ Ldr(result, FieldMemOperand(result,
                                  FixedArray::kHeaderSize - kPointerSize));
   __ Bind(&done);
 }
 
 } }  // namespace v8::internal