[Interpreter] Changes GenerateDoubleToObject to push and pop rsi value.

[Interpreter] Changes GenerateDoubleToObject to push and pop rsi value.

In the earlier implementation of GenerateDoubleToObject the context
is loaded from the parent's frame. rsi is clobbered because it is used
to store kHoleNan constnat. It is not always safe to peek at
the parents frame. Bytecode handlers have TypedFrame and the type of
frame is stored at FP + 1. GenerateDoubleToObject expects context
to be store at that place. In the current implementation rsi is pushed
onto the stack and is popped when exiting this function.

BUG=v8:4280, chromium:597565
LOG=N

Committed: https://crrev.com/e6b6e5545386985f1d0bec875307e5df52062d71
Cr-Commit-Position: refs/heads/master@{#35163}

[mythria, 2016-03-30 13:48:46]

The CQ bit was checked by mythria@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-03-30 13:48:51]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1848473002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1848473002/1

[commit-bot: I haz the power, 2016-03-30 14:10:35]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-03-30 14:10:36]

Dry run: This issue passed the CQ dry run.

[mythria, 2016-03-30 15:27:35]

mythria@chromium.org changed reviewers:
+ mvstanton@chromium.org, verwaest@chromium.org

[mythria, 2016-03-30 15:27:36]

Michael and Toon, 

I was looking at an ignition failure
(https://bugs.chromium.org/p/chromium/issues/detail?id=597565).  It was failing
because of an incorrect context value. 

The wrong context value is stored into rsi in GenerateDoubleToObject. This stub
loads the context from its parent frame (from rbp-0x8). In ignition we create a
TypedFrame so the type of frame is stored at that location as opposed to cotnext
in standard frames. In this cl I push and pop rsi so that we need not peek at
parent's frame. Please take a look. 

I don't understand this code too well, so I am not sure this is the right fix.
Please take a look. If you think it is ok, I will also port it to other
architectures.

Thanks,
Mythri

[mvstanton, 2016-03-30 15:28:01]

lgtm

[Toon Verwaest, 2016-03-31 08:22:17]

lgtm

[mythria, 2016-03-31 10:38:43]

The CQ bit was checked by mythria@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-03-31 10:38:51]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1848473002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1848473002/20001

[mythria, 2016-03-31 10:42:08]

Thanks for your reviews. I ported it to ia32 as well. Arm and mips does not seem
to have this problem. They don't use the context register. I will land this once
the bots are green.

Thanks and Regards,
Mythri

[rmcilroy, 2016-03-31 10:46:17]

Drive by comment - could you add a mjsunit test for this (the minismised
clusterfuzz js file would be fine).

[commit-bot: I haz the power, 2016-03-31 10:59:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-03-31 10:59:45]

Dry run: This issue passed the CQ dry run.

[mythria, 2016-03-31 11:10:43]

mythria@chromium.org changed reviewers:
+ oth@chromium.org

[mythria, 2016-03-31 11:10:44]

Thanks Ross, I added an mjsunit test.

Orion, could you please review the mjsunit test I added.

Thanks,
Mythri

[mythria, 2016-03-31 11:11:05]

The CQ bit was checked by mythria@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-03-31 11:11:13]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1848473002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1848473002/40001

[commit-bot: I haz the power, 2016-03-31 11:32:26]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-03-31 11:32:27]

Dry run: This issue passed the CQ dry run.

[oth, 2016-03-31 12:35:06]

lgtm, a brief comment or two in the tests might help a future reader.

[mythria, 2016-03-31 13:18:27]

Thanks orion. I added comments to the test.

[mythria, 2016-03-31 13:18:34]

The CQ bit was checked by mythria@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-03-31 13:18:40]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1848473002/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1848473002/60001

[commit-bot: I haz the power, 2016-03-31 13:39:27]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-03-31 13:39:28]

Dry run: This issue passed the CQ dry run.

[mythria, 2016-03-31 13:43:02]

The CQ bit was checked by mythria@chromium.org

[mythria, 2016-03-31 13:43:03]

The patchset sent to the CQ was uploaded after l-g-t-m from
mvstanton@chromium.org, verwaest@chromium.org, oth@chromium.org
Link to the patchset: https://codereview.chromium.org/1848473002/#ps60001
(title: "adds comments to test.")

[commit-bot: I haz the power, 2016-03-31 13:43:10]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1848473002/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1848473002/60001

[commit-bot: I haz the power, 2016-03-31 13:44:48]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2016-03-31 13:45:58]

Description was changed from

==========
[Interpreter] Changes GenerateDoubleToObject to push and pop rsi value.

In the earlier implementation of GenerateDoubleToObject the context
is loaded from the parent's frame. rsi is clobbered because it is used
to store kHoleNan constnat. It is not always safe to peek at
the parents frame. Bytecode handlers have TypedFrame and the type of
frame is stored at FP + 1. GenerateDoubleToObject expects context
to be store at that place. In the current implementation rsi is pushed
onto the stack and is popped when exiting this function.

BUG=v8:4280,chromium:597565
LOG=N
==========

to

==========
[Interpreter] Changes GenerateDoubleToObject to push and pop rsi value.

In the earlier implementation of GenerateDoubleToObject the context
is loaded from the parent's frame. rsi is clobbered because it is used
to store kHoleNan constnat. It is not always safe to peek at
the parents frame. Bytecode handlers have TypedFrame and the type of
frame is stored at FP + 1. GenerateDoubleToObject expects context
to be store at that place. In the current implementation rsi is pushed
onto the stack and is popped when exiting this function.

BUG=v8:4280,chromium:597565
LOG=N

Committed: https://crrev.com/e6b6e5545386985f1d0bec875307e5df52062d71
Cr-Commit-Position: refs/heads/master@{#35163}
==========

[commit-bot: I haz the power, 2016-03-31 13:45:59]

Patchset 4 (id:??) landed as
https://crrev.com/e6b6e5545386985f1d0bec875307e5df52062d71
Cr-Commit-Position: refs/heads/master@{#35163}