[fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a count operation wi…

src/full-codegen/mips/full-codegen-mips.cc

Index: src/full-codegen/mips/full-codegen-mips.cc
diff --git a/src/full-codegen/mips/full-codegen-mips.cc b/src/full-codegen/mips/full-codegen-mips.cc
index e1e9efae08137005b32dae25805e25be6bb32851..9a20462a3348e0cb54baba9b194912f092ca5d14 100644
--- a/src/full-codegen/mips/full-codegen-mips.cc
+++ b/src/full-codegen/mips/full-codegen-mips.cc
@@ -3203,25 +3203,23 @@ void FullCodeGenerator::VisitCountOperation(CountOperation* expr) {
         VisitForStackValue(prop->obj()->AsSuperPropertyReference()->this_var());
         VisitForAccumulatorValue(
             prop->obj()->AsSuperPropertyReference()->home_object());
-        PushOperand(result_register());
         const Register scratch = a1;
         __ lw(scratch, MemOperand(sp, kPointerSize));

[Jakob Kummerow, 2016/07/28 12:36:02]

This loads a different value now, that doesn't seem intentional.
s/kPointerSize/0/?

-        PushOperands(scratch, result_register());
+        PushOperands(result_register(), scratch, result_register());
         EmitNamedSuperPropertyLoad(prop);
         break;
       }
 
       case KEYED_SUPER_PROPERTY: {
         VisitForStackValue(prop->obj()->AsSuperPropertyReference()->this_var());
-        VisitForAccumulatorValue(
+        VisitForStackValue(
             prop->obj()->AsSuperPropertyReference()->home_object());
-        const Register scratch = a1;
-        const Register scratch1 = t0;
-        __ Move(scratch, result_register());
         VisitForAccumulatorValue(prop->key());
-        PushOperands(scratch, result_register());
+        const Register scratch1 = a1;
+        const Register scratch2 = t0;
         __ lw(scratch1, MemOperand(sp, 2 * kPointerSize));

[Jakob Kummerow, 2016/07/28 12:36:02]

I think this should be s/2 * kPointerSize/kPointerSize/, because now there's one
less push happening before we get here.

-        PushOperands(scratch1, scratch, result_register());
+        __ lw(scratch2, MemOperand(sp, 1 * kPointerSize));

[Jakob Kummerow, 2016/07/28 12:36:02]

...and this should be s/1 * kPointerSize/0/ by the same reasoning.

+        PushOperands(result_register(), scratch1, scratch2, result_register());
         EmitKeyedSuperPropertyLoad(prop);
         break;
       }