Fix register mixup in arm64's Crankshafted typeof() == 'object'

src/arm64/lithium-codegen-arm64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arm64/lithium-codegen-arm64.h"
 #include "src/arm64/lithium-gap-resolver-arm64.h"
 #include "src/code-stubs.h"
 #include "src/stub-cache.h"
@@ skipping 5878 matching lines @@
 
     __ JumpIfSmi(value, false_label);
     if (!FLAG_harmony_typeof) {
       __ JumpIfRoot(value, Heap::kNullValueRootIndex, true_label);
     }
     __ JumpIfObjectType(value, map, scratch,
                         FIRST_NONCALLABLE_SPEC_OBJECT_TYPE, false_label, lt);
     __ CompareInstanceType(map, scratch, LAST_NONCALLABLE_SPEC_OBJECT_TYPE);
     __ B(gt, false_label);
     // Check for undetectable objects => false.
-    __ Ldrb(scratch, FieldMemOperand(value, Map::kBitFieldOffset));
+    __ Ldrb(scratch, FieldMemOperand(map, Map::kBitFieldOffset));
     EmitTestAndBranch(instr, eq, scratch, 1 << Map::kIsUndetectable);
 
   } else {
     __ B(false_label);
   }
 }
 
 
 void LCodeGen::DoUint32ToDouble(LUint32ToDouble* instr) {
   __ Ucvtf(ToDoubleRegister(instr->result()), ToRegister32(instr->value()));
@@ skipping 142 matching lines @@
   Handle<ScopeInfo> scope_info = instr->scope_info();
   __ Push(scope_info);
   __ Push(ToRegister(instr->function()));
   CallRuntime(Runtime::kHiddenPushBlockContext, 2, instr);
   RecordSafepoint(Safepoint::kNoLazyDeopt);
 }
 
 
 
 } }  // namespace v8::internal