Clobber non-live temporaries on some paths involving a possible slow-path allocation.

runtime/vm/intermediate_language_ia32.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_IA32.
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/intermediate_language.h"
 
 #include "vm/dart_entry.h"
@@ skipping 1864 matching lines @@
 
     // Fall through.
     __ jmp(&store_pointer);
 
 
     if (!compiler->is_optimizing()) {
       locs()->live_registers()->Add(locs()->in(0));
       locs()->live_registers()->Add(locs()->in(1));
     }
 
+    // Manually preserve temp which could be clobbered on the slow path.
+    locs()->live_registers()->Add(locs()->temp(0));

[Vyacheslav Egorov (Google), 2014/12/09 17:49:46]

Actually I have been looking at this code and it does not seem like temp(0) is
live across allocation  slow path so there is no need to preserve it. 

temp(0) is used as allocation result and overwritten

[zerny-google, 2014/12/10 09:49:15]

Your right, the updated patch set won't clobber temp. With patch-set 1, temp was
clobbered on the fast path (via AllocateOnFailure) in with the box_reg value
from EnsureMutableBox would be lost.

+
     {
       __ Bind(&store_double);
       EnsureMutableBox(compiler,
                        this,
                        temp,
                        compiler->double_class(),
                        instance_reg,
                        offset_in_bytes_,
                        temp2);
       __ movsd(fpu_temp, FieldAddress(value_reg, Double::value_offset()));
@@ skipping 1898 matching lines @@
         break;
       default:
         UNREACHABLE();
         break;
     }
     if (can_pack_into_smi()) {
       __ SmiTag(result);
     } else {
       // If the value cannot fit in a smi then allocate a mint box for it.
       Register temp = locs()->temp(0).reg();
+      // Temp register needs to be manually preserved on allocation slow-path.
+      locs()->live_registers()->Add(locs()->temp(0), kUnboxedInt32);
+
       ASSERT(temp != result);
       __ MoveRegister(temp, result);
       __ SmiTag(result);
 
       Label done;
       __ testl(temp, Immediate(0xC0000000));
       __ j(ZERO, &done);
       BoxAllocationSlowPath::Allocate(
           compiler, this, compiler->mint_class(), result, kNoRegister);
       __ movl(FieldAddress(result, Mint::value_offset()), temp);
@@ skipping 2999 matching lines @@
 #if defined(DEBUG)
   __ movl(EDX, Immediate(kInvalidObjectPointer));
 #endif
 }
 
 }  // namespace dart
 
 #undef __
 
 #endif  // defined TARGET_ARCH_IA32