Index: src/ic/x87/handler-compiler-x87.cc |
diff --git a/src/ic/x87/handler-compiler-x87.cc b/src/ic/x87/handler-compiler-x87.cc |
index 6b97ccb0fb3de0beaa4dced361c1f7909a788273..48b7c875d5a86b2bf1b549d3a76ce64292ecb39f 100644 |
--- a/src/ic/x87/handler-compiler-x87.cc |
+++ b/src/ic/x87/handler-compiler-x87.cc |
@@ -18,16 +18,21 @@ namespace internal { |
void NamedLoadHandlerCompiler::GenerateLoadViaGetter( |
MacroAssembler* masm, Handle<HeapType> type, Register receiver, |
- Register holder, int accessor_index, int expected_arguments) { |
+ Register holder, int accessor_index, int expected_arguments, |
+ Register scratch) { |
{ |
FrameScope scope(masm, StackFrame::INTERNAL); |
if (accessor_index >= 0) { |
+ DCHECK(!holder.is(scratch)); |
+ DCHECK(!receiver.is(scratch)); |
// Call the JavaScript getter with the receiver on the stack. |
if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) { |
// Swap in the global receiver. |
- __ mov(receiver, |
+ // Do not overwrite receiver register, it can alias to holder register. |
+ __ mov(scratch, |
FieldOperand(receiver, JSGlobalObject::kGlobalProxyOffset)); |
+ receiver = scratch; |
} |
__ push(receiver); |
ParameterCount actual(0); |
@@ -231,7 +236,8 @@ void PropertyHandlerCompiler::GenerateCheckPropertyCell( |
void NamedStoreHandlerCompiler::GenerateStoreViaSetter( |
MacroAssembler* masm, Handle<HeapType> type, Register receiver, |
- Register holder, int accessor_index, int expected_arguments) { |
+ Register holder, int accessor_index, int expected_arguments, |
+ Register scratch) { |
// ----------- S t a t e ------------- |
// -- esp[0] : return address |
// ----------------------------------- |
@@ -242,11 +248,16 @@ void NamedStoreHandlerCompiler::GenerateStoreViaSetter( |
__ push(value()); |
if (accessor_index >= 0) { |
+ DCHECK(!holder.is(scratch)); |
+ DCHECK(!receiver.is(scratch)); |
+ DCHECK(!value().is(scratch)); |
// Call the JavaScript setter with receiver and value on the stack. |
if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) { |
// Swap in the global receiver. |
- __ mov(receiver, |
+ // Do not overwrite receiver register, it can alias to holder register. |
+ __ mov(scratch, |
FieldOperand(receiver, JSGlobalObject::kGlobalProxyOffset)); |
+ receiver = scratch; |
} |
__ push(receiver); |
__ push(value()); |