Fix variable decl register collision on ARM.

BUG=chromium:455207
LOG=n
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1040703003

Cr-Commit-Position: refs/heads/master@{#30249}

diff --git a/src/full-codegen/arm/full-codegen-arm.cc b/src/full-codegen/arm/full-codegen-arm.cc
index d7a9bc3..411721c 100644 (file)
--- a/src/full-codegen/arm/full-codegen-arm.cc
+++ b/src/full-codegen/arm/full-codegen-arm.cc
@@ -842,8 +842,8 @@ void FullCodeGenerator::VisitVariableDeclaration(
     case VariableLocation::LOCAL:
       if (hole_init) {
         Comment cmnt(masm_, "[ VariableDeclaration");
-        __ LoadRoot(ip, Heap::kTheHoleValueRootIndex);
-        __ str(ip, StackOperand(variable));
+        __ LoadRoot(r0, Heap::kTheHoleValueRootIndex);
+        __ str(r0, StackOperand(variable));
       }
       break;
 
@@ -851,8 +851,8 @@ void FullCodeGenerator::VisitVariableDeclaration(
       if (hole_init) {
         Comment cmnt(masm_, "[ VariableDeclaration");
         EmitDebugCheckDeclarationContext(variable);
-        __ LoadRoot(ip, Heap::kTheHoleValueRootIndex);
-        __ str(ip, ContextOperand(cp, variable->index()));
+        __ LoadRoot(r0, Heap::kTheHoleValueRootIndex);
+        __ str(r0, ContextOperand(cp, variable->index()));
         // No write barrier since the_hole_value is in old space.
         PrepareForBailoutForId(proxy->id(), NO_REGISTERS);
       }

diff --git a/test/mjsunit/regress/regress-455207.js b/test/mjsunit/regress/regress-455207.js
new file mode 100644 (file)
index 0000000..88fec4a
--- /dev/null
+++ b/test/mjsunit/regress/regress-455207.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var s = "";
+for (var i = 16; i < 1085; i++) {
+  s += ("var a" + i + " = " + i + ";");
+}
+s += "const x = 10;" +
+    "assertEquals(10, x); x = 11; assertEquals(11, x)";
+assertThrows(function() { eval(s); });