MIPS: Fix several bugs that cause crashes in soft-float mode.

TEST=cctest/RobustSubStringStub,cctest/test-api/Threading,cctest/test-api/ExternalFloatArray,cctest/test-api/ExternalDoubleArray,mjsunit/external-array,mjsunit/unicodelctest

BUG=

Review URL: https://chromiumcodereview.appspot.com/10446003
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/mips/code-stubs-mips.cc

@@ -3130,7 +3130,7 @@ void BinaryOpStub::GenerateInt32Stub(MacroAssembler* masm) {
       } else {
         // Tail call that writes the int32 in a2 to the heap number in v0, using
         // a3 and a0 as scratch. v0 is preserved and returned.
-        __ mov(a0, t1);
+        __ mov(v0, t1);
         WriteInt32ToHeapNumberStub stub(a2, v0, a3, a0);
         __ TailCallStub(&stub);
       }

src/mips/simulator-mips.cc

@@ -1502,10 +1502,15 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
             break;
         }
       }
-      double result = target(arg0, arg1, arg2, arg3);
       if (redirection->type() != ExternalReference::BUILTIN_COMPARE_CALL) {
-          SetFpResult(result);
+        SimulatorRuntimeFPCall target =
+            reinterpret_cast<SimulatorRuntimeFPCall>(external);
+        double result = target(arg0, arg1, arg2, arg3);
+        SetFpResult(result);
       } else {
+        SimulatorRuntimeCall target =
+            reinterpret_cast<SimulatorRuntimeCall>(external);
+        uint64_t result = target(arg0, arg1, arg2, arg3, arg4, arg5);
         int32_t gpreg_pair[2];
         memcpy(&gpreg_pair[0], &result, 2 * sizeof(int32_t));
         set_register(v0, gpreg_pair[0]);

src/mips/stub-cache-mips.cc

@@ -3705,7 +3705,7 @@ void KeyedLoadStubCompiler::GenerateLoadExternalArray(
       __ li(t0, 0x7ff);
       __ Xor(t1, t5, Operand(0xFF));
       __ Movz(t5, t0, t1);  // Set t5 to 0x7ff only if t5 is equal to 0xff.
-      __ Branch(&exponent_rebiased, eq, t0, Operand(0xff));
+      __ Branch(&exponent_rebiased, eq, t1, Operand(zero_reg));
 
       // Rebias exponent.
       __ Addu(t5,
@@ -4005,7 +4005,7 @@ void KeyedStoreStubCompiler::GenerateStoreExternalArray(
         __ xor_(t1, t6, t5);
         __ li(t2, kBinary32ExponentMask);
         __ Movz(t6, t2, t1);  // Only if t6 is equal to t5.
-        __ Branch(&nan_or_infinity_or_zero, eq, t6, Operand(t5));
+        __ Branch(&nan_or_infinity_or_zero, eq, t1, Operand(zero_reg));
 
         // Rebias exponent.
         __ srl(t6, t6, HeapNumber::kExponentShift);
@@ -4036,7 +4036,7 @@ void KeyedStoreStubCompiler::GenerateStoreExternalArray(
 
         __ bind(&done);
         __ sll(t9, key, 1);
-        __ addu(t9, a2, t9);
+        __ addu(t9, a3, t9);
         __ sw(t3, MemOperand(t9, 0));
 
         // Entry registers are intact, a0 holds the value which is the return
@@ -4054,7 +4054,7 @@ void KeyedStoreStubCompiler::GenerateStoreExternalArray(
         __ or_(t3, t6, t4);
         __ Branch(&done);
       } else if (elements_kind == EXTERNAL_DOUBLE_ELEMENTS) {
-        __ sll(t8, t0, 3);
+        __ sll(t8, key, 2);
         __ addu(t8, a3, t8);
         // t8: effective address of destination element.
         __ sw(t4, MemOperand(t8, 0));