Fix implementation of compare-minus-zero-and-branch on ia32 and x64.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/63573004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/ia32/lithium-codegen-ia32.cc

@@ -2689,7 +2689,7 @@ void LCodeGen::DoCompareMinusZeroAndBranch(LCompareMinusZeroAndBranch* instr) {
   } else {
     Register value = ToRegister(instr->value());
     Handle<Map> map = masm()->isolate()->factory()->heap_number_map();
-    __ CheckMap(eax, map, &if_false, DO_SMI_CHECK);
+    __ CheckMap(value, map, &if_false, DO_SMI_CHECK);
     __ cmp(FieldOperand(value, HeapNumber::kExponentOffset),
            Immediate(0x80000000));
     __ j(not_equal, &if_false);

src/x64/lithium-codegen-x64.cc

@@ -2263,7 +2263,7 @@ void LCodeGen::DoCompareMinusZeroAndBranch(LCompareMinusZeroAndBranch* instr) {
   } else {
     Register value = ToRegister(instr->value());
     Handle<Map> map = masm()->isolate()->factory()->heap_number_map();
-    __ CheckMap(rax, map, &if_false, DO_SMI_CHECK);
+    __ CheckMap(value, map, &if_false, DO_SMI_CHECK);
     __ cmpl(FieldOperand(value, HeapNumber::kExponentOffset),
             Immediate(0x80000000));
     __ j(not_equal, &if_false);