[ia32] Save used FP-regs before calling RecordWrite

xmm0 and xmm1 are used to save/restore values in asm builtins, but they
were not saved before calling RecordWrite, which calls C++ code.
Instead of passing SaveFPRegsMode::kSave to RecordWriteField, which
would save/restore all FP-regs, this CL explicitly saves/restores the
FP-regs we rely on beyond the C-Call.

Bug: chromium:1216295
Change-Id: Ifcc7ce4e8819303ffb79576a88304df2e3a6cc4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2944427Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74991}

src/builtins/ia32/builtins-ia32.cc

@@ -798,8 +798,8 @@ static void TailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(!AreAliased(edx, edi, optimized_code_entry));
 
   Register closure = edi;
-  __ movd(xmm0, eax);
-  __ movd(xmm1, edx);
+  __ Push(eax);
+  __ Push(edx);
 
   Label heal_optimized_code_slot;
 
@@ -821,16 +821,16 @@ static void TailCallOptimizedCodeSlot(MacroAssembler* masm,
                                       eax);
   static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
   __ LoadCodeObjectEntry(ecx, optimized_code_entry);
-  __ movd(edx, xmm1);
-  __ movd(eax, xmm0);
+  __ Pop(edx);
+  __ Pop(eax);
   __ jmp(ecx);
 
   // Optimized code slot contains deoptimized code or code is cleared and
   // optimized code marker isn't updated. Evict the code, update the marker
   // and re-enter the closure's code.
   __ bind(&heal_optimized_code_slot);
-  __ movd(edx, xmm1);
-  __ movd(eax, xmm0);
+  __ Pop(edx);
+  __ Pop(eax);
   GenerateTailCallToReturnedCode(masm, Runtime::kHealOptimizedCodeSlot);
 }
 
@@ -1256,9 +1256,10 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
     __ mov(ecx, FieldOperand(ecx, BaselineData::kBaselineCodeOffset));
     static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
     __ push(edx);  // Spill.
+    __ Push(xmm0, eax);  // Save the argument count (currently in xmm0).
     ReplaceClosureCodeWithOptimizedCode(masm, ecx, closure, eax, edx);
+    __ pop(eax);  // Restore the argument count.
     __ pop(edx);
-    __ movd(eax, xmm0);  // Recover argument count.
     __ JumpCodeObject(ecx);
 
     __ bind(&install_baseline_code);