Load size in signed int before making negative.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23074003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16184 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/ia32/lithium-codegen-ia32.cc

@@ -2506,7 +2506,7 @@ void LCodeGen::DoCmpHoleAndBranch(LCmpHoleAndBranch* instr) {
   } else {
     // Put the value to the top of stack
     X87Register src = ToX87Register(instr->object());
-    X87LoadForUsage(src);
+    X87Fxch(src);
     __ fld(0);
     __ fld(0);
     __ FCmp();
@@ -2525,7 +2525,8 @@ void LCodeGen::DoCmpHoleAndBranch(LCmpHoleAndBranch* instr) {
   }
 
   __ add(esp, Immediate(kDoubleSize));
-  __ cmp(MemOperand(esp, -sizeof(kHoleNanUpper32)), Immediate(kHoleNanUpper32));
+  int offset = sizeof(kHoleNanUpper32);
+  __ cmp(MemOperand(esp, -offset), Immediate(kHoleNanUpper32));
   EmitBranch(instr, equal);
 }
 

src/x64/lithium-codegen-x64.cc

@@ -2196,9 +2196,8 @@ void LCodeGen::DoCmpHoleAndBranch(LCmpHoleAndBranch* instr) {
   __ movsd(MemOperand(rsp, 0), input_reg);
   __ addq(rsp, Immediate(kDoubleSize));
 
-  int size = sizeof(kHoleNanUpper32);
-  __ cmpl(MemOperand(rsp, -size),
-         Immediate(kHoleNanUpper32));
+  int offset = sizeof(kHoleNanUpper32);
+  __ cmpl(MemOperand(rsp, -offset), Immediate(kHoleNanUpper32));
   EmitBranch(instr, equal);
 }