[ia32,root] Preserve kRootRegister (ebx) in CallBoundFunction

Bug: v8:6666
Change-Id: I5c75eda044312bba6be1ce6bf71afbfe94534afc
Reviewed-on: https://chromium-review.googlesource.com/1233674Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56075}

src/builtins/builtins-call-gen.cc

@@ -39,6 +39,9 @@ void Builtins::Generate_CallFunction_ReceiverIsAny(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_CallBoundFunction(MacroAssembler* masm) {
+#ifdef V8_TARGET_ARCH_IA32
+  Assembler::SupportsRootRegisterScope supports_root_register(masm);
+#endif
   Generate_CallBoundFunctionImpl(masm);
 }
 

src/builtins/ia32/builtins-ia32.cc

@@ -2070,6 +2070,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
 
 // static
 void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
+  Assembler::SupportsRootRegisterScope supports_root_register(masm);
   // ----------- S t a t e -------------
   //  -- eax : the number of arguments (not including the receiver)
   //  -- edi : the function to call (checked to be a JSBoundFunction)
@@ -2077,8 +2078,8 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
   __ AssertBoundFunction(edi);
 
   // Patch the receiver to [[BoundThis]].
-  __ mov(ebx, FieldOperand(edi, JSBoundFunction::kBoundThisOffset));
-  __ mov(Operand(esp, eax, times_pointer_size, kPointerSize), ebx);
+  __ mov(ecx, FieldOperand(edi, JSBoundFunction::kBoundThisOffset));
+  __ mov(Operand(esp, eax, times_pointer_size, kPointerSize), ecx);
 
   // Push the [[BoundArguments]] onto the stack.
   Generate_PushBoundArguments(masm);