Fix ARM bug introduced in r12604 that caused crashes on ARM

on crypto-md5 from SunSpider.  Bug=152402
Review URL: https://chromiumcodereview.appspot.com/10991045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12623 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/arm/code-stubs-arm.cc

@@ -7561,7 +7561,9 @@ void StoreArrayLiteralElementStub::Generate(MacroAssembler* masm) {
   // Array literal has ElementsKind of FAST_DOUBLE_ELEMENTS.
   __ bind(&double_elements);
   __ ldr(r5, FieldMemOperand(r1, JSObject::kElementsOffset));
-  __ StoreNumberToDoubleElements(r0, r3, r1, r5, r6, r7, r9, r2,
+  __ StoreNumberToDoubleElements(r0, r3, r1,
+                                 // Overwrites all regs after this.
+                                 r5, r6, r7, r9, r2,
                                  &slow_elements);
   __ Ret();
 }

src/arm/ic-arm.cc

@@ -1380,8 +1380,8 @@ static void KeyedStoreGenerateGenericHelper(
   __ StoreNumberToDoubleElements(value,
                                  key,
                                  receiver,
-                                 elements,
-                                 r3,
+                                 elements,  // Overwritten.
+                                 r3,        // Scratch regs...
                                  r4,
                                  r5,
                                  r6,

src/arm/macro-assembler-arm.cc

@@ -1988,7 +1988,7 @@ void MacroAssembler::StoreNumberToDoubleElements(Register value_reg,
     destination = FloatingPointHelper::kCoreRegisters;
   }
 
-  Register untagged_value = receiver_reg;
+  Register untagged_value = elements_reg;
   SmiUntag(untagged_value, value_reg);
   FloatingPointHelper::ConvertIntToDouble(this,
                                           untagged_value,

src/arm/macro-assembler-arm.h

@@ -816,6 +816,7 @@ class MacroAssembler: public Assembler {
   void StoreNumberToDoubleElements(Register value_reg,
                                    Register key_reg,
                                    Register receiver_reg,
+                                   // All regs below here overwritten.
                                    Register elements_reg,
                                    Register scratch1,
                                    Register scratch2,

src/arm/stub-cache-arm.cc

@@ -4686,6 +4686,7 @@ void KeyedStoreStubCompiler::GenerateStoreFastDoubleElement(
   __ StoreNumberToDoubleElements(value_reg,
                                  key_reg,
                                  receiver_reg,
+                                 // All registers after this are overwritten.
                                  elements_reg,
                                  scratch1,
                                  scratch2,