MIPS: Fix several bugs that cause crashes in soft-float mode.

src/mips/stub-cache-mips.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3677 matching lines @@
       // Extract exponent to t5.
       __ srl(t5, value, kBinary32MantissaBits);
       __ And(t5, t5, Operand(kBinary32ExponentMask >> kBinary32MantissaBits));
 
       Label exponent_rebiased;
       __ Branch(&exponent_rebiased, eq, t5, Operand(zero_reg));
 
       __ li(t0, 0x7ff);
       __ Xor(t1, t5, Operand(0xFF));
       __ Movz(t5, t0, t1);  // Set t5 to 0x7ff only if t5 is equal to 0xff.
-      __ Branch(&exponent_rebiased, eq, t0, Operand(0xff));
+      __ Branch(&exponent_rebiased, eq, t1, Operand(zero_reg));
 
       // Rebias exponent.
       __ Addu(t5,
               t5,
               Operand(-kBinary32ExponentBias + HeapNumber::kExponentBias));
 
       __ bind(&exponent_rebiased);
       __ And(a2, value, Operand(kBinary32SignMask));
       value = no_reg;
       __ sll(t0, t5, HeapNumber::kMantissaBitsInTopWord);
@@ skipping 279 matching lines @@
 
         // Test for all special exponent values: zeros, subnormal numbers, NaNs
         // and infinities. All these should be converted to 0.
         __ li(t5, HeapNumber::kExponentMask);
         __ and_(t6, t3, t5);
         __ Branch(&nan_or_infinity_or_zero, eq, t6, Operand(zero_reg));
 
         __ xor_(t1, t6, t5);
         __ li(t2, kBinary32ExponentMask);
         __ Movz(t6, t2, t1);  // Only if t6 is equal to t5.
-        __ Branch(&nan_or_infinity_or_zero, eq, t6, Operand(t5));
+        __ Branch(&nan_or_infinity_or_zero, eq, t1, Operand(zero_reg));
 
         // Rebias exponent.
         __ srl(t6, t6, HeapNumber::kExponentShift);
         __ Addu(t6,
                 t6,
                 Operand(kBinary32ExponentBias - HeapNumber::kExponentBias));
 
         __ li(t1, Operand(kBinary32MaxExponent));
         __ Slt(t1, t1, t6);
         __ And(t2, t3, Operand(HeapNumber::kSignMask));
@@ skipping 10 matching lines @@
         __ And(t3, t3, Operand(HeapNumber::kMantissaMask));
         __ sll(t3, t3, kMantissaInHiWordShift);
         __ or_(t7, t7, t3);
         __ srl(t4, t4, kMantissaInLoWordShift);
         __ or_(t7, t7, t4);
         __ sll(t6, t6, kBinary32ExponentShift);
         __ or_(t3, t7, t6);
 
         __ bind(&done);
         __ sll(t9, key, 1);
-        __ addu(t9, a2, t9);
+        __ addu(t9, a3, t9);
         __ sw(t3, MemOperand(t9, 0));
 
         // Entry registers are intact, a0 holds the value which is the return
         // value.
         __ mov(v0, a0);
         __ Ret();
 
         __ bind(&nan_or_infinity_or_zero);
         __ And(t7, t3, Operand(HeapNumber::kSignMask));
         __ And(t3, t3, Operand(HeapNumber::kMantissaMask));
         __ or_(t6, t6, t7);
         __ sll(t3, t3, kMantissaInHiWordShift);
         __ or_(t6, t6, t3);
         __ srl(t4, t4, kMantissaInLoWordShift);
         __ or_(t3, t6, t4);
         __ Branch(&done);
       } else if (elements_kind == EXTERNAL_DOUBLE_ELEMENTS) {
-        __ sll(t8, t0, 3);
+        __ sll(t8, key, 2);
         __ addu(t8, a3, t8);
         // t8: effective address of destination element.
         __ sw(t4, MemOperand(t8, 0));
         __ sw(t3, MemOperand(t8, Register::kSizeInBytes));
         __ mov(v0, a0);
         __ Ret();
       } else {
         bool is_signed_type = IsElementTypeSigned(elements_kind);
         int meaningfull_bits = is_signed_type ? (kBitsPerInt - 1) : kBitsPerInt;
         int32_t min_value    = is_signed_type ? 0x80000000 : 0x00000000;
@@ skipping 533 matching lines @@
     __ Jump(ic_slow, RelocInfo::CODE_TARGET);
   }
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_MIPS