Insert three missing FP register stack pop instructions.

src/ia32/code-stubs-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1716 matching lines @@
           case Token::SUB: __ fsubp(1); break;
           case Token::MUL: __ fmulp(1); break;
           case Token::DIV: __ fdivp(1); break;
           default: UNREACHABLE();
         }
         Label after_alloc_failure;
         GenerateHeapResultAllocation(masm, &after_alloc_failure);
         __ fstp_d(FieldOperand(eax, HeapNumber::kValueOffset));
         __ ret(0);
         __ bind(&after_alloc_failure);
-        __ ffree();
+        __ fstp(0);  // Pop FPU stack before calling runtime.
         __ jmp(&call_runtime);
       }
 
       __ bind(&not_floats);
       __ bind(&not_int32);
       GenerateTypeTransition(masm);
       break;
     }
 
     case Token::MOD: {
@@ skipping 202 matching lines @@
           case Token::SUB: __ fsubp(1); break;
           case Token::MUL: __ fmulp(1); break;
           case Token::DIV: __ fdivp(1); break;
           default: UNREACHABLE();
         }
         Label after_alloc_failure;
         GenerateHeapResultAllocation(masm, &after_alloc_failure);
         __ fstp_d(FieldOperand(eax, HeapNumber::kValueOffset));
         __ ret(0);
         __ bind(&after_alloc_failure);
-        __ ffree();
+        __ fstp(0);  // Pop FPU stack before calling runtime.
         __ jmp(&call_runtime);
       }
 
       __ bind(&not_floats);
       GenerateTypeTransition(masm);
       break;
     }
 
     case Token::MOD: {
       // For MOD we go directly to runtime in the non-smi case.
@@ skipping 183 matching lines @@
           case Token::SUB: __ fsubp(1); break;
           case Token::MUL: __ fmulp(1); break;
           case Token::DIV: __ fdivp(1); break;
           default: UNREACHABLE();
         }
         Label after_alloc_failure;
         GenerateHeapResultAllocation(masm, &after_alloc_failure);
         __ fstp_d(FieldOperand(eax, HeapNumber::kValueOffset));
         __ ret(0);
         __ bind(&after_alloc_failure);
-          __ ffree();
-          __ jmp(&call_runtime);
+        __ fstp(0);  // Pop FPU stack before calling runtime.
+        __ jmp(&call_runtime);
       }
         __ bind(&not_floats);
         break;
       }
     case Token::MOD: {
       // For MOD we go directly to runtime in the non-smi case.
       break;
     }
     case Token::BIT_OR:
     case Token::BIT_AND:
@@ skipping 5203 matching lines @@
                                  false);
   __ pop(edx);
   __ ret(0);
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32