https://bugs.webkit.org/show_bug.cgi?id=112477

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

Moved allocation of temporary GPRs to be before any generated branches in the functions below.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):

LayoutTests: 

New tests added to verify proper operation of
SpeculativeJIT::compileObjectToObjectOrOtherEquality,
SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality
and SpeculativeJIT::compileObjectOrOtherLogicalNot.

* fast/js/dfg-compare-final-object-to-final-object-or-other-expected.txt: Added.
* fast/js/dfg-compare-final-object-to-final-object-or-other.html: Added.
* fast/js/dfg-logical-not-final-object-or-other-expected.txt: Added.
* fast/js/dfg-logical-not-final-object-or-other.html: Added.
* fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-expected.txt: Added.
* fast/js/dfg-peephole-compare-final-object-to-final-object-or-other.html: Added.
* fast/js/script-tests/dfg-compare-final-object-to-final-object-or-other.js: Added.
* fast/js/script-tests/dfg-logical-not-final-object-or-other.js: Added.
* fast/js/script-tests/dfg-peephole-compare-final-object-to-final-object-or-other.js: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146100 268f45cc-cd09-0410-ab3c-d52691b4dbfc