REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
https://bugs.webkit.org/show_bug.cgi?id=108576

Reviewed by Filip Pizlo.

This was a long-standing bug. The DFG would destructively reuse a register
in op_convert_this, but:

    * The bug only presented during speculation failure for type Other

    * The bug presented by removing the low bits of a pointer, which
    used to be harmless, since all objects were so aligned anyway.

* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
our scratch register. The whole point of our scratch register is to
avoid destructively modifying our this register. I'm pretty sure this
was a copy-paste error.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141536 268f45cc-cd09-0410-ab3c-d52691b4dbfc