Currently, the method `Assembler::prefix`, shown below, may emit two REX prefixes when the `adr` needs `REX_B` and `dst` needs `REX_R`. It seems this code path is not invoked by any caller, so the bug is not exposed now.

```
void Assembler::prefix(Register dst, Address adr, Prefix p) {
  if (adr.base_needs_rex()) {
    if (adr.index_needs_rex()) {
      assert(false, "prefix(Register dst, Address adr, Prefix p) does not support handling of an X");
    } else {
      prefix(REX_B); // <-- here
    }
  } else {
    if (adr.index_needs_rex()) {
      assert(false, "prefix(Register dst, Address adr, Prefix p) does not support handling of an X");
    }
  }
  if (dst->encoding() >= 8) {
    p = (Prefix)(p | REX_R);
  }
  if (p != Prefix_EMPTY) {
    // do not generate an empty prefix
    prefix(p);
  }
}
```