ip cannot be used in cmp instruction. Revert to r1.

src/ic-arm.cc

Index: src/ic-arm.cc
===================================================================
--- src/ic-arm.cc	(revision 807)
+++ src/ic-arm.cc	(working copy)
@@ -658,15 +658,16 @@
   // Array case: Get the length and the elements array from the JS
   // array. Check that the array is in fast mode; if it is the
   // length is always a smi.
-  // r0 == value, r1 == key, r3 == object
+  // r0 == value, r3 == object
   __ bind(&array);
   __ ldr(r2, FieldMemOperand(r3, JSObject::kElementsOffset));
-  __ ldr(ip, FieldMemOperand(r2, HeapObject::kMapOffset));
-  __ cmp(ip, Operand(Factory::hash_table_map()));
+  __ ldr(r1, FieldMemOperand(r2, HeapObject::kMapOffset));
+  __ cmp(r1, Operand(Factory::hash_table_map()));
   __ b(eq, &slow);
 
   // Check the key against the length in the array, compute the
   // address to store into and fall through to fast case.
+  __ ldr(r1, MemOperand(sp));  // resotre key 

[iposva, 2008/11/20 17:37:36]

resotre -> restore

   // r0 == value, r1 == key, r2 == elements, r3 == object.
   __ ldr(ip, FieldMemOperand(r3, JSArray::kLengthOffset));
   __ cmp(r1, Operand(ip));