Try to preallocate the scratch registers used for inlined keyed loads...

src/ia32/codegen-ia32.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5397 matching lines @@
                                : RelocInfo::CODE_TARGET;
         Result answer = cgen_->frame()->CallLoadIC(mode);
         // A test eax instruction following the call signals that the
         // inobject property case was inlined.  Ensure that there is not
         // a test eax instruction here.
         __ nop();
         cgen_->frame()->Push(&answer);
       } else {
         // Inline the inobject property case.
         Comment cmnt(masm, "[ Inlined named property load");
+        DeferredReferenceGetNamedValue* deferred =
+            new DeferredReferenceGetNamedValue(cgen_, GetName());
         Result receiver = cgen_->frame()->Pop();
         receiver.ToRegister();
 
-        // Preallocate the value register to ensure that there is no
-        // spill emitted between the patch site label and the offset in
-        // the load instruction and that all frames reaching the
-        // deferred code are identical.
-        Result value = cgen_->allocator()->Allocate();
-        ASSERT(value.is_valid());
+        // Try to preallocate the value register so that all frames
+        // reaching the deferred code are identical.
+        Result value = cgen_->allocator()->AllocateWithoutSpilling();
 
         // Check that the receiver is a heap object.
         __ test(receiver.reg(), Immediate(kSmiTagMask));
 
-        DeferredReferenceGetNamedValue* deferred =
-            new DeferredReferenceGetNamedValue(cgen_, GetName());
-        deferred->SetEntryFrame(&receiver);
+        if (value.is_valid()) deferred->SetEntryFrame(&receiver);
         deferred->enter()->Branch(zero, &receiver, not_taken);
 
+        // Do not allocate the value register after binding the patch
+        // site label.  The distance from the patch site to the offset
+        // must be constant.
+        if (!value.is_valid()) {
+          value = cgen_->allocator()->Allocate();
+          ASSERT(value.is_valid());
+        }
+
         __ bind(deferred->patch_site());
         // This is the map check instruction that will be patched (so we can't
         // use the double underscore macro that may insert instructions).
         // Initially use an invalid map to force a failure.
         masm->cmp(FieldOperand(receiver.reg(), HeapObject::kMapOffset),
                   Immediate(Factory::null_value()));
         // This branch is always a forwards branch so it's always a fixed
         // size which allows the assert below to succeed and patching to work.
         deferred->enter()->Branch(not_equal, &receiver, not_taken);
 
@@ skipping 29 matching lines @@
       if (cgen_->loop_nesting() > 0) {
         Comment cmnt(masm, "[ Inlined array index load");
         DeferredReferenceGetKeyedValue* deferred =
             new DeferredReferenceGetKeyedValue(cgen_, is_global);
 
         Result key = cgen_->frame()->Pop();
         Result receiver = cgen_->frame()->Pop();
         key.ToRegister();
         receiver.ToRegister();
 
+        // Try to preallocate the elements and index scratch registers
+        // so that all frames reaching the deferred code are identical.
+        Result elements = cgen_->allocator()->AllocateWithoutSpilling();
+        Result index = cgen_->allocator()->AllocateWithoutSpilling();
+        if (elements.is_valid() && index.is_valid()) {
+          deferred->SetEntryFrame(&receiver, &key);
+        }
+
         // Check that the receiver is not a smi (only needed if this
         // is not a load from the global context) and that it has the
         // expected map.
         if (!is_global) {
           __ test(receiver.reg(), Immediate(kSmiTagMask));
           deferred->enter()->Branch(zero, &receiver, &key, not_taken);
         }
 
         // Initially, use an invalid map. The map is patched in the IC
         // initialization code.
         __ bind(deferred->patch_site());
         // Use masm-> here instead of the double underscore macro since extra
         // coverage code can interfere with the patching.
         masm->cmp(FieldOperand(receiver.reg(), HeapObject::kMapOffset),
                Immediate(Factory::null_value()));
         deferred->enter()->Branch(not_equal, &receiver, &key, not_taken);
 
         // Check that the key is a smi.
         __ test(key.reg(), Immediate(kSmiTagMask));
         deferred->enter()->Branch(not_zero, &receiver, &key, not_taken);
 
         // Get the elements array from the receiver and check that it
         // is not a dictionary.
-        Result elements = cgen_->allocator()->Allocate();
-        ASSERT(elements.is_valid());
+        if (!elements.is_valid()) {
+          elements = cgen_->allocator()->Allocate();
+          ASSERT(elements.is_valid());
+        }
         __ mov(elements.reg(),
                FieldOperand(receiver.reg(), JSObject::kElementsOffset));
         __ cmp(FieldOperand(elements.reg(), HeapObject::kMapOffset),
                Immediate(Factory::hash_table_map()));
         deferred->enter()->Branch(equal, &receiver, &key, not_taken);
 
         // Shift the key to get the actual index value and check that
         // it is within bounds.
-        Result index = cgen_->allocator()->Allocate();
-        ASSERT(index.is_valid());
+        if (!index.is_valid()) {
+          index = cgen_->allocator()->Allocate();
+          ASSERT(index.is_valid());
+        }
         __ mov(index.reg(), key.reg());
         __ sar(index.reg(), kSmiTagSize);
         __ cmp(index.reg(),
                FieldOperand(elements.reg(), Array::kLengthOffset));
         deferred->enter()->Branch(above_equal, &receiver, &key, not_taken);
 
         // Load and check that the result is not the hole.  We could
         // reuse the index or elements register for the value.
         //
         // TODO(206): Consider whether it makes sense to try some
@@ skipping 1708 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal