Experimental: for the inlined keyed load IC, change the base address...

src/codegen-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4787 matching lines @@
   enter()->Bind(&receiver, &key);
   cgen->frame()->Push(&receiver);  // First IC argument.
   cgen->frame()->Push(&key);       // Second IC argument.
 
   // Calculate the delta from the IC call instruction to the map check
   // cmp instruction in the inlined version.  This delta is stored in
   // a test(eax, delta) instruction after the call so that we can find
   // it in the IC initialization code and patch the cmp instruction.
   // This means that we cannot allow test instructions after calls to
   // KeyedLoadIC stubs in other places.
-  //
-  // The virtual frame should be spilled fully before the call so that
-  // the call itself does not generate extra code to spill values,
-  // which would invalidate the delta calculation.
-  cgen->frame()->SpillAll();
-  int delta_to_patch_site = __ SizeOfCodeGeneratedSince(patch_site());
   Result value(cgen);
   if (is_global_) {
     value = cgen->frame()->CallCodeObject(ic,
                                           RelocInfo::CODE_TARGET_CONTEXT,
                                           0);
   } else {
     value = cgen->frame()->CallCodeObject(ic, RelocInfo::CODE_TARGET, 0);
   }
   // The result needs to be specifically the eax register because the
   // offset to the patch site will be expected in a test eax
   // instruction.
   ASSERT(value.is_register() && value.reg().is(eax));
+  // The delta from the start of the map-compare instruction to the
+  // test eax instruction.
+  int delta_to_patch_site = __ SizeOfCodeGeneratedSince(patch_site());
   __ test(value.reg(), Immediate(-delta_to_patch_site));
   __ IncrementCounter(&Counters::keyed_load_inline_miss, 1);
   exit()->Jump(&value);
 }
 
 
 #undef __
 #define __ masm->
 
 Handle<String> Reference::GetName() {
@@ skipping 1730 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal