Shorten live ranges of argument subexpressions.

src/ia32/lithium-codegen-ia32.cc

Index: src/ia32/lithium-codegen-ia32.cc
diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc
index 0e9773748e061ecd88463a27ca689d35793f4789..22123e5f5c20114673dff3ea3f9f7e06af644674 100644
--- a/src/ia32/lithium-codegen-ia32.cc
+++ b/src/ia32/lithium-codegen-ia32.cc
@@ -2390,9 +2390,19 @@ void LCodeGen::DoCallGlobal(LCallGlobal* instr) {
 
 
 void LCodeGen::DoCallKnownGlobal(LCallKnownGlobal* instr) {
+  ASSERT(ToRegister(instr->input()).is(eax));
   ASSERT(ToRegister(instr->result()).is(eax));
-  __ mov(edi, instr->target());
-  CallKnownFunction(instr->target(), instr->arity(), instr);
+
+  // The receiver slot in the outgoing arguments holds the global object,
+  // because that's what the unoptimized code expects if we deoptimize the
+  // argument subexpressions.  Patch it to the global receiver before making
+  // the call.
+  int arity = instr->arity();  // Arity does not include receiver.
+  __ mov(Operand(esp, arity * kPointerSize), eax);

[fschneider, 2010/12/20 16:13:02]

It would be nice to avoid patching in the global receiver.

+
+  Handle<JSFunction> target = instr->target();
+  __ mov(edi, target);
+  CallKnownFunction(target, arity, instr);
 }