Fix HInnerAllocatedObject to use an HValue for the offset.

Fix HInnerAllocatedObject to use an HValue for the offset.

R=hpayer@chromium.org, mvstanton@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18181

[Benedikt Meurer, 2013-12-02 10:14:59]

Hey Michael,
Next step on the "BinaryOpIC with allocation site" road. We have to fix
HInnerAllocatedObject here, because we want to add mementos for sequential
strings where we don't know the exact size beforehand.
PTAL
-- Benedikt

[mvstanton, 2013-12-02 10:25:49]

Hi Benedikt, looks good. Can you do two things:

1) Get Hannes to have a look at the change in
HAllocate::CreateFreeSpaceFiller().

2) Can you verify by looking at the generated code for, say, a ordinary inlined
array constructor

function foo(size) { var a = new Array(size); return a; }
foo(5); foo(5);
%OptimizeFunctionOnNextCall(foo);
foo(5);

Verify that the lea operand uses a constant, that no register is allocated for
that constant.

Provided 1) and 2) are successful, then 

lgtm.

[Benedikt Meurer, 2013-12-02 10:37:19]

> 2) Can you verify by looking at the generated code for, say, a ordinary
inlined
> array constructor
> 
> function foo(size) { var a = new Array(size); return a; }
> foo(5); foo(5);
> %OptimizeFunctionOnNextCall(foo);
> foo(5);

Verified.

[Hannes Payer (out of office), 2013-12-02 10:48:02]

LGTM

[Benedikt Meurer, 2013-12-02 11:24:43]

Committed patchset #1 manually as r18181 (presubmit successful).