(The ldr r0, [sp, #28] is reloading a spill of the variable bucket.)
The beq 114 branch jumps forwards to a block that uses r0 and r3. I'd expect the values in those registers to be rematerialized in that block, rather than in the body of a loop. (They don't appear to be live on any other edges out of this loop.)
I don't think my recent CL would change this, all the modifications were outside the probe loop.
Looking at disasembly, I see big changes at tip from the assembly listed here. I think the bucket variable is no longer restored in the loop, but the key we're searching for is.
So there's still work to be done.