Merge r4182 to trunk.

src/ia32/codegen-ia32.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3747 matching lines @@
       // Record the source position of the statement as this code which
       // is after the code for the body actually belongs to the loop
       // statement and not the body.
       CodeForStatementPosition(node);
       Visit(node->next());
     }
   }
 
   // The update expression resets the type of the loop variable. So we
   // set it to smi before compiling the test expression.
-  if (node->is_fast_smi_loop()) {
+  if (node->is_fast_smi_loop() && has_valid_frame()) {
     // Set number type of the loop variable to smi.
     Slot* slot = node->loop_variable()->slot();
     ASSERT(slot->type() == Slot::LOCAL);
     frame_->SetTypeForLocalAt(slot->index(), NumberInfo::Smi());
     if (FLAG_debug_code) {
       frame_->PushLocalAt(slot->index());
       Result var = frame_->Pop();
       var.ToRegister();
       __ AbortIfNotSmi(var.reg(), "Loop variable not a smi.");
     }
@@ skipping 8468 matching lines @@
 
   // Call the runtime; it returns -1 (less), 0 (equal), or 1 (greater)
   // tagged as a small integer.
   __ bind(&runtime);
   __ TailCallRuntime(Runtime::kStringCompare, 2, 1);
 }
 
 #undef __
 
 } }  // namespace v8::internal