A register allocation bugfix....

src/ia32/virtual-frame-ia32.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 605 matching lines @@
   ASSERT(index < elements_.length());
 
   int top_index = elements_.length() - 1;
   FrameElement top = elements_[top_index];
   FrameElement original = elements_[index];
   if (top.is_copy() && top.index() == index) return;
   ASSERT(top.is_valid());
 
   InvalidateFrameSlotAt(index);
 
+  // InvalidateFrameSlotAt can potentially change any frame element, due
+  // to spilling registers to allocate temporaries in order to preserve
+  // the copy-on-write semantics of aliased elements.  Reload top from
+  // the frame.
+  top = elements_[top_index];
+
   if (top.is_copy()) {
     // There are two cases based on the relative positions of the
     // stored-to slot and the backing slot of the top element.
     int backing_index = top.index();
     ASSERT(backing_index != index);
     if (backing_index < index) {
       // 1. The top element is a copy of a slot below the stored-to
       // slot.  The stored-to slot becomes an unsynced copy of that
       // same backing slot.
       elements_[index] = CopyElementAt(backing_index);
@@ skipping 403 matching lines @@
   ASSERT(stack_pointer_ == elements_.length() - 1);
   elements_.Add(FrameElement::MemoryElement());
   stack_pointer_++;
   __ push(immediate);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal