Fix for off-by-one when initializing a constant or function...

src/codegen-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1413 matching lines @@
 
   // If we have a function or a constant, we need to initialize the variable.
   Expression* val = NULL;
   if (node->mode() == Variable::CONST) {
     val = new Literal(Factory::the_hole_value());
   } else {
     val = node->fun();  // NULL if we don't have a function
   }
 
   if (val != NULL) {
-    // Set initial value.
-    Reference target(this, node->proxy());
-    ASSERT(target.is_slot());
-    Load(val);
-    target.SetValue(NOT_CONST_INIT);
-    // Get rid of the assigned value (declarations are statements).  It's
-    // safe to pop the value lying on top of the reference before unloading
-    // the reference itself (which preserves the top of stack) because we
-    // know that it is a zero-sized reference.
+    {
+      // Set initial value.
+      Reference target(this, node->proxy());
+      Load(val);
+      target.SetValue(NOT_CONST_INIT);
+    }
+    // Get rid of the assigned value (declarations are statements).
     frame_->Pop();
   }
 }
 
 
 void CodeGenerator::VisitExpressionStatement(ExpressionStatement* node) {
   Comment cmnt(masm_, "[ ExpressionStatement");
   CodeForStatement(node);
   Expression* expression = node->expression();
   expression->MarkAsStatement();
@@ skipping 3857 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal