Do not visit slots in the top-level code generator's backend....

src/ia32/fast-codegen-ia32.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 97 matching lines @@
   __ pop(eax);
   __ RecordJSReturn();
   // Do not use the leave instruction here because it is too short to
   // patch with the code required by the debugger.
   __ mov(esp, ebp);
   __ pop(ebp);
   __ ret((function_->scope()->num_parameters() + 1) * kPointerSize);
 }
 
 
-void FastCodeGenerator::VisitSlot(Slot* expr) {
-  Comment cmnt(masm_, "[ Slot");
-  if (expr->location().is_temporary()) {
-    __ push(Operand(ebp, SlotOffset(expr)));
-  } else {
-    ASSERT(expr->location().is_nowhere());
+void FastCodeGenerator::VisitVariableProxy(VariableProxy* expr) {
+  Comment cmnt(masm_, "[ VariableProxy");
+  Expression* rewrite = expr->var()->rewrite();
+  ASSERT(rewrite != NULL);
+
+  Slot* slot = rewrite->AsSlot();
+  ASSERT(slot != NULL);
+  { Comment cmnt(masm_, "[ Slot");
+    if (expr->location().is_temporary()) {
+      __ push(Operand(ebp, SlotOffset(slot)));
+    } else {
+      ASSERT(expr->location().is_nowhere());
+    }
   }
 }
 
 
 void FastCodeGenerator::VisitLiteral(Literal* expr) {
   Comment cmnt(masm_, "[ Literal");
   if (expr->location().is_temporary()) {
     __ push(Immediate(expr->handle()));
   } else {
     ASSERT(expr->location().is_nowhere());
@@ skipping 13 matching lines @@
     __ mov(eax, Operand(esp, 0));
     __ mov(Operand(ebp, SlotOffset(var->slot())), eax);
   } else {
     ASSERT(expr->location().is_nowhere());
     __ pop(Operand(ebp, SlotOffset(var->slot())));
   }
 }
 
 
 } }  // namespace v8::internal