Do not visit slots in the top-level code generator's backend....

src/x64/fast-codegen-x64.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 114 matching lines @@
   // have just generated "movq rsp, rbp; pop rbp; ret k" with length 7
   // (3 + 1 + 3).
   const int kPadding = Debug::kX64JSReturnSequenceLength - 7;
   for (int i = 0; i < kPadding; ++i) {
     masm_->int3();
   }
 #endif
 }
 
 
-void FastCodeGenerator::VisitSlot(Slot* expr) {
-  Comment cmnt(masm_, "[ Slot");
-  if (expr->location().is_temporary()) {
-    __ push(Operand(rbp, SlotOffset(expr)));
-  } else {
-    ASSERT(expr->location().is_nowhere());
+void FastCodeGenerator::VisitVariableProxy(VariableProxy* expr) {
+  Comment cmnt(masm_, "[ VariableProxy");
+  Expression* rewrite = expr->var()->rewrite();
+  ASSERT(rewrite != NULL);
+
+  Slot* slot = rewrite->AsSlot();
+  ASSERT(slot != NULL);
+  { Comment cmnt(masm_, "[ Slot");
+    if (expr->location().is_temporary()) {
+      __ push(Operand(rbp, SlotOffset(slot)));
+    } else {
+      ASSERT(expr->location().is_nowhere());
+    }
   }
 }
 
 
 void FastCodeGenerator::VisitLiteral(Literal* expr) {
   Comment cmnt(masm_, "[ Literal");
   if (expr->location().is_temporary()) {
     __ Push(expr->handle());
   } else {
     ASSERT(expr->location().is_nowhere());
@@ skipping 14 matching lines @@
     __ movq(rax, Operand(rsp, 0));
     __ movq(Operand(rbp, SlotOffset(var->slot())), rax);
   } else {
     ASSERT(expr->location().is_nowhere());
     __ pop(Operand(rbp, SlotOffset(var->slot())));
   }
 }
 
 
 } }  // namespace v8::internal