Fix issue 259....

src/codegen-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2812 matching lines @@
       } else {
         // Fake TOS for targets that shadowed breaks and continues.
         frame_->EmitPush(Immediate(Factory::undefined_value()));
       }
       __ Set(ecx, Immediate(Smi::FromInt(JUMPING + i)));
       unlink.Jump();
     }
   }
 
   // Unlink from try chain; be careful not to destroy the TOS.
-  unlink.Bind();
-  // Reload sp from the top handler, because some statements that we
-  // break from (eg, for...in) may have left stuff on the stack.
-  // Preserve the TOS in a register across stack manipulation.
-  frame_->EmitPop(eax);
-  ExternalReference handler_address(Top::k_handler_address);
-  __ mov(edx, Operand::StaticVariable(handler_address));
-  const int kNextOffset = StackHandlerConstants::kNextOffset +
-      StackHandlerConstants::kAddressDisplacement;
-  __ lea(esp, Operand(edx, kNextOffset));
-  frame_->Forget(frame_->height() - handler_height);
+  if (unlink.is_linked()) {
+    unlink.Bind();
+  }
 
-  frame_->EmitPop(Operand::StaticVariable(handler_address));
-  frame_->Drop(StackHandlerConstants::kSize / kPointerSize - 1);
-  // Next_sp popped.
-  frame_->EmitPush(eax);
+  // Control can reach here via a jump to unlink or by falling off the
+  // end of the try block (with no unlinks).
+  if (has_valid_frame()) {
+    // Reload sp from the top handler, because some statements that we
+    // break from (eg, for...in) may have left stuff on the stack.
+    // Preserve the TOS in a register across stack manipulation.
+    frame_->EmitPop(eax);
+    ExternalReference handler_address(Top::k_handler_address);
+    __ mov(edx, Operand::StaticVariable(handler_address));
+    const int kNextOffset = StackHandlerConstants::kNextOffset +
+        StackHandlerConstants::kAddressDisplacement;
+    __ lea(esp, Operand(edx, kNextOffset));
+    frame_->Forget(frame_->height() - handler_height);
+
+    frame_->EmitPop(Operand::StaticVariable(handler_address));
+    frame_->Drop(StackHandlerConstants::kSize / kPointerSize - 1);
+    // Next_sp popped.
+    frame_->EmitPush(eax);
+  }
 
   // --- Finally block ---
   finally_block.Bind();
 
   // Push the state on the stack.
   frame_->EmitPush(ecx);
 
   // We keep two elements on the stack - the (possibly faked) result
   // and the state - while evaluating the finally block. Record it, so
   // that a break/continue crossing this statement can restore the
@@ skipping 3960 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal