Fix issue 265 by handling extra statement state on the frame based on...

src/virtual-frame-ia32.cc

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 153 matching lines @@
   if (stack_pointer_ < expected->stack_pointer_) {
     int difference = expected->stack_pointer_ - stack_pointer_;
     stack_pointer_ = expected->stack_pointer_;
     __ sub(Operand(esp), Immediate(difference * kPointerSize));
   }
 
   MergeMoveRegistersToMemory(expected);
   MergeMoveRegistersToRegisters(expected);
   MergeMoveMemoryToRegisters(expected);
 
-  // Fix any sync bit problems.
-  for (int i = 0; i <= stack_pointer_; i++) {
+  // Fix any sync bit problems from the bottom-up, stopping when we
+  // hit the stack pointer or the top of the frame if the stack
+  // pointer is floating above the frame.
+  int limit = Min(stack_pointer_, elements_.length() - 1);
+  for (int i = 0; i <= limit; i++) {
     FrameElement source = elements_[i];
     FrameElement target = expected->elements_[i];
     if (source.is_synced() && !target.is_synced()) {
       elements_[i].clear_sync();
     } else if (!source.is_synced() && target.is_synced()) {
       SyncElementAt(i);
     }
   }
 
   // Adjust the stack point downard if necessary.
@@ skipping 16 matching lines @@
   // stores of copies in registers.
   //
   // Moving memory-backed copies to memory requires a spare register
   // for the memory-to-memory moves.  Since we are performing a merge,
   // we use esi (which is already saved in the frame).  We keep track
   // of the index of the frame element esi is caching or kIllegalIndex
   // if esi has not been disturbed.
   int esi_caches = kIllegalIndex;
   // A "singleton" memory element.
   FrameElement memory_element = FrameElement::MemoryElement();
-  for (int i = stack_pointer_; i >= 0; i--) {
+  // Loop downward from the stack pointer or the top of the frame if
+  // the stack pointer is floating above the frame.
+  int start = Min(stack_pointer_, elements_.length() - 1);
+  for (int i = start; i >= 0; i--) {
     FrameElement target = expected->elements_[i];
     if (target.is_memory()) {
       FrameElement source = elements_[i];
       switch (source.type()) {
         case FrameElement::INVALID:
           // Not a legal merge move.
           UNREACHABLE();
           break;
 
         case FrameElement::MEMORY:
@@ skipping 757 matching lines @@
   ASSERT(stack_pointer_ == elements_.length() - 1);
   elements_.Add(FrameElement::MemoryElement());
   stack_pointer_++;
   __ push(immediate);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal