Fix flaw in VirtualFrame::SetElementAt handling multiple copies of elements.

src/virtual-frame.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 369 matching lines @@
   FrameElement new_element;
   if (value->is_register()) {
     // There are two cases depending no whether the register already
     // occurs in the frame or not.
     if (register_count(value->reg()) == 0) {
       Use(value->reg());
       elements_[frame_index] =
           FrameElement::RegisterElement(value->reg(),
                                         FrameElement::NOT_SYNCED);
     } else {
-      for (int i = 0; i < elements_.length(); i++) {
-        FrameElement element = elements_[i];
-        if (element.is_register() && element.reg().is(value->reg())) {
-          if (i < frame_index) {
-            // The register backing store is lower in the frame than its
-            // copy.
-            elements_[frame_index] = CopyElementAt(i);
-          } else {
-            // There was an early bailout for the case of setting a
-            // register element to itself.
-            ASSERT(i != frame_index);
-            element.clear_sync();
-            elements_[frame_index] = element;
-            elements_[i] = CopyElementAt(frame_index);
+      int i = 0;
+      for (; i < elements_.length(); i++) {
+        if (elements_[i].is_register() && elements_[i].reg().is(value->reg())) {
+          break;
+        }
+      }
+      ASSERT(i < elements_.length());
+
+      if (i < frame_index) {
+        // The register backing store is lower in the frame than its copy.
+        elements_[frame_index] = CopyElementAt(i);
+      } else {
+        // There was an early bailout for the case of setting a
+        // register element to itself.
+        ASSERT(i != frame_index);
+        elements_[frame_index] = elements_[i];
+        elements_[i] = CopyElementAt(frame_index);
+        if (elements_[frame_index].is_synced()) {
+          elements_[i].set_sync();
+        }
+        elements_[frame_index].clear_sync();
+        for (int j = i + 1; j < elements_.length(); j++) {
+          if (elements_[j].is_copy() && elements_[j].index() == i) {
+            elements_[j].set_index(frame_index);
           }
-          // Exit the loop once the appropriate copy is inserted.
-          break;
         }
       }
     }
   } else {
     ASSERT(value->is_constant());
     elements_[frame_index] =
         FrameElement::ConstantElement(value->handle(),
                                       FrameElement::NOT_SYNCED);
   }
   value->Unuse();
@@ skipping 140 matching lines @@
 #endif
   if (stack_pointer_ != other->stack_pointer_) return false;
   for (int i = 0; i < elements_.length(); i++) {
     if (!elements_[i].Equals(other->elements_[i])) return false;
   }
 
   return true;
 }
 
 } }  // namespace v8::internal