Fix reliability crash caused by wrong assert.

src/frame-element.h

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 47 matching lines @@
     // we have to inspect their backing element in the frame.
     ASSERT(!is_copy());
     if (!is_constant()) return NumberInfoField::decode(value_);
     Handle<Object> value = handle();
     if (value->IsSmi()) return NumberInfo::kSmi;
     if (value->IsHeapNumber()) return NumberInfo::kHeapNumber;
     return NumberInfo::kUnknown;
   }
 
   inline void set_number_info(NumberInfo::Type info) {
+    // Copied elements do not have number info. Instead
+    // we have to inspect their backing element in the frame.
+    ASSERT(!is_copy());
     value_ = value_ & ~NumberInfoField::mask();
     value_ = value_ | NumberInfoField::encode(info);
   }
 
   // The default constructor creates an invalid frame element.
   FrameElement() {
     value_ = TypeField::encode(INVALID)
         | CopiedField::encode(false)
         | SyncedField::encode(false)
         | NumberInfoField::encode(NumberInfo::kUninitialized)
@@ skipping 173 matching lines @@
   class SyncedField: public BitField<bool, 4, 1> {};
   class NumberInfoField: public BitField<NumberInfo::Type, 5, 3> {};
   class DataField: public BitField<uint32_t, 8, 32 - 8> {};
 
   friend class VirtualFrame;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_FRAME_ELEMENT_H_