Merge r3962 to trunk

src/jump-target.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 82 matching lines @@
 
   // Compute elements based on the other reaching frames.
   if (reaching_frames_.length() > 1) {
     for (int i = 0; i < length; i++) {
       FrameElement* element = elements[i];
       for (int j = 1; j < reaching_frames_.length(); j++) {
         // Element computation is monotonic: new information will not
         // change our decision about undetermined or invalid elements.
         if (element == NULL || !element->is_valid()) break;
 
-        element = element->Combine(&reaching_frames_[j]->elements_[i]);
-
         FrameElement* other = &reaching_frames_[j]->elements_[i];
+        element = element->Combine(other);
         if (element != NULL && !element->is_copy()) {
           ASSERT(other != NULL);
           // We overwrite the number information of one of the incoming frames.
           // This is safe because we only use the frame for emitting merge code.
           // The number information of incoming frames is not used anymore.
           element->set_number_info(NumberInfo::Combine(element->number_info(),
                                                        other->number_info()));
         }
       }
       elements[i] = element;
@@ skipping 300 matching lines @@
   temp.CopyTo(this);
   temp.Unuse();
 
 #ifdef DEBUG
   is_shadowing_ = false;
 #endif
 }
 
 
 } }  // namespace v8::internal