Push V8 r1767 to trunk. This fixes a problem in the string type...

src/virtual-frame-ia32.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 173 matching lines @@
     FrameElement target = expected->elements_[i];
     if (source.is_synced() && !target.is_synced()) {
       elements_[i].clear_sync();
     } else if (!source.is_synced() && target.is_synced()) {
       SyncElementAt(i);
     }
     elements_[i].clear_copied();
     if (elements_[i].is_copy()) {
       elements_[elements_[i].index()].set_copied();
     }
-    elements_[i].set_static_type(target.static_type());
   }
 
   // Adjust the stack pointer downward if necessary.
   if (stack_pointer_ > expected->stack_pointer_) {
     int difference = stack_pointer_ - expected->stack_pointer_;
     stack_pointer_ = expected->stack_pointer_;
     __ add(Operand(esp), Immediate(difference * kPointerSize));
   }
 
   // At this point, the frames should be identical.
@@ skipping 827 matching lines @@
   ASSERT(stack_pointer_ == elements_.length() - 1);
   elements_.Add(FrameElement::MemoryElement());
   stack_pointer_++;
   __ push(immediate);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal