Push V8 r1767 to trunk. This fixes a problem in the string type...

src/virtual-frame.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 279 matching lines @@
       // synced, and the element is not in memory, then the sync state
       // of the element is irrelevant.  We clear the sync bit.
       ASSERT(source.is_valid());
       elements_[i].clear_sync();
     }
 
     elements_[i].clear_copied();
     if (elements_[i].is_copy()) {
       elements_[elements_[i].index()].set_copied();
     }
+
+    // No code needs to be generated to change the static type of an
+    // element.
+    elements_[i].set_static_type(target.static_type());
   }
 }
 
 
 void VirtualFrame::PrepareForCall(int spilled_args, int dropped_args) {
   ASSERT(height() >= dropped_args);
   ASSERT(height() >= spilled_args);
   ASSERT(dropped_args <= spilled_args);
 
   SyncRange(0, elements_.length());
@@ skipping 213 matching lines @@
 #endif
   if (stack_pointer_ != other->stack_pointer_) return false;
   for (int i = 0; i < elements_.length(); i++) {
     if (!elements_[i].Equals(other->elements_[i])) return false;
   }
 
   return true;
 }
 
 } }  // namespace v8::internal