Fix some out-of-line constant pool garbage collection bugs.

src/frames.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 125 matching lines @@
   // Generator support to preserve stack handlers.
   void Unwind(Isolate* isolate, FixedArray* array, int offset,
               int previous_handler_offset) const;
   int Rewind(Isolate* isolate, FixedArray* array, int offset, Address fp);
 
  private:
   // Accessors.
   inline Kind kind() const;
   inline unsigned index() const;
 
+  inline Object** constant_pool_address() const;
   inline Object** context_address() const;
   inline Object** code_address() const;
   inline void SetFp(Address slot, Address fp);
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(StackHandler);
 };
 
 
 #define STACK_FRAME_TYPE_LIST(V)                         \
   V(ENTRY,                   EntryFrame)                 \
   V(ENTRY_CONSTRUCT,         EntryConstructFrame)        \
   V(EXIT,                    ExitFrame)                  \
   V(JAVA_SCRIPT,             JavaScriptFrame)            \
   V(OPTIMIZED,               OptimizedFrame)             \
   V(STUB,                    StubFrame)                  \
   V(STUB_FAILURE_TRAMPOLINE, StubFailureTrampolineFrame) \
   V(INTERNAL,                InternalFrame)              \
   V(CONSTRUCT,               ConstructFrame)             \
   V(ARGUMENTS_ADAPTOR,       ArgumentsAdaptorFrame)
 
 
 class StandardFrameConstants : public AllStatic {
  public:
   // Fixed part of the frame consists of return address, caller fp,
   // constant pool (if FLAG_enable_ool_constant_pool), context, and function.
-  // StandardFrame::IterateExpressions assumes that kContextOffset is the last
-  // object pointer.
+  // StandardFrame::IterateExpressions assumes that kLastObjectOffset is the
+  // last object pointer.
   static const int kCPSlotSize =
       FLAG_enable_ool_constant_pool ? kPointerSize : 0;
   static const int kFixedFrameSizeFromFp =  2 * kPointerSize + kCPSlotSize;
   static const int kFixedFrameSize       =  kPCOnStackSize + kFPOnStackSize +
                                             kFixedFrameSizeFromFp;
   static const int kExpressionsOffset    = -3 * kPointerSize - kCPSlotSize;
   static const int kMarkerOffset         = -2 * kPointerSize - kCPSlotSize;
   static const int kContextOffset        = -1 * kPointerSize - kCPSlotSize;
   static const int kConstantPoolOffset   = FLAG_enable_ool_constant_pool ?
                                            -1 * kPointerSize : 0;
   static const int kCallerFPOffset       =  0 * kPointerSize;
   static const int kCallerPCOffset       = +1 * kFPOnStackSize;
   static const int kCallerSPOffset       = kCallerPCOffset + 1 * kPCOnStackSize;
+
+  static const int kLastObjectOffset     = FLAG_enable_ool_constant_pool ?
+                                           kConstantPoolOffset : kContextOffset;
 };
 
 
 // Abstract base class for all stack frames.
 class StackFrame BASE_EMBEDDED {
  public:
 #define DECLARE_TYPE(type, ignore) type,
   enum Type {
     NONE = 0,
     STACK_FRAME_TYPE_LIST(DECLARE_TYPE)
@@ skipping 220 matching lines @@
 
 
 // Exit frames are used to exit JavaScript execution and go to C.
 class ExitFrame: public StackFrame {
  public:
   virtual Type type() const { return EXIT; }
 
   virtual Code* unchecked_code() const;
 
   Object*& code_slot() const;
+  Object*& constant_pool_slot() const;
 
   // Garbage collection support.
   virtual void Iterate(ObjectVisitor* v) const;
 
   virtual void SetCallerFp(Address caller_fp);
 
   static ExitFrame* cast(StackFrame* frame) {
     ASSERT(frame->is_exit());
     return static_cast<ExitFrame*>(frame);
   }
@@ skipping 500 matching lines @@
 };
 
 
 // Reads all frames on the current stack and copies them into the current
 // zone memory.
 Vector<StackFrame*> CreateStackMap(Isolate* isolate, Zone* zone);
 
 } }  // namespace v8::internal
 
 #endif  // V8_FRAMES_H_