Adds Nip() function, makes UnloadReference() work without spilling

src/virtual-frame-ia32.h

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 367 matching lines @@
   void EmitPush(Immediate immediate);
 
   // Push an element on the virtual frame.
   void Push(Register reg);
   void Push(Handle<Object> value);
 
   // Pushing a result invalidates it (its contents become owned by the
   // frame).
   void Push(Result* result);
 
+  // Nip removes zero or more elements from immediately below the top
+  // of the frame, leaving the previous top-of-frame value on top of
+  // the frame.  Nip(k) is equivalent to x = Pop(), Drop(k), Push(x).
+  void Nip(int num_dropped);
+
 #ifdef DEBUG
   bool IsSpilled();
 #endif
 
  private:
   // An illegal index into the virtual frame.
   static const int kIllegalIndex = -1;
 
   static const int kLocal0Offset = JavaScriptFrameConstants::kLocal0Offset;
   static const int kFunctionOffset = JavaScriptFrameConstants::kFunctionOffset;
@@ skipping 119 matching lines @@
   // Called after all register-to-memory and register-to-register
   // moves have been made.  After this function returns, the frames
   // should be equal.
   void MergeMoveMemoryToRegisters(VirtualFrame* expected);
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_VIRTUAL_FRAME_IA32_H_