Small change to uses of reference: adds two more frame spills after reference...

src/codegen-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2270 matching lines @@
   { Reference ref(this, node->catch_var());
     ASSERT(ref.is_slot());
     // Load the exception to the top of the stack.  Here we make use of the
     // convenient property that it doesn't matter whether a value is
     // immediately on top of or underneath a zero-sized reference.
     ref.SetValue(NOT_CONST_INIT);
   }
 
   // Remove the exception from the stack.
   frame_->Drop();
+  // Dropping a reference can leave the stack in an unspilled state.
+  frame_->SpillAll();
 
   VisitStatementsAndSpill(node->catch_block()->statements());
   if (has_valid_frame()) {
     exit.Jump();
   }
 
 
   // --- Try block ---
   try_block.Bind();
 
@@ skipping 768 matching lines @@
         LoadAndSpill(node->value());
         GenericBinaryOperation(node->binary_op(), node->type());
       }
     }
 
     Variable* var = node->target()->AsVariableProxy()->AsVariable();
     if (var != NULL &&
         var->mode() == Variable::CONST &&
         node->op() != Token::INIT_VAR && node->op() != Token::INIT_CONST) {
       // Assignment ignored - leave the value on the stack.
-  } else {
+    } else {
       CodeForSourcePosition(node->position());
       if (node->op() == Token::INIT_CONST) {
         // Dynamic constant initializations must use the function context
         // and initialize the actual constant declared. Dynamic variable
         // initializations are simply assignments and use SetValue.
         target.SetValue(CONST_INIT);
       } else {
         target.SetValue(NOT_CONST_INIT);
       }
     }
@@ skipping 130 matching lines @@
       frame_->SpillAll();
       ref.GetValueAndSpill(NOT_INSIDE_TYPEOF);
 
       // Pass receiver to called function.
       // The reference's size is non-negative.
       frame_->EmitPush(frame_->ElementAt(ref.size()));
 
       // Call the function.
       CallWithArguments(args, node->position());
     }
+    // Needed because of the Reference destructor in the else case.
+    // Does nothing in the then case.
+    frame_->SpillAll();
 
   } else {
     // ----------------------------------
     // JavaScript example: 'foo(1, 2, 3)'  // foo is not global
     // ----------------------------------
 
     // Load the function.
     LoadAndSpill(function);
 
     // Pass the global proxy as the receiver.
@@ skipping 2704 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal