Allow HPhis to have an invalid merge index.

src/ia32/lithium-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 852 matching lines @@
     block->UpdateEnvironment(last_environment);
     ASSERT(pred->argument_count() >= 0);
     argument_count_ = pred->argument_count();
   } else {
     // We are at a state join => process phis.
     HBasicBlock* pred = block->predecessors()->at(0);
     // No need to copy the environment, it cannot be used later.
     HEnvironment* last_environment = pred->last_environment();
     for (int i = 0; i < block->phis()->length(); ++i) {
       HPhi* phi = block->phis()->at(i);
-      if (phi->merged_index() < last_environment->length()) {
+      // TODO(mstarzinger): The length check below should actually not
+      // be necessary, but some array stubs already rely on it. This
+      // should be investigated and fixed.
+      if (phi->HasMergedIndex() &&
+          phi->merged_index() < last_environment->length()) {
         last_environment->SetValueAt(phi->merged_index(), phi);
       }
     }
     for (int i = 0; i < block->deleted_phis()->length(); ++i) {
       if (block->deleted_phis()->at(i) < last_environment->length()) {
         last_environment->SetValueAt(block->deleted_phis()->at(i),
                                      graph_->GetConstantUndefined());
       }
     }
     block->UpdateEnvironment(last_environment);
@@ skipping 1865 matching lines @@
 LInstruction* LChunkBuilder::DoLoadFieldByIndex(HLoadFieldByIndex* instr) {
   LOperand* object = UseRegister(instr->object());
   LOperand* index = UseTempRegister(instr->index());
   return DefineSameAsFirst(new(zone()) LLoadFieldByIndex(object, index));
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32