GCMole evaluation order issue in CallIC::DoCustomHandler().

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "v8.h"
 
 #include "accessors.h"
 #include "api.h"
 #include "arguments.h"
 #include "codegen.h"
@@ skipping 1832 matching lines @@
                              Handle<Object> function,
                              Handle<FixedArray> vector,
                              Handle<Smi> slot,
                              const State& state) {
   ASSERT(function->IsJSFunction());
   // Are we the array function?
   Handle<JSFunction> array_function = Handle<JSFunction>(
       isolate()->context()->native_context()->array_function(), isolate());
   if (array_function.is_identical_to(Handle<JSFunction>::cast(function))) {
     // Alter the slot.
-    vector->set(slot->value(), *isolate()->factory()->NewAllocationSite());
+    Handle<AllocationSite> new_site = isolate()->factory()->NewAllocationSite();
+    vector->set(slot->value(), *new_site);
     State new_state = state.ToMonomorphicArrayCallState();
     CallICStub stub(isolate(), new_state);
     set_target(*stub.GetCode());
     Handle<String> name;
     if (array_function->shared()->name()->IsString()) {
       name = Handle<String>(String::cast(array_function->shared()->name()),
                             isolate());
     }
 
     TRACE_IC("CallIC (Array call)", name);
@@ skipping 1174 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal