Patch forthcoming.
Because VirtualRegister is what we use as the offset into JSEnvironmentRecord, there is no way to get rid of m_registers. To make this happen we have to get rid of VirtualRegister as the scope offset.
*** This bug has been marked as a duplicate of bug 141174 ***