Some SunSpider tests (3d-raytrace, string-unpack-code) crash due to keeping around a ScopeChain* that points into the register file, but the register file can move in memory when it grows.
A possible solution is to pass around ScopeChainNode* instead.
Created attachment 20548 [details] the fix
Comment on attachment 20548 [details] the fix r=me
Landed in r31897.