Sorry... it's still a undefined or null comparison issue - which is missed in previous commits.
Created attachment 110333 [details] the patch This passed the last SunSpider case "access-binary-trees".
Comment on attachment 110333 [details] the patch Clearing flags on attachment: 110333 Committed r97072: <http://trac.webkit.org/changeset/97072>
All reviewed patches have been landed. Closing bug.