Fix virtual frame height on ARM

Bug introduced in r4608 where Dup2 increses the frame height with 4 instead of 2 when in a spilled scope.

Also removed a bogus ASSERT and used Push from macro assemler for double pushes.

TBR=erik.corry@gmail.com
Review URL: http://codereview.chromium.org/2005005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4611 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/arm/ic-arm.cc

@@ -841,7 +841,6 @@ void KeyedLoadIC::GenerateString(MacroAssembler* masm) {
   // string and a number), and call runtime.
   __ bind(&slow_char_code);
   __ EnterInternalFrame();
-  ASSERT(object.code() > index.code());
   __ Push(object, index);
   __ CallRuntime(Runtime::kStringCharCodeAt, 2);
   ASSERT(!code.is(r0));

src/arm/virtual-frame-arm.cc

@@ -536,9 +536,9 @@ void VirtualFrame::Dup() {
 void VirtualFrame::Dup2() {
   if (SpilledScope::is_spilled()) {
     __ ldr(ip, MemOperand(sp, kPointerSize));
-    EmitPush(ip);
+    __ push(ip);
     __ ldr(ip, MemOperand(sp, kPointerSize));
-    EmitPush(ip);
+    __ push(ip);
   } else {
     switch (top_of_stack_state_) {
       case NO_TOS_REGISTERS:
@@ -557,13 +557,11 @@ void VirtualFrame::Dup2() {
         top_of_stack_state_ = R1_R0_TOS;
         break;
       case R0_R1_TOS:
-        __ push(r1);
-        __ push(r0);
+        __ Push(r1, r0);
         top_of_stack_state_ = R0_R1_TOS;
         break;
       case R1_R0_TOS:
-        __ push(r0);
-        __ push(r1);
+        __ Push(r0, r1);
         top_of_stack_state_ = R1_R0_TOS;
         break;
       default: