Port r18421 (39719ed)

Original commit message:
Since r16993 the cp register is handled by registers allocator,
and we cannot assume that the cp always contains the context.

BUG=318420
LOG=Y
TEST=test/mjsunit/regress/regress-318420.js
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/123183002

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18443 ce2b1a6d-e550-0410-aec6-3dcde31c8c00