[INFER] Don't immediately evict data register when storing top frame entry, bug 643653.

js/src/jit-test/tests/jaeger/bug643653-1.js

@@ -0,0 +1,10 @@
+function f(x) {
+    var a;
+    var b = [1].length;
+    var c = x;
+    var d = b + 1;
+    AA = x;
+    a = d;
+    assertEq(b + d, 3);
+}
+f();

js/src/methodjit/FrameState.cpp

@@ -2074,9 +2074,11 @@ FrameState::storeTop(FrameEntry *target, JSValueType type, bool popGuaranteed)
             if (backing->isTypeKnown()) {
                 target->setType(backing->getKnownType());
             } else {
-                RegisterID reg = tempRegForType(backing);
-                target->type.setRegister(reg);
-                regstate(reg).reassociate(target);
+                pinReg(reg);
+                RegisterID typeReg = tempRegForType(backing);
+                unpinReg(reg);
+                target->type.setRegister(typeReg);
+                regstate(typeReg).reassociate(target);
             }
         } else if (type != JSVAL_TYPE_DOUBLE || backing->isType(JSVAL_TYPE_INT32)) {
             /*