Fragment ilist recreation not deterministic when following direct jumps to a future sandbox2ro page

_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on October 08, 2012 14:39:53_

This V8 command reproduces the issue:

$ ~/dynamorio/build/install/bin64/drrun -debug -ops "-checklevel 1 -reset_every_nth_pending 0 -stderr_mask 12" ~/v8/out/x64.release/d8 --nobreak-on-abort ~/v8/test/mjsunit/mjsunit.js ~/v8/test/mjsunit/mul-exhaustive-part3.js --test