[webkit-reviews] review requested: [Bug 20857] REGRESSION (r36427): ASSERTION FAILED: m_refCount >= 0 in RegisterID::deref() : [Attachment 23495] Proposed patch

[bugzilla-daemon at webkit.org]

Cameron Zwarich (cpst) <cwzwarich at uwaterloo.ca> has asked  for review:
Bug 20857: REGRESSION (r36427): ASSERTION FAILED: m_refCount >= 0 in
RegisterID::deref()
https://bugs.webkit.org/show_bug.cgi?id=20857

Attachment 23495: Proposed patch
https://bugs.webkit.org/attachment.cgi?id=23495&action=edit

------- Additional Comments from Cameron Zwarich (cpst)
<cwzwarich at uwaterloo.ca>
Here is a patch that fixes this bug, as well as bug 20340. It passes all tests
and all changes it makes to SunSpider codegen are positive. If this is
reviewed, I will put the reduction here as a test case in
fast/js/codegen-temporaries.

Just doing this for NewExprNode::emitCode() caused a lot of tests to fail, so
it seems that if we are going to fix this, we need to fix it everywhere.