[Webkit-unassigned] [Bug 117140] ASSERTION FAILED: m_isCheckingArgumentTypes || m_canExit in JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=117140





--- Comment #1 from Oliver Hunt <oliver at apple.com>  2013-06-03 11:13:52 PST ---
function f() {for (var a =a; "\n" + a; -a) a="foo"; return a; } f()


We end up with what looks bizarre to me:
    MakeRope(KnownString:@12<String>, KnownString:@8<String>, JS|PureInt, bc#16)

Fil, does the above no make any sense?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.