[Webkit-unassigned] [Bug 117140] ASSERTION FAILED: m_isCheckingArgumentTypes || m_canExit in JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=117140





--- Comment #2 from Filip Pizlo <fpizlo at apple.com>  2013-06-03 11:42:35 PST ---
(In reply to comment #1)
> function f() {for (var a =a; "\n" + a; -a) a="foo"; return a; } f()
> 
> 
> We end up with what looks bizarre to me:
>     MakeRope(KnownString:@12<String>, KnownString:@8<String>, JS|PureInt, bc#16)
> 
> Fil, does the above no make any sense?

Why is that bizarre?  It's a MakeRope node.  And it takes two strings.  What's the big deal?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.