[Webkit-unassigned] [Bug 117140] ASSERTION FAILED: m_isCheckingArgumentTypes || m_canExit in JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=117140





--- Comment #3 from Oliver Hunt <oliver at apple.com>  2013-06-03 11:46:46 PST ---
(In reply to comment #2)
> (In reply to comment #1)
> > function f() {for (var a =a; "\n" + a; -a) a="foo"; return a; } f()
> > 
> > 
> > We end up with what looks bizarre to me:
> >     MakeRope(KnownString:@12<String>, KnownString:@8<String>, JS|PureInt, bc#16)
> > 
> > Fil, does the above no make any sense?
> 
> Why is that bizarre?  It's a MakeRope node.  And it takes two strings.  What's the big deal?

The PureInt bit

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.