[Webkit-unassigned] [Bug 117140] ASSERTION FAILED: m_isCheckingArgumentTypes || m_canExit in JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=117140





--- Comment #4 from Filip Pizlo <fpizlo at apple.com>  2013-06-03 11:48:00 PST ---
(In reply to comment #3)
> (In reply to comment #2)
> > (In reply to comment #1)
> > > function f() {for (var a =a; "\n" + a; -a) a="foo"; return a; } f()
> > > 
> > > 
> > > We end up with what looks bizarre to me:
> > >     MakeRope(KnownString:@12<String>, KnownString:@8<String>, JS|PureInt, bc#16)
> > > 
> > > Fil, does the above no make any sense?
> > 
> > Why is that bizarre?  It's a MakeRope node.  And it takes two strings.  What's the big deal?
> 
> The PureInt bit

MakeRope is dead, therefore it isn't used as a number, therefore the flags indicate PureInt.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.