[Webkit-unassigned] [Bug 112106] REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=112106





--- Comment #5 from Mark Hahnenberg <mhahnenberg at apple.com>  2013-03-26 10:35:55 PST ---
I think this has to do with alwaysUnboxSimplePrimitives introduced in this change and the fact that we always assume in our fixup of ValueToInt32 that if it's not speculated as Integer, Number, or Boolean, then we speculate NotCell, which seems wrong.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.