[Webkit-unassigned] [Bug 112106] REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=112106





--- Comment #4 from Mark Hahnenberg <mhahnenberg at apple.com>  2013-03-26 10:19:27 PST ---
Looks like we're trying to compile a ValueToInt32 node, the node thinks it's a constant (isConstant() == true), but the internal JSValue says that it's a cell. Given the revision that caused the regression, looks like we're unboxing incorrectly somewhere.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.