[Webkit-unassigned] [Bug 112106] REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=112106





--- Comment #6 from Mark Hahnenberg <mhahnenberg at apple.com>  2013-03-26 12:31:29 PST ---
Nevermind all that. The issue is that we get an empty type for the value during CFA, which guarantees that we're going to exit before we get to this later node (ValueToInt32). Because of this, ValueToInt32 is calling terminateSpeculativeExecution because it doesn't know what to do, when instead it should just abandon compilation of the current basic block.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.