124138 2013-11-10 23:37:47 -0800 regress/script-tests/make-indexed-storage.js.ftl-eager-no-cjit: Exception: Error: bad result: NaN 2013-11-17 17:47:16 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 124137 124169 124171 124181 112840 1 fpizlo fpizlo barraclough ggaren mark.lam mhahnenberg msaboff nrotem oliver sam oldest_to_newest 949223 0 fpizlo 2013-11-10 23:37:47 -0800 Will fix it soon. This is revealed by the fix to https://bugs.webkit.org/show_bug.cgi?id=124137 951474 1 fpizlo 2013-11-17 17:47:00 -0800 OK, I think this is fixed, as of http://trac.webkit.org/changeset/159394. The problem was that we were constant-folding a variable but only along one control flow path, which was resulting in its live range appearing to be truncated. This was ultimately solved by ensuring that liveness in the original bytecode, rather than liveness in the DFG IR after optimization, determines whether or not a variable is preserved by OSR.