REGRESSION(r172794) + 32Bit build: for-in-base-reassigned-later-and-change-structure.js fail with NaN result

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

+++ This bug was initially created as a clone of Bug #136165 +++

This bug is to track the for-in-base-reassigned-later-and-change-structure.js failures and Bug #136165 will be used to track the ASSERT failures.

The following JavaScriptCore regression tests are failing after r172794 <http://trac.webkit.org/changeset/172794>:

	stress/for-in-base-reassigned-later-and-change-structure.js.always-trigger-copy-phase
	stress/for-in-base-reassigned-later-and-change-structure.js.default
	stress/for-in-base-reassigned-later-and-change-structure.js.default-ftl
	stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager
	stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager-no-cjit-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager-no-cjit
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-no-inline-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-validate
	stress/for-in-base-reassigned-later-and-change-structure.js.no-cjit-validate-phases
	stress/for-in-base-reassigned-later-and-change-structure.js.no-llint

All of these "for-in-base-reassigned-later-and-change-structure.js" fail with "Exception: Error: bad result: NaN"

[Michael Saboff]

Created attachment 237135 [details]
Patch

[Mark Hahnenberg]

Comment on attachment 237135 [details]
Patch

r=me

[Michael Saboff]

Committed r172962: <http://trac.webkit.org/changeset/172962>