StackLayoutPhase is attempting to ensure that the register that CodeBlock::scopeRegister() points to is the right one for the DFG. But the DFG does nothing else to maintain the validity of the scopeRegister(). It's not captured as far as I can tell. StackLayoutPhase doesn't explicitly mark it live. So, by the time we get here the register referred to by CodeBlock::scopeRegister() is junk. Moreover, CodeBlock::scopeRegister() is not used for DFG code blocks, and is hardly ever used outside of bytecode generation.
Created attachment 246304 [details]
Created attachment 246309 [details]
Addressing Michael's concerns
Comment on attachment 246309 [details]
Landed in http://trac.webkit.org/changeset/179863