Patch forthcoming.
Created attachment 259581 [details] the patch
Comment on attachment 259581 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=259581&action=review > Source/JavaScriptCore/dfg/DFGSafeToExecute.h:79 > + if (m_state.forNode(edge).m_type & ~BooleanUse) Fishy. Is that BooleanUse right?
(In reply to comment #2) > Comment on attachment 259581 [details] > the patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=259581&action=review > > > Source/JavaScriptCore/dfg/DFGSafeToExecute.h:79 > > + if (m_state.forNode(edge).m_type & ~BooleanUse) > > Fishy. Is that BooleanUse right? Yeah. :-) Fixed locally.
Landed in http://trac.webkit.org/changeset/188747