According to DFG::OSRExit::executeOSRExit() and DFG::OSRExit::compileExit(), recovered DoubleDisplacedInJSStack values need to be purified. ValueRecovery::recover() should do the same. <rdar://problem/47625488>
Created attachment 360496 [details] proposed patch.
Thanks for the review. Landed in r240681: <http://trac.webkit.org/r240681>.