This is at least observable in the JS LayoutTest reserved-words.js. The following fix seems to take care of it: diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp index 3940a4e9afd3..113a7d9e191e 100644 --- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp +++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp @@ -13440,6 +13440,7 @@ void SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode(Node* node) m_jit.or64(scratch.gpr(), resultRegs.payloadGPR()); #else m_jit.move(TrustedImm32(JSPropertyNameEnumerator::IndexedMode), resultRegs.tagGPR()); + m_jit.or32(scratch.gpr(), resultRegs.payloadGPR()); #endif jsValueResult(resultRegs, node);
Created attachment 436384 [details] v1
Created attachment 436390 [details] v2
Comment on attachment 436390 [details] v2 r=me
Committed r281571 (240935@main): <https://commits.webkit.org/240935@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 436390 [details].
<rdar://problem/82350525>