The DFG speculative JIT's compare() helper method may call the JITCodeGenerator's non-speculative compare helper, which calls use() on the operands. But then SpeculativeJIT::compare() also calls use() on the operands. The SpeculativeJIT::compare() method should not call use() on the operands if the JITCodeGenerator has already done so.
Created attachment 101526 [details] the patch
Comment on attachment 101526 [details] the patch Clearing flags on attachment: 101526 Committed r91428: <http://trac.webkit.org/changeset/91428>
All reviewed patches have been landed. Closing bug.