In https://bugs.webkit.org/show_bug.cgi?id=67551 we fixed a bug in speculation recovery of additions in JavaScriptCore. There is currently no test that covers this regression and fix.
Created attachment 106474 [details] the patch
Comment on attachment 106474 [details] the patch r=me
Comment on attachment 106474 [details] the patch Clearing flags on attachment: 106474 Committed r94594: <http://trac.webkit.org/changeset/94594>
All reviewed patches have been landed. Closing bug.