The PutScopedVar case in DFGSpeculativeJIT.cpp does not call noResult(), causing its child (the scope chain) to remain referenced. It then does not get removed from the register bank, and its virtual register does not get cleared. This has two effects: bizarre assertion failures and possibly regressed performance in the absence of assertion failures, due to increased register pressure.
Created attachment 108543 [details]
Comment on attachment 108543 [details]
oooh, i didn't realise that was necessary/existed -- best to check my other changes for similar screw ups :-(
(In reply to comment #2)
> (From update of attachment 108543 [details])
> oooh, i didn't realise that was necessary/existed -- best to check my other changes for similar screw ups :-(
GetScopeChain and GetScopeVar are right, because they call the relevant xyzResult methods. It's the ones that don't return anything that are annoying.
Committed r95868: <http://trac.webkit.org/changeset/95868>