There are a couple of wrong integer checks in JSVALUE32_64 DFG JIT code.
Created attachment 108987 [details] the patch
Comment on attachment 108987 [details] the patch r=me
Comment on attachment 108987 [details] the patch Clearing flags on attachment: 108987 Committed r96230: <http://trac.webkit.org/changeset/96230>
All reviewed patches have been landed. Closing bug.