The setupResults routine has the bug of reversing the source and destination. Also some other trivial (but stupid) bugs need to be fixed in JSVALUE32_64 DFG JIT.
Created attachment 109250 [details] the patch
Comment on attachment 109250 [details] the patch Clearing flags on attachment: 109250 Committed r96451: <http://trac.webkit.org/changeset/96451>
All reviewed patches have been landed. Closing bug.