Once we get to a UInt32ToNumber node, we may no longer have the state necessary to execute the bytecode operation that the UInt32ToNumber belongs to. So a standard OSR exit, which relies on rolling execution state backwards, won't work. But we have all of the information necessary to roll execution forward. We should do that instead.
Created attachment 119109 [details]
Landed in http://trac.webkit.org/changeset/102723