The code completely fails to match up with what DFG::SpeculativeJIT is doing. Not to mention that it makes no sense at all.
Created attachment 130764 [details] the patch
Comment on attachment 130764 [details] the patch Reviewed in person by Gavin.
Landed in http://trac.webkit.org/changeset/110159