107081 2013-01-16 18:31:03 -0800 DFG 32_64 backend doesn't check for hasArrayStorage() in NewArrayWithSize 2013-01-16 18:34:44 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 fpizlo fpizlo ggaren mhahnenberg msaboff oldest_to_newest 808951 0 fpizlo 2013-01-16 18:31:03 -0800 <rdar://problem/12966526> 808952 1 fpizlo 2013-01-16 18:31:26 -0800 Already reviewed by Michael Saboff in person. 808953 2 fpizlo 2013-01-16 18:34:34 -0800 I couldn't easily come up with a good test case - this flaw would lead to code "just working" in a surprising number of cases. 808955 3 fpizlo 2013-01-16 18:34:44 -0800 Landed in http://trac.webkit.org/changeset/139949