97322 2012-09-21 03:46:01 -0700 canOptimize() should not return with a random value 2012-09-21 03:57:47 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified NEW P2 Normal --- 1 zherczeg webkit-unassigned barraclough fpizlo rhodovan.u-szeged oldest_to_newest 725391 0 zherczeg 2012-09-21 03:46:01 -0700 compilePatchGetArrayLength(...) in JIT.h creates a JIT jit(...) but the constructor does not set the m_canOptimize boolean flag for a default value when DFG JIT is enabled. After that it calls JIT::emitArrayProfilingSiteForBytecodeIndex(...) in JITInlineMethods.h which calls JIT::emitArrayProfilingSite(...). The latter do things randomly depending on the optimization flag. I think this behaviour is not intentional, so how can I fix it?