<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>99470</bug_id>
          
          <creation_ts>2012-10-16 08:49:47 -0700</creation_ts>
          <short_desc>GetScopedVar CSE matches dead GetScopedVar&apos;s leading to IR corruption</short_desc>
          <delta_ts>2012-10-16 14:22:34 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Xan Lopez">xan.lopez</reporter>
          <assigned_to name="Filip Pizlo">fpizlo</assigned_to>
          <cc>fpizlo</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>743179</commentid>
    <comment_count>0</comment_count>
    <who name="Xan Lopez">xan.lopez</who>
    <bug_when>2012-10-16 08:49:47 -0700</bug_when>
    <thetext>I can get this entering and deleting text in gmail&apos;s search entry, 100%. Debug build, ToT:

At @77: validation (myRefCounts[nodeIndex] = 1) == (node.adjustedRefCount() = 0) (../../Source/JavaScriptCore/dfg/DFGValidate.cpp:132) failed.
Graph at time of failure:
Block #0 (bc#0):  (OSR target)
  Predecessors:
  Phi Nodes:
  vars before: (None, [], []) (OthercellOtherobjFinalArrayInt8arrayInt16arrayInt32arrayUint8arrayUint8clampedarrayUint16arrayUint32arrayFloat32arrayFloat64arrayFunctionMyargumentsForeignargumentsString, TOP, TOP) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: @0 @1 : - - - - - - - - - - - - - - - - - - - - -
   0:  skipped  &lt; 0:-&gt;	SetArgument(&lt;empty&gt;, arg0(A), bc#0)
   1:           &lt; 3:-&gt;	SetArgument(arg1(ED&lt;Final&gt;), bc#0)  predicting Final
   2:  skipped  &lt; 0:-&gt;	JSConstant(JS|PureInt|CanExit, $4 = Undefined, bc#0)
   3:  skipped  &lt; 0:-&gt;	SetLocal(@2, &lt;empty&gt;, r0(C), bc#0)
   4:  skipped  &lt; 0:-&gt;	SetLocal(@2, &lt;empty&gt;, r1(D), bc#0)
   5:  skipped  &lt; 0:-&gt;	SetLocal(@2, &lt;empty&gt;, r2(E), bc#0)
   6:  skipped  &lt; 0:-&gt;	SetLocal(@2, &lt;empty&gt;, r3(F), bc#0)
   7:  skipped  &lt; 0:-&gt;	SetLocal(@2, &lt;empty&gt;, r4(G), bc#0)
   8:           &lt; 2:-&gt;	GetLocal(@1, JS, arg1(ED&lt;Final&gt;), bc#1)  predicting Final
   9:           &lt;!0:-&gt;	CheckStructure(@8&lt;Final&gt;, MustGen|CanExit, struct(0x7fff595b5540), bc#1)
  10:           &lt; 1:-&gt;	GetByOffset(@8&lt;Final&gt;, JS, id0{B}, 4, bc#1)  predicting Final
  11:  skipped  &lt; 0:-&gt;	SetLocal(@10&lt;Final&gt;, &lt;empty&gt;, r5(H), bc#1)
  12:           &lt;!0:-&gt;	Branch(@10&lt;Final&gt;, MustGen|CanExit, T:#11, F:#1, bc#10)
  vars after: (None, [], []) (Final, [0x7fff595b5540], [0x7fff595b5540]) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: @0 @8 : @3 @4 @5 @6 @7 @11 - - - - - - - - - - - - - - -
Block #1 (bc#13): 
  Predecessors: #0
  Phi Nodes: @13-&gt;(@1)
  vars before: (None, [], []) (Final, [0x7fff595b5540], [0x7fff595b5540]) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: - @14 : - - - - - - - - - - - - - - - - - - - - -
  14:           &lt; 10:-&gt;	GetLocal(@13, JS, arg1(ED&lt;Final&gt;), bc#13)  predicting Final
  15:  skipped  &lt; 0:-&gt;	SetLocal(@14&lt;Final&gt;, &lt;empty&gt;, r5(J), bc#13)
  16:           &lt; 1:-&gt;	GetScope(JS, bc#16)
  17:           &lt; 1:-&gt;	GetScopeRegisters(@16&lt;Cell&gt;, Storage|PureInt, bc#16)
  18:           &lt; 1:-&gt;	GetScopedVar(@17&lt;Other&gt;, JS, var61, bc#16)  predicting Function
  19:  skipped  &lt; 0:-&gt;	SetLocal(@18&lt;Function&gt;, &lt;empty&gt;, r6(K), bc#16)
  20:           &lt;!1:-&gt;	Construct(@18&lt;Function&gt;, JS|MustGen|VarArgs|Clobbers|CanExit, bc#21)  predicting Final
  21:  skipped  &lt; 0:-&gt;	SetLocal(@20&lt;Final&gt;, &lt;empty&gt;, r8(L), bc#21)
  22:           &lt;!0:-&gt;	CheckStructure(@14&lt;Final&gt;, MustGen|CanExit, struct(0x7fff595b6080), bc#30)
  23:           &lt; 2:-&gt;	WeakJSConstant(JS, 0x7fff724f5b00, bc#30)
  24:           &lt;!0:-&gt;	StructureTransitionWatchpoint(@23&lt;Final&gt;, MustGen|CanExit, struct(0x7fff595b61c0), bc#30)
  25:           &lt; 2:-&gt;	WeakJSConstant(JS, 0x7fff9922ffc0, bc#30)
  26:           &lt;!0:-&gt;	StructureTransitionWatchpoint(@25&lt;Object&gt;, MustGen|CanExit, struct(0x7fff5969f720), bc#30)
  27:           &lt;!0:-&gt;	PutStructure(@14&lt;Final&gt;, MustGen, struct(0x7fff595b6080 -&gt; 0x7fff595b55e0), bc#30)
  28:           &lt;!0:-&gt;	PutByOffset(@14&lt;Final&gt;, @14&lt;Final&gt;, @20&lt;Final&gt;, MustGen, id0{B}, 4, bc#30)
  29:           &lt; 1:-&gt;	JSConstant(JS, $0 = Int32: 0, bc#39)
  30:           &lt;!0:-&gt;	Phantom(@14&lt;Final&gt;, MustGen, bc#39)
  31:           &lt;!0:-&gt;	Phantom(@23&lt;Final&gt;, MustGen, bc#39)
  32:           &lt;!0:-&gt;	Phantom(@25&lt;Object&gt;, MustGen, bc#39)
  33:           &lt;!0:-&gt;	PutStructure(@14&lt;Final&gt;, MustGen, struct(0x7fff595b55e0 -&gt; 0x7fff595b5540), bc#39)
  34:           &lt;!0:-&gt;	PutByOffset(@14&lt;Final&gt;, @14&lt;Final&gt;, @29&lt;Int32&gt;, MustGen, id1{ea}, 5, bc#39)
  35:           &lt;!0:-&gt;	StructureTransitionWatchpoint(@14&lt;Final&gt;, MustGen|CanExit, struct(0x7fff595b5540), bc#48)
  36:           &lt; 1:-&gt;	GetByOffset(@14&lt;Final&gt;, JS, id2{O}, 2, bc#48)  predicting Other
  37:  skipped  &lt; 0:-&gt;	SetLocal(@36&lt;Other&gt;, &lt;empty&gt;, r5(M), bc#48)
  38:           &lt;!0:-&gt;	Branch(@36&lt;Other&gt;, MustGen|CanExit, T:#2, F:#11, bc#57)
  vars after: (None, [], []) (Final, [0x7fff595b5540], [0x7fff595b5540]) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: - @14 : - - - - - @37 @19 - @21 - - - - - - - - - - - -
Block #2 (bc#60): 
  Predecessors: #1
  Phi Nodes: @40-&gt;(@13)
  vars before: (None, [], []) (Final, [0x7fff595b5540], [0x7fff595b5540]) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: - @41 : - - - - - - - - - - - - - - - - - - - - -
  39:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#60)
  41:           &lt; 1:-&gt;	GetLocal(@40, JS|CanExit, arg1(ED&lt;Final&gt;), bc#60)  predicting Final
  42:           &lt;!2:-&gt;	GetById(@41&lt;Final&gt;, JS|MustGen|Clobbers|CanExit, id2{O}, bc#60)  predicting None
  43:  skipped  &lt; 0:-&gt;	SetLocal(@42, &lt;empty&gt;, r7(O), bc#60)
  44:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#69)
  45:           &lt;!1:-&gt;	GetById(@42, JS|MustGen|Clobbers|CanExit, id3{split}, bc#69)  predicting None
  46:  skipped  &lt; 0:-&gt;	SetLocal(@45, &lt;empty&gt;, r5(P), bc#69)
  47:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $1 = Cell: 0x7fff9a5a23e0 (0x7fffa008fcc0: string, NonArray), bc#79)
  48:  skipped  &lt; 0:-&gt;	SetLocal(@47&lt;String&gt;, &lt;empty&gt;, r6(Q), bc#79)
  49:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#82)
  50:           &lt;!2:-&gt;	Call(@45, @42, @47&lt;String&gt;, JS|MustGen|VarArgs|Clobbers|CanExit, bc#82)  predicting None
  51:           &lt; 1:-&gt;	SetLocal(@50, &lt;empty&gt;, r0(CD), bc#82)  predicting None
  52:           &lt; 2:-&gt;	JSConstant(JS|UseAsInt|CanExit, $0 = Int32: 0, bc#91)
  53:           &lt; 1:-&gt;	SetLocal(@52&lt;Int32&gt;, &lt;empty&gt;, r1(AD&lt;Int32&gt;), bc#91)  predicting Int
  54:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#94)
  55:           &lt;!1:-&gt;	GetById(@50, JS|MustGen|Clobbers|CanExit, id4{length}, bc#94)  predicting None
  56:  skipped  &lt; 0:-&gt;	SetLocal(@55, &lt;empty&gt;, r5(T), bc#94)
  57:           &lt;!1:-&gt;	CompareLess(@52&lt;Int32&gt;, @55, Boolean|MustGen|MightClobber|CanExit, bc#103)
  58:           &lt;!0:-&gt;	Branch(@57&lt;Boolean&gt;, MustGen|CanExit, T:#3, F:#11, bc#103)
  vars after: (None, [], []) (None, [], []) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: - @41 : @51 @53 - - - @56 @48 @43 - - - - - - - - - - - - -
Block #3 (bc#107):  (OSR target)
  Predecessors: #2 #9
  Phi Nodes: @61-&gt;(@51, @222), @63-&gt;(@53, @210), @244-&gt;(@40, @239)
  vars before: &lt;empty&gt;
  var links: - @244 : @62 @64 - - - - - - - - - - - - - - - - - - -
  59:           &lt;!0:-&gt;	Phantom(MustGen|CanExit, bc#107)
  60:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#108)
  62:           &lt; 1:-&gt;	GetLocal(@61, JS|CanExit, r0(CD), bc#108)  predicting None
  64:           &lt; 1:-&gt;	GetLocal(@63, JS|PureNum|UseAsInt|CanExit, r1(AD&lt;Int32&gt;), bc#108)  predicting Int
 245:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#108)
  65:           &lt;!2:-&gt;	GetByVal(@62, @64&lt;Int32&gt;, JS|MustGen|MightClobber|CanExit, ForceExit, bc#108)  predicting None
  66:  skipped  &lt; 0:-&gt;	SetLocal(@65, &lt;empty&gt;, r7(W), bc#108)
  67:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#114)
  68:           &lt;!1:-&gt;	GetById(@65, JS|MustGen|Clobbers|CanExit, id5{indexOf}, bc#114)  predicting None
  69:  skipped  &lt; 0:-&gt;	SetLocal(@68, &lt;empty&gt;, r5(X), bc#114)
  70:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $2 = Cell: 0x7fff9a5a23c0 (0x7fffa008fcc0: string, NonArray), bc#124)
  71:  skipped  &lt; 0:-&gt;	SetLocal(@70&lt;String&gt;, &lt;empty&gt;, r6(Y), bc#124)
  72:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#127)
  73:           &lt;!2:-&gt;	Call(@68, @65, @70&lt;String&gt;, JS|MustGen|VarArgs|Clobbers|CanExit, bc#127)  predicting None
  74:           &lt; 1:-&gt;	SetLocal(@73, &lt;empty&gt;, r2(HB), bc#127)  predicting None
  75:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#136)
  76:  skipped  &lt; 0:-&gt;	GetScope(JS|PureInt|CanExit, bc#136)
  77:  skipped  &lt; 0:-&gt;	GetScopeRegisters(@76, Storage|PureInt|CanExit, bc#136)
  78:           &lt; 1:-&gt;	GetScopedVar(@77, JS|PureInt|CanExit, var5, bc#136)  predicting None
  79:  skipped  &lt; 0:-&gt;	SetLocal(@78, &lt;empty&gt;, r3(AB), bc#136)
  80:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#141)
  81:           &lt; 1:-&gt;	GetScope(JS|CanExit, bc#141)
  82:           &lt; 1:-&gt;	GetScopeRegisters(@81&lt;Cell&gt;, Storage|PureInt|CanExit, bc#141)
  83:           &lt;!0:-&gt;	Phantom(@82&lt;Other&gt;, MustGen|CanExit, bc#141)
  84:           &lt; 1:-&gt;	SetLocal(@78, &lt;empty&gt;, r4(OC), bc#141)  predicting None
  85:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $0 = Int32: 0, bc#146)
  86:           &lt;!1:-&gt;	CompareLessEq(@85&lt;Int32&gt;, @73, Boolean|MustGen|MightClobber|CanExit, bc#146)
  87:           &lt;!0:-&gt;	Branch(@86&lt;Boolean&gt;, MustGen|CanExit, T:#4, F:#5, bc#146)
  vars after: &lt;empty&gt;
  var links: - @244 : @62 @64 @74 @79 @84 @69 @71 @66 - - - - - - - - - - - - -
Block #4 (bc#150): 
  Predecessors: #3
  Phi Nodes: @89-&gt;(@61), @91-&gt;(@63), @100-&gt;(@74), @243-&gt;(@244)
  vars before: &lt;empty&gt;
  var links: - @243 : @90 @92 @101 - - - - - - - - - - - - - - - - - -
  88:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#150)
  90:           &lt; 2:-&gt;	GetLocal(@89, JS|CanExit, r0(CD), bc#150)  predicting None
  92:           &lt; 2:-&gt;	GetLocal(@91, JS|PureNum|UseAsInt|CanExit, r1(AD&lt;Int32&gt;), bc#150)  predicting Int
 246:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#150)
  93:           &lt;!2:-&gt;	GetByVal(@90, @92&lt;Int32&gt;, JS|MustGen|MightClobber|CanExit, ForceExit, bc#150)  predicting None
  94:  skipped  &lt; 0:-&gt;	SetLocal(@93, &lt;empty&gt;, r9(EB), bc#150)
  95:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#156)
  96:           &lt;!1:-&gt;	GetById(@93, JS|MustGen|Clobbers|CanExit, id6{substring}, bc#156)  predicting None
  97:  skipped  &lt; 0:-&gt;	SetLocal(@96, &lt;empty&gt;, r6(FB), bc#156)
  98:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $0 = Int32: 0, bc#166)
  99:  skipped  &lt; 0:-&gt;	SetLocal(@98&lt;Int32&gt;, &lt;empty&gt;, r8(GB), bc#166)
 101:           &lt; 2:-&gt;	GetLocal(@100, JS|CanExit, r2(HB), bc#169)  predicting None
 102:  skipped  &lt; 0:-&gt;	SetLocal(@101, &lt;empty&gt;, r7(IB), bc#169)
 103:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#172)
 104:           &lt;!1:-&gt;	Call(@96, @93, @98&lt;Int32&gt;, @101, JS|MustGen|VarArgs|Clobbers|CanExit, bc#172)  predicting None
 105:           &lt; 1:-&gt;	SetLocal(@104, &lt;empty&gt;, r3(VB), bc#172)  predicting None
 106:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#181)
 247:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#181)
 107:           &lt;!2:-&gt;	GetByVal(@90, @92&lt;Int32&gt;, JS|MustGen|MightClobber|CanExit, ForceExit, bc#181)  predicting None
 108:  skipped  &lt; 0:-&gt;	SetLocal(@107, &lt;empty&gt;, r8(KB), bc#181)
 109:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#187)
 110:           &lt;!1:-&gt;	GetById(@107, JS|MustGen|Clobbers|CanExit, id6{substring}, bc#187)  predicting None
 111:  skipped  &lt; 0:-&gt;	SetLocal(@110, &lt;empty&gt;, r6(LB), bc#187)
 112:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $3 = Int32: 1, bc#197)
 113:           &lt;!1:-&gt;	ValueAdd(@101, @112&lt;Int32&gt;, JS|MustGen|MightClobber|CanExit, bc#197)
 114:  skipped  &lt; 0:-&gt;	SetLocal(@113, &lt;empty&gt;, r7(MB), bc#197)
 115:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#202)
 116:           &lt;!1:-&gt;	Call(@110, @107, @113, JS|MustGen|VarArgs|Clobbers|CanExit, bc#202)  predicting None
 117:           &lt; 1:-&gt;	SetLocal(@116, &lt;empty&gt;, r4(OC), bc#202)  predicting None
 118:  skipped  &lt; 0:-&gt;	SetLocal(@116, &lt;empty&gt;, r5(OB), bc#211)
 119:           &lt;!0:-&gt;	Jump(MustGen|CanExit, T:#6, bc#214)
  vars after: &lt;empty&gt;
  var links: - @243 : @90 @92 @101 @105 @117 @118 @111 @114 @108 @94 - - - - - - - - - - -
Block #5 (bc#216): 
  Predecessors: #3
  Phi Nodes: @121-&gt;(@61), @123-&gt;(@63), @236-&gt;(@84), @242-&gt;(@244)
  vars before: &lt;empty&gt;
  var links: - @242 : @122 @124 - - @236 - - - - - - - - - - - - - - - -
 120:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#216)
 122:           &lt; 1:-&gt;	GetLocal(@121, JS|CanExit, r0(CD), bc#216)  predicting None
 124:           &lt; 1:-&gt;	GetLocal(@123, JS|PureNum|UseAsInt|CanExit, r1(AD&lt;Int32&gt;), bc#216)  predicting Int
 248:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#216)
 125:           &lt;!1:-&gt;	GetByVal(@122, @124&lt;Int32&gt;, JS|MustGen|MightClobber|CanExit, ForceExit, bc#216)  predicting None
 126:           &lt; 1:-&gt;	SetLocal(@125, &lt;empty&gt;, r3(VB), bc#216)  predicting None
 127:  skipped  &lt; 0:-&gt;	SetLocal(@125, &lt;empty&gt;, r5(SB), bc#222)
 128:           &lt;!0:-&gt;	Jump(MustGen|CanExit, T:#6, bc#225)
  vars after: &lt;empty&gt;
  var links: - @242 : @122 @124 - @126 @236 @127 - - - - - - - - - - - - - - -
Block #6 (bc#225): 
  Predecessors: #5 #4
  Phi Nodes: @134-&gt;(@126, @105), @156-&gt;(@242, @243), @168-&gt;(@236, @117), @225-&gt;(@121, @89), @229-&gt;(@123, @91)
  vars before: &lt;empty&gt;
  var links: - @157 : @225 @229 - @135 @169 - - - - - - - - - - - - - - - -
 129:           &lt; 2:-&gt;	JSConstant(JS|CanExit, $4 = Undefined, bc#225)
 130:  skipped  &lt; 0:-&gt;	SetLocal(@129&lt;Other&gt;, &lt;empty&gt;, r7(TB), bc#225)
 131:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#228)
 132:           &lt;!1:-&gt;	ResolveGlobal(JS|MustGen|Clobbers|CanExit, bc#228)  predicting None
 133:  skipped  &lt; 0:-&gt;	SetLocal(@132, &lt;empty&gt;, r5(UB), bc#228)
 135:           &lt; 2:-&gt;	GetLocal(@134, JS|CanExit, r3(VB), bc#234)  predicting None
 136:  skipped  &lt; 0:-&gt;	SetLocal(@135, &lt;empty&gt;, r10(WB), bc#234)
 137:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#237)
 138:           &lt;!1:-&gt;	GetById(@135, JS|MustGen|Clobbers|CanExit, id8{replace}, bc#237)  predicting None
 139:  skipped  &lt; 0:-&gt;	SetLocal(@138, &lt;empty&gt;, r6(XB), bc#237)
 140:           &lt; 1:-&gt;	NewRegexp(JS|CanExit, bc#247)
 141:  skipped  &lt; 0:-&gt;	SetLocal(@140&lt;Object&gt;, &lt;empty&gt;, r9(YB), bc#247)
 142:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $5 = Cell: 0x7fff9a5a4a00 (0x7fffa008fcc0: string, NonArray), bc#250)
 143:  skipped  &lt; 0:-&gt;	SetLocal(@142&lt;String&gt;, &lt;empty&gt;, r8(ZB), bc#250)
 144:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#253)
 145:           &lt;!1:-&gt;	Call(@138, @135, @140&lt;Object&gt;, @142&lt;String&gt;, JS|MustGen|VarArgs|Clobbers|CanExit, bc#253)  predicting None
 146:  skipped  &lt; 0:-&gt;	SetLocal(@145, &lt;empty&gt;, r6(AC), bc#253)
 147:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#262)
 148:           &lt;!1:-&gt;	Call(@132, @129&lt;Other&gt;, @145, JS|MustGen|VarArgs|Clobbers|CanExit, bc#262)  predicting None
 149:  skipped  &lt; 0:-&gt;	SetLocal(@148, &lt;empty&gt;, r3(BC), bc#262)
 150:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#271)
 151:           &lt; 1:-&gt;	GetScope(JS|CanExit, bc#271)
 152:           &lt; 1:-&gt;	GetScopeRegisters(@151&lt;Cell&gt;, Storage|PureInt|CanExit, bc#271)
 153:           &lt; 1:-&gt;	GetScopedVar(@152&lt;Other&gt;, JS|CanExit, var310, bc#271)  predicting None
 154:  skipped  &lt; 0:-&gt;	SetLocal(@153, &lt;empty&gt;, r5(CC), bc#271)
 155:  skipped  &lt; 0:-&gt;	SetLocal(@129&lt;Other&gt;, &lt;empty&gt;, r8(DC), bc#276)
 157:           &lt; 3:-&gt;	GetLocal(@156, JS|CanExit, arg1(ED&lt;Final&gt;), bc#279)  predicting Final
 158:  skipped  &lt; 0:-&gt;	SetLocal(@157&lt;Final&gt;, &lt;empty&gt;, r7(FC), bc#279)
 159:  skipped  &lt; 0:-&gt;	SetLocal(@148, &lt;empty&gt;, r6(GC), bc#282)
 160:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#285)
 161:           &lt;!1:-&gt;	Call(@153, @129&lt;Other&gt;, @157&lt;Final&gt;, @148, JS|MustGen|VarArgs|Clobbers|CanExit, bc#285)  predicting None
 162:  skipped  &lt; 0:-&gt;	SetLocal(@161, &lt;empty&gt;, r3(HC), bc#285)
 163:           &lt; 2:-&gt;	SetLocal(@157&lt;Final&gt;, &lt;empty&gt;, r8(XC&lt;Final&gt;), bc#294)  predicting Final
 164:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#297)
 165:           &lt;!1:-&gt;	GetById(@157&lt;Final&gt;, JS|MustGen|Clobbers|CanExit, id9{add}, bc#297)  predicting None
 166:           &lt; 2:-&gt;	SetLocal(@165, &lt;empty&gt;, r5(WC), bc#297)  predicting None
 167:           &lt; 2:-&gt;	SetLocal(@161, &lt;empty&gt;, r7(YC), bc#307)  predicting None
 169:           &lt; 1:-&gt;	GetLocal(@168, JS|CanExit, r4(OC), bc#310)  predicting None
 170:           &lt;!0:-&gt;	Branch(@169, MustGen|CanExit, T:#7, F:#8, bc#310)
  vars after: &lt;empty&gt;
  var links: - @157 : @225 @229 - @162 @169 @166 @159 @167 @163 @141 @136 - - - - - - - - - -
Block #7 (bc#313): 
  Predecessors: #6
  Phi Nodes: @176-&gt;(@168), @224-&gt;(@225), @228-&gt;(@229), @231-&gt;(@167), @233-&gt;(@163), @235-&gt;(@166), @241-&gt;(@156)
  vars before: &lt;empty&gt;
  var links: - @241 : @224 @228 - - @177 @235 - @231 @233 - - - - - - - - - - - -
 171:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $4 = Undefined, bc#313)
 172:  skipped  &lt; 0:-&gt;	SetLocal(@171&lt;Other&gt;, &lt;empty&gt;, r11(MC), bc#313)
 173:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#316)
 174:           &lt;!1:-&gt;	ResolveGlobal(JS|MustGen|Clobbers|CanExit, bc#316)  predicting None
 175:  skipped  &lt; 0:-&gt;	SetLocal(@174, &lt;empty&gt;, r9(NC), bc#316)
 177:           &lt; 2:-&gt;	GetLocal(@176, JS|CanExit, r4(OC), bc#322)  predicting None
 178:  skipped  &lt; 0:-&gt;	SetLocal(@177, &lt;empty&gt;, r14(PC), bc#322)
 179:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#325)
 180:           &lt;!1:-&gt;	GetById(@177, JS|MustGen|Clobbers|CanExit, id8{replace}, bc#325)  predicting None
 181:  skipped  &lt; 0:-&gt;	SetLocal(@180, &lt;empty&gt;, r10(QC), bc#325)
 182:           &lt; 1:-&gt;	NewRegexp(JS|CanExit, bc#335)
 183:  skipped  &lt; 0:-&gt;	SetLocal(@182&lt;Object&gt;, &lt;empty&gt;, r13(RC), bc#335)
 184:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $5 = Cell: 0x7fff9a5a4a00 (0x7fffa008fcc0: string, NonArray), bc#338)
 185:  skipped  &lt; 0:-&gt;	SetLocal(@184&lt;String&gt;, &lt;empty&gt;, r12(SC), bc#338)
 186:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#341)
 187:           &lt;!1:-&gt;	Call(@180, @177, @182&lt;Object&gt;, @184&lt;String&gt;, JS|MustGen|VarArgs|Clobbers|CanExit, bc#341)  predicting None
 188:  skipped  &lt; 0:-&gt;	SetLocal(@187, &lt;empty&gt;, r10(TC), bc#341)
 189:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#350)
 190:           &lt;!1:-&gt;	Call(@174, @171&lt;Other&gt;, @187, JS|MustGen|VarArgs|Clobbers|CanExit, bc#350)  predicting None
 191:           &lt; 1:-&gt;	SetLocal(@190, &lt;empty&gt;, r6(ZC&lt;String&gt;), bc#350)  predicting String
 192:           &lt;!0:-&gt;	Jump(MustGen|CanExit, T:#9, bc#359)
  vars after: &lt;empty&gt;
  var links: - @241 : @224 @228 - - @177 @235 @191 @231 @233 @175 @188 @172 @185 @183 @178 - - - - - -
Block #8 (bc#361): 
  Predecessors: #6
  Phi Nodes: @223-&gt;(@225), @227-&gt;(@229), @230-&gt;(@167), @232-&gt;(@163), @234-&gt;(@166), @240-&gt;(@156)
  vars before: &lt;empty&gt;
  var links: - @240 : @223 @227 - - - @234 - @230 @232 - - - - - - - - - - - -
 193:           &lt; 1:-&gt;	JSConstant(JS|CanExit, $6 = Cell: 0x7fff9a5affe0 (0x7fffa008fcc0: string, NonArray), bc#361)
 194:           &lt; 1:-&gt;	SetLocal(@193&lt;String&gt;, &lt;empty&gt;, r6(ZC&lt;String&gt;), bc#361)  predicting String
 195:           &lt;!0:-&gt;	Jump(MustGen|CanExit, T:#9, bc#364)
  vars after: &lt;empty&gt;
  var links: - @240 : @223 @227 - - - @234 @194 @230 @232 - - - - - - - - - - - -
Block #9 (bc#364): 
  Predecessors: #8 #7
  Phi Nodes: @196-&gt;(@234, @235), @198-&gt;(@232, @233), @200-&gt;(@230, @231), @202-&gt;(@194, @191), @222-&gt;(@223, @224), @226-&gt;(@227, @228), @239-&gt;(@240, @241), @206-&gt;(@226), @212-&gt;(@222), @237-&gt;(@239)
  vars before: &lt;empty&gt;
  var links: - @239 : @222 @226 - - - @197 @203 @201 @199 - - - - - - - - - - - -
 197:           &lt; 1:-&gt;	GetLocal(@196, JS|CanExit, r5(WC), bc#364)  predicting None
 199:           &lt; 1:-&gt;	GetLocal(@198, JS|CanExit, r8(XC&lt;Final&gt;), bc#364)  predicting Final
 201:           &lt; 1:-&gt;	GetLocal(@200, JS|CanExit, r7(YC), bc#364)  predicting None
 203:           &lt; 1:-&gt;	GetLocal(@202, JS|CanExit, r6(ZC&lt;String&gt;), bc#364)  predicting String
 204:           &lt;!0:-&gt;	Call(@197, @199&lt;Final&gt;, @201, @203&lt;String&gt;, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, bc#364)  predicting None
 205:           &lt;!0:-&gt;	Phantom(MustGen|CanExit, bc#370)
 207:           &lt; 1:-&gt;	GetLocal(@226, JS|UseAsInt|CanExit, r1(AD&lt;Int32&gt;), bc#370)  predicting Int
 208:           &lt; 1:-&gt;	JSConstant(JS|UseAsInt|CanExit, $3 = Int32: 1, bc#370)
 209:           &lt;!2:-&gt;	ArithAdd(@207&lt;Int32&gt;, @208&lt;Int32&gt;, Number|MustGen|UseAsInt|CanExit, bc#370)
 210:           &lt; 1:-&gt;	SetLocal(@209&lt;Int32&gt;, &lt;empty&gt;, r1(AD&lt;Int32&gt;), bc#370)  predicting Int
 211:           &lt;!0:-&gt;	ForceOSRExit(MustGen|CanExit, bc#372)
 213:           &lt; 1:-&gt;	GetLocal(@222, JS|CanExit, r0(CD), bc#372)  predicting None
 214:           &lt;!1:-&gt;	GetById(@213, JS|MustGen|Clobbers|CanExit, id4{length}, bc#372)  predicting None
 215:  skipped  &lt; 0:-&gt;	SetLocal(@214, &lt;empty&gt;, r5(DD), bc#372)
 216:           &lt;!1:-&gt;	CompareLess(@209&lt;Int32&gt;, @214, Boolean|MustGen|MightClobber|CanExit, bc#381)
 217:           &lt;!0:-&gt;	Branch(@216&lt;Boolean&gt;, MustGen|CanExit, T:#3, F:#11, bc#381)
  vars after: &lt;empty&gt;
  var links: - @239 : @213 @210 - - - @215 @203 @201 @199 - - - - - - - - - - - -
Block #11 (bc#385): 
  Predecessors: #0 #1 #2 #9
  Phi Nodes: @218-&gt;(@238, @239), @238-&gt;(@1, @13, @40)
  vars before: (None, [], []) (Final, [0x7fff595b5540], [0x7fff595b5540]) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: - @219 : - - - - - - - - - - - - - - - - - - - - -
 219:           &lt;!0:-&gt;	Flush(@218, MustGen, arg1(ED&lt;Final&gt;), bc#385)  predicting Final
 220:           &lt; 1:-&gt;	JSConstant(JS, $4 = Undefined, bc#385)
 221:           &lt;!0:-&gt;	Return(@220&lt;Other&gt;, MustGen, bc#385)
  vars after: (None, [], []) (None, [], []) : (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], []) (None, [], [])
  var links: - @219 : - - - - - - - - - - - - - - - - - - - - -
ASSERTION FAILED: myRefCounts[nodeIndex] == node.adjustedRefCount()
../../Source/JavaScriptCore/dfg/DFGValidate.cpp(132) : void JSC::DFG::Validate::validate()
1   0x7ffff79bd9f7 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG8Validate8validateEv+0x581) [0x7ffff79bd9f7]
2   0x7ffff79bd31d /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG8validateERNS0_5GraphENS0_13GraphDumpModeE+0x31) [0x7ffff79bd31d]
3   0x7ffff791ed3a /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG22CFGSimplificationPhase3runEv+0xb08) [0x7ffff791ed3a]
4   0x7ffff79213c2 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG9runAndLogINS0_22CFGSimplificationPhaseEEEbRT_+0x18) [0x7ffff79213c2]
5   0x7ffff7920f10 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG8runPhaseINS0_22CFGSimplificationPhaseEEEbRNS0_5GraphE+0x2c) [0x7ffff7920f10]
6   0x7ffff791de37 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG24performCFGSimplificationERNS0_5GraphE+0x2b) [0x7ffff791de37]
7   0x7ffff793179d /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG7compileENS0_11CompileModeEPNS_9ExecStateEPNS_9CodeBlockERNS_7JITCodeEPNS_21MacroAssemblerCodePtrEj+0x41b) [0x7ffff793179d]
8   0x7ffff793121c /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC3DFG18tryCompileFunctionEPNS_9ExecStateEPNS_9CodeBlockERNS_7JITCodeERNS_21MacroAssemblerCodePtrEj+0x42) [0x7ffff793121c]
9   0x7ffff7ad936b /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC31jitCompileFunctionIfAppropriateEPNS_9ExecStateERN3WTF6OwnPtrINS_17FunctionCodeBlockEEERNS_7JITCodeERNS_21MacroAssemblerCodePtrERNS_12WriteBarrierINS_17SharedSymbolTableEEENS7_7JITTypeEjNS_20JITCompilationEffortE+0x114) [0x7ffff7ad936b]
10  0x7ffff7ad9663 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC27prepareFunctionForExecutionEPNS_9ExecStateERN3WTF6OwnPtrINS_17FunctionCodeBlockEEERNS_7JITCodeERNS_21MacroAssemblerCodePtrERNS_12WriteBarrierINS_17SharedSymbolTableEEENS7_7JITTypeEjNS_22CodeSpecializationKindE+0xb7) [0x7ffff7ad9663]
11  0x7ffff7ad7563 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC18FunctionExecutable22compileForCallInternalEPNS_9ExecStateEPNS_7JSScopeENS_7JITCode7JITTypeEj+0x2c7) [0x7ffff7ad7563]
12  0x7ffff7ad698d /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC18FunctionExecutable23compileOptimizedForCallEPNS_9ExecStateEPNS_7JSScopeEj+0x12b) [0x7ffff7ad698d]
13  0x7ffff78675d5 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC18FunctionExecutable19compileOptimizedForEPNS_9ExecStateEPNS_7JSScopeEjNS_22CodeSpecializationKindE+0x141) [0x7ffff78675d5]
14  0x7ffff78637ac /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(_ZN3JSC17FunctionCodeBlock16compileOptimizedEPNS_9ExecStateEPNS_7JSScopeEj+0x96) [0x7ffff78637ac]
15  0x7ffff7a2d56a /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(+0x6a856a) [0x7ffff7a2d56a]
16  0x7ffff7a29963 /home/xan/git/webkit/build/debug/.libs/libjavascriptcoregtk-3.0.so(+0x6a4963) [0x7ffff7a29963]
17  0x7fffffffcab0 [0x7fffffffcab0]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff79bda01 in JSC::DFG::Validate::validate (this=0x7fffffffa220) at ../../Source/JavaScriptCore/dfg/DFGValidate.cpp:132
132	                V_EQUAL((nodeIndex), myRefCounts[nodeIndex], node.adjustedRefCount());
Missing separate debuginfos, use: debuginfo-install google-talkplugin-3.9.1.0-1.x86_64
(gdb) bt
#0  0x00007ffff79bda01 in JSC::DFG::Validate::validate (this=0x7fffffffa220) at ../../Source/JavaScriptCore/dfg/DFGValidate.cpp:132
#1  0x00007ffff79bd31d in JSC::DFG::validate (graph=..., graphDumpMode=JSC::DFG::DumpGraph) at ../../Source/JavaScriptCore/dfg/DFGValidate.cpp:354
#2  0x00007ffff791ed3a in JSC::DFG::CFGSimplificationPhase::run (this=0x7fffffffa3c0) at ../../Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp:243
#3  0x00007ffff79213c2 in JSC::DFG::runAndLog&lt;JSC::DFG::CFGSimplificationPhase&gt; (phase=...) at ../../Source/JavaScriptCore/dfg/DFGPhase.h:83
#4  0x00007ffff7920f10 in JSC::DFG::runPhase&lt;JSC::DFG::CFGSimplificationPhase&gt; (graph=...) at ../../Source/JavaScriptCore/dfg/DFGPhase.h:95
#5  0x00007ffff791de37 in JSC::DFG::performCFGSimplification (graph=...) at ../../Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp:741
#6  0x00007ffff793179d in JSC::DFG::compile (compileMode=JSC::DFG::CompileFunction, exec=0x7fffa0095698, codeBlock=0x344f0a0, jitCode=..., jitCodeWithArityCheck=0x7fff724d3f10, osrEntryBytecodeIndex=0) at ../../Source/JavaScriptCore/dfg/DFGDriver.cpp:128
#7  0x00007ffff793121c in JSC::DFG::tryCompileFunction (exec=0x7fffa0095698, codeBlock=0x344f0a0, jitCode=..., jitCodeWithArityCheck=..., bytecodeIndex=0) at ../../Source/JavaScriptCore/dfg/DFGDriver.cpp:173
#8  0x00007ffff7ad936b in JSC::jitCompileFunctionIfAppropriate (exec=0x7fffa0095698, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., symbolTable=..., jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0, effort=JSC::JITCompilationCanFail) at ../../Source/JavaScriptCore/jit/JITDriver.h:95
#9  0x00007ffff7ad9663 in JSC::prepareFunctionForExecution (exec=0x7fffa0095698, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., symbolTable=..., jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0, kind=JSC::CodeForCall) at ../../Source/JavaScriptCore/runtime/ExecutionHarness.h:64
#10 0x00007ffff7ad7563 in JSC::FunctionExecutable::compileForCallInternal (this=0x7fff724d3ec0, exec=0x7fffa0095698, scope=0x7fff7249f180, jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0) at ../../Source/JavaScriptCore/runtime/Executable.cpp:522
#11 0x00007ffff7ad698d in JSC::FunctionExecutable::compileOptimizedForCall (this=0x7fff724d3ec0, exec=0x7fffa0095698, scope=0x7fff7249f180, bytecodeIndex=0) at ../../Source/JavaScriptCore/runtime/Executable.cpp:422
#12 0x00007ffff78675d5 in JSC::FunctionExecutable::compileOptimizedFor (this=0x7fff724d3ec0, exec=0x7fffa0095698, scope=0x7fff7249f180, bytecodeIndex=0, kind=JSC::CodeForCall) at ../../Source/JavaScriptCore/runtime/Executable.h:634
#13 0x00007ffff78637ac in JSC::FunctionCodeBlock::compileOptimized (this=0x308e550, exec=0x7fffa0095698, scope=0x7fff7249f180, bytecodeIndex=0) at ../../Source/JavaScriptCore/bytecode/CodeBlock.cpp:2739
#14 0x00007ffff7a2d56a in JSC::cti_optimize (args=0x7fffffffca80) at ../../Source/JavaScriptCore/jit/JITStubs.cpp:2020
#15 0x00007ffff7a29963 in JSC::JITThunks::tryCacheGetByID (callFrame=0x7ffff7fe85c0, codeBlock=0x0, returnAddress=..., baseValue=..., propertyName=..., slot=..., stubInfo=0x7fff00000000) at ../../Source/JavaScriptCore/jit/JITStubs.cpp:968
#16 0x00007fffffffcab0 in ?? ()
#17 0x00007fff00000000 in ?? ()
#18 0x00007fff00000003 in ?? ()
#19 0x00007ffff794a057 in JSC::Register::Register (this=0xc9cbe8c78948104d) at ../../Source/JavaScriptCore/interpreter/Register.h:105
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>743482</commentid>
    <comment_count>1</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-10-16 13:33:14 -0700</bug_when>
    <thetext>&lt;rdar://problem/12363698&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>743485</commentid>
    <comment_count>2</comment_count>
      <attachid>169011</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-10-16 13:35:45 -0700</bug_when>
    <thetext>Created attachment 169011
the patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>743489</commentid>
    <comment_count>3</comment_count>
      <attachid>169011</attachid>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-10-16 13:36:43 -0700</bug_when>
    <thetext>Comment on attachment 169011
the patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>743490</commentid>
    <comment_count>4</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-10-16 13:37:09 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; (From update of attachment 169011 [details])
&gt; r=me

Thanks!  Tests forthcoming.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>743552</commentid>
    <comment_count>5</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-10-16 14:22:34 -0700</bug_when>
    <thetext>Landed in http://trac.webkit.org/changeset/131501</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>169011</attachid>
            <date>2012-10-16 13:35:45 -0700</date>
            <delta_ts>2012-10-16 13:36:43 -0700</delta_ts>
            <desc>the patch</desc>
            <filename>everything_1.patch</filename>
            <type>text/plain</type>
            <size>3595</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTMxNDkyKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIxIEBA
CisyMDEyLTEwLTE2ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
R2V0U2NvcGVkVmFyIENTRSBtYXRjaGVzIGRlYWQgR2V0U2NvcGVkVmFyJ3MgbGVhZGluZyB0byBJ
UiBjb3JydXB0aW9uCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn
aT9pZD05OTQ3MAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg
ICAgIEFsbCBpdCB0YWtlcyBpcyB0byBmb2xsb3cgdGhlICJpZiAoIXNob3VsZEdlbmVyYXRlKSBj
b250aW51ZSIgaWRpb20gYW5kIGV2ZXJ5dGhpbmcgd2lsbCBiZSBPSy4KKworICAgICAgICAqIGRm
Zy9ERkdDU0VQaGFzZS5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6Q1NFUGhhc2U6Omdsb2JhbFZh
ckxvYWRFbGltaW5hdGlvbik6CisgICAgICAgIChKU0M6OkRGRzo6Q1NFUGhhc2U6OnNjb3BlZFZh
ckxvYWRFbGltaW5hdGlvbik6CisgICAgICAgIChKU0M6OkRGRzo6Q1NFUGhhc2U6Omdsb2JhbFZh
cldhdGNocG9pbnRFbGltaW5hdGlvbik6CisgICAgICAgIChKU0M6OkRGRzo6Q1NFUGhhc2U6Omdl
dEJ5VmFsTG9hZEVsaW1pbmF0aW9uKToKKyAgICAgICAgKEpTQzo6REZHOjpDU0VQaGFzZTo6Y2hl
Y2tTdHJ1Y3R1cmVFbGltaW5hdGlvbik6CisgICAgICAgIChKU0M6OkRGRzo6Q1NFUGhhc2U6OnN0
cnVjdHVyZVRyYW5zaXRpb25XYXRjaHBvaW50RWxpbWluYXRpb24pOgorICAgICAgICAoSlNDOjpE
Rkc6OkNTRVBoYXNlOjpnZXRCeU9mZnNldExvYWRFbGltaW5hdGlvbik6CisKIDIwMTItMTAtMTYg
IEJhbGF6cyBLaWx2YWR5ICA8a2lsdmFkeWJAaG9tZWppbm5pLmNvbT4KIAogICAgICAgICBBZGQg
bWlzc2luZyBNSVBTIGZ1bmN0aW9ucyB0byBhc3NlbWJsZXIuCkluZGV4OiBTb3VyY2UvSmF2YVNj
cmlwdENvcmUvZGZnL0RGR0NTRVBoYXNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNj
cmlwdENvcmUvZGZnL0RGR0NTRVBoYXNlLmNwcAkocmV2aXNpb24gMTMxNDg1KQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL2RmZy9ERkdDU0VQaGFzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE5
OCw2ICsxOTgsOCBAQCBwcml2YXRlOgogICAgICAgICBmb3IgKHVuc2lnbmVkIGkgPSBtX2luZGV4
SW5CbG9jazsgaS0tOykgewogICAgICAgICAgICAgTm9kZUluZGV4IGluZGV4ID0gbV9jdXJyZW50
QmxvY2stPmF0KGkpOwogICAgICAgICAgICAgTm9kZSYgbm9kZSA9IG1fZ3JhcGhbaW5kZXhdOwor
ICAgICAgICAgICAgaWYgKCFub2RlLnNob3VsZEdlbmVyYXRlKCkpCisgICAgICAgICAgICAgICAg
Y29udGludWU7CiAgICAgICAgICAgICBzd2l0Y2ggKG5vZGUub3AoKSkgewogICAgICAgICAgICAg
Y2FzZSBHZXRHbG9iYWxWYXI6CiAgICAgICAgICAgICAgICAgaWYgKG5vZGUucmVnaXN0ZXJQb2lu
dGVyKCkgPT0gcmVnaXN0ZXJQb2ludGVyKQpAQCAtMjIxLDYgKzIyMyw4IEBAIHByaXZhdGU6CiAg
ICAgICAgIGZvciAodW5zaWduZWQgaSA9IG1faW5kZXhJbkJsb2NrOyBpLS07KSB7CiAgICAgICAg
ICAgICBOb2RlSW5kZXggaW5kZXggPSBtX2N1cnJlbnRCbG9jay0+YXQoaSk7CiAgICAgICAgICAg
ICBOb2RlJiBub2RlID0gbV9ncmFwaFtpbmRleF07CisgICAgICAgICAgICBpZiAoIW5vZGUuc2hv
dWxkR2VuZXJhdGUoKSkKKyAgICAgICAgICAgICAgICBjb250aW51ZTsKICAgICAgICAgICAgIHN3
aXRjaCAobm9kZS5vcCgpKSB7CiAgICAgICAgICAgICBjYXNlIEdldFNjb3BlZFZhcjogewogICAg
ICAgICAgICAgICAgIE5vZGUmIGdldFNjb3BlUmVnaXN0ZXJzID0gbV9ncmFwaFtub2RlLmNoaWxk
MSgpXTsKQEAgLTI0OSw2ICsyNTMsOCBAQCBwcml2YXRlOgogICAgICAgICBmb3IgKHVuc2lnbmVk
IGkgPSBtX2luZGV4SW5CbG9jazsgaS0tOykgewogICAgICAgICAgICAgTm9kZUluZGV4IGluZGV4
ID0gbV9jdXJyZW50QmxvY2stPmF0KGkpOwogICAgICAgICAgICAgTm9kZSYgbm9kZSA9IG1fZ3Jh
cGhbaW5kZXhdOworICAgICAgICAgICAgaWYgKCFub2RlLnNob3VsZEdlbmVyYXRlKCkpCisgICAg
ICAgICAgICAgICAgY29udGludWU7CiAgICAgICAgICAgICBzd2l0Y2ggKG5vZGUub3AoKSkgewog
ICAgICAgICAgICAgY2FzZSBHbG9iYWxWYXJXYXRjaHBvaW50OgogICAgICAgICAgICAgICAgIGlm
IChub2RlLnJlZ2lzdGVyUG9pbnRlcigpID09IHJlZ2lzdGVyUG9pbnRlcikKQEAgLTMzNSw2ICsz
NDEsOCBAQCBwcml2YXRlOgogICAgICAgICAgICAgICAgIGJyZWFrOwogCiAgICAgICAgICAgICBO
b2RlJiBub2RlID0gbV9ncmFwaFtpbmRleF07CisgICAgICAgICAgICBpZiAoIW5vZGUuc2hvdWxk
R2VuZXJhdGUoKSkKKyAgICAgICAgICAgICAgICBjb250aW51ZTsKICAgICAgICAgICAgIHN3aXRj
aCAobm9kZS5vcCgpKSB7CiAgICAgICAgICAgICBjYXNlIEdldEJ5VmFsOgogICAgICAgICAgICAg
ICAgIGlmICghbV9ncmFwaC5ieVZhbElzUHVyZShub2RlKSkKQEAgLTM5MSw2ICszOTksOCBAQCBw
cml2YXRlOgogICAgICAgICAgICAgICAgIGJyZWFrOwogCiAgICAgICAgICAgICBOb2RlJiBub2Rl
ID0gbV9ncmFwaFtpbmRleF07CisgICAgICAgICAgICBpZiAoIW5vZGUuc2hvdWxkR2VuZXJhdGUo
KSkKKyAgICAgICAgICAgICAgICBjb250aW51ZTsKICAgICAgICAgICAgIHN3aXRjaCAobm9kZS5v
cCgpKSB7CiAgICAgICAgICAgICBjYXNlIENoZWNrU3RydWN0dXJlOgogICAgICAgICAgICAgY2Fz
ZSBGb3J3YXJkQ2hlY2tTdHJ1Y3R1cmU6CkBAIC00NDUsNiArNDU1LDggQEAgcHJpdmF0ZToKICAg
ICAgICAgICAgICAgICBicmVhazsKIAogICAgICAgICAgICAgTm9kZSYgbm9kZSA9IG1fZ3JhcGhb
aW5kZXhdOworICAgICAgICAgICAgaWYgKCFub2RlLnNob3VsZEdlbmVyYXRlKCkpCisgICAgICAg
ICAgICAgICAgY29udGludWU7CiAgICAgICAgICAgICBzd2l0Y2ggKG5vZGUub3AoKSkgewogICAg
ICAgICAgICAgY2FzZSBDaGVja1N0cnVjdHVyZToKICAgICAgICAgICAgIGNhc2UgRm9yd2FyZENo
ZWNrU3RydWN0dXJlOgpAQCAtNTQ3LDYgKzU1OSw4IEBAIHByaXZhdGU6CiAgICAgICAgICAgICAg
ICAgYnJlYWs7CiAKICAgICAgICAgICAgIE5vZGUmIG5vZGUgPSBtX2dyYXBoW2luZGV4XTsKKyAg
ICAgICAgICAgIGlmICghbm9kZS5zaG91bGRHZW5lcmF0ZSgpKQorICAgICAgICAgICAgICAgIGNv
bnRpbnVlOwogICAgICAgICAgICAgc3dpdGNoIChub2RlLm9wKCkpIHsKICAgICAgICAgICAgIGNh
c2UgR2V0QnlPZmZzZXQ6CiAgICAgICAgICAgICAgICAgaWYgKG5vZGUuY2hpbGQxKCkgPT0gY2hp
bGQxCg==
</data>
<flag name="review"
          id="182160"
          type_id="1"
          status="+"
          setter="mhahnenberg"
    />
          </attachment>
      

    </bug>

</bugzilla>