Assertion failure in DFG::Node::switchData() (isSwitch()) at cnn.com

• Component: JavaScriptCore
• Status: NEW ---

To reproduce the bug, navigate to http://www.cnn.com/. The result is

ASSERTION FAILED: isSwitch()
Source/JavaScriptCore/dfg/DFGNode.h(1004) : JSC::DFG::SwitchData *JSC::DFG::Node::switchData()
1   0x10a267060 WTFCrash
2   0x1099e0f65 JSC::DFG::Node::switchData()
3   0x109a4605d JSC::DFG::Node::numSuccessors()
4   0x109a45f6d JSC::DFG::BasicBlock::numSuccessors()
5   0x109b4018e JSC::DFG::Graph::determineReachability()
6   0x109a125d5 JSC::DFG::ByteCodeParser::parse()
7   0x109a129d2 JSC::DFG::parse(JSC::DFG::Graph&)
8   0x109beb9db JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
9   0x109beb53d JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
10  0x109cd38b4 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
11  0x109cd1294 JSC::DFG::Worklist::threadFunction(void*)
12  0x10a2bf7f9 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const
13  0x10a2bf7cc std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()()
14  0x10a293001 std::__1::function<void ()>::operator()() const
15  0x10a2be5de WTF::threadEntryPoint(void*)
16  0x10a2bff6c WTF::wtfThreadEntryPoint(void*)
17  0x1045cb268 _pthread_body
18  0x1045cb1e5 _pthread_body
19  0x1045c941d thread_start

<rdar://problem/19119833>