Bug 64562

Summary: DFG JIT crashes on host constructor calls in debug mode
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, fpizlo, scheib, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch none

Filip Pizlo
Reported 2011-07-14 14:43:27 PDT
The DFG JIT's support for host constructor calls has a broken ASSERT statement that results in crashes in debug mode.
Attachments
the patch (4.14 KB, patch)
2011-07-14 14:52 PDT, Filip Pizlo 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-07-14 14:52:15 PDT
Created attachment 100867 [details] the patch
WebKit Review Bot
Comment 2 2011-07-14 16:26:58 PDT
Comment on attachment 100867 [details] the patch Clearing flags on attachment: 100867 Committed r91034: <http://trac.webkit.org/changeset/91034>
WebKit Review Bot
Comment 3 2011-07-14 16:27:02 PDT
All reviewed patches have been landed. Closing bug.
Vincent Scheib
Comment 4 2011-07-14 16:38:23 PDT
Committed r91035: <http://trac.webkit.org/changeset/91035>
Note You need to log in before you can comment on or make changes to this bug.