Bug 64562

Summary: DFG JIT crashes on host constructor calls in debug mode
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, fpizlo, scheib, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch none

Description Filip Pizlo 2011-07-14 14:43:27 PDT
The DFG JIT's support for host constructor calls has a broken ASSERT statement that results in crashes in debug mode.
Comment 1 Filip Pizlo 2011-07-14 14:52:15 PDT
Created attachment 100867 [details]
the patch
Comment 2 WebKit Review Bot 2011-07-14 16:26:58 PDT
Comment on attachment 100867 [details]
the patch

Clearing flags on attachment: 100867

Committed r91034: <http://trac.webkit.org/changeset/91034>
Comment 3 WebKit Review Bot 2011-07-14 16:27:02 PDT
All reviewed patches have been landed.  Closing bug.
Comment 4 Vincent Scheib 2011-07-14 16:38:23 PDT
Committed r91035: <http://trac.webkit.org/changeset/91035>