Seems fast/js/array-sort-modifying-tostring.html case has been passed in release mode, whereas crashed occasionally in debug mode.
Created attachment 177180 [details] Patch
Comment on attachment 177180 [details] Patch Clearing flags on attachment: 177180 Committed r136366: <http://trac.webkit.org/changeset/136366>
All reviewed patches have been landed. Closing bug.