From <rdar://problem/13021805> Try this program: function foo(a, b) { return (a / b) | 0; } for (var i = 0; i < 200; ++i) print(foo(-2147483647-1, -1)); Expected result: prints -2147483648 200 times. Actual result: crash. The reason is that the !nodeUsedAsNumber(node.arithNodeFlags()) case of ArithDiv doesn't correctly handle -2^31/-1.
Committed r139835: <http://trac.webkit.org/changeset/139835>
Expected test results fixed, see bug 106991.