Reproducible crash on ToT when the linux emulator tries to boot Steps: 1) Load web site 2) Wait for emulator to start booting linux 3) Crash after a couple seconds
<rdar://problem/13452599>
The issue is that we're killing the ValueToInt32 node in fixIntEdge in DFGFixupPhase.cpp, which is not safe.
Created attachment 193900 [details] Patch
I can has LayoutTest?
Created attachment 193915 [details] Patch
Comment on attachment 193915 [details] Patch Clearing flags on attachment: 193915 Committed r146263: <http://trac.webkit.org/changeset/146263>
All reviewed patches have been landed. Closing bug.