inlineFunctionForCapabilityLevel() begins with: if (isClosureCall) { ASSERT(kind == CodeForCall); return inlineFunctionForClosureCallCapabilityLevel(codeBlock); } In some cases inlineFunctionForCapabilityLevel is called with isClosureCall true for CodeForConstruct. In release builds we'll do the wrong thing. Instead we should return CannotCompile.
Created attachment 233109 [details] Patch
Comment on attachment 233109 [details] Patch r=me
Committed r170011: <http://trac.webkit.org/changeset/170011>
Comment on attachment 233109 [details] Patch Seems like this should be pretty easy to test in a debug build. Can you add a test case?
(In reply to comment #4) > (From update of attachment 233109 [details]) > Seems like this should be pretty easy to test in a debug build. Can you add a test case? I don't know about easy. In testing on a debug build, I hit this very infrequently, say ~20 minutes. I will look into writing a test that can reliably hit this case. Tracked in <https://bugs.webkit.org/show_bug.cgi?id=133950> - "Add test for case where inlineFunctionForCapabilityLevel() is called for a constructor and isClosureCall is true"