The JumpLists were being returned by value. As a result, new jumps added to them in the client are actually added to a temporary copy and promptly discarded. Those jumps never get linked, resulting in infinite loops in DFG generated code that used the snippets.
Created attachment 265866 [details]
I started tests with this patch applied on the ARMv7 Thumb2 bot:
It will finish testing in 40-45 minutes, let's see the results.
Thanks for the review. Landed in r192632: <http://trac.webkit.org/r192632>.
*** Bug 151440 has been marked as a duplicate of this bug. ***