...
Created attachment 273519 [details] patch
Comment on attachment 273519 [details] patch Clearing flags on attachment: 273519 Committed r197918: <http://trac.webkit.org/changeset/197918>
All reviewed patches have been landed. Closing bug.
Comment on attachment 273519 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=273519&action=review > Source/JavaScriptCore/runtime/ArrayConstructor.h:91 > + ASSERT_NOT_REACHED(); I didn't catch this before, but you should probably make this a RELEASE_ASSERT_NOT_REACHED().
Comment on attachment 273519 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=273519&action=review >> Source/JavaScriptCore/runtime/ArrayConstructor.h:91 >> + ASSERT_NOT_REACHED(); > > I didn't catch this before, but you should probably make this a RELEASE_ASSERT_NOT_REACHED(). Nevermind. Saam reminded me (offline) that this comes after an infinite loop. Short of a compiler error, there's really no way to reach this point. The debug assert is good enough if only for documentation (in case someone re-writes the loop in the future to not be an infinite loop).