There is an incorrect RELEASE_ASSERT in JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count): RELEASE_ASSERT(offset = startOffset + i); it should not assign to offset, but compare to offset.
Created attachment 303064 [details] Patch
Comment on attachment 303064 [details] Patch r=me
Comment on attachment 303064 [details] Patch Clearing flags on attachment: 303064 Committed r213275: <http://trac.webkit.org/changeset/213275>
All reviewed patches have been landed. Closing bug.
<rdar://problem/30978527>