Reliably crashes under GuardMalloc:
run-webkit-tests -g fast/canvas/canvas-putImageData.html
Thread 0 Crashed:
This is likely caused by r36821, since that is where the only RefPtr<RegisterID> instance variable for CodeGenerator was defined:
Ah, looks like the RefPtr destructor runs after the SegmentedVector destructor. Should be easy to fix.
Created attachment 23750 [details]
I haven't been able to verify this patch with the original test case, because DRT with GuardMalloc crashes in LaunchServices on my machine. However, I did verify that this patch fixes the destructor order.
Comment on attachment 23750 [details]
Committed revision 36853.