The bug is caused by an access to a prototype chain being cached, that doesn't check for immediates before dereferencing the passed JSValue*. Write a test case to force a chained access to be cached, then pass it an immediate. Should probably also test the non-chained prototype accesses, at the same time.
Created attachment 25421 [details] A test
Sending LayoutTests/ChangeLog Adding LayoutTests/fast/js/pic/cached-prototype-then-immediate-expected.txt Adding LayoutTests/fast/js/pic/cached-prototype-then-immediate.html Transmitting file data ... Committed revision 38703.
Comment on attachment 25421 [details] A test Silly bugzilla. Clearing review flag since this landed.