Native functions are not correctly unlinking from optimised callsites when they're collected, which may result in a crash if a new object is subsequently allocated at the same address, and is then called at the optimised call location.
Created attachment 31533 [details]
Comment on attachment 31533 [details]
Please to be adding ASSERTs to check code type enum is sizeof(int32_t), and add ASSERTSs to cti_op_call_JSFunction & the arity check to the function is not a host function.
Also, in the ChangeLog you say 'Reviewed by NOBODY (OOPS!).', this should read 'Reviewed by Gavin "Viceroy of Venezuela" Barraclough.'.
Committing to http://svn.webkit.org/repository/webkit/trunk ...
Corresponding Windows build fix http://trac.webkit.org/changeset/44845.