Native functions are not correctly unlinking from optimised callsites when they're collected, which may result in a crash if a new object is subsequently allocated at the same address, and is then called at the optimised call location.
Created attachment 31533 [details] Fixeration
Comment on attachment 31533 [details] Fixeration Please to be adding ASSERTs to check code type enum is sizeof(int32_t), and add ASSERTSs to cti_op_call_JSFunction & the arity check to the function is not a host function. Also, in the ChangeLog you say 'Reviewed by NOBODY (OOPS!).', this should read 'Reviewed by Gavin "Viceroy of Venezuela" Barraclough.'. r+. G.
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/JavaScriptCore.exp M JavaScriptCore/bytecode/CodeBlock.cpp M JavaScriptCore/bytecode/CodeBlock.h M JavaScriptCore/jit/JIT.cpp M JavaScriptCore/jit/JITStubs.cpp M JavaScriptCore/parser/Nodes.cpp M JavaScriptCore/parser/Nodes.h M JavaScriptCore/runtime/JSFunction.cpp M JavaScriptCore/runtime/JSGlobalData.cpp M JavaScriptCore/runtime/JSGlobalData.h Committed r44844
Corresponding Windows build fix http://trac.webkit.org/changeset/44845.