To reproduce: 1. run-webkit-tests Two fast/js tests crash: fast/js/excessive-comma-usage.html and fast/js/math-transforms.html. See <http://build.webkit.org/results/Windows%20Release%20(Tests)/r51675%20(6688)/results.html> for an example of the crashes. This started happening between r51670 and r51675. The new "rope" JS string representation landed in this range, and seems likely to be the culprit.
<rdar://problem/7444149>
*** Bug 32228 has been marked as a duplicate of this bug. ***
Sending JavaScriptCore/ChangeLog Sending JavaScriptCore/runtime/JSString.cpp Sending JavaScriptCore/runtime/JSString.h Sending JavaScriptCore/runtime/Operations.h Sending LayoutTests/ChangeLog Sending LayoutTests/platform/win/Skipped Transmitting file data ...... Committed revision 51933.
<http://trac.webkit.org/changeset/51933>