The DFG Speculative JIT attempts to guess the type of variables. Sometimes, it guesses that a variable is an array. The JIT should insert checking code that validates that variables that are speculate-array are actually arrays. However, the JIT does not insert these checks at PutLocal instructions, even though subsequent code assumes that specualte-array variables that are retrieved via GetLocal are already validated.
Created attachment 100254 [details] the patch
Is there a reason why this doesn't have a regression test?
Comment on attachment 100254 [details] the patch Clearing flags on attachment: 100254 Committed r90768: <http://trac.webkit.org/changeset/90768>
All reviewed patches have been landed. Closing bug.