The DFG JIT's support for host constructor calls has a broken ASSERT statement that results in crashes in debug mode.
Created attachment 100867 [details]
Comment on attachment 100867 [details]
Clearing flags on attachment: 100867
Committed r91034: <http://trac.webkit.org/changeset/91034>
All reviewed patches have been landed. Closing bug.
Committed r91035: <http://trac.webkit.org/changeset/91035>