Steps to reproduce: open http://webmop.de/app/context.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010afc5c34 JSC::JSCell::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 4 1 com.apple.JavaScriptCore 0x000000010af022cd JSC::jsAddSlowCase(JSC::ExecState*, JSC::JSValue, JSC::JSValue) + 941 2 com.apple.JavaScriptCore 0x000000010ae966e9 cti_op_add + 121 3 ??? 0x00004cbbf7f54454 0 + 84370202641492 4 com.apple.JavaScriptCore 0x000000010ae37128 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1112 5 com.apple.JavaScriptCore 0x000000010ae36cbd JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 45 <rdar://problem/10306791>
Created attachment 113084 [details] the patch
Landed in http://trac.webkit.org/changeset/98878