The DFG GetGlobalVar is smart enough to know which global object to read from when it is used from inlined code, if the inlinee comes from a different global object than the inline caller. But CSE is not smart enough to handle this, and may replace a GetGlobalVar from one global object with a GetGlobalVar from another global object, if the inline caller and inlinee (or two different inlinees) both did GetGlobalVar on the same identifier.
Created attachment 115445 [details] the patch Going to investigate making a test for this in LayoutTests.
Created attachment 115457 [details] the patch Added a test case, and checked that it indeed does break on ToT but not with my changes.
Comment on attachment 115457 [details] the patch r=me Please copy this to Radar.
<rdar://problem/10458466>
Landed in http://trac.webkit.org/changeset/100514