In BumpPointerPool::create(), poolSize is set to MINIMUM_BUMP_POOL_SIZE and then passed to PageAllocation::allocate(). If this value is not divisible by WTF::pageSize() (or, if the page size is larger than poolSize) allocate() crashes because of ASSERT(isPageAligned(size)).
Created attachment 131664 [details]
What can I do to get this submitted? According to http://www.webkit.org/quality/lifecycle.html it should be automatically submitted, but this hasn't happened.
Comment on attachment 131664 [details]
Clearing flags on attachment: 131664
Committed r114477: <http://trac.webkit.org/changeset/114477>
All reviewed patches have been landed. Closing bug.