Biolab disaster crashes on ToT
Created attachment 138886 [details] Patch
Comment on attachment 138886 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=138886&action=review r=me with the simplification > Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp:115 > + InlineCallFrame& inlineCallFrame = codeBlock()->inlineCallFrames()[i]; > + CodeBlock* codeBlock = jsCast<FunctionExecutable*>(inlineCallFrame.executable.get())->baselineCodeBlockFor(inlineCallFrame.isCall ? CodeForCall : CodeForConstruct); baselineCodeBlockForInlineCallFrame(&codeBlock()->inlineCallFrames()[i])
Committed r115252: <http://trac.webkit.org/changeset/115252>
Committed r115253: <http://trac.webkit.org/changeset/115253>