[Webkit-unassigned] [Bug 46443] REGRESSION: Crash in cti_op_strcat

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=46443





--- Comment #4 from Alexey Proskuryakov <ap at webkit.org>  2010-09-24 10:11:39 PST ---
It's a garbage value used as JSCell:

this == 0x1
#0    0x101b2cd5e in JSC::JSCell::isString at JSCell.h:156
#1    0x101b2d905 in JSC::JSValue::isString at JSCell.h:182
#2    0x101bda890 in JSC::jsString at Operations.h:156
#3    0x101bcb602 in cti_op_strcat at JITStubs.cpp:3327

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.