[Webkit-unassigned] [Bug 96184] [GTK][Stable] Crash in JSC::DFG::SpeculativeJIT::speculateArray(JSC::DFG::Array::Mode, JSC::DFG::Edge, JSC::X86Registers::RegisterID)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=96184





--- Comment #6 from Filip Pizlo <fpizlo at apple.com>  2012-09-11 11:51:06 PST ---
Does this repro on ToT?  The SpeculativeJIT::speculateArray() method doesn't even exist in ToT.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.