[Webkit-unassigned] [Bug 119405] REGRESSION(FTL merge): Assertion fail on 32 bit with enabled DFG JIT

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=119405


Csaba Osztrogonac <ossy at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |barraclough at apple.com,
                   |                            |fpizlo at apple.com,
                   |                            |ggaren at apple.com,
                   |                            |mark.lam at apple.com,
                   |                            |mhahnenberg at apple.com,
                   |                            |msaboff at apple.com,
                   |                            |oliver at apple.com,
                   |                            |ossy at webkit.org




--- Comment #1 from Csaba Osztrogonac <ossy at webkit.org>  2013-08-01 11:58:59 PST ---
I forgot to mention that I got it after applying https://bugs.webkit.org/attachment.cgi?id=207937&action=review

And the following fast/js tests assert:
  fast/js/dfg-string-out-of-bounds-check-structure.html [ Crash ]
  fast/js/dfg-string-out-of-bounds-cse.html [ Crash ]
  fast/js/dfg-string-out-of-bounds-negative-check-structure.html [ Crash ]
  fast/js/dfg-string-out-of-bounds-negative-proto-value.html [ Crash ]
  fast/js/regress/string-get-by-val-out-of-bounds-insane.html [ Crash ]
  fast/js/regress/string-get-by-val-out-of-bounds.html [ Crash ]

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.