[Webkit-unassigned] [Bug 119872] REGRESSION: Crash under JITCompiler::link while loading Gmail

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=119872





--- Comment #4 from Ryosuke Niwa <rniwa at webkit.org>  2013-08-20 12:56:24 PST ---
Still crashing:

ASSERTION FAILED: isInt32()
/Volumes/Data/webkit/Source/JavaScriptCore/runtime/JSCJSValueInlines.h(409) : int32_t JSC::JSValue::asInt32() const
1   0x1031de450 WTFCrash
2   0x102ca4cd5 JSC::JSValue::asInt32() const
3   0x102e54b5a JSC::DFG::LazyJSValue::switchLookupValue() const
4   0x102e51647 JSC::DFG::JITCompiler::link(JSC::LinkBuffer&)
5   0x102e539a4 JSC::DFG::JITCompiler::linkFunction()
6   0x102e88aa9 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
7   0x102e88497 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&)
8   0x102f2476c JSC::DFG::Worklist::runThread()
9   0x102f238e5 JSC::DFG::Worklist::threadFunction(void*)
10  0x103223490 WTF::threadEntryPoint(void*)
11  0x103223e18 WTF::wtfThreadEntryPoint(void*)
12  0x7fff91c097a2 _pthread_start
13  0x7fff91bf61e1 thread_start

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.