[Webkit-unassigned] [Bug 126219] js/dom/dfg-custom-getter-throw.html and js/dom/dfg-custom-getter-throw-inlined.html hit assertions after r161051

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=126219





--- Comment #1 from Ryosuke Niwa <rniwa at webkit.org>  2013-12-24 12:36:05 PST ---
Looks like this is a fairly recent regression in JSC.

I certainly did not encounter it at r158715, and reverting the WebCore code change in r161051 confirms that the assertion failure exists without the patch.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.