diff -r b72c6db6890b -r 5dc02b23752f src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h	Wed Jun 23 19:07:03 2010 +0300
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h	Tue Jul 06 15:10:48 2010 +0300
@@ -104,7 +104,11 @@
         void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
-            
+
+#if ENABLE(JSC_ZOMBIES)
+            ASSERT(!v.isZombie());
+#endif
+
             if (m_isUsingInlineBuffer && m_size < inlineCapacity) {
                 m_vector.uncheckedAppend(v);
                 ++m_size;
@@ -187,6 +191,10 @@
             : m_args(args)
             , m_argCount(argCount)
         {
+#if ENABLE(JSC_ZOMBIES)
+            for (size_t i = 0; i < argCount; i++)
+                ASSERT(!m_args[i].isZombie());
+#endif
         }
         
         ArgList(Register* args, int argCount)