Due to the use of allocated rare data (FatEntry's) in SymbolTableEntry's, the hash trait needsDestruction should be set to true. The code is currently working due to the Key trait, HashTraits<RefPtr<StringImpl> > having needsDestruction set true. If the key or it's trait is set to false, then this would leak memory.
<rdar://problem/12350394>
Created attachment 170771 [details] Patch
Comment on attachment 170771 [details] Patch r=me
Comment on attachment 170771 [details] Patch Clearing flags on attachment: 170771 Committed r132566: <http://trac.webkit.org/changeset/132566>
All reviewed patches have been landed. Closing bug.
Comment on attachment 170771 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=170771&action=review > Source/JavaScriptCore/runtime/SymbolTable.h:340 > - static const bool needsDestruction = false; > + static const bool needsDestruction = true; A simpler correct fix is to simply remove this line entirely. It is true by default for structs, so no need to explicitly set it to true.