Currently we depend upon the fact that Butterfly::growArrayRight works with null Butterfly objects purely by coincidence. We should add a new static function that null checks the old Butterfly object and creates a new one if it's null, or calls growArrayRight if it isn't for use in the couple of places in JSObject that expect such behavior to work.
Created attachment 179821 [details] Patch
Comment on attachment 179821 [details] Patch Attachment 179821 [details] did not pass qt-ews (qt): Output: http://queues.webkit.org/results/15360953
Comment on attachment 179821 [details] Patch Attachment 179821 [details] did not pass qt-wk2-ews (qt): Output: http://queues.webkit.org/results/15375881
Created attachment 179834 [details] Patch
Committed r137961: <http://trac.webkit.org/changeset/137961>