One is in a JSCellInlines.h, another is in Heap.cpp. These are all critical enough and small enough to belong in HeapInlines.h
Created attachment 228565 [details] Patch
Comment on attachment 228565 [details] Patch r=me
Comment on attachment 228565 [details] Patch Clearing flags on attachment: 228565 Committed r166759: <http://trac.webkit.org/changeset/166759>
All reviewed patches have been landed. Closing bug.