Patch forthcoming.
Created attachment 233385 [details] the patch
This function is following: https://searchfox.org/wubkat/rev/dc6a01c9fd207e1b1394a1cb8261b410a1909cf6/Source/JavaScriptCore/bytecode/StructureSet.h#52 Structure* onlyStructure() const { return onlyEntry(); } While onlyEntry is: // Returns the only entry if the array has exactly one entry. T onlyEntry() const { if (isThin()) return singleEntry(); OutOfLineList* list = this->list(); if (list->m_length != 1) return T(); return list->list()[0]; } __ Which is similar to proposed patch, so I think it is fixed. Marking this as 'RESOLVED CONFIGURATION CHANGED' and CCing - Alexey and Yusuke.