Since PropertyTable is the object that does the marking of these references, it should be the owner.
Created attachment 234353 [details] Patch
Comment on attachment 234353 [details] Patch More logical, simpler slightly faster code, but what other benefit is there to having the correct owner?
(In reply to comment #2) > (From update of attachment 234353 [details]) > More logical, simpler slightly faster code, but what other benefit is there to having the correct owner? It's a correctness issue for generational garbage collection. If the owner is the Structure instead of the PropertyTable, there's the possibility that the new value won't be visited during the next EdenCollection. Imagine the following situation: Structure: old gen PropertyTable: old gen specificValue: young gen In the current code, the Structure will be recorded in the remembered set as the object to visit during the next EdenCollection. When we visit it, the Structure will see that all of its children (including the PropertyTable) are already marked and return early. The specificValue in the PropertyTable will then not be marked, causing it to be prematurely collected.
(In reply to comment #3) > It's a correctness issue for generational garbage collection. Could you create a stress test that demonstrates the bug? Maybe not worth the effort.
Typically (always?), a Structure is allocated after a specific value, so it may be impossible to trigger the scenario where the Structure is old and a specific value is new (in a test or in real life).
Comment on attachment 234353 [details] Patch Clearing flags on attachment: 234353 Committed r171115: <http://trac.webkit.org/changeset/171115>
All reviewed patches have been landed. Closing bug.