...
Created attachment 301831 [details] work in progress: has lots of debugging code that needs to be cleaned up.
Comment on attachment 301831 [details] work in progress: has lots of debugging code that needs to be cleaned up. View in context: https://bugs.webkit.org/attachment.cgi?id=301831&action=review > Source/JavaScriptCore/heap/MarkedBlockInlines.h:222 > + if (vm.heap.verifier()) > + vm.heap.verifier()->addSweptCell(cell); > + } This doesn't catch all cases of swept cells.
Created attachment 301943 [details] work in progress 2
Created attachment 304082 [details] proposed patch. Let's try this on the EWS first.
Comment on attachment 304082 [details] proposed patch. LGTM. Seems like you might have builds to fix.
Created attachment 304298 [details] patch for landing. Thanks for the review.
Created attachment 304300 [details] patch for landing: rebased to ToT again.
Created attachment 304322 [details] Patch for landing: with fix for the Windows build. The Windows EWS actually found a bug (now fixed).
Landed in r213883: <http://trac.webkit.org/r213883>.
<rdar://problem/30358206>