Right now, JSSegmentedVariableObjects' subclasses install finalizers that call destroy. They do this in random ways, which sometimes result in JSSegmentedVariableObject::~JSSegmentedVariableObject executing more than once (which works because of the way that ~SegmentedVector is written). Maybe this works now, but it's a disaster waiting to happen.
Fortunately we can now just give those things their own Subspace and teach it its own protocol of destruction.
Created attachment 299227 [details]
Attachment 299227 [details] did not pass style-queue:
Total errors found: 2 in 16 files
If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 299230 [details]
Landed in https://trac.webkit.org/changeset/210912