Otherwise the GC could blow away the table as we are pinning it.
Created attachment 299285 [details] the patch
This fixes crashes with this signature: Termination Signal: Trace/BPT trap: 5 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010d3b3df5 0x10c970000 + 10763765 1 com.apple.JavaScriptCore 0x000000010d3b49cb bool JSC::Structure::checkOffsetConsistency<JSC::Structure::materializePropertyTable(JSC::VM&, bool)::$_0>(JSC::PropertyTable*, JSC::Structure::materializePropertyTable(JSC::VM&, bool)::$_0 const&) const::'lambda'(char const*)::operator()(char const*) const + 1179 2 com.apple.JavaScriptCore 0x000000010d3afa2c JSC::Structure::materializePropertyTable(JSC::VM&, bool) + 1228 (StructureInlines.h:276) 3 com.apple.JavaScriptCore 0x000000010c97861a int JSC::Structure::add<JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int)>(JSC::VM&, JSC::PropertyName, unsigned int, JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int) const&) + 58 (Structure.h:688) 4 com.apple.JavaScriptCore 0x000000010cb33d07 JSC::JSObject::putDirectWithoutTransition(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int) + 231 (PropertyOffset.h:108) 5 com.apple.JavaScriptCore 0x000000010d1133bf JSC::JSGlobalObject::init(JSC::VM&) + 15599 (WriteBarrier.h:108) 6 com.apple.JavaScriptCore 0x000000010d11a285 JSC::JSGlobalObject::finishCreation(JSC::VM&, JSC::JSObject*) + 149 (WriteBarrierInlines.h:53)
<rdar://problem/30108809>
Landed in http://trac.webkit.org/changeset/210947