If we're adding a new structure to StructureStubInfo's bufferedStructures, we should write barrier the StubInfo's owner CodeBlock because that structure may be collected during the next GC. Write barrier-ing the owner CodeBlock ensures that CodeBlock::finalizeBaselineJITInlineCaches() is called on it during the GC, which, in turn, gives the StructureStubInfo the opportunity to filter out the dead structure.
<rdar://problem/28656664>
Created attachment 301182 [details] proposed patch.
Comment on attachment 301182 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=301182&action=review Nice. > Source/JavaScriptCore/bytecode/StructureStubInfo.h:2 > - * Copyright (C) 2008, 2012-2016 Apple Inc. All rights reserved. > + * Copyright (C) 2008, 2012-2017 Apple Inc. All rights reserved. I think that we're supposed to write this as "2008-2017".
Created attachment 301188 [details] patch for landing + build fix.
Thanks for the review. Landed in r212146: <http://trac.webkit.org/r212146>.