Race condition in JSPropertyNameIterator and Structure destruction
Created attachment 49516 [details] Patch
Comment on attachment 49516 [details] Patch r=me
Comment on attachment 49516 [details] Patch > + void setCachedStructure(Structure* structure) How about PassRefPtr for this argument?
Committed r55256: <http://trac.webkit.org/changeset/55256>