https://bugs.webkit.org/show_bug.cgi?id=46794 introduced handling of HashTableDeletedValue into the smart point directly. This was incorrect. Instead, in places where class members track whether or not their parent has been deleted from a hash table, use manual memory management for those members.
Created attachment 72707 [details] Patch for this issue
Comment on attachment 72707 [details] Patch for this issue Makes sense.
Committed r71148: <http://trac.webkit.org/changeset/71148>