The JSC GC has support for installing zombie cells in free memory as a way of tracking when a reference in the heap is missed. But this functionality no longer works, and is not tested during any regressions (either in bots or in command-line tools). It's not clear that it's needed, since WebCore and JSC appear to track references accurately enough to be correct. Furthermore, it's not clear that the GC should continue to support a relatively complex piece of untested functionality, which makes implementing new features difficult, and whose existence is predicated upon the GC being broken. In short, zombie support should be removed unless a good argument can be made for its necessity.
Created attachment 102416 [details] the patch
Comment on attachment 102416 [details] the patch Attachment 102416 [details] did not pass qt-ews (qt): Output: http://queues.webkit.org/results/9267624
Comment on attachment 102416 [details] the patch Attachment 102416 [details] did not pass efl-ews (efl): Output: http://queues.webkit.org/results/9267623
Created attachment 102419 [details] the patch (fix various platforms)
Comment on attachment 102419 [details] the patch (fix various platforms) Clearing flags on attachment: 102419 Committed r92046: <http://trac.webkit.org/changeset/92046>
All reviewed patches have been landed. Closing bug.
Sad thing... was a nice feature.