Merge r173787 - Leak of mallocs under StructureSet::OutOfLineList::cr…

…eate

https://bugs.webkit.org/show_bug.cgi?id=136970

Reviewed by Filip Pizlo.

addOutOfLine should free the old list when expanding the capacity.

* bytecode/StructureSet.cpp:
(JSC::StructureSet::addOutOfLine):

Canonical link: https://commits.webkit.org/154760.14@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173828 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,15 @@
+2014-09-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Leak of mallocs under StructureSet::OutOfLineList::create
+        https://bugs.webkit.org/show_bug.cgi?id=136970
+
+        Reviewed by Filip Pizlo.
+
+        addOutOfLine should free the old list when expanding the capacity.
+
+        * bytecode/StructureSet.cpp:
+        (JSC::StructureSet::addOutOfLine):
+
 2014-09-18  Joseph Pecoraro  <pecoraro@apple.com>
 
         Unreviewed rollout r173731. Broke multiple builds.

Source/JavaScriptCore/bytecode/StructureSet.cpp

@@ -357,6 +357,7 @@ bool StructureSet::addOutOfLine(Structure* structure)
     for (unsigned i = list->m_length; i--;)
         newList->list()[i] = list->list()[i];
     newList->list()[list->m_length] = structure;
+    OutOfLineList::destroy(list);
     set(newList);
     return true;
 }