diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp index 1616151ac7d9..4679be6bea67 100644 --- a/Source/JavaScriptCore/heap/Heap.cpp +++ b/Source/JavaScriptCore/heap/Heap.cpp @@ -700,8 +700,10 @@ void Heap::finalizeUnconditionalFinalizers() [&] (auto& space) { this->finalizeMarkedUnconditionalFinalizers(space.set, collectionScope); }); - if (collectionScope == CollectionScope::Full) + if (collectionScope == CollectionScope::Full) { finalizeMarkedUnconditionalFinalizers(structureSpace, collectionScope); + finalizeMarkedUnconditionalFinalizers(brandedStructureSpace, collectionScope); + } finalizeMarkedUnconditionalFinalizers(structureRareDataSpace, collectionScope); finalizeMarkedUnconditionalFinalizers(unlinkedFunctionExecutableSpaceAndSet.set, collectionScope); if (m_weakSetSpace) diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp index 6ade91b895c0..2b8c4c61e340 100644 --- a/Source/JavaScriptCore/runtime/JSObject.cpp +++ b/Source/JavaScriptCore/runtime/JSObject.cpp @@ -4092,7 +4092,6 @@ void JSObject::putOwnDataPropertyBatching(VM& vm, const RefPtrisDictionary() || (structure->transitionCountEstimate() + size) > Structure::s_maxTransitionLength || !structure->canPerformFastPropertyEnumeration() || (structure->transitionWatchpointSet().isBeingWatched() && structure->transitionWatchpointSet().isStillValid()))) { Vector offsets; offsets.reserveInitialCapacity(size); - Structure* originalStructure = structure; for (unsigned index = 0; index < size; ++index) { PropertyName propertyName(properties[index].get()); @@ -4135,10 +4134,11 @@ void JSObject::putOwnDataPropertyBatching(VM& vm, const RefPtroutOfLineCapacity() != structure->outOfLineCapacity()) { - ASSERT(structure != originalStructure); - newButterfly = allocateMoreOutOfLineStorage(vm, originalStructure->outOfLineCapacity(), structure->outOfLineCapacity()); - nukeStructureAndSetButterfly(vm, originalStructure->structureID(), newButterfly); + auto* oldStructure = this->structure(); + if (oldStructure->outOfLineCapacity() != structure->outOfLineCapacity()) { + ASSERT(structure != oldStructure); + newButterfly = allocateMoreOutOfLineStorage(vm, oldStructure->outOfLineCapacity(), structure->outOfLineCapacity()); + nukeStructureAndSetButterfly(vm, StructureID::encode(oldStructure), newButterfly); } for (unsigned index = 0; index < offsets.size(); ++index)