Merge WebKit at r84325: Initial merge by git.

Change-Id: Ic1a909300ecc0a13ddc6b4e784371d2ac6e3d59b

6 files changed, 103 insertions, 169 deletions

diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 98bbb3c..0e648ba 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -1390,31 +1390,9 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
 
 CodeBlock::~CodeBlock()
 {
-#if ENABLE(INTERPRETER)
-    for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i)
-        derefStructures(&m_instructions[m_globalResolveInstructions[i]]);
-
-    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
-        derefStructures(&m_instructions[m_propertyAccessInstructions[i]]);
-#endif
 #if ENABLE(JIT)
-    for (size_t size = m_globalResolveInfos.size(), i = 0; i < size; ++i) {
-        if (m_globalResolveInfos[i].structure)
-            m_globalResolveInfos[i].structure->deref();
-    }
-
     for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
         m_structureStubInfos[i].deref();
-
-    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
-        if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure) {
-            structure->deref();
-            // Both members must be filled at the same time
-            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
-            m_methodCallLinkInfos[i].cachedPrototypeStructure->deref();
-        }
-    }
-
 #endif // ENABLE(JIT)
 
 #if DUMP_CODE_BLOCK_STATISTICS
@@ -1422,35 +1400,37 @@ CodeBlock::~CodeBlock()
 #endif
 }
 
-void CodeBlock::derefStructures(Instruction* vPC) const
+void CodeBlock::markStructures(MarkStack& markStack, Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto)) {
-        vPC[4].u.structure->deref();
-        vPC[5].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
-        vPC[4].u.structure->deref();
-        vPC[5].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structure);
+        markStack.append(&vPC[6].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_resolve_global) || vPC[0].u.opcode == interpreter->getOpcode(op_resolve_global_dynamic)) {
         if (vPC[3].u.structure)
-            vPC[3].u.structure->deref();
+            markStack.append(&vPC[3].u.structure);
         return;
     }
     if ((vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto_list))
@@ -1460,7 +1440,7 @@ void CodeBlock::derefStructures(Instruction* vPC) const
         || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto_list))
         || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self_list))) {
         PolymorphicAccessStructureList* polymorphicStructures = vPC[4].u.polymorphicStructures;
-        polymorphicStructures->derefStructures(vPC[5].u.operand);
+        polymorphicStructures->markAggregate(markStack, vPC[5].u.operand);
         delete polymorphicStructures;
         return;
     }
@@ -1469,37 +1449,6 @@ void CodeBlock::derefStructures(Instruction* vPC) const
     ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_get_array_length) || vPC[0].u.opcode == interpreter->getOpcode(op_get_string_length));
 }
 
-void CodeBlock::refStructures(Instruction* vPC) const
-{
-    Interpreter* interpreter = m_globalData->interpreter;
-
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto)) {
-        vPC[4].u.structure->ref();
-        vPC[5].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
-        vPC[4].u.structure->ref();
-        vPC[5].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    
-    // These instructions don't ref their Structures.
-    ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic));
-}
-
 void EvalCodeCache::markAggregate(MarkStack& markStack)
 {
     EvalCacheMap::iterator end = m_cacheMap.end();
@@ -1524,18 +1473,26 @@ void CodeBlock::markAggregate(MarkStack& markStack)
             markStack.append(&callLinkInfo(i).callee);
 #endif
 #if ENABLE(INTERPRETER)
-    Interpreter* interpreter = m_globalData->interpreter;
-    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i) {
-        Instruction* vPC = &m_instructions[m_propertyAccessInstructions[i]];
-        if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain))
-            markStack.append(&vPC[5].u.structureChain);
-        else if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition))
-            markStack.append(&vPC[6].u.structureChain);
-    }
+    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
+        markStructures(markStack, &m_instructions[m_propertyAccessInstructions[i]]);
 #endif
 #if ENABLE(JIT)
+    for (size_t size = m_globalResolveInfos.size(), i = 0; i < size; ++i) {
+        if (m_globalResolveInfos[i].structure)
+            markStack.append(&m_globalResolveInfos[i].structure);
+    }
+
     for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
         m_structureStubInfos[i].markAggregate(markStack);
+
+    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
+        if (m_methodCallLinkInfos[i].cachedStructure) {
+            // Both members must be filled at the same time
+            markStack.append(&m_methodCallLinkInfos[i].cachedStructure);
+            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
+            markStack.append(&m_methodCallLinkInfos[i].cachedPrototypeStructure);
+        }
+    }
 #endif
 }
 
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 25e65f4..af68eb5 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -122,8 +122,6 @@ namespace JSC {
 
     struct MethodCallLinkInfo {
         MethodCallLinkInfo()
-            : cachedStructure(0)
-            , cachedPrototypeStructure(0)
         {
         }
 
@@ -142,24 +140,23 @@ namespace JSC {
             //     - Once this transition has been taken once, cachedStructure is
             //       null and cachedPrototypeStructure is set to a nun-null value.
             //     - Once the call is linked both structures are set to non-null values.
-            cachedPrototypeStructure = (Structure*)1;
+            cachedPrototypeStructure.setWithoutWriteBarrier((Structure*)1);
         }
 
         CodeLocationCall callReturnLocation;
         CodeLocationDataLabelPtr structureLabel;
-        Structure* cachedStructure;
-        Structure* cachedPrototypeStructure;
+        WriteBarrier<Structure> cachedStructure;
+        WriteBarrier<Structure> cachedPrototypeStructure;
     };
 
     struct GlobalResolveInfo {
         GlobalResolveInfo(unsigned bytecodeOffset)
-            : structure(0)
-            , offset(0)
+            : offset(0)
             , bytecodeOffset(bytecodeOffset)
         {
         }
 
-        Structure* structure;
+        WriteBarrier<Structure> structure;
         unsigned offset;
         unsigned bytecodeOffset;
     };
@@ -215,8 +212,6 @@ namespace JSC {
         virtual ~CodeBlock();
 
         void markAggregate(MarkStack&);
-        void refStructures(Instruction* vPC) const;
-        void derefStructures(Instruction* vPC) const;
 
         static void dumpStatistics();
 
@@ -486,6 +481,7 @@ namespace JSC {
         void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
         void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
 #endif
+        void markStructures(MarkStack&, Instruction* vPC) const;
 
         void createRareDataIfNecessary()
         {
diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h
index da0821d..d9cbb11 100644
--- a/Source/JavaScriptCore/bytecode/Instruction.h
+++ b/Source/JavaScriptCore/bytecode/Instruction.h
@@ -33,6 +33,7 @@
 #include "Opcode.h"
 #include "PropertySlot.h"
 #include "Structure.h"
+#include "StructureChain.h"
 #include <wtf/VectorTraits.h>
 
 #define POLYMORPHIC_LIST_CACHE_SIZE 8
@@ -60,45 +61,45 @@ namespace JSC {
         struct PolymorphicStubInfo {
             bool isChain;
             PolymorphicAccessStructureListStubRoutineType stubRoutine;
-            Structure* base;
+            WriteBarrier<Structure> base;
             union {
-                Structure* proto;
+                WriteBarrierBase<Structure> proto;
                 WriteBarrierBase<StructureChain> chain;
             } u;
 
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
-                u.proto = 0;
+                base.set(globalData, owner, _base);
+                u.proto.clear();
                 isChain = false;
             }
             
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
-                u.proto = _proto;
+                base.set(globalData, owner, _base);
+                u.proto.set(globalData, owner, _proto);
                 isChain = false;
             }
             
             void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
+                base.set(globalData, owner, _base);
                 u.chain.set(globalData, owner, _chain);
                 isChain = true;
             }
         } list[POLYMORPHIC_LIST_CACHE_SIZE];
         
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
         {
-            list[0].set(stubRoutine, firstBase);
+            list[0].set(globalData, owner, stubRoutine, firstBase);
         }
 
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
         {
-            list[0].set(stubRoutine, firstBase, firstProto);
+            list[0].set(globalData, owner, stubRoutine, firstBase, firstProto);
         }
 
         PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
@@ -106,28 +107,16 @@ namespace JSC {
             list[0].set(globalData, owner, stubRoutine, firstBase, firstChain);
         }
 
-        void derefStructures(int count)
-        {
-            for (int i = 0; i < count; ++i) {
-                PolymorphicStubInfo& info = list[i];
-
-                ASSERT(info.base);
-                info.base->deref();
-
-                if (info.u.proto) {
-                    if (!info.isChain)
-                        info.u.proto->deref();
-                }
-            }
-        }
-
         void markAggregate(MarkStack& markStack, int count)
         {
             for (int i = 0; i < count; ++i) {
                 PolymorphicStubInfo& info = list[i];
                 ASSERT(info.base);
                 
-                if (info.u.proto && info.isChain)
+                markStack.append(&info.base);
+                if (info.u.proto && !info.isChain)
+                    markStack.append(&info.u.proto);
+                if (info.u.chain && info.isChain)
                     markStack.append(&info.u.chain);
             }
         }
@@ -152,7 +141,11 @@ namespace JSC {
             u.operand = operand;
         }
 
-        Instruction(Structure* structure) { u.structure = structure; }
+        Instruction(JSGlobalData& globalData, JSCell* owner, Structure* structure)
+        {
+            u.structure.clear();
+            u.structure.set(globalData, owner, structure);
+        }
         Instruction(JSGlobalData& globalData, JSCell* owner, StructureChain* structureChain)
         {
             u.structureChain.clear();
@@ -169,12 +162,16 @@ namespace JSC {
         union {
             Opcode opcode;
             int operand;
-            Structure* structure;
+            WriteBarrierBase<Structure> structure;
             WriteBarrierBase<StructureChain> structureChain;
             WriteBarrierBase<JSCell> jsCell;
             PolymorphicAccessStructureList* polymorphicStructures;
             PropertySlot::GetValueFunc getterFunc;
         } u;
+        
+    private:
+        Instruction(StructureChain*);
+        Instruction(Structure*);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h
index a0696b1..74b4852 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.h
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.h
@@ -29,13 +29,13 @@
 #ifndef SamplingTool_h
 #define SamplingTool_h
 
+#include "Strong.h"
+#include "Nodes.h"
+#include "Opcode.h"
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
 #include <wtf/Threading.h>
 
-#include "Nodes.h"
-#include "Opcode.h"
-
 namespace JSC {
 
     class ScriptExecutable;
@@ -113,7 +113,7 @@ namespace JSC {
         
         void sample(CodeBlock*, Instruction*);
 
-        Global<ScriptExecutable> m_executable;
+        Strong<ScriptExecutable> m_executable;
         CodeBlock* m_codeBlock;
         int m_sampleCount;
         int m_opcodeSampleCount;
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
index 4d59ac1..be5760a 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
@@ -35,42 +35,28 @@ namespace JSC {
 void StructureStubInfo::deref()
 {
     switch (accessType) {
-    case access_get_by_id_self:
-        u.getByIdSelf.baseObjectStructure->deref();
-        return;
-    case access_get_by_id_proto:
-        u.getByIdProto.baseObjectStructure->deref();
-        u.getByIdProto.prototypeStructure->deref();
-        return;
-    case access_get_by_id_chain:
-        u.getByIdChain.baseObjectStructure->deref();
-        return;
     case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
-        polymorphicStructures->derefStructures(u.getByIdSelfList.listSize);
         delete polymorphicStructures;
         return;
     }
     case access_get_by_id_proto_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdProtoList.structureList;
-        polymorphicStructures->derefStructures(u.getByIdProtoList.listSize);
         delete polymorphicStructures;
         return;
     }
+    case access_get_by_id_self:
+    case access_get_by_id_proto:
+    case access_get_by_id_chain:
     case access_put_by_id_transition:
-        u.putByIdTransition.previousStructure->deref();
-        u.putByIdTransition.structure->deref();
-        return;
     case access_put_by_id_replace:
-        u.putByIdReplace.baseObjectStructure->deref();
-        return;
     case access_get_by_id:
     case access_put_by_id:
     case access_get_by_id_generic:
     case access_put_by_id_generic:
     case access_get_array_length:
     case access_get_string_length:
-        // These instructions don't ref their Structures.
+        // These instructions don't have to release any allocated memory
         return;
     default:
         ASSERT_NOT_REACHED();
@@ -81,10 +67,15 @@ void StructureStubInfo::markAggregate(MarkStack& markStack)
 {
     switch (accessType) {
     case access_get_by_id_self:
+        markStack.append(&u.getByIdSelf.baseObjectStructure);
         return;
     case access_get_by_id_proto:
+        markStack.append(&u.getByIdProto.baseObjectStructure);
+        markStack.append(&u.getByIdProto.prototypeStructure);
         return;
     case access_get_by_id_chain:
+        markStack.append(&u.getByIdChain.baseObjectStructure);
+        markStack.append(&u.getByIdChain.chain);
         return;
     case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
@@ -97,8 +88,12 @@ void StructureStubInfo::markAggregate(MarkStack& markStack)
         return;
     }
     case access_put_by_id_transition:
+        markStack.append(&u.putByIdTransition.previousStructure);
+        markStack.append(&u.putByIdTransition.structure);
+        markStack.append(&u.putByIdTransition.chain);
         return;
     case access_put_by_id_replace:
+        markStack.append(&u.putByIdReplace.baseObjectStructure);
         return;
     case access_get_by_id:
     case access_put_by_id:
@@ -106,7 +101,7 @@ void StructureStubInfo::markAggregate(MarkStack& markStack)
     case access_put_by_id_generic:
     case access_get_array_length:
     case access_get_string_length:
-        // These instructions don't ref their Structures.
+        // These instructions don't need to mark anything
         return;
     default:
         ASSERT_NOT_REACHED();
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.h b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
index 28202f9..bfeeb1e 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -58,33 +58,27 @@ namespace JSC {
         {
         }
 
-        void initGetByIdSelf(Structure* baseObjectStructure)
+        void initGetByIdSelf(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure)
         {
             accessType = access_get_by_id_self;
 
-            u.getByIdSelf.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
+            u.getByIdSelf.baseObjectStructure.set(globalData, owner, baseObjectStructure);
         }
 
-        void initGetByIdProto(Structure* baseObjectStructure, Structure* prototypeStructure)
+        void initGetByIdProto(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure, Structure* prototypeStructure)
         {
             accessType = access_get_by_id_proto;
 
-            u.getByIdProto.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
-
-            u.getByIdProto.prototypeStructure = prototypeStructure;
-            prototypeStructure->ref();
+            u.getByIdProto.baseObjectStructure.set(globalData, owner, baseObjectStructure);
+            u.getByIdProto.prototypeStructure.set(globalData, owner, prototypeStructure);
         }
 
-        void initGetByIdChain(Structure* baseObjectStructure, StructureChain* chain)
+        void initGetByIdChain(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure, StructureChain* chain)
         {
             accessType = access_get_by_id_chain;
 
-            u.getByIdChain.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
-
-            u.getByIdChain.chain = chain;
+            u.getByIdChain.baseObjectStructure.set(globalData, owner, baseObjectStructure);
+            u.getByIdChain.chain.set(globalData, owner, chain);
         }
 
         void initGetByIdSelfList(PolymorphicAccessStructureList* structureList, int listSize)
@@ -105,25 +99,20 @@ namespace JSC {
 
         // PutById*
 
-        void initPutByIdTransition(Structure* previousStructure, Structure* structure, StructureChain* chain)
+        void initPutByIdTransition(JSGlobalData& globalData, JSCell* owner, Structure* previousStructure, Structure* structure, StructureChain* chain)
         {
             accessType = access_put_by_id_transition;
 
-            u.putByIdTransition.previousStructure = previousStructure;
-            previousStructure->ref();
-
-            u.putByIdTransition.structure = structure;
-            structure->ref();
-
-            u.putByIdTransition.chain = chain;
+            u.putByIdTransition.previousStructure.set(globalData, owner, previousStructure);
+            u.putByIdTransition.structure.set(globalData, owner, structure);
+            u.putByIdTransition.chain.set(globalData, owner, chain);
         }
 
-        void initPutByIdReplace(Structure* baseObjectStructure)
+        void initPutByIdReplace(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure)
         {
             accessType = access_put_by_id_replace;
     
-            u.putByIdReplace.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
+            u.putByIdReplace.baseObjectStructure.set(globalData, owner, baseObjectStructure);
         }
 
         void deref();
@@ -144,15 +133,15 @@ namespace JSC {
 
         union {
             struct {
-                Structure* baseObjectStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
             } getByIdSelf;
             struct {
-                Structure* baseObjectStructure;
-                Structure* prototypeStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
+                WriteBarrierBase<Structure> prototypeStructure;
             } getByIdProto;
             struct {
-                Structure* baseObjectStructure;
-                StructureChain* chain;
+                WriteBarrierBase<Structure> baseObjectStructure;
+                WriteBarrierBase<StructureChain> chain;
             } getByIdChain;
             struct {
                 PolymorphicAccessStructureList* structureList;
@@ -163,12 +152,12 @@ namespace JSC {
                 int listSize;
             } getByIdProtoList;
             struct {
-                Structure* previousStructure;
-                Structure* structure;
-                StructureChain* chain;
+                WriteBarrierBase<Structure> previousStructure;
+                WriteBarrierBase<Structure> structure;
+                WriteBarrierBase<StructureChain> chain;
             } putByIdTransition;
             struct {
-                Structure* baseObjectStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
             } putByIdReplace;
         } u;