Merge changes I78ff6a85,Ic85c6405,Ibf903baa,I3a0459db,I35140385,I54790419,I6bfe5d24,Ia9f39b83,I5bcecd5a,I1de96683,I543c6810,I8a5b0878,I0ae670bf,Ide4d58dc,I28ebaf3d,I499d6631,Ie5090e0d,I6d3e5f1f

* changes:
  Merge WebKit at r78450: Update ThirdPartyProject.prop
  Merge WebKit at r78450: Add new Font::canExpandAroundIdeographsInComplexText()
  Merge WebKit at r78450: Add new ChromeClient::selectItemAlignmentFollowsMenuWritingDirection()
  Merge WebKit at r78450: FrameLoaderClient::didRunInsecureContent() signature changed
  Merge WebKit at r78450: HTMLAreaElement::getRect() renamed
  Merge WebKit at r78450: FrameLoader::url() removed
  Merge WebKit at r78450: HTMLParserQuirks removed
  Merge WebKit at r78450: TextRun::padding() renamed
  Merge WebKit at r78450: Use new FontMetrics
  Merge WebKit at r78450: GraphicsContext current path removed
  Merge WebKit at r78450: TransformationMatrix multiply methods renamed and meaning changed
  Merge WebKit at r78450: FontCustomPlatformData::fontPlatformData() signature changed
  Merge WebKit at r78450: IntRect::bottom()/right() renamed
  Merge WebKit at r78450: Fix remaining conflicts
  Merge WebKit at r78450: Fix conflicts due to new ENABLE_WEB_ARCHIVE guard
  Merge WebKit at r78450: Fix conflicts in media controls
  Merge WebKit at r78450: Fix Makefiles
  Merge WebKit at r78450: Initial merge by git.

1 files changed, 5 insertions, 3 deletions

diff --git a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index db2d1d7..0f6a646 100644
--- a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -34,8 +34,9 @@ namespace JSC {
     class BatchedTransitionOptimizer {
         WTF_MAKE_NONCOPYABLE(BatchedTransitionOptimizer);
     public:
-        BatchedTransitionOptimizer(JSObject* object)
-            : m_object(object)
+        BatchedTransitionOptimizer(JSGlobalData& globalData, JSObject* object)
+            : m_globalData(&globalData)
+            , m_object(object)
         {
             if (!m_object->structure()->isDictionary())
                 m_object->setStructure(Structure::toCacheableDictionaryTransition(m_object->structure()));
@@ -43,10 +44,11 @@ namespace JSC {
 
         ~BatchedTransitionOptimizer()
         {
-            m_object->flattenDictionaryObject();
+            m_object->flattenDictionaryObject(*m_globalData);
         }
 
     private:
+        JSGlobalData* m_globalData;
         JSObject* m_object;
     };