Unused Structure property tables waste 14MB on Membuster.
<http://webkit.org/b/110854>
<rdar://problem/13292104>

Reviewed by Filip Pizlo.

Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
14 MB progression on Membuster3.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.gypi:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:

    Added PropertyTable.cpp.

* runtime/PropertyTable.cpp: Added.
(JSC::PropertyTable::create):
(JSC::PropertyTable::clone):
(JSC::PropertyTable::PropertyTable):
(JSC::PropertyTable::destroy):
(JSC::PropertyTable::~PropertyTable):
(JSC::PropertyTable::visitChildren):

    Moved marking of property table values here from Structure::visitChildren().

* runtime/StructureInlines.h:
(JSC::Structure::putWillGrowOutOfLineStorage):
(JSC::Structure::checkOffsetConsistency):

    Moved these to StructureInlines.h to break header dependency cycle between Structure/PropertyTable.

* runtime/Structure.cpp:
(JSC::Structure::visitChildren):

    Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.

(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::copyPropertyTable):
(JSC::Structure::copyPropertyTableForPinning):
(JSC::Structure::putSpecificValue):
(JSC::Structure::createPropertyMap):
* runtime/Structure.h:
(Structure):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
* runtime/JSGlobalData.h:
(JSGlobalData):
* runtime/PropertyMapHashTable.h:
(PropertyTable):
(JSC::PropertyTable::createStructure):
(JSC::PropertyTable::copy):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144074 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: IDBObjectStore.index() doesn't report errors after deleteIndex()
https://bugs.webkit.org/show_bug.cgi?id=110792

Reviewed by Tony Chang.

Source/WebCore:

The object store's metadata wasn't updated if the index hadn't been accessed
by script and hence placed in the name->object map. Make sure the metadata
is always updated.

Test: storage/indexeddb/deleteIndex-bug110792.html

* Modules/indexeddb/IDBObjectStore.cpp:
(WebCore::IDBObjectStore::deleteIndex): Always update the object store's metadata.

LayoutTests:

Added regression test for bug.

* storage/indexeddb/deleteIndex-bug110792-expected.txt: Added.
* storage/indexeddb/deleteIndex-bug110792.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144075 268f45cc-cd09-0410-ab3c-d52691b4dbfc