For JSVALUE32_64, maxOffsetRelativeToPatchedStorage() doesn't compute the maximum negative offset
https://bugs.webkit.org/show_bug.cgi?id=110828

Reviewed by Oliver Hunt.

* runtime/JSObject.h:
(JSC::maxOffsetRelativeToPatchedStorage): Only add the OBJECT_OFFSETOF(tag) for positive offsets.
That way this function will return the offset farthest from 0 needed to access either the payload
or tag.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143994 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Forgot to delete a no-longer-needed unit test after r143980.

Unreviewed, build fix.

* Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py:
(ChromiumWinTest.test_path_to_image_diff):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143995 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add cookies to FastMalloc spans
https://bugs.webkit.org/show_bug.cgi?id=110827

Reviewed by Michael Saboff.

Add a cookie to spans, and move some of the hardening around so
that it's more useful.

* wtf/FastMalloc.cpp:
(WTF::internalEntropyValue):
(WTF::spanInitializerCookie):
(WTF::Span::initCookie):
(WTF::Span::clearCookie):
(WTF::Span::isValid):
(Span):
(WTF::NewSpan):
(WTF::DeleteSpan):
(WTF::TCMalloc_ThreadCache_FreeList::Validate):
(WTF::TCMalloc_Central_FreeList::Populate):
(WTF::TCMalloc_ThreadCache::Deallocate):
(WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143996 268f45cc-cd09-0410-ab3c-d52691b4dbfc