NonStringCell and Object are practically the same thing for the purpose of speculation
https://bugs.webkit.org/show_bug.cgi?id=109492

Reviewed by Mark Hahnenberg.
        
Removed isNonStringCellSpeculation, and made all callers use isObjectSpeculation.
        
Changed isNonStringCellOrOtherSpeculation to be isObjectOrOtherSpeculation.
        
I believe this is correct because even weird object types like JSNotAnObject end up
being "objects" from the standpoint of our typesystem. Anyway, the assumption that
"is cell but not a string" equates to "object" is an assumption that is already made
in other places in the system so there's little value in being paranoid about it.

* bytecode/SpeculatedType.h:
(JSC::isObjectSpeculation):
(JSC::isObjectOrOtherSpeculation):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGNode.h:
(Node):
(JSC::DFG::Node::shouldSpeculateObjectOrOther):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142530 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[HTMLTemplateElement] <template> inside of <head> may not create <body> if EOF is hit
https://bugs.webkit.org/show_bug.cgi?id=109338

Reviewed by Adam Barth.

Source/WebCore:

This patch adds the logic to clear the stack of open elements back to the first <template> when EOF
is hit. This allows a <body> to be generated if the initial <template> was opened inside of <head>.

Tests added to html5lib.

* html/parser/HTMLTreeBuilder.cpp:
(WebCore):
(WebCore::HTMLTreeBuilder::popAllTemplates):
(WebCore::HTMLTreeBuilder::processEndTag):
(WebCore::HTMLTreeBuilder::processEndOfFile):
* html/parser/HTMLTreeBuilder.h:
(HTMLTreeBuilder):

LayoutTests:

* html5lib/resources/template.dat:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142531 268f45cc-cd09-0410-ab3c-d52691b4dbfc