CanvasRenderingContext2D::setFont argument may reference destroyed object
https://bugs.webkit.org/show_bug.cgi?id=106385

Reviewed by Abhishek Arya.

No new tests: covered by fast/canvas/canvas-measureText.html

This is a re-write of r138994.  Fixing bug in setFont instead of
workaround at call site.

* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::setFont):
(WebCore::CanvasRenderingContext2D::accessFont):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Support op_typeof in the DFG
https://bugs.webkit.org/show_bug.cgi?id=98898

Reviewed by Filip Pizlo.

Adds a TypeOf node to the DFG to support op_typeof.

To avoid adding too much GC horror, this also makes the
common strings portion of the SmallString cache strongly
referenced.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
  We try to determine the result early here, and substitute in a constant.
  Otherwise we leave the node intact, and set the result type to SpecString.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
  Parse op_typeof
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
  TypeOf nodes can be subjected to pure CSE
* dfg/DFGCapabilities.h:
(JSC::DFG::canCompileOpcode):
  We can handle typeof.
* dfg/DFGNodeType.h:
(DFG):
  Define the node.
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
  Add operationTypeOf to support the non-trivial cases.
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
  Actual codegen
* runtime/Operations.cpp:
(JSC::jsTypeStringForValue):
(JSC):
* runtime/Operations.h:
(JSC):
  Some refactoring to allow us to get the type string for an
  object without needing a callframe.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139145 268f45cc-cd09-0410-ab3c-d52691b4dbfc