~BlockAllocator should ASSERT that it has no more Regions left
https://bugs.webkit.org/show_bug.cgi?id=115287

Reviewed by Andreas Kling.

* heap/BlockAllocator.cpp:
(JSC::BlockAllocator::~BlockAllocator):
(JSC::BlockAllocator::allRegionSetsAreEmpty):
* heap/BlockAllocator.h:
(RegionSet):
(JSC::BlockAllocator::RegionSet::isEmpty):
(BlockAllocator):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149305 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SVGElement destructor can use invalid iterator
https://bugs.webkit.org/show_bug.cgi?id=115361

Reviewed by Philip Rogers.

Source/WebCore:

When an SVGElement object has rare data, its destructor gets a
hash map iterator for the rare data, uses it to clear resources,
then uses the iterator to delete the rare data. However, the resource
cleanup can delete other SVG elements, thus modifying the hash map
from which the iterator came and hence invalidating the iterator
itself.

The fix is to re-get the iterator before deleting the rare data.

Test: svg/custom/svg-element-destructor-iteration-crash.html

* svg/SVGElement.cpp:
(WebCore::SVGElement::~SVGElement): Get a new iterator after clearing rare data.

LayoutTests:

Test asserts in Debug and should also crash in memory checking builds.

* svg/custom/svg-element-destructor-iteration-crash-expected.txt: Added.
* svg/custom/svg-element-destructor-iteration-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149306 268f45cc-cd09-0410-ab3c-d52691b4dbfc