Structure::flattenDictionaryStructure should compute max offset in a manner that soundly handles the case where the property list becomes empty
https://bugs.webkit.org/show_bug.cgi?id=110155
<rdar://problem/13233773>

Source/JavaScriptCore: 

Reviewed by Mark Rowe.
        
This was a rookie mistake.  It was doing:
        
for (blah) {
    m_offset = foo // foo's monotonically increase in the loop
}
        
as a way of computing max offset for all of the properties.  Except what if the loop doesn't
execute because there are no properties?  Well, then, you're going to have a bogus m_offset.
        
The solution is to initialize m_offset at the top of the loop.

* runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):

LayoutTests: 

Reviewed by Mark Rowe.

* fast/js/flatten-dictionary-structure-from-which-all-properties-were-deleted-expected.txt: Added.
* fast/js/flatten-dictionary-structure-from-which-all-properties-were-deleted.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/flatten-dictionary-structure-from-which-all-properties-were-deleted.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143269 268f45cc-cd09-0410-ab3c-d52691b4dbfc