parserAppendChild and parserInsertBefore should ensure that child nodes are in the same document
https://bugs.webkit.org/show_bug.cgi?id=108260

Reviewed by Eric Seidel.

Source/WebCore:

Test: fast/parser/xml-error-adopted.xml

The check and adoption if the documents don't match is now moved into ContainerNode::parser* from HTMLConstructionSite.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::parserInsertBefore):
(WebCore::ContainerNode::parserAppendChild):
* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::insertTextNode):
(WebCore::HTMLConstructionSite::findFosterSite):
(WebCore::HTMLConstructionSite::fosterParent):

LayoutTests:

* fast/parser/xml-error-adopted-expected.txt: Added.
* fast/parser/xml-error-adopted.xml: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141198 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
https://bugs.webkit.org/show_bug.cgi?id=107839

Reviewed by Geoffrey Garen.

Fixing several ASSERTs that were incorrect along with some of the reallocation of m_prototype and
m_constructor that they were based on.

* API/JSWrapperMap.mm:
(-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We now only allocate those
fields that are null (i.e. have been collected or have never been allocated to begin with).
(-[JSObjCClassInfo reallocateConstructorAndOrPrototype]): Renamed to better indicate that we're
reallocating one or both of the prototype/constructor combo.
(-[JSObjCClassInfo wrapperForObject:]): Call new reallocate function.
(-[JSObjCClassInfo constructor]): Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141199 268f45cc-cd09-0410-ab3c-d52691b4dbfc