DFG should not elide CheckStructure if it's needed to perform a cell check
https://bugs.webkit.org/show_bug.cgi?id=106074

Source/JavaScriptCore: 

Reviewed by Ryosuke Niwa.
        
The problem here was that the constant folding phase was misinterpreting the meaning of the sets
in DFG::AbstractValue.  AbstractValue describes a constraint on the values that a variable (i.e.
a DFG Node, or a virtual register, i.e. local or argument) may have. It does so by containing
four sets: the set of JSValues (either empty, the singleton set containing one JSValue, or the
set of all JSValues); the set of "current known" structures, i.e. the set of structures that you
already know that this value may have right now (also either empty, the singleton set, or the set
of all structures); the set of "future possible" structures, i.e. the set of structures that this
value could have in the future if none of the structure transition watchpoints for those
structures had fired (also empty, singleton, or all); and the set of types, which is a
SpeculatedType bitmask. The correct way to interpret the sets is to think of the AbstractValue as
the intersection of these three sets of values:
        
- The set of JSValues that have a type that belongs to the m_type set.
- If m_value is not the empty value then: the set of all JSValues that are == m_value;
                                    else: the set of all JSValues.
  where '==' is as defined by JSValue::operator==.
- Union of { the set of all cells that have a structure that belongs to m_currentKnownStructure }
       and { the set of all JSValues that are not cells }.
        
You can then further intersect this set with the following set, if you guard the code with
watchpoints on all structures in the m_futurePossibleStructure:
        
- Union of { the set of all cells that have a structure that belongs to m_futurePossibleStructure }
       and { the set of all JSValues that are not cells }.
        
One way to think of this is that m_currentKnownStructure is filtered by m_futurePossibleStructure
(i.e. is set to the intersection of m_currentKnownStructure and m_futurePossibleStructure), if the
code for which you're doing this is always preceded by watchpoints on all structures in
m_futurePossibleStructure, and is always before any side-effects that could change the structures
of objects.
        
The incorrect optimization related to CheckStructure. CheckStructure checks that the value is a
cell, and that it has a particular structure. It was incorrectly assuming that you could eliminate
the CheckStructure, if m_currentKnownStructure contained the structure that CheckStructure was
checking. But this is not the case, since m_currentKnownStructure does not prove that the value is
a cell with a particular structure; it only proves that if the value was a cell then it would have
a particular structure. Hence, to eliminate CheckStructure, it is also necessary to check that
AbstractValue::m_type contains only cells (i.e. isCellSpeculation(m_type) == true).
        
It wasn't doing that, and this changes makes sure that it does do that.

* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests: 

Reviewed by Ryosuke Niwa.

* fast/js/dfg-check-structure-elimination-for-non-cell-expected.txt: Added.
* fast/js/dfg-check-structure-elimination-for-non-cell.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-check-structure-elimination-for-non-cell.js: Added.
(foo):
(bar):
(baz):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138862 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Heap-use-after-free in WebCore::XMLDocumentParser::doEnd
https://bugs.webkit.org/show_bug.cgi?id=100152

Reviewed by Adam Barth.

XMLDocumentParser can be blown away inside document()->styleResolverChanged()
call. Protect it with a local RefPtr in Document::explitClose.

No new tests. The site specific dependencies are hard to minimize.

* dom/Document.cpp:
(WebCore::Document::explicitClose): RefPtr m_parser into a local, since
it can be detached and nulled out in DocumentWriter::end().
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::end): Bail out when we are detached.
* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.
* xml/parser/XMLDocumentParserQt.cpp:
(WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138863 268f45cc-cd09-0410-ab3c-d52691b4dbfc