compileMakeRope does not emit necessary bounds checks

https://bugs.webkit.org/show_bug.cgi?id=130684
<rdar://problem/16398388>

Reviewed by Oliver Hunt.

Add string length bounds checks in a bunch of places. We should never allow a string
to have a length greater than 2^31-1 because it's not clear that the language has
semantics for it and because there is code that assumes that this cannot happen.

Also add a bunch of tests to that effect to cover the various ways in which this was
previously allowed to happen.

* dfg/DFGOperations.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileMakeRope):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMakeRope):
* runtime/JSString.cpp:
(JSC::JSRopeString::RopeBuilder::expand):
* runtime/JSString.h:
(JSC::JSString::create):
(JSC::JSRopeString::RopeBuilder::append):
(JSC::JSRopeString::RopeBuilder::release):
(JSC::JSRopeString::append):
* runtime/Operations.h:
(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
* tests/stress/make-large-string-jit-strcat.js: Added.
(foo):
* tests/stress/make-large-string-jit.js: Added.
(foo):
* tests/stress/make-large-string-strcat.js: Added.
* tests/stress/make-large-string.js: Added.

Change-Id: If01dd2a2d2daa3d209eddf0213d2b391e94f54a0
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167336 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Unreviewed, ARMv7 build fix after r167336.

* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::branchAdd32):

Change-Id: Ia16f8dce00ce660cf5f7b9eb1c3496e08cbdb603
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167354 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[ARM] Unreviewed build fix after r167336.

* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::branchAdd32):

Change-Id: I919df8301e69cca630f475afcc0c4311d713f10e
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167565 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Add missing branchAdd32 implementations to fix sh4 and mips builds

sh4 implementation has been taken from WebKit r173222.

Change-Id: I1c188e88e9fd8772f97cac94d7ee31945b538b71
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
Merge remote-tracking branch 'origin/5.3' into 5.4

Change-Id: I509f0440296df39aece8133382aacc43a4e05f99
Merge "Merge remote-tracking branch 'origin/5.3' into 5.4" into refs/staging/5.4
Crash in WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::createBidiRunsForLine

https://bugs.webkit.org/show_bug.cgi?id=122776

Reviewed by Darin Adler.

Merge https://chromium.googlesource.com/chromium/blink/+/aca89bc4d984705a1f94b623dae0ab03e239a248

Fix modification of whitespace endpoints to not assume it's operating on RenderTexts

During line layout, we use midpoints to identify RenderObjects, or parts of
RenderObjects, that don't need InlineBoxes, usually because of collapsed whitespace.

Prior to actually creating BidiRuns (the precursor to InlineBoxes), we use
checkMidpoints to fix up our lineMidpointState to handle the case where we start
ignoring spaces in our line, but don't stop until somewhere on the following line.
Previously, this function assumed that the final midpoint (called an endpoint)
was a RenderText, but this assumption is wrong if we have a beginning midpoint
created by shouldSkipWhitespaceAfterStartObject (which handles inlines and list
markers) and no endpoint on that line. In that case, we'd instead adjust the
position backwards on the beginning midpoint, which would cause us to fail to
create an InlineBox for the inline or list marker. In the new test added, this
would actually trigger a crash due to an assumption when visually re-ordering
BidiRuns that a non-empty line would actually contain at least one such run.

Test: fast/text/whitespace/whitespace-and-margin-wrap-after-list-marker-crash.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::checkMidpoints):

Change-Id: I894bd9da4250dc2c79a55a8014e54df7dcbec719
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157436 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>