Crash when attempting to perform array iteration on a non-array with numeric keys not initialized.
<https://webkit.org/b/137814>

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

The arrayIteratorNextThunkGenerator() thunk was not checking for the case where
the butterfly may be NULL.  This was the source of the crash, and is now fixed.

In addition, it is also not checking for the case where a property named "length"
may have been set on the iterated object.  The thunk only checks the butterfly's
publicLength for its iteration operation.  Array objects will work fine with this
because it always updates its butterfly's publicLength when its length changes.
In the case of iterable non-Array objects, the "length" property will require a
look up outside of the scope of this thunk.  The fix is simply to limit the fast
case checks in this thunk to Array objects.

* jit/ThunkGenerators.cpp:
(JSC::arrayIteratorNextThunkGenerator):

LayoutTests:

* js/array-length-shortening-expected.txt: Added.
* js/array-length-shortening.html: Added.
* js/for-of-crash-expected.txt: Added.
* js/for-of-crash.html: Added.
* js/script-tests/array-length-shortening.js: Added.
(testLengthShortening):
(denseInt32Elements):
(denseDoubleElements):
(denseObjectElements):
(holeyInt32Elements):
(holeyDoubleElements):
(holeyObjectElements):
(arrayStorageInt32Elements):
(arrayStorageDoubleElements):
(arrayStorageObjectElements):
(sparseInt32Elements):
(sparseDoubleElements):
(sparseObjectElements):
* js/script-tests/for-of-crash.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175243 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] OS X Mavericks build broken with public SDK
https://bugs.webkit.org/show_bug.cgi?id=138108

Reviewed by Mark Rowe.

* Shared/API/Cocoa/WKFoundation.h: Only define the NSEventModifierFlags type when using a
version of the OS X SDK that doesn’t define it.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175244 268f45cc-cd09-0410-ab3c-d52691b4dbfc