https://bugs.webkit.org/show_bug.cgi?id=123746

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

This patch disallows clients from allocating 0 bytes in CopiedSpace. We enforce this invariant 
with an ASSERT in C++ code and a breakpoint in JIT code. Clients who care about 0-byte 
allocations (like JSArrayBufferViews) must handle that case themselves, but we don't punish 
anybody else for the rare case that somebody decides to allocate a 0-length typed array. 
It also makes the allocation and copying cases consistent for CopiedSpace: no 0-byte allocations, 
no 0-byte copying.
 
Also added a check so that JSArrayBufferViews don't try to copy their m_vector backing store when 
their length is 0. Also sprinkled several ASSERTs throughout the JSArrayBufferView code to make sure that 
when length is 0 m_vector is null.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
* heap/CopiedSpaceInlines.h:
(JSC::CopiedSpace::tryAllocate):
* runtime/ArrayBuffer.h:
(JSC::ArrayBuffer::create):
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::::visitChildren):
(JSC::::copyBackingStore):
(JSC::::slowDownAndWasteMemory):

LayoutTests: 

Added a test to make sure that we don't crash when allocating a typed array with 0 length.

* js/script-tests/typedarray-zero-size.js: Added.
(foo):
* js/typedarray-zero-size-expected.txt: Added.
* js/typedarray-zero-size.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158583 268f45cc-cd09-0410-ab3c-d52691b4dbfc