Reviewed by Darin Adler.

This appears to be due to a couple of issues.
(1) When the atomic string table is deleted it does not clear the 'inTable' bit
on AtomicStrings - it implicitly assumes that all AtomicStrings have already
been deleted at this point (otherwise they will crash in their destructor when
they try to remove themselves from the atomic string table).
(2) We don't fix the ordering in which WTF::WTFThreadData and
WebCore::ThreadGlobalData are destructed.

We should make sure that ThreadGlobalData is cleaned up before worker threads
terminate and WTF::WTFThreadData is destroyed, and we should clear the inTable
bit of members on atomic string table destruction.

JavaScriptCore: 

WTF changes (fix issue 1, above) - ensure inTable property is cleared when the
atomic string table is destroyed (also, rename InTable to IsAtomic, to make it
clear which table we are refering to!)

* wtf/text/AtomicString.cpp:
(WebCore::AtomicStringTable::destroy):
(WebCore::CStringTranslator::translate):
(WebCore::UCharBufferTranslator::translate):
(WebCore::HashAndCharactersTranslator::translate):
(WebCore::AtomicString::add):
* wtf/text/StringImpl.cpp:
(WebCore::StringImpl::~StringImpl):
* wtf/text/StringImpl.h:
(WebCore::StringImpl::isAtomic):
(WebCore::StringImpl::setIsAtomic):
* wtf/text/StringImplBase.h:

WebCore: 

WTF changes (fix issue 2, above) - clean up the thread data on worker termination.

* platform/ThreadGlobalData.cpp:
(WebCore::ThreadGlobalData::~ThreadGlobalData):
(WebCore::ThreadGlobalData::destroy):
* platform/ThreadGlobalData.h:
* workers/WorkerThread.cpp:
(WebCore::WorkerThread::workerThread):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@58851 268f45cc-cd09-0410-ab3c-d52691b4dbfc