Avoid dangling pointers in WeakBlock list https://bugs.webkit.org/sho…

Source/JavaScriptCore/heap/Heap.cpp

@@ -2534,6 +2534,7 @@ bool Heap::shouldDoFullCollection()
 
 void Heap::addLogicallyEmptyWeakBlock(WeakBlock* block)
 {
+    RELEASE_ASSERT(!block->next() && !block->prev());
     m_logicallyEmptyWeakBlocks.append(block);
 }
 
@@ -2552,6 +2553,7 @@ bool Heap::sweepNextLogicallyEmptyWeakBlock()
         return false;
 
     WeakBlock* block = m_logicallyEmptyWeakBlocks[m_indexOfNextLogicallyEmptyWeakBlockToSweep];
+    RELEASE_ASSERT(!block->next() && !block->prev());
 
     block->sweep();
     if (block->isEmpty()) {

Source/JavaScriptCore/heap/WeakBlock.cpp

@@ -45,6 +45,7 @@ WeakBlock* WeakBlock::create(Heap& heap, CellContainer container)
 
 void WeakBlock::destroy(Heap& heap, WeakBlock* block)
 {
+    RELEASE_ASSERT(!block->next() && !block->prev());
     block->~WeakBlock();
     WeakBlockMalloc::free(block);
     heap.didFreeBlock(WeakBlock::blockSize);

Source/JavaScriptCore/heap/WeakSet.cpp

@@ -37,12 +37,9 @@ WeakSet::~WeakSet()
         remove();
 
     Heap& heap = *this->heap();
-    WeakBlock* next = nullptr;
-    for (WeakBlock* block = m_blocks.head(); block; block = next) {
-        next = block->next();
+    while (WeakBlock* block = m_blocks.removeHead())
         WeakBlock::destroy(heap, block);
-    }
-    m_blocks.clear();
+    ASSERT(m_blocks.isEmpty());
 }
 
 void WeakSet::sweep()

Source/WTF/wtf/DoublyLinkedList.h

@@ -41,8 +41,8 @@ template<typename T> class DoublyLinkedListNode {
 
 template<typename T> inline DoublyLinkedListNode<T>::DoublyLinkedListNode()
 {
-    setPrev(0);
-    setNext(0);
+    setPrev(nullptr);
+    setNext(nullptr);
 }
 
 template<typename T> inline void DoublyLinkedListNode<T>::setPrev(T* prev)
@@ -84,14 +84,16 @@ class DoublyLinkedList {
     void remove(T*);
     void append(DoublyLinkedList<T>&);
 
+    DoublyLinkedList<T> splitAt(size_t);
+
 private:
     T* m_head;
     T* m_tail;
 };
 
 template<typename T> inline DoublyLinkedList<T>::DoublyLinkedList()
-    : m_head(0)
-    , m_tail(0)
+    : m_head(nullptr)
+    , m_tail(nullptr)
 {
 }
 
@@ -126,40 +128,59 @@ template<typename T> inline T* DoublyLinkedList<T>::tail() const
 
 template<typename T> inline void DoublyLinkedList<T>::push(T* node)
 {
+    ASSERT(!node->prev() && !node->next());
     if (!m_head) {
         ASSERT(!m_tail);
         m_head = node;
         m_tail = node;
-        node->setPrev(0);
-        node->setNext(0);
         return;
     }
 
     ASSERT(m_tail);
     m_head->setPrev(node);
     node->setNext(m_head);
-    node->setPrev(0);
     m_head = node;
 }
 
 template<typename T> inline void DoublyLinkedList<T>::append(T* node)
 {
+    ASSERT(!node->prev() && !node->next());
     if (!m_tail) {
         ASSERT(!m_head);
         m_head = node;
         m_tail = node;
-        node->setPrev(0);
-        node->setNext(0);
         return;
     }
 
     ASSERT(m_head);
     m_tail->setNext(node);
     node->setPrev(m_tail);
-    node->setNext(0);
     m_tail = node;
 }
 
+template<typename T> inline DoublyLinkedList<T> DoublyLinkedList<T>::splitAt(size_t toKeep)
+{
+    auto* p = head();
+
+    if (!p || !p->next())
+        return { };
+    for (size_t i = 1; i < toKeep; i++) {
+        p = p->next();
+        if (!p->next())
+            return { };
+    }
+
+    DoublyLinkedList<T> newList { };
+    newList.m_head = p->next();
+    newList.m_tail = m_tail;
+    newList.m_head->setPrev(nullptr);
+
+    m_tail = p;
+    m_tail->setNext(nullptr);
+
+    return newList;
+}
+
 template<typename T> inline void DoublyLinkedList<T>::remove(T* node)
 {
     if (node->prev()) {
@@ -177,6 +198,8 @@ template<typename T> inline void DoublyLinkedList<T>::remove(T* node)
         ASSERT(node == m_tail);
         m_tail = node->prev();
     }
+    node->setNext(nullptr);
+    node->setPrev(nullptr);
 }
 
 template<typename T> inline T* DoublyLinkedList<T>::removeHead()