Cherry-pick 259548.689@safari-7615-branch (a75d564). https://bugs.web…

…kit.org/show_bug.cgi?id=255806

    jsc_fuzz: ASSERTION FAILED: !is8Bit() || isEmpty() in stringProtoFuncToWellFormed()
    https://bugs.webkit.org/show_bug.cgi?id=255806
    <rdar://108256807>

    Reviewed by Yusuke Suzuki.

    It's necessary to resolve a rope to determine if a string is 8-bit: JSRopeString's is8BitInPointer merely
    implies it can be represented as 8-bit, but after the rope is resolved, it can become a 16-bit string.

    * JSTests/stress/regress-255806.js: Added.
    * Source/JavaScriptCore/runtime/StringPrototype.cpp:
    (JSC::JSC_DEFINE_HOST_FUNCTION):

    Canonical link: https://commits.webkit.org/259548.689@safari-7615-branch

JSTests/stress/regress-255806.js

@@ -0,0 +1,4 @@
+let s0 = '000'.toLocaleUpperCase();
+let s1 = s0.slice(1);
+s1[s0] = undefined;
+s1.toWellFormed();

Source/JavaScriptCore/runtime/StringPrototype.cpp

@@ -1844,6 +1844,9 @@ JSC_DEFINE_HOST_FUNCTION(stringProtoFuncToWellFormed, (JSGlobalObject* globalObj
     String string = stringValue->value(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
 
+    if (string.is8Bit())
+        return JSValue::encode(stringValue);
+
     const UChar* characters = string.characters16();
     unsigned length = string.length();
     auto firstIllFormedIndex = illFormedIndex(characters, length);