Fix aliasing bugs in Vector::fill() and Vector::insertFill()

[cdumez]

80119b4

Fix aliasing bugs in Vector::fill() and Vector::insertFill()
https://bugs.webkit.org/show_bug.cgi?id=310889

Reviewed by Darin Adler.

Both `fill()` and `insertFill()` take a `const T&` parameter that may reference
an element within the vector itself. If the vector mutates (via shrink,
clear, reallocation, or element shifting), that reference becomes dangling
or points to the wrong value.

For `fill()`, `clear()` destroys all elements before reallocation, and `shrink()`
destroys elements past the new size -- either case invalidates a reference
to a vector element. For `insertFill()`, `expandCapacity()` may reallocate the
buffer, and even without reallocation, `moveOverlapping()` shifts elements
right, so a reference to an element at or after the insertion position
reads the wrong value (or a destructed object for non-trivial types).

Fix both by copying the value into a local before any mutation, matching
how std::vector is required to handle this case for `insert(pos, count, value)`
and `assign(count, value)`.

Test: Tools/TestWebKitAPI/Tests/WTF/Vector.cpp

* Source/WTF/wtf/Vector.h:
(WTF::Malloc>::fill):
(WTF::Malloc>::insertFill):
* Tools/TestWebKitAPI/Tests/WTF/Vector.cpp:
(TestWebKitAPI::TEST(WTF_Vector, FillAliasingGrowth)):
(TestWebKitAPI::TEST(WTF_Vector, FillAliasingShrink)):
(TestWebKitAPI::TEST(WTF_Vector, FillAliasingNoReallocation)):
(TestWebKitAPI::TEST(WTF_Vector, FillAliasingSameSize)):
(TestWebKitAPI::TEST(WTF_Vector, InsertFillAliasingWithReallocation)):
(TestWebKitAPI::TEST(WTF_Vector, InsertFillAliasingElementAfterPosition)):
(TestWebKitAPI::TEST(WTF_Vector, InsertFillAliasingElementAtPosition)):
(TestWebKitAPI::TEST(WTF_Vector, InsertFillAliasingElementBeforePosition)):

Canonical link: https://commits.webkit.org/310131@main

18d0f43

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	❌ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
❌ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

[webkit-early-warning-system]

EWS run on current version of this PR (hash 18d0f43)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	❌ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
❌ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

[webkit-commit-queue]

Committed 310131@main (80119b4): https://commits.webkit.org/310131@main

Reviewed commits have been landed. Closing PR #61491 and removing active labels.