[Windows] Fix for fast/xpath test regressions caused by r157205.
https://bugs.webkit.org/show_bug.cgi?id=122658.

Reviewed by Darin Adler.

* xml/XPathStep.h:
(WebCore::XPath::Step::NodeTest::NodeTest):
(WebCore::XPath::Step::NodeTest::operator=):
We were incorrectly setting the predicate list to null instead of the predicate list of the NodeTest being passed in.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157324 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed EFL gardening.

Unskip tests that are already passing.

* platform/efl-wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157325 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix handling of indirect stackmap locations in FTL OSR exit
https://bugs.webkit.org/show_bug.cgi?id=122666

Reviewed by Mark Hahnenberg.
        
With this change, the llvm.webkit.stackmap-based OSR exit only fails one test, down from
five tests previously.

* ftl/FTLLocation.cpp:
(JSC::FTL::Location::gpr): It's OK to call this method when kind() == Indirect, so asserting that isGPR() is wrong; change to assert that involvesGPR().
(JSC::FTL::Location::restoreInto): Stack-related registers aren't saved to the scratch buffer, so use them directly.
* ftl/FTLLocation.h: Add comment about requirements for stack layout.
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStubWithOSRExitStackmap): Make enough room on the stack so that saveAllRegisters() has a scratchpad to save things to. Without this, saveAllRegisters() may clobber a spilled value.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157326 268f45cc-cd09-0410-ab3c-d52691b4dbfc
sunspider-1.0/math-spectral-norm.js.dfg-eager occasionally fails with Trap 5 (i.e int $3)
https://bugs.webkit.org/show_bug.cgi?id=122462

Reviewed by Mark Hahnenberg.
        
This fixes two bugs, both of which led to GetByVal on Int32 trapping because the
array no longer had Int32 shape but the check wasn't executed:
        
1) We weren't snapshotting the structures of mustHandleValues. This led to an awesome
   race where if a mustHandleValue JSValue's structure changed on the main thread
   between runs of the AI, the AI would contradict each other and things would just
   get corrupted in funny ways.
        
2) The constant folder has a long standing bug! It will fold a node to a constant if
   the AI proved it to be a constant. But it's possible that the original node also
   proved things about the constant's structure. In that case "folding" to a
   JSConstant actually loses information since JSConstant doesn't guarantee anything
   about a constant's structure. There are various things we could do here to ensure
   that a folded constant's structure doesn't change, and that if it does, we
   deoptimize the code. But for now we can just make this sound by disabling folding
   in this pathological case.

* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::Graph):
* dfg/DFGGraph.h:
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::initialize):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157327 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Dramatically simplify calculateAdjustedNodes
https://bugs.webkit.org/show_bug.cgi?id=122680

Reviewed by Antti Koivisto.

Without insertion points, we never have to worry about entering a shadow DOM we've already climbed out of.
Deleted the logic to deal with insertion points in calculateAdjustedNodes accordingly.

* dom/EventDispatcher.cpp:
(WebCore::EventPath::EventPath):
(WebCore::calculateAdjustedNodes):
(WebCore::updateTouchListsInEventPath):
(WebCore::EventPath::updateTouchLists):
(WebCore::EventPath::setRelatedTarget):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157328 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG: Add JIT support for  LogicalNot(String/StringIdent)
https://bugs.webkit.org/show_bug.cgi?id=122627

Patch by Nadav Rotem <nrotem@apple.com> on 2013-10-11
Reviewed by Filip Pizlo.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileStringZeroLength):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileLogicalNot):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157329 268f45cc-cd09-0410-ab3c-d52691b4dbfc