DFGAbstractInterpreter should not claim Int52 arithmetic creates Int52s
https://bugs.webkit.org/show_bug.cgi?id=132446

Reviewed by Mark Hahnenberg.
        

Source/JavaScriptCore: 
Basically any arithmetic operation can turn an Int52 into an Int32 or vice-versa, and
our modeling of Int52Rep nodes is such that they can have either Int32 or Int52 type
to indicate a bound on the value. This is useful for knowing, for example, that
Int52Rep(Int32:) returns a value that cannot be outside the Int32 range. Also,
ValueRep(Int52Rep:) uses this to determine whether it may return a double or an int.
But this means that all arithmetic operations must be careful to note that they may
turn Int32 inputs into an Int52 output or vice-versa, as these new tests show.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::makeSafe):
* tests/stress/int52-ai-add-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-mul-then-filter-int32-directly.js: Added.
(foo):
* tests/stress/int52-ai-mul-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-neg-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-sub-then-filter-int32.js: Added.
(foo):

Tools: 
Test the FTL by default now that it's enabled by default.

* Scripts/run-javascriptcore-tests:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@168172 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r168150.
https://bugs.webkit.org/show_bug.cgi?id=132471

This test is still broken (Requested by ap on #webkit).

Reverted changeset:

"REGRESSION(r125251): It made svg/custom/use-instanceRoot-as-
event-target.xhtml assert and flakey"
https://bugs.webkit.org/show_bug.cgi?id=93812
http://trac.webkit.org/changeset/168150

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@168173 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WK2] Can't scroll on gatesnotes.com
https://bugs.webkit.org/show_bug.cgi?id=132459
<rdar://problem/16770909>

Reviewed by Benjamin Poulain.

The custom UIView hit-testing code was finding views that were created by
the compositing code for clipping, above the UIScrollViews. We only ever
need to find UIScrollViews here for touch overflow-scrolling, so constrain
the hit-testing code to only return UIScrollViews.

* UIProcess/ios/RemoteLayerTreeHostIOS.mm:
(-[UIView _recursiveFindDescendantScrollViewAtPoint:withEvent:]):
(-[UIView _findDescendantViewAtPoint:withEvent:]):
(-[UIView _recursiveFindDescendantViewAtPoint:withEvent:]): Deleted.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@168174 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WK2] Animations on vox.com look wrong
https://bugs.webkit.org/show_bug.cgi?id=132462
<rdar://problem/16731884>

Reviewed by Sam Weinig.

PlatformCALayerRemote was managing animations incorrectly; aninations
would stick around in m_properties.addedAnimations and get added a second
time by mistake.

Animations have to be managed a little differently to other properties,
since they are not steady-state things. A given commit has to send over
the added and removed animations, and then clear the layer properties.

Do this by adding PlatformCALayerRemote::didCommit(), which is called
after the layer properties have been encoded, and have it clear the lists
of added and removed animations.

removeAnimationForKey() also has to remove the animation from addedAnimations
so that an add/remove in the same commit doesn't send the animation to the
UI process.

* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(WebKit::PlatformCALayerRemote::recursiveBuildTransaction):
(WebKit::PlatformCALayerRemote::didCommit):
(WebKit::PlatformCALayerRemote::removeAnimationForKey):
* WebProcess/WebPage/mac/PlatformCALayerRemote.h:
* WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:
(WebKit::RemoteLayerTreeDrawingArea::flushLayers):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@168175 268f45cc-cd09-0410-ab3c-d52691b4dbfc