Unreviewed, rolling out r177238 and r177244.
https://bugs.webkit.org/show_bug.cgi?id=139632

Introduced memory corruption (Requested by ap on #webkit).

Reverted changesets:

"REGRESSION (r168217): Images are cropped out during animation
at jetblue.com"
https://bugs.webkit.org/show_bug.cgi?id=136410
http://trac.webkit.org/changeset/177238

https://bugs.webkit.org/show_bug.cgi?id=139596
http://trac.webkit.org/changeset/177244

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@177269 268f45cc-cd09-0410-ab3c-d52691b4dbfc
PutLocalSinkingPhase has an invalid assertion about incoming values, because both liveness and deferral analyses are conservative
https://bugs.webkit.org/show_bug.cgi?id=139630

Reviewed by Oliver Hunt.

Replaces a faulty assertion with code to handle an awesome special case. Also adds a lot of
comments that reconstruct my reasoning about this code. I had to work hard to remember how
deferral worked so I wrote my discoveries down.

* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertBottomConstantForUse):
* dfg/DFGPutLocalSinkingPhase.cpp:
* tests/stress/put-local-conservative.js: Added.
(foo):
(.result):
(bar):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@177270 268f45cc-cd09-0410-ab3c-d52691b4dbfc