Gardening: build fix for non-Mac builds after r172737.
https://bugs.webkit.org/show_bug.cgi?id=135750

Not reviewed.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172739 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Mark shape-image-threshold-001.html as crashing in debug

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-08-18

* TestExpectations:
The test css3/shapes/shape-outside/values/shape-image-threshold-001.html systematically assert
in debug. Skip the results until the author investigate.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172740 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r172401): for-in optimization no longer works at all
https://bugs.webkit.org/show_bug.cgi?id=136056

Reviewed by Mark Hahnenberg.
        
This is a partial roll-out of r172401. It turns out that the fix wasn't actually fixing a
real bug (since it's fine to use op_get_direct_pname on the wrong base because it has a
structure check) and it was actually breaking the entire for-in optimization (since there is
no way that we can statically prove that the base matches, because the base we see is a
newly created temporary, and anyway doing it right would be really hard in our bytecode
because it's 3AC form).
        
But, I added a new test for the problem, and kept the original test. Both the old test and
the new test prove that r172401 wasn't fixing what it thought it was fixing. To the extent
that it resolved crashes it was because it just disabled the for-in optimization entirely.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitGetByVal):
(JSC::BytecodeGenerator::pushIndexedForInScope):
(JSC::BytecodeGenerator::pushStructureForInScope):
* bytecompiler/BytecodeGenerator.h:
(JSC::ForInContext::ForInContext):
(JSC::StructureForInContext::StructureForInContext):
(JSC::IndexedForInContext::IndexedForInContext):
(JSC::ForInContext::base): Deleted.
* bytecompiler/NodesCodegen.cpp:
(JSC::ForInNode::emitMultiLoopBytecode):
* tests/stress/for-in-base-reassigned.js: Added.
* tests/stress/for-in-base-reassigned-later.js: Added.
* tests/stress/for-in-base-reassigned-later-and-change-structure.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172741 268f45cc-cd09-0410-ab3c-d52691b4dbfc