Subpixel rendering: Embedded non-compositing rotate transform paints to wrong position.
https://bugs.webkit.org/show_bug.cgi?id=135028

Reviewed by Simon Fraser.

CTM always translates to where the layer's renderer() is going to paint.
It ensures that the pixel snapped renderer() always end up painting to (0, 0) which is
required to be able to position properly on transformed context.

Source/WebCore:
Test: fast/layers/hidpi-transform-on-child-content-is-mispositioned.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::beginTransparencyLayers):
(WebCore::RenderLayer::clipToRect):
(WebCore::RenderLayer::paintLayerByApplyingTransform):
(WebCore::RenderLayer::paintBackgroundForFragments):
(WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
(WebCore::RenderLayer::paintOutlineForFragments):
(WebCore::RenderLayer::paintMaskForFragments):
(WebCore::RenderLayer::paintOverflowControlsForFragments):
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderLayer.h:

LayoutTests:
* fast/layers/hidpi-transform-on-child-content-is-mispositioned-expected.html: Added.
* fast/layers/hidpi-transform-on-child-content-is-mispositioned.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171210 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r171167): LoaderClient processDidCrash call is made after load state changes
https://bugs.webkit.org/show_bug.cgi?id=135032
<rdar://problem/17716602>

Reviewed by Dan Bernstein.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::processDidCrash): Create a transaction, so that the nested
transaction in resetStateAfterProcessExited() wouldn't be committed.
(WebKit::WebPageProxy::resetStateAfterProcessExited): Don't use auto - it was hiding
the most important fact that this is a stack object that can't be simply moved to
a different function.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171211 268f45cc-cd09-0410-ab3c-d52691b4dbfc