https://bugs.webkit.org/show_bug.cgi?id=117363

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

Previously (in http://trac.webkit.org/changeset/151303) I made it so that we
inserted ForceOSRExits more eagerly.  I now think it's better to have
contradictions execute normally and exit with full OSR exit profiling.  It's
better at catching the few cases where the DFG will end up with different
types than the baseline engines.

This simplifies a bunch of code. For example it gets rid of
ConstantFoldingPhase::paintUnreachableCode().

You can think of this as a partial roll-out of r151303, except that it uses
the facilities introduced by that patch to give us run-time assertions that
check the CFA's correctness: if the CFA thought that something was a
contradiction but the code didn't exit, we'll now trap.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::AbstractState):
(JSC::DFG::AbstractState::startExecuting):
(JSC::DFG::AbstractState::executeEffects):
(JSC::DFG::AbstractState::execute):
(JSC::DFG::AbstractState::filter):
(JSC::DFG::AbstractState::filterArrayModes):
(JSC::DFG::AbstractState::filterByValue):
(DFG):
* dfg/DFGAbstractState.h:
(AbstractState):
(JSC::DFG::AbstractState::filter):
(JSC::DFG::AbstractState::filterArrayModes):
(JSC::DFG::AbstractState::filterByValue):
* dfg/DFGCFAPhase.cpp:
(JSC::DFG::CFAPhase::performBlockCFA):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::run):
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(ConstantFoldingPhase):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):

LayoutTests:

Reviewed by Mark Hahnenberg.

Convert this test, since this was the test originally added for
ConstantFoldingPhase::paintUnreachableCode(). I wanted to make sure that I had good coverage
for this since I am removing that method.

* fast/js/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop-expected.txt:
* fast/js/script-tests/dfg-force-exit-then-sparse-conditional-constant-prop-in-loop.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153215 268f45cc-cd09-0410-ab3c-d52691b4dbfc