[CSS Regions] Add performance test for selection
https://bugs.webkit.org/show_bug.cgi?id=119230

Reviewed by Ryosuke Niwa.

Add new performance test for selection in CSS Regions. It checks a
selection from the first region to the last one, passing through all the
regions.

Test is skipped for now while implementation of selection in CSS Regions
is still evolving.

* Layout/RegionsSelection.html: Added.
* Layout/resources/regions.js:
(.):
* Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add more assertions with security implications in DocumentOrderedMap
https://bugs.webkit.org/show_bug.cgi?id=124559

Reviewed by Antti Koivisto.

Assert that newly added elements and existing elements in the document ordered map are in the same tree scope
as the document ordered map. Also exit early if we're about to add an element in a wrong document to the map.
We don't exit early in get() because the damage has already been done at that point (the element may have been
deleted already).

* dom/Document.cpp:
(WebCore::Document::addImageElementByLowercasedUsemap):
* dom/DocumentOrderedMap.cpp:
(WebCore::DocumentOrderedMap::add): Assert that the newly added element is in the current tree scope.
Also exit early if either the element is not in the tree scope or not in the right document.
While this doesn't make the function completely fault safe, it'll catch when we try to add a detached node.
(WebCore::DocumentOrderedMap::remove): Convert existing assertions to ones with security implication.
(WebCore::DocumentOrderedMap::get): Assert with security implication that the element we're about to return
is in the current tree scope. The element may have already been deleted if we ever hit these assertions.
(WebCore::DocumentOrderedMap::getAllElementsById):  Convert an existing assertion to an assertion with security
implication.
* dom/DocumentOrderedMap.h:
* dom/TreeScope.cpp:
(WebCore::TreeScope::addElementById):
(WebCore::TreeScope::addElementByName):
(WebCore::TreeScope::addImageMap):
(WebCore::TreeScope::addLabel):
* html/HTMLDocument.cpp:
(WebCore::HTMLDocument::addDocumentNamedItem):
(WebCore::HTMLDocument::addWindowNamedItem):
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::insertedInto): Set InTreeScope flag before calling addImageElementByLowercasedUsemap.
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::insertedInto): Ditto for addImageMap.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159489 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening. Adding failure expectations for the remaining layout test failures.

* platform/gtk/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159490 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, EFL gardening. descent-clip-in-scaled-page.html is being passed
after enabling subpixel layout on EFL port.

* platform/efl/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159491 268f45cc-cd09-0410-ab3c-d52691b4dbfc