Revert 167680 "Move popular DOM attributes to prototype chains"

This CL caused unacceptable perf regression, because I landed the CL
before landing a V8 side CL that fixes the perf regression.

I'll land the CL again after landing the V8 side CL.

> Move popular DOM attributes to prototype chains
> 
> Design document: https://docs.google.com/a/google.com/document/d/1yeHTCHhulVIlrKyx9_gCguAhLfcefVOa9uxxfW2LVG0/edit
> 
> Intent-to-ship-and-implement in blink-dev: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/t0XiZuMey7M/9-5AuhoFyisJ
> 
> This CL moves DOM attributes used in Dromaeo to prototype chains. When I landed the CL two months ago (https://codereview.chromium.org/94403002), it caused 20+% regression in benchmarks. However, now that a V8 side fix is landed, there should be no overhead in moving DOM attributes to prototype chains in theory.
> 
> Dromaeo/dom-attr 1086 runs/sec => 1077 runs/sec (-0.8%)
> Dromaeo/dom-modify 522 runs/sec => 525 runs/sec (+0.5%)
> Dromaeo/dom-query 26150 runs/sec => 26200 runs/sec (+0.2%)
> Dromaeo/dom-traverse 564 runs/sec => 544 runs/sec (-3.6%)
> 
> I don't understand the regression in dom-traverse. The regression is reproducible but I cannot reproduce the regression in a super-micro benchmark that just repeats accessing div.firstChild. Probably the regression might be a noise.
> 
> I'm going to land this CL and see how much regression is observed in perf bots (I'll email to perf-sheriff@). If I find the regression is unacceptable, I'll revert the CL.
> 
> See the design document and the Intent-to-ship email for justification for the regression.
> 
> BUG=43394
> 
> Review URL: https://codereview.chromium.org/158713002

TBR=haraken@chromium.org

Review URL: https://codereview.chromium.org/179343002

git-svn-id: svn://svn.chromium.org/blink/trunk@167722 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[FastTextAutosizer] Refactor {isWider,isNarrower}Descendant into one fn

Two codes for the price of one codes:
isWiderDescendant + isNarrowerDescendant -> isWiderOrNarrowerDescendant
I have recently learned pay is not depend on lines of code. This change
make code squeaky clean and re-use common logic to make benefit
glorious fast text autosizer.

BUG=302005

Review URL: https://codereview.chromium.org/176503002

git-svn-id: svn://svn.chromium.org/blink/trunk@167723 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Convert LayoutState/LayoutStateMaintainer/LayoutStateDisabler to references

Convert LayoutState/LayoutStateMaintainer/LayoutStateDisabler to references when
possible.  This is very much in the same spirit as r159391 in WebKit, but goes a
little further in converting to references where possible.  I've also taken the
opportunity to convert LayoutStateDisabler to take a RenderObject instead of the
view.  Also, FrameView gets a new RAII class to simplify code in performLayout.

BUG=None

Review URL: https://codereview.chromium.org/164553004

git-svn-id: svn://svn.chromium.org/blink/trunk@167724 bbb929c8-8fbe-4397-9dbb-9b2b20218538
plain/text is not a real MIME type.

Change to 'text/plain'.

BUG=none

Review URL: https://codereview.chromium.org/176873007

git-svn-id: svn://svn.chromium.org/blink/trunk@167725 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Factor CompositingReasonFinder out of RenderLayerCompositor

RenderLayerCompositor is a large block of code. This CL moves a chunk of code
related to finding the direct compositing reasons into its own class. This code
doesn't interact much with the rest of RenderLayerCompositor.

Eventually, we might want to update the direct compositing reasons during style
recalc (rather than during compositing update). Having the code in a separate
class will make that easier.

R=vollick@chromium.org

Review URL: https://codereview.chromium.org/178743002

git-svn-id: svn://svn.chromium.org/blink/trunk@167726 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Make SharedBuffer support purgeable memory in-place.                                                                                                                                                                                                                                                                           

This CL adds a createPurgeable() static factory method as well as lock() and 
unlock() methods to SharedBuffer so that |Resource::m_data| can be allocated in
purgeable memory from the start.

Note that only the flat buffer (|SharedBuffer::m_buffer|) is made purgeable for 
now since the segments usually get merged anyway into that buffer (modulo
images which will have to be addressed in a follow up CL).

This removes in particular a memcpy() that we were doing in
Resource::makePurgeable() which will be needed to increase the usage of
Resource::makePurgeable().

Since Resource and SharedBuffer were the only clients using PurgeableBuffer
this CL also removes PurgeableBuffer to avoid unnecessary layering.

BUG=290193

Review URL: https://codereview.chromium.org/123443005

git-svn-id: svn://svn.chromium.org/blink/trunk@167727 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Avoid calling Node::numberOfScopedHTMLStyleChildren() to check for existence

Avoid calling Node::numberOfScopedHTMLStyleChildren() to check for existence as
we don't want to traverse all children merely to check for the existence
of 1 child. Node::hasScopedHTMLStyleChild() can be used to check this instead
as we have a dedicated flag for this. Also, don't unnecessarily traverse all
children to set the HasScopedHTMLStyleChildFlag, and break early instead as
soon as one child is found.

R=adamk, eseidel

Review URL: https://codereview.chromium.org/178333005

git-svn-id: svn://svn.chromium.org/blink/trunk@167728 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[SVG] Prevent spurious SVGImageElement loader updates

SVGImageElement needs to update its loader after document insertion for
base URIs to work properly.

Currently, we are calling ImageLoader::updateFromElement()
indiscriminately when inserted into the document. But this can cause
spurious image reloads on element re-inserts, with visible repaint side
effects for local (uncached) resources.

The CL changes SVGImageElement::insertedInto() to only update its image
loader when needed.

R=pdr@chromium.org
BUG=346486

Review URL: https://codereview.chromium.org/177153003

git-svn-id: svn://svn.chromium.org/blink/trunk@167729 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[FastTextAutosizer] Fix crash due to no blocks returning from getTentativeClusterRoots

This patch fixes a crash in FastTextAutosizer::getSupercluster where
m_fingerprintMapper.get(block) can return a fingerprint but
m_fingerprintMapper.getTentativeClusterRoots can later return null.

I'm splitting this out of https://codereview.chromium.org/167893005.
Tests will crash with https://codereview.chromium.org/167893005 applied
without this patch.

BUG=

Review URL: https://codereview.chromium.org/178693003

git-svn-id: svn://svn.chromium.org/blink/trunk@167730 bbb929c8-8fbe-4397-9dbb-9b2b20218538