OrderIterator refactoring to avoid extra loops
https://bugs.webkit.org/show_bug.cgi?id=119061

Reviewed by Darin Adler.

This patch removes order values Vector and use a Vector of pairs instead. The pairs are formed by a child
(RenderBox) and the index of this child. In addition, OrderIterator code is simplified.

It provides a helper class OrderIteratorPopulator, used for manipulating the Vector directly. Which allows to
consolidate the code into a single implementation across flexbox and grid. OrderIteratorPopulator part is based
on a patch from Blink r153971 by <jchaffraix@chromium.org>.

Current implementation is O(number of children * number of order values). Now it will just do a sort operation
and then a regular loop. So if you have different order values in a flexbox or grid the performance will
improve.

Comparing results of perf-tests:
* Layout/auto-grid-lots-of-data: ~0.5% worse.
* Layout/fixed-grid-lots-of-data: ~0.5% worse.
* Layout/fixed-grid-lots-of-data (setting 100 different order values): ~50% better.
* Layout/flexbox-lots-of-data: ~5% better.

No new tests, already covered by current tests.

* rendering/OrderIterator.cpp:
(WebCore::OrderIterator::currentChild): Return current child according to m_childrenIndex.
(WebCore::OrderIterator::first): Initialize m_childrenIndex and return current child.
(WebCore::OrderIterator::next): Increase m_childrenIndex and return current child.
(WebCore::compareByOrderValueAndIndex): Sorts the Vector by order value and index.
(WebCore::OrderIteratorPopulator::~OrderIteratorPopulator): Calls compareByOrderValueAndIndex() if there is any
child with non default order value.
(WebCore::OrderIteratorPopulator::collectChild): Adds the child and index to the Vector. Update
m_allChildrenHaveDefaultOrderValue accordingly.
(WebCore::OrderIterator::OrderIterator): Deleted.
(WebCore::OrderIterator::setOrderValues): Deleted.
(WebCore::OrderIterator::reset): Deleted.
* rendering/OrderIterator.h:
(WebCore::OrderIteratorPopulator::OrderIteratorPopulator): New helper class to manipulate the Vector.
(WebCore::OrderIterator::currentChild): Deleted.
* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::RenderFlexibleBox): Remove OrderIterator intialization.
(WebCore::RenderFlexibleBox::layoutBlock): Remove unneeded code related to old OrderValues vector.
(WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins): Populate OrderIterator using collectChild().
(WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Deleted.
* rendering/RenderFlexibleBox.h: Rename computeMainAxisPreferredSizes() to prepareOrderIteratorAndMargins().
* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::RenderGrid): Remove OrderIterator initialization.
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator): Populate OrderIterator using collectChild().


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167879 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Update GObject DOM bindings symbols file.

* bindings/gobject/webkitdom.symbols: Add missing symbols.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167880 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Review media bugs flags
https://bugs.webkit.org/show_bug.cgi?id=132246

Reviewed by Philippe Normand.

* platform/gtk/TestExpectations: Review flags of the GTK media
bugs.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167881 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening. Adding failure expectations for 6
failing and flaky tests. Removed 1.

* platform/gtk/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167882 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Crash in debug build with removing windowed plugin child widgets from the view
https://bugs.webkit.org/show_bug.cgi?id=132252

Reviewed by Philippe Normand.

It crashes due to an assert in HashTable that checks the iterators
validity. The problem is that we are iterating the children map
and the callback called on every iteration might modify the map,
making the iterators invalid. This happens when the WebView is
destroyed, GtkContainer calls gtk_container_foreach() with
gtk_widget_destroy as callback. When a widget inside a container
is destroyed, it's removed from the container, and in our case,
the child widget is removed from the map. This fixes several
crashes when running layout tests in debug bot.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseContainerForall): Use copyKeysToVector() instead
of using a range iterator for the map keys and check in every
iteration that the child widget from the keys vector is still
present in the map before calling the callback.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167883 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][WK2] Missing return statement in webkit_plugin_get_description()
https://bugs.webkit.org/show_bug.cgi?id=132263

Reviewed by Carlos Garcia Campos.

* UIProcess/API/gtk/WebKitPlugin.cpp:
(webkit_plugin_get_description): Actually return the data of the cached
plugin description CString.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167884 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2][X11] NetscapePluginModule::scanPlugin() should write UTF-8 strings to stdout
https://bugs.webkit.org/show_bug.cgi?id=132245

Reviewed by Carlos Garcia Campos.

NetscapePluginModule::scanPlugin(), in the helper writeLine function, takes each character
of the given string and writes it out as a UChar, doing two fputc calls for each byte of the
16-bit type.

This fails badly with characters with integer value less than 256 as the most significant byte
of the UChar is written out as a null character. This effectively chops the output that's gathered
in the UIProcess and is parsed in PluginProcessProxy::scanPlugin().

To avoid all this, the UTF-8 encoding of the string is written out in the PluginProcess, and
String::fromUTF8() is called in the UIProcess to properly decode the received string.

* Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp:
(WebKit::writeCharacter):
(WebKit::writeLine):
(WebKit::writeByte): Deleted.
* UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:
(WebKit::PluginProcessProxy::scanPlugin):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167885 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening.

* platform/gtk/TestExpectations: Flagged some tests.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167886 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Builtin cursors do not properly handle transparency
https://bugs.webkit.org/show_bug.cgi?id=131866

Reviewed by Gustavo Noronha Silva.

Tested by ManualTests/cursor.html.

* platform/gtk/CursorGtk.cpp:
(WebCore::createNamedCursor): Instead of interpreting the source bitmap as an A1 image, use
it as a 1-bit black and white image. We do this by:
    1. Painting the result to a full color image with transparency instead of an alpha-only surface.
    2. Masking a white background using the cursor alpha surface.
    3. Painting the black parts of the cursor by painting the source surface, where black pixels
    will be interpreted as full opaque pixels.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167887 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening.

* platform/gtk/TestExpectations: Flagged some tests.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167888 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Deleting properties poisons objects
https://bugs.webkit.org/show_bug.cgi?id=131551

Reviewed by Oliver Hunt.

Source/JavaScriptCore:
This is ~3% progression on Dromaeo with a ~6% progression on the jslib portion of Dromaeo in particular.

* runtime/JSPropertyNameIterator.cpp:
(JSC::JSPropertyNameIterator::create):
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::hasDeletedOffset):
(JSC::PropertyTable::hadDeletedOffset): If we ever had deleted properties we can no longer cache offsets when
iterating properties because we're required to iterate properties in insertion order.
* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap): We now re-use deleted properties when materializing the property map.
(JSC::Structure::removePropertyTransition): We allow up to 5 deletes for a particular path through the tree of
Structure transitions. After that, we convert to an uncacheable dictionary like we used to. We don't cache
delete transitions, but we allow transitioning from them.
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::removePropertyWithoutTransition):
(JSC::Structure::pin): Now does only what it says it does--marks the property table as pinned.
(JSC::Structure::pinAndPreventTransitions): More descriptive version of what the old pin() was doing.
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::setEnumerationCache):
(JSC::Structure::hadDeletedOffsets):
(JSC::Structure::propertyTable):
(JSC::Structure::checkOffsetConsistency): Rearranged variables to be more sensible.
* tests/stress/for-in-after-delete.js: Added.
(foo):

LayoutTests:
New JS regress test. We're ~3.5x faster on this microbenchmark now.

* js/regress/delete-a-few-properties-then-get-by-id-expected.txt: Added.
* js/regress/delete-a-few-properties-then-get-by-id.html: Added.
* js/regress/script-tests/delete-a-few-properties-then-get-by-id.js: Added.
(MyObject):
(foo):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167889 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[X11] Add missing case for mime type application/x-webkit-test-netscape
https://bugs.webkit.org/show_bug.cgi?id=132278

Patch by Krzysztof Wolanski <k.wolanski@samsung.com> on 2014-04-28
Reviewed by Darin Adler.

Case for x-webkit-test-netscape has been omitted along with r167759.

* WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
(WebKit::NetscapePlugin::initialize):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167890 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WK2] flickery scrolling with overflow-scrolling:touch
https://bugs.webkit.org/show_bug.cgi?id=132150

Source/WebCore:

Reviewed by Tim Horton.

Fix typo in a comment.

* page/scrolling/AsyncScrollingCoordinator.cpp:
(WebCore::AsyncScrollingCoordinator::scheduleUpdateScrollPositionAfterAsyncScroll):

Source/WebKit2:
<rdar://problem/16683006>

Reviewed by Tim Horton.

Maintain a flag that tells us if the user is interacting
with the UIScrollView, and while set, don't clobber the contentOffset
via scrolling tree updates.

* UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.mm:
(-[WKOverflowScrollViewDelegate initWithScrollingTreeNode:WebKit::]):
(-[WKOverflowScrollViewDelegate scrollViewWillBeginDragging:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDragging:willDecelerate:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDecelerating:]): We need this one,
not scrollViewDidEndScrollingAnimation:, to detect the end of decleration.
(WebKit::ScrollingTreeOverflowScrollingNodeIOS::updateAfterChildren):
(-[WKOverflowScrollViewDelegate scrollViewDidEndScrollingAnimation:]): Deleted.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167891 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WK2] Make subview rebuilding more incremental
https://bugs.webkit.org/show_bug.cgi?id=132162
<rdar://problem/16718916>

Reviewed by Sam Weinig.

Previously we did bulk replacement of subviews, but that triggers
UIKit to send spurious will/DidMoveToWindow messages, which can
interfere with UIScrollView scrolling.

Make _web_setSubviews more incremental, only removing
deleted subviews, adding new ones, and moving existing ones
into the correct order.

* Shared/mac/RemoteLayerTreePropertyApplier.mm:
(-[UIView _web_setSubviews:]):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167892 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the iOS buld.

* UIProcess/WebPageProxy.cpp:
(WebKit::areAllTouchPointsReleased):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167893 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r167853.
https://bugs.webkit.org/show_bug.cgi?id=132288

caused crashes+timeouts+layout test failures described in the
bug (Requested by thorton on #webkit).

Reverted changeset:

"Coalesce responses on network process side"
https://bugs.webkit.org/show_bug.cgi?id=132229
http://trac.webkit.org/changeset/167853

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167894 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r167871.
https://bugs.webkit.org/show_bug.cgi?id=132290

broke a newmulticol test (spanner-nested-dynamic) (Requested
by thorton on #webkit).

Reverted changeset:

"Store the containing region map inside the flow thread"
https://bugs.webkit.org/show_bug.cgi?id=131647
http://trac.webkit.org/changeset/167871

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167895 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Hide service controls for selection behind a runtime switch
<rdar://problem/16736616> and https://bugs.webkit.org/show_bug.cgi?id=132291

Reviewed by Tim Horton.

* Shared/WebPreferencesStore.h:

* WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::selectionRectsDidChange): Do nothing if the UI is disabled.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::WebPage):
(WebKit::WebPage::updatePreferences):

* WebProcess/WebPage/WebPage.h:
(WebKit::WebPage::serviceControlsEnabled):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167896 268f45cc-cd09-0410-ab3c-d52691b4dbfc
GC should be able to remove things from the DFG worklist and cancel on-going compilations if it knows that the compilation would already be invalidated
https://bugs.webkit.org/show_bug.cgi?id=132166

Reviewed by Oliver Hunt and Mark Hahnenberg.
        
The GC can aid type inference by removing structures that are dead and jettisoning
code that relies on those structures. This can dramatically accelerate type inference
for some tricky programs.
        
Unfortunately, we previously pinned any structures that enqueued compilations depended
on. This means that if you're on a machine that only runs a single compilation thread
and where compilations are relatively slow, you have a high chance of large numbers of
structures being pinned during any GC since the compilation queue is likely to be full
of random stuff.
        
This comprehensively fixes this issue by allowing the GC to remove compilation plans
if the things they depend on are dead, and to even cancel safepointed compilations.
        
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
(JSC::CodeBlock::isKnownToBeLiveDuringGC):
(JSC::CodeBlock::finalizeUnconditionally):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan): Deleted.
* dfg/DFGDesiredIdentifiers.cpp:
(JSC::DFG::DesiredIdentifiers::DesiredIdentifiers):
* dfg/DFGDesiredIdentifiers.h:
* dfg/DFGDesiredWatchpoints.h:
* dfg/DFGDesiredWeakReferences.cpp:
(JSC::DFG::DesiredWeakReferences::DesiredWeakReferences):
* dfg/DFGDesiredWeakReferences.h:
* dfg/DFGGraphSafepoint.cpp:
(JSC::DFG::GraphSafepoint::GraphSafepoint):
* dfg/DFGGraphSafepoint.h:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::Plan):
(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::notifyCompiling):
(JSC::DFG::Plan::notifyCompiled):
(JSC::DFG::Plan::notifyReady):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::isKnownToBeLiveDuringGC):
(JSC::DFG::Plan::cancel):
(JSC::DFG::Plan::visitChildren): Deleted.
* dfg/DFGPlan.h:
* dfg/DFGSafepoint.cpp:
(JSC::DFG::Safepoint::Result::~Result):
(JSC::DFG::Safepoint::Result::didGetCancelled):
(JSC::DFG::Safepoint::Safepoint):
(JSC::DFG::Safepoint::~Safepoint):
(JSC::DFG::Safepoint::checkLivenessAndVisitChildren):
(JSC::DFG::Safepoint::isKnownToBeLiveDuringGC):
(JSC::DFG::Safepoint::cancel):
(JSC::DFG::Safepoint::visitChildren): Deleted.
* dfg/DFGSafepoint.h:
(JSC::DFG::Safepoint::Result::Result):
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::compilationState):
(JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
(JSC::DFG::Worklist::removeAllReadyPlansForVM):
(JSC::DFG::Worklist::completeAllReadyPlansForVM):
(JSC::DFG::Worklist::visitWeakReferences):
(JSC::DFG::Worklist::removeDeadPlans):
(JSC::DFG::Worklist::runThread):
(JSC::DFG::Worklist::visitChildren): Deleted.
* dfg/DFGWorklist.h:
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* ftl/FTLCompile.h:
* heap/CodeBlockSet.cpp:
(JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
* heap/Heap.cpp:
(JSC::Heap::markRoots):
(JSC::Heap::visitCompilerWorklistWeakReferences):
(JSC::Heap::removeDeadCompilerWorklistEntries):
(JSC::Heap::visitWeakHandles):
(JSC::Heap::collect):
(JSC::Heap::visitCompilerWorklists): Deleted.
* heap/Heap.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167897 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r167845): ASSERT(!m_renderView.needsLayout()) in svg/custom/bug79798.html
https://bugs.webkit.org/show_bug.cgi?id=132297

* platform/wk2/TestExpectations:
Skip the test.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167898 268f45cc-cd09-0410-ab3c-d52691b4dbfc