Deleting properties poisons objects
https://bugs.webkit.org/show_bug.cgi?id=131551

Reviewed by Oliver Hunt.

Source/JavaScriptCore:
This is ~3% progression on Dromaeo with a ~6% progression on the jslib portion of Dromaeo in particular.

* runtime/JSPropertyNameIterator.cpp:
(JSC::JSPropertyNameIterator::create):
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::hasDeletedOffset):
(JSC::PropertyTable::hadDeletedOffset): If we ever had deleted properties we can no longer cache offsets when
iterating properties because we're required to iterate properties in insertion order.
* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap): We now re-use deleted properties when materializing the property map.
(JSC::Structure::removePropertyTransition): We allow up to 5 deletes for a particular path through the tree of
Structure transitions. After that, we convert to an uncacheable dictionary like we used to. We don't cache
delete transitions, but we allow transitioning from them.
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::removePropertyWithoutTransition):
(JSC::Structure::pin): Now does only what it says it does--marks the property table as pinned.
(JSC::Structure::pinAndPreventTransitions): More descriptive version of what the old pin() was doing.
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::setEnumerationCache):
(JSC::Structure::hadDeletedOffsets):
(JSC::Structure::propertyTable):
(JSC::Structure::checkOffsetConsistency): Rearranged variables to be more sensible.
* tests/stress/for-in-after-delete.js: Added.
(foo):

LayoutTests:
New JS regress test. We're ~3.5x faster on this microbenchmark now.

* js/regress/delete-a-few-properties-then-get-by-id-expected.txt: Added.
* js/regress/delete-a-few-properties-then-get-by-id.html: Added.
* js/regress/script-tests/delete-a-few-properties-then-get-by-id.js: Added.
(MyObject):
(foo):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167889 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[X11] Add missing case for mime type application/x-webkit-test-netscape
https://bugs.webkit.org/show_bug.cgi?id=132278

Patch by Krzysztof Wolanski <k.wolanski@samsung.com> on 2014-04-28
Reviewed by Darin Adler.

Case for x-webkit-test-netscape has been omitted along with r167759.

* WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
(WebKit::NetscapePlugin::initialize):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167890 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WK2] flickery scrolling with overflow-scrolling:touch
https://bugs.webkit.org/show_bug.cgi?id=132150

Source/WebCore:

Reviewed by Tim Horton.

Fix typo in a comment.

* page/scrolling/AsyncScrollingCoordinator.cpp:
(WebCore::AsyncScrollingCoordinator::scheduleUpdateScrollPositionAfterAsyncScroll):

Source/WebKit2:
<rdar://problem/16683006>

Reviewed by Tim Horton.

Maintain a flag that tells us if the user is interacting
with the UIScrollView, and while set, don't clobber the contentOffset
via scrolling tree updates.

* UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.mm:
(-[WKOverflowScrollViewDelegate initWithScrollingTreeNode:WebKit::]):
(-[WKOverflowScrollViewDelegate scrollViewWillBeginDragging:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDragging:willDecelerate:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDecelerating:]): We need this one,
not scrollViewDidEndScrollingAnimation:, to detect the end of decleration.
(WebKit::ScrollingTreeOverflowScrollingNodeIOS::updateAfterChildren):
(-[WKOverflowScrollViewDelegate scrollViewDidEndScrollingAnimation:]): Deleted.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167891 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WK2] Make subview rebuilding more incremental
https://bugs.webkit.org/show_bug.cgi?id=132162
<rdar://problem/16718916>

Reviewed by Sam Weinig.

Previously we did bulk replacement of subviews, but that triggers
UIKit to send spurious will/DidMoveToWindow messages, which can
interfere with UIScrollView scrolling.

Make _web_setSubviews more incremental, only removing
deleted subviews, adding new ones, and moving existing ones
into the correct order.

* Shared/mac/RemoteLayerTreePropertyApplier.mm:
(-[UIView _web_setSubviews:]):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167892 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the iOS buld.

* UIProcess/WebPageProxy.cpp:
(WebKit::areAllTouchPointsReleased):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167893 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r167853.
https://bugs.webkit.org/show_bug.cgi?id=132288

caused crashes+timeouts+layout test failures described in the
bug (Requested by thorton on #webkit).

Reverted changeset:

"Coalesce responses on network process side"
https://bugs.webkit.org/show_bug.cgi?id=132229
http://trac.webkit.org/changeset/167853

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167894 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r167871.
https://bugs.webkit.org/show_bug.cgi?id=132290

broke a newmulticol test (spanner-nested-dynamic) (Requested
by thorton on #webkit).

Reverted changeset:

"Store the containing region map inside the flow thread"
https://bugs.webkit.org/show_bug.cgi?id=131647
http://trac.webkit.org/changeset/167871

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167895 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Hide service controls for selection behind a runtime switch
<rdar://problem/16736616> and https://bugs.webkit.org/show_bug.cgi?id=132291

Reviewed by Tim Horton.

* Shared/WebPreferencesStore.h:

* WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::selectionRectsDidChange): Do nothing if the UI is disabled.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::WebPage):
(WebKit::WebPage::updatePreferences):

* WebProcess/WebPage/WebPage.h:
(WebKit::WebPage::serviceControlsEnabled):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167896 268f45cc-cd09-0410-ab3c-d52691b4dbfc