Move popular DOM attributes to prototype chains

Design document: https://docs.google.com/a/google.com/document/d/1yeHTCHhulVIlrKyx9_gCguAhLfcefVOa9uxxfW2LVG0/edit

Intent-to-ship-and-implement in blink-dev: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/t0XiZuMey7M/9-5AuhoFyisJ

This CL moves DOM attributes used in Dromaeo to prototype chains. When I landed the CL two months ago (https://codereview.chromium.org/94403002), it caused 20+% regression in benchmarks. However, now that a V8 side fix is landed, there should be no overhead in moving DOM attributes to prototype chains in theory.

Dromaeo/dom-attr 1086 runs/sec => 1077 runs/sec (-0.8%)
Dromaeo/dom-modify 522 runs/sec => 525 runs/sec (+0.5%)
Dromaeo/dom-query 26150 runs/sec => 26200 runs/sec (+0.2%)
Dromaeo/dom-traverse 564 runs/sec => 544 runs/sec (-3.6%)

I don't understand the regression in dom-traverse. The regression is reproducible but I cannot reproduce the regression in a super-micro benchmark that just repeats accessing div.firstChild. Probably the regression might be a noise.

I'm going to land this CL and see how much regression is observed in perf bots (I'll email to perf-sheriff@). If I find the regression is unacceptable, I'll revert the CL.

See the design document and the Intent-to-ship email for justification for the regression.

BUG=43394

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=167680

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/158713002

git-svn-id: svn://svn.chromium.org/blink/trunk@168383 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Use OwnPtrs for heap contains cache and persistent anchor. We were leaking the HeapContainsCache.

R=haraken@chromium.org, vegorov@chromium.org
BUG=348629
NOTRY=true

Review URL: https://codereview.chromium.org/183683017

git-svn-id: svn://svn.chromium.org/blink/trunk@168384 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: Workaround for crash on quora and geek-and-poke. There is a finalization issue that we need to resolve in CSSCursorImageValue.

R=erik.corry@gmail.com, haraken@chromium.org, wibling@chromium.org
BUG=347943
NOTRY=true

Review URL: https://codereview.chromium.org/185723006

git-svn-id: svn://svn.chromium.org/blink/trunk@168385 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: fix tracing of KeyframeVector which is a HeapVector of Members.

The HeapVector was put in a normal Vector of pairs on the stack
which is not traced.

This issue was found with the ASAN build on layout tests.

R=erik.corry@gmail.com, haraken@chromium.org, wibling@chromium.org, zerny@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/180273021

git-svn-id: svn://svn.chromium.org/blink/trunk@168386 bbb929c8-8fbe-4397-9dbb-9b2b20218538
TimelineFlameChart: process new records incrementally.

BUG=
R=pfeldman@chromium.org

Review URL: https://codereview.chromium.org/186553002

git-svn-id: svn://svn.chromium.org/blink/trunk@168387 bbb929c8-8fbe-4397-9dbb-9b2b20218538