Disallow sizes and offsets that can't fit into a 32-bit integer in WebGL.

So we have consistent behaviors on various systems.

BUG=363869
TEST=webgl conformance tests, especially http://www.khronos.org/registry/webgl/sdk/tests/conformance/rendering/draw-elements-out-of-bounds.html
R=kbr@chromium.org

Review URL: https://codereview.chromium.org/255713002

git-svn-id: svn://svn.chromium.org/blink/trunk@172808 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[FastTextAutosizer] Remove O(n^2) supercluster text check

This patch removes an O(n^2) call in FastTextAutosizer::inflateTable where
every table cell will typically be in the same supercluster but
anyClusterHasEnoughTextToAutosize is recomputed for each cell. This patch
renames anyClusterHasEnoughTextToAutosize to superclusterHasEnoughTextToAutosize
and caches the result.

I've filed crbug.com/367484 to further cleanup
superclusterHasEnoughTextToAutosize once this lands.

Performance on Robohornet pro:
FastTextAutosizer (with patch): 4.94s (average of 3 runs)
FastTextAutosizer (without patch): 219.829s
TextAutosizer (old): 5.44s (average of 3 runs)
No autosizer: 4.75s (average of 3 runs)

Once this lands I will revert [1] which disabled the robohornet pro test.

[1] https://src.chromium.org/viewvc/chrome?view=rev&revision=266233

BUG=357338
BUG=302005

Review URL: https://codereview.chromium.org/251053002

git-svn-id: svn://svn.chromium.org/blink/trunk@172809 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add a "forwarded" flag to usergesture tokens.

Exposing this and using it in DOMTimer to check if a user gesture token
should be forwarded allows for other ways of forwarding user gestures
while still preventing a user gesture from being forwarded more than
once.

BUG=354217

Review URL: https://codereview.chromium.org/258783004

git-svn-id: svn://svn.chromium.org/blink/trunk@172810 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Compute repaint rects for squashed layers w.r.t. the transformed ancestor,
then translate them to the coordinate space of the squashing layer.

Previously there was one clear bug and one design flaw in the repaint logic for squashing:

1. Bug: RenderLayers that were children of squashed RenderLayers had any transform and
offset to the squashed RenderLayer double-added to the repaint rect when transforming
into the coordinate space of the squashed Renderlayer.

2. Design flaw: there was a bunch of one-off code in RenderObject::repaintUsingContainer that did
not belong there, duplicates existing repaint code, and is probably wrong in some corner cases.

We fix this by using the repainting code (almost) in the way it was intended:
 (a) always issue repaint rects w.r.t. some ancestor of the current render object/render layer
 (b) always issue repaint rects in the same coordinate space of the graphics layer.

This CL achieves (a) by repainting all squashed layers into the transformed ancestor of the
squashing layer as a repaintContainer. This is guaranteed to be an ancestor of all squashed
layers due to a check in RenderLayerCompositor::canSquashIntoCurrentSquashingOwner().

It almost achieves (b) because the squashing graphics layer differs from the coordinate space
of the transformed ancestor only by a translation (this is because by definition, the
transform ancestor is the lowest ancestor which contains a transform, i.e. may not a
translation). We add in special code to toss in this offset right at the end, and some
special code to adjust for the transformed ancestor.

BUG=366080

Review URL: https://codereview.chromium.org/259953004

git-svn-id: svn://svn.chromium.org/blink/trunk@172811 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[webcrypto] Reject failed operations with a DOMException rather than null.

This corresponds with the WebCrypto spec update:
https://dvcs.w3.org/hg/webcrypto-api/rev/64993be45f9f

BUG=245025

Review URL: https://codereview.chromium.org/243853004

git-svn-id: svn://svn.chromium.org/blink/trunk@172812 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Send code review threads containiing core/rendering to blink-reviews-rendering@chromium.org.
(This list was just created, for the purpose of these code review threads).
This change allows one to subscribe to a more targeted list than the firehose of blink-reviews@,
and without a message directly to you like with a watchlist that emails you. This allows one
to more easily mute or filter these threads away from the inbox.

BUG=

Review URL: https://codereview.chromium.org/252973003

git-svn-id: svn://svn.chromium.org/blink/trunk@172813 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Unship MediaController by making it an experimental runtime-enabled feature

Intent to Unship:
https://groups.google.com/a/chromium.org/d/msg/blink-dev/MVcoNSPs1UQ/LIF-fvu2lwoJ

BUG=none

Review URL: https://codereview.chromium.org/250553006

git-svn-id: svn://svn.chromium.org/blink/trunk@172814 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Don't used cached clip rects for the ancestor clipping layer.

Really, we should use a cached rect here, but our caching mechanism is
currently broken. Until we sort it out properly, we should disable the
use of cached clips in this case.

R=abarth@chromium.org
BUG=353470

Review URL: https://codereview.chromium.org/256703005

git-svn-id: svn://svn.chromium.org/blink/trunk@172815 bbb929c8-8fbe-4397-9dbb-9b2b20218538