Move most DOM attributes to prototype chains

Move most DOM attributes to prototype chains

This CL is not for review.

BUG=43394

[haraken, 2014-08-06 11:22:27]

The CL moves most DOM attributes to prototype chains. I'll use the CL and
measure performance impact on real-world benchmarks (Silk, Polymer, Speedometer,
Robohornet etc).

[haraken, 2014-08-14 08:10:13]

I hope I've fixed all layout test failures... Watching the try bots.

[haraken, 2014-08-15 00:49:24]

hmm, the CL fixed all layout test failures, but a lot of browser_tests are still
failing... I need to rebaseline/rewrite the tests one by one...

[jsbell, 2014-08-18 16:27:24]

How are performance numbers looking? (I didn't see an update in the bug...)

[haraken, 2014-08-19 00:14:30]

On 2014/08/18 16:27:24, jsbell wrote:
> How are performance numbers looking? (I didn't see an update in the bug...)

It still regresses some benchmarks in Dromaeo (we know exactly why), but doesn't
regress page_cycler, Polymer, Silk, Robohornet and Speedometer.

My current plan is:

(1) Fix all broken tests.
(2) Send a brief announcement to blink-dev.
(3) Land this CL. See what perf tests regress. See what gets broken.
(4) Revert the CL.
(5) If the situation is acceptable, send a solid announcement to blink-dev and
reland the CL.

(I'm OOO this week, so this will happen next week :-)

[haraken, 2014-08-25 13:35:22]

I minimized the browser_test failures. With the CL applied, the following code
fails.

var e = document.createElement("div");
console.log(e.children instanceof HTMLCollection);  // true
for (var i in e.children) { console.log(i) }  // length, item, namedItem
e.children.length;  // "TypeError: Illegal invocation"

I'm not sure if this is a bug of V8 or a bug of bindings... I'll take a look
tomorrow but if someone has any insight, comments are welcomed :)

[haraken, 2014-08-25 13:42:03]

On 2014/08/25 13:35:22, haraken wrote:
> I minimized the browser_test failures. With the CL applied, the following code
> fails.
> 
> var e = document.createElement("div");
> console.log(e.children instanceof HTMLCollection);  // true
> for (var i in e.children) { console.log(i) }  // length, item, namedItem
> e.children.length;  // "TypeError: Illegal invocation"
> 
> I'm not sure if this is a bug of V8 or a bug of bindings... I'll take a look
> tomorrow but if someone has any insight, comments are welcomed :)

I'd guess this is related to custom wrap methods in V8HTMLCollectionCustom.cpp.
It's possible that custom wrapping is causing some type confusion...

[haraken, 2014-08-26 07:42:27]

On 2014/08/25 13:42:03, haraken wrote:
> On 2014/08/25 13:35:22, haraken wrote:
> > I minimized the browser_test failures. With the CL applied, the following
code
> > fails.
> > 
> > var e = document.createElement("div");
> > console.log(e.children instanceof HTMLCollection);  // true
> > for (var i in e.children) { console.log(i) }  // length, item, namedItem
> > e.children.length;  // "TypeError: Illegal invocation"
> > 
> > I'm not sure if this is a bug of V8 or a bug of bindings... I'll take a look
> > tomorrow but if someone has any insight, comments are welcomed :)
> 
> I'd guess this is related to custom wrap methods in
V8HTMLCollectionCustom.cpp.
> It's possible that custom wrapping is causing some type confusion...

I'm suspecting that this is a bug of V8. I created a minimized test case here:
https://codereview.chromium.org/502333003

I'll ask V8 guys for ideas.

[haraken, 2014-08-26 07:57:35]

On 2014/08/26 07:42:27, haraken wrote:
> On 2014/08/25 13:42:03, haraken wrote:
> > On 2014/08/25 13:35:22, haraken wrote:
> > > I minimized the browser_test failures. With the CL applied, the following
> code
> > > fails.
> > > 
> > > var e = document.createElement("div");
> > > console.log(e.children instanceof HTMLCollection);  // true
> > > for (var i in e.children) { console.log(i) }  // length, item, namedItem
> > > e.children.length;  // "TypeError: Illegal invocation"
> > > 
> > > I'm not sure if this is a bug of V8 or a bug of bindings... I'll take a
look
> > > tomorrow but if someone has any insight, comments are welcomed :)
> > 
> > I'd guess this is related to custom wrap methods in
> V8HTMLCollectionCustom.cpp.
> > It's possible that custom wrapping is causing some type confusion...
> 
> I'm suspecting that this is a bug of V8. I created a minimized test case here:
> https://codereview.chromium.org/502333003
> 
> I'll ask V8 guys for ideas.

Filed a V8 bug: https://code.google.com/p/v8/issues/detail?id=3538

[haraken, 2014-08-29 06:49:25]

On 2014/08/26 07:57:35, haraken wrote:
> On 2014/08/26 07:42:27, haraken wrote:
> > On 2014/08/25 13:42:03, haraken wrote:
> > > On 2014/08/25 13:35:22, haraken wrote:
> > > > I minimized the browser_test failures. With the CL applied, the
following
> > code
> > > > fails.
> > > > 
> > > > var e = document.createElement("div");
> > > > console.log(e.children instanceof HTMLCollection);  // true
> > > > for (var i in e.children) { console.log(i) }  // length, item, namedItem
> > > > e.children.length;  // "TypeError: Illegal invocation"
> > > > 
> > > > I'm not sure if this is a bug of V8 or a bug of bindings... I'll take a
> look
> > > > tomorrow but if someone has any insight, comments are welcomed :)
> > > 
> > > I'd guess this is related to custom wrap methods in
> > V8HTMLCollectionCustom.cpp.
> > > It's possible that custom wrapping is causing some type confusion...
> > 
> > I'm suspecting that this is a bug of V8. I created a minimized test case
here:
> > https://codereview.chromium.org/502333003
> > 
> > I'll ask V8 guys for ideas.
> 
> Filed a V8 bug: https://code.google.com/p/v8/issues/detail?id=3538

I manually bisected and found that this is a behavior regression caused by a
recent V8 roll: https://codereview.chromium.org/470403005

[haraken, 2014-08-29 06:50:01]

I'm aiming at landing this CL in Q3.

[haraken, 2014-09-02 11:26:57]

The V8 side bug was fixed in https://codereview.chromium.org/528913002/
(r23586). Waiting for the V8 roll.

[haraken, 2014-12-02 00:59:00]

haraken@chromium.org changed reviewers:
+ arv@chromium.org

[haraken, 2014-12-02 00:59:01]

arv@: This is a list of failing tests with the CL.

https://docs.google.com/a/google.com/spreadsheets/d/14wU3VqFj7cQK1mxF1jZ3g-H_...

[haraken, 2015-01-13 11:23:01]

yukishiino@: Updated the latest CL to the patch set 5. Our goal is to list up
all failing tests and fix them (by updating test results or fixing Blink or V8
bugs).

[jsbell, 2015-01-13 18:19:18]

On 2015/01/13 11:23:01, haraken wrote:
> yukishiino@: Updated the latest CL to the patch set 5. Our goal is to list up
> all failing tests and fix them (by updating test results or fixing Blink or V8
> bugs).

Awesome!

FYI, the storage/indexeddb/keypath-intrinsic-properties.html failure is due to
this difference in behavior:

JSON.stringify(new Blob())

old: "{"type":"","size":0}"
new: "{}"

... but that's just part of the test debug output, not actually part of the
test. The test still verifies the serialization and access of the properties by
Indexed DB, so for that one you can just update test results.

[haraken, 2015-01-14 02:45:24]

On 2015/01/13 18:19:18, jsbell wrote:
> On 2015/01/13 11:23:01, haraken wrote:
> > yukishiino@: Updated the latest CL to the patch set 5. Our goal is to list
up
> > all failing tests and fix them (by updating test results or fixing Blink or
V8
> > bugs).
> 
> Awesome!
> 
> FYI, the storage/indexeddb/keypath-intrinsic-properties.html failure is due to
> this difference in behavior:
> 
> JSON.stringify(new Blob())
> 
> old: "{"type":"","size":0}"
> new: "{}"
> 
> ... but that's just part of the test debug output, not actually part of the
> test. The test still verifies the serialization and access of the properties
by
> Indexed DB, so for that one you can just update test results.

Yeah, as far as I see the bot results, regarding layout tests, we can just
update test results. (c.f., See my fixes in the patch set 4.)

I'm now running browser tests.

[haraken, 2015-01-14 04:30:53]

On 2015/01/14 02:45:24, haraken wrote:
> On 2015/01/13 18:19:18, jsbell wrote:
> > On 2015/01/13 11:23:01, haraken wrote:
> > > yukishiino@: Updated the latest CL to the patch set 5. Our goal is to list
> up
> > > all failing tests and fix them (by updating test results or fixing Blink
or
> V8
> > > bugs).
> > 
> > Awesome!
> > 
> > FYI, the storage/indexeddb/keypath-intrinsic-properties.html failure is due
to
> > this difference in behavior:
> > 
> > JSON.stringify(new Blob())
> > 
> > old: "{"type":"","size":0}"
> > new: "{}"
> > 
> > ... but that's just part of the test debug output, not actually part of the
> > test. The test still verifies the serialization and access of the properties
> by
> > Indexed DB, so for that one you can just update test results.
> 
> Yeah, as far as I see the bot results, regarding layout tests, we can just
> update test results. (c.f., See my fixes in the patch set 4.)
> 
> I'm now running browser tests.

With the patch set 5, only the following tests are failing. This looks like a
real bug but it's great that only 3 tests are failing :)

WebRtcGetUserMediaBrowserTest.GetUserMediaWithMandatorySourceID
WebRtcGetUserMediaBrowserTest.GetUserMediaWithInvalidOptionalSourceID
WebRtcGetUserMediaBrowserTest.GetUserMediaWithInvalidMandatorySourceID

[haraken, 2015-02-02 12:52:38]

The patch set 7 is rebased with ToT.