Fix target element handling in SVGSMILElement.
https://bugs.webkit.org/show_bug.cgi?id=104495

Reviewed by Abhishek Arya.

Source/WebCore:

This patch fixes two bugs that led to stale target elements in SVGSMILElement.

r122449 changed the <use> code to call removeAllElementReferencesForTarget to rebuild
dependent <use> trees. This contained a bug where element references would be incorrectly
removed. removeAllElementReferencesForTarget calls svgAttributeChanged(href) on all
references, which can then re-add the references back. The bug is that
removeAllElementReferencesForTarget removes a newly-added reference as the last step.

r136906 changed targetElement() to no longer be lazily resolved so any changes to an
animation's href attribute needed to be tracked. r136906 refactored the code but did not
fix a bug where animation elements not in the document would not react to
svgAttributeChanged(href).

The combination of these two bugs allowed stale targetElement references to exist. A
target element could be removed from the document without dependent animation elements
receiving a notification (bug 1) and not reacting to notifications they received (bug 2).

This patch updates SVGUseElement::buildInstanceTree to only rebuild (not remove) the
elements referencing the target by adding rebuildAllElementReferencesForTarget. This patch
also updates SVGSMILElement to correctly react to svgAttributeChanged() notifications
for href changes even when not in the document.

Test: svg/animations/target-condition-crash.html

* svg/SVGDocumentExtensions.cpp:
(WebCore::SVGDocumentExtensions::rebuildAllElementReferencesForTarget):
(WebCore::SVGDocumentExtensions::removeAllElementReferencesForTarget):

    Refactored so that we can notify element references to update without removing
    references.

* svg/SVGDocumentExtensions.h:
(SVGDocumentExtensions):
* svg/SVGElement.cpp:
(WebCore::SVGElement::~SVGElement):
(WebCore::SVGElement::removedFrom):

    Similar to SVGUseElement::buildShadowAndInstanceTree, this callsite was updated to
    only rebuild references instead of removing them.

(WebCore::SVGElement::attributeChanged):
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::buildShadowAndInstanceTree):

    The comment indicates we just want to rebuild (not remove). This callsite has been
    updated to use the new rebuildAllElementReferencesForTarget function.

(WebCore::SVGUseElement::buildInstanceTree):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::buildPendingResource):
(WebCore::SVGSMILElement::removedFrom):

    Previously, if an SVGSMILElement was not in the document, only clearResourceReferences
    would be called when the target changed. This has been refactored to reset the
    targetElement if the element needs to build resources but is not in the document.

    I looked at moving this into clearResourceReferences (since the target element might
    be considered a reference) but we run into issues calling pure virtual functions in
    the destructor. The current implementation seemed the cleanest.

    SVGSMILElement::removedFrom was cleaned up to match the rest of the code. The comment
    in removedFrom appears to be stale since disconnectConditions does not kill the element.

(WebCore::SVGSMILElement::svgAttributeChanged):

    Removed the bad !inDocument() checks that broke href change notifications.

(WebCore::SVGSMILElement::setTargetElement):

LayoutTests:

* svg/animations/target-condition-crash-expected.txt: Added.
* svg/animations/target-condition-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@137509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: follow up to r136974: handle visibility shortcut in keydown event of ElementsTreeOutline.element
https://bugs.webkit.org/show_bug.cgi?id=104694

Patch by Eberhard Graether <egraether@google.com> on 2012-12-12
Reviewed by Pavel Feldman.

Typing H in the StylesSidebarPane caused toggling of the selected elements visibility. This change only handles
the H keydown when the ElementsPanel is focused.

No new tests.

* inspector/front-end/ElementsTreeOutline.js:
(WebInspector.ElementsTreeOutline):
(WebInspector.ElementsTreeOutline.prototype._onkeydown):
(WebInspector.ElementsTreeOutline.prototype.handleShortcut):
* inspector/front-end/KeyboardShortcut.js:
(WebInspector.KeyboardShortcut.hasNoModifiers):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@137510 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r137490.
http://trac.webkit.org/changeset/137490
https://bugs.webkit.org/show_bug.cgi?id=104838

Breaks Chromium build due to references to
WebSharedWorkerRepository (Requested by aklein on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-12-12

* public/platform/WebKitPlatformSupport.h:
(WebKit):
(WebKitPlatformSupport):
(WebKit::WebKitPlatformSupport::sharedWorkerRepository):
* src/SharedWorkerRepository.cpp:
(WebKit::sharedWorkerRepository):
(WebCore::SharedWorkerRepository::isAvailable):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@137511 268f45cc-cd09-0410-ab3c-d52691b4dbfc