Try to fix the windows build
https://bugs.webkit.org/show_bug.cgi?id=100556

Patch by Elliott Sprehn <esprehn@chromium.org> on 2012-10-26
Reviewed by Eric Seidel.

Touch files by adding whitespace to try and make the windows
build bot regenerate files.

No new tests, just kick the bot.

* dom/DOMAllInOne.cpp:
* html/HTMLElementsAllInOne.cpp:
* html/shadow/TextControlInnerElements.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132692 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Turn PageLoad tests into simple performancetests, commit #6 
https://bugs.webkit.org/show_bug.cgi?id=99899

Reviewed by Ryosuke Niwa.

We cannot provide an elegant way to measure the memory consumption of the PageLoad tests, but we can turn them into simple
performance tests and measure their memory footprint and performance that way. This change moves and renames the related files
to their new location and adds html/js wrappers for them.

This is the #6 commit of the whole patch.

* PageLoad/svg/files/gearflowers.svg: Removed.
* PageLoad/svg/files/hereGear4.svg: Removed.
* PageLoad/svg/files/worldcup.svg: Removed.
* SVG/GearFlowers.html: Added.
* SVG/HereGear.html: Added.
* SVG/Worldcup.html: Added.
* SVG/resources/GearFlowers.svg: Copied from PerformanceTests/PageLoad/svg/files/gearflowers.svg.
* SVG/resources/HereGear.svg: Copied from PerformanceTests/PageLoad/svg/files/hereGear4.svg.
* SVG/resources/Worldcup.svg: Copied from PerformanceTests/PageLoad/svg/files/worldcup.svg.
* Skipped: Rename the files on the skipped list also.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132693 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove Chromium specific expectations for video-media-source-add-and-remove-buffers.html
https://bugs.webkit.org/show_bug.cgi?id=100160

Patch by Aaron Colwell <acolwell@chromium.org> on 2012-10-26
Reviewed by Adam Barth.

The common expectations just reflected a bug in Chromium. The bug has been fixed and the common expectations
have been updated to reflect the correct behavior.

* http/tests/media/media-source/video-media-source-add-and-remove-buffers-expected.txt:
* platform/chromium/http/tests/media/media-source/video-media-source-add-and-remove-buffers-expected.txt: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132694 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in WebProces at WebCore::ResourceLoadScheduler::crossOriginRedirectReceived + 78
<rdar://problem/12575514> and https://bugs.webkit.org/show_bug.cgi?id=100554

Reviewed by Alexey Proskuryakov.

This was fallout from http://trac.webkit.org/changeset/132501 where I missed some of the
spots that call resourceLoadScheduler().

As a result we were creating more than one ResourceLoadScheduler, allowing the host records
to get out of sync.

The fix that also results in less #ifdefs scattered throughout the code is to use a single
choke point for all ResourceLoadScheduler access.

No new tests
(No change of behavior for the default config, not testable at this time in the repro config)

Add a single choke point for accessing the correct ResourceLoadScheduler:
* loader/ResourceLoadScheduler.cpp:
(WebCore::defaultResourceLoadScheduler): New private function that keeps the singleton default ResourceLoadScheduler.
(WebCore::resourceLoadScheduler): Refactor this function to either ask the LoaderStrategy or call through to

Revert back to using that single choke point everywhere:
* dom/ContainerNode.cpp:
(WebCore::ContainerNode::suspendPostAttachCallbacks):
(WebCore::ContainerNode::resumePostAttachCallbacks):

* loader/MainResourceLoader.cpp:
(WebCore::MainResourceLoader::loadNow):

* loader/ResourceLoader.cpp:
(WebCore::ResourceLoader::releaseResources):
(WebCore::ResourceLoader::willSendRequest):

* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::load):

* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::performPostLoadActions):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132695 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Generated should not be supported for things with a shadow
https://bugs.webkit.org/show_bug.cgi?id=98836

Unreviewed rollout of rollout of http://trac.webkit.org/changeset/132269.
Initial rollout was speculative and was shown not to be related to crashes.
Change author: Elliott Sprehn  <esprehn@chromium.org>

Source/WebCore:

As far as CSS is concerned inputs and things with shadow content inside
shouldn't support pseudo elements like :before, :after or :first-letter.
Neither Gecko or Presto supports it, and we only accidentally supported
it.

Until the spec tells us what to do we should disable support. This is
also neccesary because the new generated content implementation doesn't
support shadows.

Test: fast/forms/pseudo-elements.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::updateFirstLetter):
* rendering/RenderListBox.h:
* rendering/RenderObjectChildList.cpp:
(WebCore::RenderObjectChildList::updateBeforeAfterContent):

LayoutTests:

Change all pseudos on <input> tests to be ref tests and clean up the tests.
They now make sure we don't support generated content on things with a shadow.
Also added another test for the other form control types to ensure they don't
support pseudos either.

* fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements.html:
* fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements.html:
* fast/forms/pseudo-elements-expected.html: Added.
* fast/forms/pseudo-elements.html: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements.html:
* fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements.html:
* platform/chromium-linux/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-linux/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-linux/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-linux/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-lion/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png:
* platform/chromium-mac-lion/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-lion/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png:
* platform/chromium-mac-lion/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png:
* platform/chromium-mac-snowleopard/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-snowleopard/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-snowleopard/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-snowleopard/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132696 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebKitIDL] Optional dictionary types should have default values of empty dictionary
https://bugs.webkit.org/show_bug.cgi?id=100547

Reviewed by Adam Barth.

Per WebIDL, "Optional dictionary type arguments are always considered to have a default
value of an empty dictionary." WebKitIDL already supported this via the extended attribute
[Optional=DefaultIsUndefined] but make this the default for Dictionary.

Binding test expectations updated.

* Modules/filesystem/DirectoryEntry.h: Remove default parameters.
(DirectoryEntry):
* Modules/indexeddb/IDBDatabase.h: Remove overloads.
(IDBDatabase):
* Modules/indexeddb/IDBObjectStore.h: Remove overloads.
(IDBObjectStore):
* Modules/mediastream/RTCPeerConnection.idl: Remove DefaultIsUndefined annotations.
* bindings/scripts/CodeGeneratorJS.pm: Special case for Optional Dictionary.
(GenerateParametersCheck):
* bindings/scripts/CodeGeneratorV8.pm: Ditto.
(GenerateParametersCheck):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjPrototypeFunctionOptionsObject): Updated expectation - no early call.
* bindings/scripts/test/V8/V8TestObj.cpp:
(WebCore::TestObjV8Internal::optionsObjectCallback): Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132698 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Notification should be sent when accessibilityIsIgnored changes
https://bugs.webkit.org/show_bug.cgi?id=99547

Reviewed by Chris Fleizach.

Source/WebCore:

Adds a new flag in AccessibilityObject that keeps track of the most recent
value of accessibilityIsIgnored(). After certain events such as an ARIA
attribute change or content change, checks the new value of
accessibilityIsIgnored() and posts a "children changed" notification on the
parent node if it changed, making sure the parent recomputes its vector of
(unignored) children.

Also moves handling of attribute changes to AXObjectCache, and sends
notifications for some attribute changes that were previously silent. On
Chromium, all changes to an accessibility object's attributes should
result in some notification.

Some tests would have broken because an AccessibilityScrollView was created
and holding a reference to a ScrollView for an iframe after it was deleted,
so this change switches AccessibilityScrollView to hold a weak reference
to ScrollView instead.

Tests: platform/chromium/accessibility/is-ignored-change-sends-notification.html
       platform/chromium/accessibility/other-aria-attribute-change-sends-notification.html
       platform/chromium/accessibility/text-change-notification.html

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::focusedUIElementForPage):
(WebCore::AXObjectCache::getOrCreate):
(WebCore::AXObjectCache::textChanged):
(WebCore):
(WebCore::AXObjectCache::childrenChanged):
(WebCore::AXObjectCache::handleAriaRoleChanged):
(WebCore::AXObjectCache::handleAttributeChanged):
(WebCore::AXObjectCache::labelChanged):
(WebCore::AXObjectCache::recomputeIsIgnored):
* accessibility/AXObjectCache.h:
(AXObjectCache):
(WebCore::AXObjectCache::childrenChanged):
(WebCore::AXObjectCache::textChanged):
(WebCore::AXObjectCache::handleAttributeChanged):
(WebCore::AXObjectCache::recomputeIsIgnored):
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::insertChild):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::AccessibilityObject):
(WebCore::AccessibilityObject::cachedIsIgnoredValue):
(WebCore):
(WebCore::AccessibilityObject::setCachedIsIgnoredValue):
(WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityObject::textChanged):
(AccessibilityObject):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
(WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
(WebCore::AccessibilityRenderObject::textChanged):
(WebCore::AccessibilityRenderObject::addHiddenChildren):
(WebCore::AccessibilityRenderObject::addChildren):
* accessibility/AccessibilityRenderObject.h:
(AccessibilityRenderObject):
* accessibility/AccessibilityScrollView.cpp:
(WebCore::AccessibilityScrollView::~AccessibilityScrollView):
(WebCore):
(WebCore::AccessibilityScrollView::detach):
(WebCore::AccessibilityScrollView::isAttachment):
(WebCore::AccessibilityScrollView::widgetForAttachmentView):
(WebCore::AccessibilityScrollView::updateScrollbars):
(WebCore::AccessibilityScrollView::webAreaObject):
(WebCore::AccessibilityScrollView::elementRect):
(WebCore::AccessibilityScrollView::documentFrameView):
(WebCore::AccessibilityScrollView::parentObject):
(WebCore::AccessibilityScrollView::parentObjectIfExists):
(WebCore::AccessibilityScrollView::getScrollableAreaIfScrollable):
(WebCore::AccessibilityScrollView::scrollTo):
* accessibility/AccessibilityScrollView.h:
(WebCore::AccessibilityScrollView::scrollView):
(AccessibilityScrollView):
* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::isDataTable):
* accessibility/chromium/AXObjectCacheChromium.cpp:
(WebCore::AXObjectCache::postPlatformNotification):
* dom/Element.cpp:
(WebCore::Element::attributeChanged):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::deleteLineBoxTree):
(WebCore::RenderBlock::createAndAppendRootInlineBox):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::styleWillChange):
* rendering/RenderText.cpp:
(WebCore::RenderText::setText):

Source/WebKit/chromium:

Adds new accessibility notifications.

* public/WebAccessibilityNotification.h:
* src/AssertMatchingEnums.cpp:

Tools:

Add additional accessibility notifications.

* DumpRenderTree/chromium/WebViewHost.cpp:
(WebViewHost::postAccessibilityNotification):

LayoutTests:

Adds 3 new test to ensure:
1. A "children changed" notification is fired on the parent object when an
   object that was previously ignored becomes unignored.
2. A notification is sent when an element's text (incl. title or label) changes.
3. A notification is sent when another ARIA attribute changes.

Modifies add-to-menu-list-crashes because it was too brittle; it was
    referencing a stale object rather than retrieving its latest handle.
Modifies aria-checkbox-sends-notification to listen on the correct
    object on all platforms.
Simplifies notification-listeners so it doesn't generate additional
    notifications that are inconsistent between platforms now.

* accessibility/aria-checkbox-sends-notification.html:
* accessibility/notification-listeners.html:
* platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt:
* platform/chromium/accessibility/add-to-menu-list-crashes.html:
* platform/chromium/accessibility/is-ignored-change-sends-notification-expected.txt: Added.
* platform/chromium/accessibility/is-ignored-change-sends-notification.html: Added.
* platform/chromium/accessibility/other-aria-attribute-change-sends-notification-expected.txt: Added.
* platform/chromium/accessibility/other-aria-attribute-change-sends-notification.html: Added.
* platform/chromium/accessibility/text-change-notification-expected.txt: Added.
* platform/chromium/accessibility/text-change-notification.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move non-Settings Inspector methods from internals.settings to internals
https://bugs.webkit.org/show_bug.cgi?id=100392

Reviewed by Adam Barth.

Source/WebCore:

These methods don't have to do with the WebCore Settings object, so move them up to internals.
I moved the reset code from InternalSettings to Internals.

No new tests, this is just a rename. Existing tests should pass.

* testing/InternalSettings.cpp:
(WebCore::InternalSettings::Backup::Backup): Remove inspector methods.
(WebCore::InternalSettings::Backup::restoreTo): Remove inspector methods.
* testing/InternalSettings.h:
* testing/InternalSettings.idl:
* testing/Internals.cpp:
(WebCore::Internals::resetToConsistentState): New method for resetting page state. Named after similar
methods in WTR.
(WebCore::Internals::setInspectorResourcesDataSizeLimits): Moved from InspectorSettings.
(WebCore::Internals::setJavaScriptProfilingEnabled): Moved from InspectorSettings.
* testing/Internals.h:
* testing/Internals.idl:
* testing/js/WebCoreTestSupport.cpp:
(WebCoreTestSupport::resetInternalsObject): Reset state in Internals.
* testing/v8/WebCoreTestSupport.cpp:
(WebCoreTestSupport::resetInternalsObject): Reset state in Internals.

LayoutTests:

Update tests to use internals.setJavaScriptProfilingEnabled instead of internals.settings.setJavaScriptProfilingEnabled.
Update tests to use internals.setInspectorResourcesDataSizeLimits instead of internals.settings.setInspectorResourcesDataSizeLimits.

* fast/profiler/anonymous-event-handler.html:
* fast/profiler/anonymous-function-called-from-different-contexts.html:
* fast/profiler/anonymous-function-calls-built-in-functions.html:
* fast/profiler/anonymous-function-calls-eval.html:
* fast/profiler/anonymous-functions-with-display-names.html:
* fast/profiler/apply.html:
* fast/profiler/built-in-function-calls-anonymous.html:
* fast/profiler/built-in-function-calls-user-defined-function.html:
* fast/profiler/call-register-leak.html:
* fast/profiler/call.html:
* fast/profiler/calling-the-function-that-started-the-profiler-from-another-scope.html:
* fast/profiler/compare-multiple-profiles.html:
* fast/profiler/constructor.html:
* fast/profiler/dead-time.html:
* fast/profiler/document-dot-write.html:
* fast/profiler/event-handler.html:
* fast/profiler/execution-context-and-eval-on-same-line.html:
* fast/profiler/inline-event-handler.html:
* fast/profiler/many-calls-in-the-same-scope.html:
* fast/profiler/multiple-and-different-scoped-anonymous-function-calls.html:
* fast/profiler/multiple-and-different-scoped-function-calls.html:
* fast/profiler/multiple-anonymous-functions-called-from-the-same-function.html:
* fast/profiler/multiple-frames.html:
* fast/profiler/named-functions-with-display-names.html:
* fast/profiler/nested-anonymous-functon.html:
* fast/profiler/nested-start-and-stop-profiler.html:
* fast/profiler/no-execution-context.html:
* fast/profiler/one-execution-context.html:
* fast/profiler/profile-calls-in-included-file.html:
* fast/profiler/profile-with-no-title.html:
* fast/profiler/profiling-from-a-nested-location-but-stop-profiling-outside-the-nesting.html:
* fast/profiler/profiling-from-a-nested-location.html:
* fast/profiler/simple-event-call.html:
* fast/profiler/simple-no-level-change.html:
* fast/profiler/start-and-stop-profiler-multiple-times.html:
* fast/profiler/start-and-stop-profiling-in-the-same-function.html:
* fast/profiler/start-but-dont-stop-profiling.html:
* fast/profiler/stop-profiling-after-setTimeout.html:
* fast/profiler/stop-then-function-call.html:
* fast/profiler/two-execution-contexts.html:
* fast/profiler/user-defined-function-calls-built-in-functions.html:
* fast/profiler/window-dot-eval.html:
* http/tests/inspector/network-test.js:
(resetInspectorResourcesData):
* http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html:
* http/tests/inspector/network/network-content-replacement-embed.html:
* http/tests/inspector/network/network-content-replacement-xhr.html:
* inspector/profiler/cpu-profiler-profiling-without-inspector.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132700 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Forward OSR calculation is wrong in the presence of multiple SetLocals, or a mix of SetLocals and Phantoms
https://bugs.webkit.org/show_bug.cgi?id=100461

Reviewed by Oliver Hunt and Gavin Barraclough.

This does a couple of things. First, it removes the part of the change in r131822 that made the forward
OSR exit calculator capable of handling multiple SetLocals. That change was wrong, because it would
blindly assume that all SetLocals had the same ValueRecovery, and would ignore the possibility that if
there is no value recovery then a ForwardCheckStructure on the first SetLocal would not know how to
recover the state associated with the second SetLocal. Then, it introduces the invariant that any bytecode
op that decomposes into multiple SetLocals must first emit dead SetLocals as hints and then emit a second
set of SetLocals to actually do the setting of the locals. This means that if a ForwardCheckStructure (or
any other hoisted forward speculation) is inserted, it will always be inserted on the second set of
SetLocals (since hoisting only touches the live ones), at which point OSR will already know about the
mov hints implied by the first set of (dead) SetLocals. This gives us the behavior we wanted, namely, that
a ForwardCheckStructure applied to a variant set by a resolve_with_base-like operation can correctly do a
forward exit while also ensuring that prior to exiting we set the appropriate locals.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::OSRExit):
* dfg/DFGOSRExit.h:
(OSRExit):
* dfg/DFGOSRExitCompiler.cpp:
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132701 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Prevent NaN offset values in ElementTimeControl.
https://bugs.webkit.org/show_bug.cgi?id=100322

Reviewed by Abhishek Arya.

Source/WebCore:

NaN values can cause ElementTimeControl to go back in time!
If a value of NaN is passed to ElementTimeControl::beginElementAt(offset),
subsequent sorting will cause an assert in SVGSMILElement::findInstanceTime
because NaN values are not properly sorted. NaN SMILTime values
should not be allowed at all, so this patch adds a check for them in
ElementTimeControl's setters.

This patch also adds preventative asserts to catch if SMILTime is ever
initialized with NaN, or if addEndTime/addBeginTime are ever called
with NaN values.

Test: svg/custom/elementTimeControl-nan-crash.html

* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::beginElementAt):
(WebCore::SVGAnimationElement::endElementAt):
* svg/animation/SMILTime.h:
(WebCore::SMILTime::SMILTime):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::addBeginTime):
(WebCore::SVGSMILElement::addEndTime):

LayoutTests:

* svg/custom/elementTimeControl-nan-crash-expected.txt: Added.
* svg/custom/elementTimeControl-nan-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132702 268f45cc-cd09-0410-ab3c-d52691b4dbfc