Regression(r132681): Heap-use-after-free in WebCore::RenderTextTrackCue::layout
https://bugs.webkit.org/show_bug.cgi?id=100981

Patch by Aaron Colwell <acolwell@chromium.org> on 2012-11-06
Reviewed by Eric Carlson.

Source/WebCore:

Fixing a TextTrackCue use after free bug. textTrackRemoveCues() needs to be called when
an HTMLTrackElement is removed from an HTMLMediaElement so that references to
TextTrackCues are removed from m_cueTree.

Test: media/track/track-remove-by-setting-innerHTML.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::willRemoveTrack):

LayoutTests:

Added a test that removes track elements by setting innerHTML on the track's parent.

* media/track/track-remove-by-setting-innerHTML-expected.txt: Added.
* media/track/track-remove-by-setting-innerHTML.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133609 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Heap-buffer-overflow in WebCore::TextTrackCueList::add
https://bugs.webkit.org/show_bug.cgi?id=101018

Patch by Aaron Colwell <acolwell@chromium.org> on 2012-11-06
Reviewed by Eric Carlson.

Source/WebCore:

Added an extra check to avoid using a negative array index when a cue
is added to the beginning of the list.

Test case added to LayoutTests/media/track/track-add-remove-cue.html.

* html/track/TextTrackCueList.cpp:
(WebCore::TextTrackCueList::add):

LayoutTests:

Added a test case to verify that adding a cue to the beginning of a non-empty list doesn't crash.

* media/track/track-add-remove-cue-expected.txt:
* media/track/track-add-remove-cue.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133610 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Unreviewed gardening.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133611 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed.  Rolled DEPS.

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133612 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] fast/images/exif-orientation-image-document.html failing on WK2 bots
https://bugs.webkit.org/show_bug.cgi?id=101344

Unreviewed gardening.

Patch by Thiago Marcos P. Santos <thiago.santos@intel.com> on 2012-11-06

* platform/efl-wk2/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133613 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Added console.clear() method

Web Inspector: add console.clear()
https://bugs.webkit.org/show_bug.cgi?id=101021

Patch by Andrey Lushnikov <lushnikov@google.com> on 2012-11-06
Reviewed by Vsevolod Vlasov.

Source/WebCore:

Adds native implementation of console.clear

Test: inspector/console/console-clear-function.html

* English.lproj/localizedStrings.js: Adds 'Console was cleared' string
* inspector/ConsoleMessage.cpp:
(WebCore::messageTypeValue): Adds ClearMessageType
* inspector/Inspector.json:
* inspector/InspectorConsoleAgent.cpp:
(WebCore::InspectorConsoleAgent::addMessageToConsole):
* inspector/front-end/ConsoleMessage.js:
(WebInspector.ConsoleMessageImpl.prototype._formatMessage): Display strategy for "clear" message
* inspector/front-end/ConsoleModel.js:
* inspector/front-end/inspector.css:
(.console-info): Adds style for the 'console was cleared' message
* page/Console.cpp: backend binging for console.clear()
(WebCore::Console::clear):
(WebCore):
* page/Console.h:
(Console):
* page/Console.idl: Adds 'clear' message to protocol
* page/ConsoleTypes.h:

Source/WebKit/mac:

* WebCoreSupport/WebChromeClient.mm:
(stringForMessageType): Added ClearMessageType case to switch

LayoutTests:

* inspector/console/console-clear-function-expected.txt: Added.
* inspector/console/console-clear-function.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133614 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Gardening. Unskip test that's been passing for a while.

* platform/efl-wk2/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133615 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Unreviewed gardening.

Mark fast/dom/shadow/shadowdom-for-output-only-shadow.html as flaky.

* platform/efl/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133616 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Make webkit_lint happy.  Unreviewed.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133617 268f45cc-cd09-0410-ab3c-d52691b4dbfc