Harden pointers in FastMalloc's singly linked list implementation
https://bugs.webkit.org/show_bug.cgi?id=105571

Reviewed by Gavin Barraclough.

Add simple xor based hardening of the next pointer in the
fast malloc singly linked list implementation.  We rely on
ASLR to introduce the address randomness we want for the mask.
Happily this produces a very low cost random value to use.

* wtf/FastMalloc.cpp:
(WTF):
(WTF::SLL_Next):
(WTF::SLL_SetNext):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138293 268f45cc-cd09-0410-ab3c-d52691b4dbfc
chromium nrwt: Pick the newest binary found in DEFAULT_BUILD_DIRECTORIES, not the first
https://bugs.webkit.org/show_bug.cgi?id=105498

Reviewed by Dirk Pranke.

Use the newest binary available rather than an than always picking one
build directory over another based on iteration order.

* Scripts/webkitpy/layout_tests/port/chromium.py:
(ChromiumPort._static_build_path):
Check for timestamps.
* Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
(ChromiumMacPortTest.test_build_path_timestamps):
Test that out / xcodebuild selection happens based on timestamps
* Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py:
(ChromiumWinPortTest.test_build_path_timestamps):
Test that out / build selection happens based on timestamps


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138294 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Unreviewed gardening.

Rebaseline tests mentioned in 105121 and remove tests that are passing on Win bots according to the flakiness dashboard.

* platform/chromium-linux/platform/chromium/virtual/gpu/compositedscrolling/overflow/nested-scrolling-expected.png: Added.
* platform/chromium-linux/platform/chromium/virtual/gpu/compositedscrolling/scrollbars/overflow-scrollbar-combinations-expected.png: Added.
* platform/chromium-mac-lion/platform/chromium/virtual/gpu/compositedscrolling/overflow/nested-scrolling-expected.png: Added.
* platform/chromium-mac-lion/platform/chromium/virtual/gpu/compositedscrolling/scrollbars/overflow-scrollbar-combinations-expected.png: Added.
* platform/chromium-mac-snowleopard/platform/chromium/virtual/gpu/compositedscrolling/overflow/nested-scrolling-expected.png: Added.
* platform/chromium-mac-snowleopard/platform/chromium/virtual/gpu/compositedscrolling/scrollbars/overflow-scrollbar-combinations-expected.png: Added.
* platform/chromium-mac/platform/chromium/virtual/gpu/compositedscrolling/overflow/nested-scrolling-expected.png: Added.
* platform/chromium-mac/platform/chromium/virtual/gpu/compositedscrolling/scrollbars/overflow-scrollbar-combinations-expected.png: Added.
* platform/chromium/TestExpectations:
* platform/chromium/platform/chromium/virtual/gpu/compositedscrolling/overflow/overflow-auto-with-touch-toggle-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138295 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fastAttributeLookupAllowed: classAttr is only animatable by SVG styled elements
https://bugs.webkit.org/show_bug.cgi?id=105565

Reviewed by Eric Seidel.

When it comes to determining if we can use fastGetAttribute we should not penalize
all classAttr access just because some SVG styled elements does funky things with
className.

This makes classAttr considered animatable only for styled SVG elements.

No new tests. No change in behavior.

* bindings/scripts/CodeGenerator.pm:
* dom/Element.cpp:
* svg/SVGElement.cpp:
* svg/SVGElement.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138296 268f45cc-cd09-0410-ab3c-d52691b4dbfc