:-webkit-any pseudo with escaped '(' should not crash.

Pseudo classes or elements which had an escaped '(' character were
recognized as functions after it had been unescaped. That caused for
instance ":-webkit-any\(" to be correctly tokenized as ':' IDENT, but
incorrectly recognized as the -webkit-any _function_. Since mandatory
arguments were not present in the internal representation, the code crashed.

Fixed by making sure IDENTs are recognized as invalid pseudo classes, before
any token matching is done, if the unescaped IDENT ends with a '('.

Also, removed workaround code for a similar crasher for :not() now that the
parsing issue is fixed for :not() as well.

BUG=294023

Review URL: https://chromiumcodereview.appspot.com/23710067

git-svn-id: svn://svn.chromium.org/blink/trunk@157980 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Auto-rebaseline for r157970

http://src.chromium.org/viewvc/blink?view=revision&revision=157970

BUG=251727
TBR=stavila@adobe.com

Review URL: https://codereview.chromium.org/23506046

git-svn-id: svn://svn.chromium.org/blink/trunk@157981 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Web Animations: Correctly apply timing functions to CSS animations

Timing functions for CSS animations should be applied per-keyframe, whereas in
the Web Animations model, timing functions apply to the entire animation. To
solve this, this patch introduces a new ChainedTimingFunction, which chains
together several 'primitive' timing functions.

This causes 5 tests to start passing in the web-animations-css virtual suite.

Note that the update to the web-animations-css expected result for
missing-keyframe-properties-timing-function.html is due to the fact that we
don't yet correctly handle keyframes which specify only a subset of the
properties animated by the animation. See the FIXME in
StyleResolver::resolveKeyframes().

BUG=240653
R=dstockwell

Review URL: https://chromiumcodereview.appspot.com/23542026

git-svn-id: svn://svn.chromium.org/blink/trunk@157982 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert "Support OpenType GSUB lookupType 7 and substFormat 1"

This reverts commit ab2d641b54593df4e38e5ea3f76beb4be93bed77.

The CL has a bug that interprets the subtable offsets incorrectly.
In addition, because the current DroidSansFallback.ttf on Android
contains an incorrect GSUB table, if the CL worked correctly, the
situation would be worse because the puctuations in vertical text
will be substituted with totally unrelated glyphs.

Will reland this CL (with the bug in it fixed) after Android fixes
the incorrect GSUB table in DroidSansFallback.ttf.

BUG=287995
TBR=tony

Review URL: https://chromiumcodereview.appspot.com/23694040

git-svn-id: svn://svn.chromium.org/blink/trunk@157983 bbb929c8-8fbe-4397-9dbb-9b2b20218538