Ported from http://trac.webkit.org/changeset/152825
Original author: Jacky Jiang <zhajiang@blackberry.com>

Length(Calculated) won't insert any CalculationValue to CalculationValueHandleMap;
therefore, we dereference null CalculationValue pointer when the temporary
Length object goes out of the scope.
Length(Calculated) is not allowed as it doesn't make sense that we construct
a Calculated Length object with uninitialized calc expression.
The code just wants to blend with zero. To fix the bug, we can just blend
with Length(0, Fixed) here as we currently can blend different type units
and zero has the same behavior regardless of unit.

BUG=261474

Review URL: https://chromiumcodereview.appspot.com/21024002

git-svn-id: svn://svn.chromium.org/blink/trunk@155260 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Auto-rebaseline for r155253

http://src.chromium.org/viewvc/blink?view=revision&revision=155253

BUG=258650
TBR=cbiesinger@chromium.org

Review URL: https://codereview.chromium.org/20990011

git-svn-id: svn://svn.chromium.org/blink/trunk@155261 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[CSS Grid Layout] Store m_grid across layout

This patch implements the logic to correctly invalidate m_grid
whenever needed. This will make it possible to speed up painting
across layout as we can use it to select the right sub-grid to be
painted.

The added tests are the blind spots in our testing (we already have
test checking grid items removal / addition, ...).

BUG=248151

Review URL: https://chromiumcodereview.appspot.com/21205004

git-svn-id: svn://svn.chromium.org/blink/trunk@155262 bbb929c8-8fbe-4397-9dbb-9b2b20218538
DevTools: remove toolbar icons.

Review URL: https://chromiumcodereview.appspot.com/21226002

git-svn-id: svn://svn.chromium.org/blink/trunk@155263 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[SVG2] Merge SVGStyledElement into SVGElement

Merge SVGStyledElement into SVGElement as per the latest SVG2 specification:
https://svgwg.org/svg2-draft/single-page.html#types-InterfaceSVGElement

This greatly simplifies the inheritance model in SVG and is a big step
towards supporting SVG2.

BUG=231536

Review URL: https://chromiumcodereview.appspot.com/21042009

git-svn-id: svn://svn.chromium.org/blink/trunk@155264 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Move paintSkBitmap and friends into NativeImageSkia.

These used to be static methods in ImageSkia, but they are more closely
connected to NativeImageSkia and fit better there.

BUG=242060

Review URL: https://chromiumcodereview.appspot.com/21022006

git-svn-id: svn://svn.chromium.org/blink/trunk@155265 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add UseCounters for display:run-in and display:compact.

This is to see if we can remove these features and simplify the code.
Our run-in implementation is buggy-tastic and, as best I can tell,
compact does nothing different than display:block.

Review URL: https://chromiumcodereview.appspot.com/21081004

git-svn-id: svn://svn.chromium.org/blink/trunk@155266 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add a protector to DocumentLoader::handleSubstituteDataLoadNow()

responseReceived()'s protector now longer does everything it needs, post r155110

BUG=266364
TEST=fast/loader/open-in-srcdoc-unload.html (under asan)

Review URL: https://chromiumcodereview.appspot.com/21369004

git-svn-id: svn://svn.chromium.org/blink/trunk@155267 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove some skip lines for webgl tests.

The webgl directory no longer exists and the other tests pass
according to the trybots.

TBR=kbr@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21385003

git-svn-id: svn://svn.chromium.org/blink/trunk@155268 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove hyphen dictionary from WebKitUnitTests isolate file.

We need to remove this before we can delete the chromium
code.  AFAICT, webkit_unit_tests doesn't try to hyphenate.

BUG=None
R=ojan@chromium.org

Review URL: https://codereview.chromium.org/21124014

git-svn-id: svn://svn.chromium.org/blink/trunk@155269 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Port of WK119295: Shrink Vectors with inline capacity

Original patch by Andreas Kling <akling@apple.com>:

Pack Vector::m_size next to VectorBufferBase::m_capacity so there's no space
wasted on padding when sizeof(T) >= 8. Since m_size is not conceptually part
of the buffer, I just using'ed it into Vector.

BUG=http://webkit.org/b/119295

Review URL: https://chromiumcodereview.appspot.com/21374002

git-svn-id: svn://svn.chromium.org/blink/trunk@155270 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Update tests to no longer use window.internals.

It isn't needed in Blink or in WebKit, so I've removed it upstream in
the CSSWG repo. This merges that change into Blink.

BUG=260357

Review URL: https://chromiumcodereview.appspot.com/20995005

git-svn-id: svn://svn.chromium.org/blink/trunk@155271 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Update percentage rectangle and inset rectangle tests

Update percentage based tests to work with the new positioning model.
Also move the tests to be W3C spec tests, so they have been impored
back here from the CSSWG repo.

This was committed to WebKit as http://trac.webkit.org/changeset/153437

BUG=260357
R=ojan@chromium.org

Review URL: https://codereview.chromium.org/21378004

git-svn-id: svn://svn.chromium.org/blink/trunk@155272 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 154327 "Fix performance regression from Blink r154194."

Still causing perf issues.

> Fix performance regression from Blink r154194.
> 
> Change in Blink r154194 caused perf regression on tests that use many floating
> objects.
> 
> This change reduces the overhead of clearFloats(), at the cost of leaving
> obsolete container references in the floating object container map. These
> references are cleared when the float or the containing RenderBlock is
> deleted. In most cases when these references are being removed, they will be
> re-added again during layout anyway.
> 
> BUG=260286
> R=inferno@chromium.org
> 
> Review URL: https://chromiumcodereview.appspot.com/19240005

TBR=kenrb@chromium.org

Review URL: https://codereview.chromium.org/21406002

git-svn-id: svn://svn.chromium.org/blink/trunk@155273 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add assertions for CSSPrimitiveValue's m_value.valueID accessor.

This is a backport from WebKit r153401 from Sam Weinig reviewed by
Andreas Kling.

Review URL: https://chromiumcodereview.appspot.com/21364004

git-svn-id: svn://svn.chromium.org/blink/trunk@155274 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 154194 "Manage FloatingObjects using hashmaps"

Bad perf regression.

> Manage FloatingObjects using hashmaps
> 
> Previously, FloatingObject objects are kept in a list referenced
> by a member variable in RenderBlock. There have been many special
> cases in which these objects end up in lists that are not cleared
> properly due to mutations of the render tree, resulting in
> security bugs.
> 
> This patch changes FloatingObject tracking to use 2 global
> hashmaps, one of which replaces the member variable pointer
> in RenderBlock, and the other of which stores container
> references, so that we can easily find all RenderBlocks that
> have a given FloatingObject in their maps.
> 
> R=inferno@chromium.org
> BUG=245727
> 
> Review URL: https://chromiumcodereview.appspot.com/16827004

TBR=kenrb@chromium.org

Review URL: https://codereview.chromium.org/21426002

git-svn-id: svn://svn.chromium.org/blink/trunk@155275 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove WebCore::invalidPlatformFileHandle and WebCore::isHandleValid.

These are unused, so we can get rid of these and the corresponding FIXME.

BUG=265858

Review URL: https://chromiumcodereview.appspot.com/21131006

git-svn-id: svn://svn.chromium.org/blink/trunk@155276 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Adjust the default timeout for debug builds to reflect reality.

Currently content_shell is 10x slower in debug mode than release.
The previous code only adjusted the timeout to be 2x slower, and that
led us to mark a lot of tests as either slow or timeout unfairly.

R=abarth@chromium.org, ojan@chromium.org, esprehn@chromium.org
BUG=254188

Review URL: https://chromiumcodereview.appspot.com/18566004

git-svn-id: svn://svn.chromium.org/blink/trunk@155277 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove ASCIILiteral optimization from StringImpl

This CL removes the ASCIILiteral optimization from StringImpl. We now treat
literal strings the same as we treat non-literal strings, which is to say we
copy the into the StringImpl object instead of pointing to them in the heap.

ASCIILiteral is only remaining client of the pointer in StringImpl. Once we
remove this optimization, we can remove the pointer from StringImpl, which
saves 12 bytes on 64 architectures (8 bytes for the pointer itself and 4 bytes
of alignment).

Using a hacked up version of STRING_STATS, I evaluated how much memory the
ASCIILiteral optimiation saves. I compared the memory saved by not copying the
character data into the heap with the 12 bytes per StringImpl object that we'll
save by removing the pointer. To be conservative, I only counted the savings on
StringImpl objects that used the ASCIILiteral optimization.

Browsing around a number of typical web pages, I found that the ASCIILiteral
optimization typically saves about 600 bytes of memory. On some pages, the
ASCIILiteral "optimization" was actually a net negative (because the average
length of the literal strings was less than 12 characters).

This CL doesn't rip out all the callers of these functions. I'll do that in a
followup CL once this CL has been through all the performance bots.

R=eseidel
BUG=262320

Review URL: https://chromiumcodereview.appspot.com/21274008

git-svn-id: svn://svn.chromium.org/blink/trunk@155278 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Enable composited scrollbars on Mac. 

Split ScrollbarThemeMac's paint function into separate parts when
possible, and call into ScrollbarThemeComposite to draw these parts.
Only do this when the overlay scrollbar methods are available.

Change ScrollbarThemeComposite to shrink scrollbars on overscroll, using
the same math as was removed from ScrollbarThemeMac.

Replace multiple instances of scrollbarMap()->get(scrollbar).get() with
calls to painterForScrollbar.

Call registerScrollbar on WebScrollbarThemeClientImpl scrollbars. If
this is not done, then ScrollbarThemeMac::minimumThumbLength will always
return zero because painterForScrollbar will return NULL for these
scrollbars.

Note that the animation of the scrollbars (fade-in, fade-out,
engorge-when-hovered-over, shrink-when-overscrolled) are all still
handled on the main thread, and lag behind the action that would
happen on the impl thread if input events were handled on the impl
thread. 

BUG=133093

Review URL: https://chromiumcodereview.appspot.com/21162004

git-svn-id: svn://svn.chromium.org/blink/trunk@155279 bbb929c8-8fbe-4397-9dbb-9b2b20218538