Crash in WebCore::HTMLMediaElement::~HTMLMediaElement.
https://bugs.webkit.org/show_bug.cgi?id=113531

Reviewed by Adam Barth.

No new tests, though this is intermittently reproducible with
http/tests/misc/delete-frame-during-readystatechange.html under ASAN.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::~HTMLMediaElement): Clear the media player manually
    before the destructor exits. Clearing the media player may cancel a resource load,
    which can trigger a readystatechange event. It's possible for the HTMLMediaElement
    to attempt to fire an abort event within the readystatechange event, even though it is
    now in an inconsistent state. Clearling the media player before finishing the destructor
    ensures that the HTMLMediaElement will at least still be alive if this case is triggered.
    Set m_completelyLoaded to true to ensure that if userCancelledLoad() is called, it doesn't
    attempt to fire events while destructing.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@147370 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Shadow DOM] Change the order of event dispatching at AT_TARGET phase.
https://bugs.webkit.org/show_bug.cgi?id=113676

Reviewed by Dimitri Glazkov.

Source/WebCore:

Change the order of event dispatching at AT_TARGET phase so that it mimics bubbling events.

The spec side bug is:
https://www.w3.org/Bugs/Public/show_bug.cgi?id=21404

Example:

Given the event path, from Node A (top-most) to Node G (target,
inner-most), where C and D are shadow hosts and G is the target,
the event dispatching order in the current WebKit implementation is:
(T: AT_TARGET, C: CAPTURING, B: BUBBLING)

For bubbling events:

  A          1 (C)  11 (B)
  B          2 (C)  10 (B)
  C (SH)     3 (T)
  D          4 (C)   9 (B)
  E (SH)     5 (T)
  F          6 (C)   8 (B)
  G (Target) 7 (T)

For non-bubbling events:

  A          1 (C)
  B          2 (C)
  C (SH)     3 (T)
  D          4 (C)
  E (SH)     5 (T)
  F          6 (C)
  G (Target) 7 (T)

This patch has changed the order of event dispatching as follows:

For bubbling events:

  A          1 (C)  11 (B)
  B          2 (C)  10 (B)
  C (SH)             9 (T)
  D          3 (C)   8 (B)
  E (SH)             7 (T)
  F          4 (C)   6 (B)
  G (Target)         5 (T)

For non-bubbling events:

  A          1 (C)
  B          2 (C)
  C (SH)            7 (T)
  D          3 (C)
  E (SH)            6 (T)
  F          4 (C)
  G (Target)        5 (T)

No new tests, updating existing layouts.

* dom/EventDispatcher.cpp:
(WebCore::EventDispatcher::dispatchEventAtCapturing):
(WebCore::EventDispatcher::dispatchEventAtBubbling):
* dom/EventDispatcher.h:
(EventDispatcher):

LayoutTests:

* fast/dom/shadow/cppevent-in-shadow-expected.txt:
* fast/dom/shadow/cppevent-input-in-shadow-expected.txt:
* fast/dom/shadow/events-stopped-at-shadow-boundary-expected.txt:
* fast/dom/shadow/gesture-tap-expected.txt:
* fast/dom/shadow/shadow-boundary-events-expected.txt:
* fast/dom/shadow/shadow-boundary-events.html:
* fast/dom/shadow/shadow-dom-event-dispatching-distributed-text-node-expected.txt:
* fast/dom/shadow/shadow-dom-event-dispatching-fallback-nodes-expected.txt:
* fast/dom/shadow/shadow-dom-event-dispatching-non-distributed-nodes-expected.txt:
* fast/dom/shadow/shadow-dom-event-dispatching-text-node-in-shadow-root-expected.txt:
* fast/dom/shadow/shadow-root-blur-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@147371 268f45cc-cd09-0410-ab3c-d52691b4dbfc