Bad cast from CSSInitialValue to CSSValueList
https://bugs.webkit.org/show_bug.cgi?id=121729

Source/WebCore: 

Reviewed by Beth Dakin.

Merge https://chromium.googlesource.com/chromium/blink/+/fcfaa51f9207b32cffe751c1a1380a921e464cbb

The issue was that we would cast to CSSValueList without checking
the type of the CSSValue. After this change, we use the ASSERT'ing
cast and explicitly check the type of the CSSValue before the cast.

Test: fast/css/crash-inherit-value-font-family.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseFontFaceValue):

LayoutTests: 

Reviewed by Beth Dakin.
        
Add a regression test. This is not a merge since the test in the Blink change involves
superfluous execCommand calls.

* fast/css/crash-inherit-value-font-family-expected.txt: Added.
* fast/css/crash-inherit-value-font-family.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156222 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Handle panning gestures messages properly on Windows
https://bugs.webkit.org/show_bug.cgi?id=121711

Follow-up fix: five regression tests started to crash on Mac.

Reviewed by Anders Carlsson.

* rendering/RenderLayer.cpp: (WebCore::RenderLayer::scrollByRecursively):
Added null checks, not all callers are interested in scrolled view pointer.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156223 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Another CSS parser leak fix
https://bugs.webkit.org/show_bug.cgi?id=121730

Reviewed by Alexey Proskuryakov.

* css/CSSGrammar.y.in: Added a missing adoptPtr.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156224 268f45cc-cd09-0410-ab3c-d52691b4dbfc