Crash in WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches
https://bugs.webkit.org/show_bug.cgi?id=125970

Reviewed by Antti Koivisto.

Source/WebCore: 

The bug was caused by containingBlockForAbsolutePosition returning a non-RenderBlock render object.
Fixed the bug by obtaining its containg block.

Also changed the return type of containingBlockForFixedPosition, containingBlockForAbsolutePosition,
containingBlockForObjectInFlow from RenderElement to RenderBlock as all callers of these functions
had assumed the return value to be an instance of RenderBlock.

Test: svg/text/select-text-inside-non-static-position.html

* rendering/LogicalSelectionOffsetCaches.h:
(WebCore::containingBlockForFixedPosition):
(WebCore::containingBlockForAbsolutePosition):
(WebCore::containingBlockForObjectInFlow):
(WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):

LayoutTests: 

Added a regression test.

* svg/text/select-text-inside-non-static-position-expected.txt: Added.
* svg/text/select-text-inside-non-static-position.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160819 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS: Fall back to cache-less cascade when encountering explicitly inherited value.
<https://webkit.org/b/125968>

When encountering an explicitly inherited value for a property that's not
"statically inherited", drop out of the matched properties cache path
immediately instead of waiting for some coincidence to trigger it later on.

Fixes 3 asserting table tests:

- fast/table/border-collapsing/cached-69296.html
- tables/mozilla/bugs/bug27038-3.html
- tables/mozilla_expected_failures/marvin/backgr_border-table-row-group.html

Reviewed by Antti Koivisto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160820 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DelayedReleaseScope is in the wrong place
https://bugs.webkit.org/show_bug.cgi?id=125876

Reviewed by Geoffrey Garen.

The DelayedReleaseScope needs to be around the free list sweeping in MarkedAllocator::tryAllocateHelper.
This location gives us a good safe point between getting ready to allocate  (i.e. identifying a non-empty
free list) and doing the actual allocation (popping the free list).

* heap/MarkedAllocator.cpp:
(JSC::MarkedAllocator::tryAllocateHelper):
(JSC::MarkedAllocator::allocateSlowCase):
(JSC::MarkedAllocator::addBlock):
* runtime/JSCellInlines.h:
(JSC::allocateCell):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160822 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WinCairo] Unreviewed build fix after r160798.

* win/tools/vsprops/FeatureDefinesCairo.props:
Removed ENABLE_MEDIA_CONTROLS_SCRIPT definition for now.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160823 268f45cc-cd09-0410-ab3c-d52691b4dbfc