Get rid of multiple inheritence for SVGViewElement interface
https://bugs.webkit.org/show_bug.cgi?id=118014

Reviewed by Kentaro Hara.

Source/WebCore:

Web IDL no longer supports multiple inheritence. As per the latest
specification SVGViewElement should only inherit from SVGElement.
'implements' statements are used for the rest. This patch refactors
the IDL files to match the latest specification:
http://www.w3.org/TR/SVG2/linking.html#InterfaceSVGViewElement

Note that there is a WebExposed change as SVGZoomAndPan used to be
exposed on the Window and it is not anymore. SVGZoomAndPan merely
supplements SVGViewElement and should not be exposed to JavaScript
according to the latest specification.

No new tests, covered by existing tests.

* CMakeLists.txt:
* DerivedSources.pri:
* GNUmakefile.list.am:
* svg/SVGExternalResourcesRequired.idl:
* svg/SVGFitToViewBox.idl:
* svg/SVGViewElement.idl:
* svg/SVGZoomAndPan.idl:

LayoutTests:

Update / Rebaseline several SVG test cases now that SVGZoomAndPan interface
is no longer exposed.

* fast/js/global-constructors-attributes-expected.txt:
* platform/efl/fast/js/global-constructors-attributes-expected.txt:
* platform/gtk/fast/js/global-constructors-attributes-expected.txt:
* platform/mac-lion/fast/js/global-constructors-attributes-expected.txt:
* platform/qt/fast/js/global-constructors-attributes-expected.txt:
* svg/custom/global-constructors-expected.txt:
* svg/custom/js-svg-constructors-expected.txt:
* svg/custom/js-svg-constructors.svg:
* svg/custom/script-tests/global-constructors.js:
* svg/dom/SVGViewSpec-defaults-expected.txt:
* svg/dom/SVGViewSpec-expected.txt:
* svg/dom/resources/viewspec-parser.js:
(zoomAndPanToString):
(viewSpecToString):
* svg/dom/script-tests/SVGViewSpec-defaults.js:
* svg/dom/script-tests/SVGViewSpec.js:
(continueTesting):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151985 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use-after-free in RadioInputType::handleKeydownEvent
https://bugs.webkit.org/show_bug.cgi?id=118035

Reviewed by Kent Tamura.

Use RefPtr for inputElement since setFocusedNode could blow it away.

* html/RadioInputType.cpp:
(WebCore::RadioInputType::handleKeydownEvent):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151986 268f45cc-cd09-0410-ab3c-d52691b4dbfc