use after free in WebCore::DocumentOrderedMap::remove / WebCore::TreeScope::removeElementById
https://bugs.webkit.org/show_bug.cgi?id=121324

Reviewed by Ryosuke Niwa.

Update the document ordered map for an image element before dispatching load or error events
when it's inserted into a document.

Source/WebCore:

Test: fast/dom/modify-node-and-while-in-the-callback-too-crash.html

* dom/DocumentOrderedMap.cpp: defensive fix to avoid use after free issues.
(WebCore::DocumentOrderedMap::remove):
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::insertedInto):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::updateFromElement): setting m_failedLoadURL makes
repeated updateFromElement calls return early.

LayoutTests:

* fast/dom/modify-node-and-while-in-the-callback-too-crash-expected.txt: Added.
* fast/dom/modify-node-and-while-in-the-callback-too-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159481 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: aria-labelledby should be used in preference to aria-labeledby
https://bugs.webkit.org/show_bug.cgi?id=62351

Reviewed by Chris Fleizach.

Source/WebCore:

Making sure aria-labelled by overrides the incorrectly spelled aria-labeledby attribute.

Test: accessibility/aria-labelledby-overrides-aria-labeledby.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::ariaLabeledByElements):

LayoutTests:

Added test to make sure aria-labelledby overrides aria-labeledby correctly.

* accessibility/aria-labelledby-overrides-aria-labeledby-expected.txt: Added.
* accessibility/aria-labelledby-overrides-aria-labeledby.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
build.webkit.org/dashboard builder headers should link to the builder page
https://bugs.webkit.org/show_bug.cgi?id=124553

Reviewed by Timothy Hatcher.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueue.js:
(BuildbotQueue.prototype.get overviewURL):
Add overviewURL(), which returns the URL to the builder overview page, with the last 50 builds shown.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotBuilderQueueView.js:
(BuildbotBuilderQueueView.prototype.update.appendBuildArchitecture):
(BuildbotBuilderQueueView.prototype.update):
* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotTesterQueueView.js:
(BuildbotTesterQueueView.prototype.update.appendBuilderQueueStatus):
(BuildbotTesterQueueView.prototype.update.appendBuild):
(BuildbotTesterQueueView.prototype.update):
* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Styles/BuildbotQueueView.css:
(.queue-view .queueLabel):
(.queue-view .queueLabel:not(:first-child)):
Make the header a link instead of a label, and wire it up to overviewURL.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159484 268f45cc-cd09-0410-ab3c-d52691b4dbfc