PassOwnPtr, PassOwnArrayPtr: const_pointer_cast should only remove 'const' qualifier.

Remove WTF smart pointers 'const_pointer_cast' functions as they are not used by anyone.
Another reason is that const_pointer_cast for PassOwnPtr and PassOwnArrayPtr was implemented wrongly (tried to cast to a different pointer type).

Review URL: https://codereview.chromium.org/25545002

git-svn-id: svn://svn.chromium.org/blink/trunk@158997 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Call createV8HTMLFallbackWrapper instead of createV8HTMLWrapper when dispatching a disabled MediaElement wrap. If media is disabled, createV8HTMLWrapper makes a crash when media element is created.  
    
Test: fast/media/media-disable-crash.html

BUG=N/A

Review URL: https://codereview.chromium.org/23684014

git-svn-id: svn://svn.chromium.org/blink/trunk@159000 bbb929c8-8fbe-4397-9dbb-9b2b20218538
REGRESSION: formaction, formenctype, formmethod, formnovalidatio, and formtarget attributes don't work with input[type=submit]

This is a regression by Blink r152700 [1].
We use a shadow node in button input types since r152700. The code handling
form* attribute for input[type=submit] didn't support cases that shadow nodes
were clicked. We need to process the shadow host.

This bug was not detected by existing layout tests because they used
Element::click() to invoke form submission.

[1] http://src.chromium.org/viewvc/blink?view=revision&revision=152700

BUG=303707
TEST=automated.

Review URL: https://codereview.chromium.org/26209003

git-svn-id: svn://svn.chromium.org/blink/trunk@159003 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Notify nodes removal to Range/Selection after dispatching blur and mutation event

This patch changes notifying nodes removal to Range/Selection after dispatching blur and mutation event. In willRemoveChildren(), like willRemoveChild(); r115686 did same change, although it didn't change willRemoveChildren().

The issue 295010, use-after-free, is caused by setting removed node to Selection in mutation event handler.

BUG=295010
TEST=LayoutTests/fast/dom/Range/range-created-during-remove-children.html, LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children.html, LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children.html
R=tkent@chromium.org

Review URL: https://codereview.chromium.org/25389004

git-svn-id: svn://svn.chromium.org/blink/trunk@159007 bbb929c8-8fbe-4397-9dbb-9b2b20218538
IDL compiler: CallWith for getters

In general CallWith has 6 possible values, but for readonly attributes only
[CallWith=ScriptExecutionContext] occurs.

[CallWith=ScriptState] *could* occur, but is not used for attributes in any
real IDL files, so I'm omitting it.

ActiveWindow and FirstWindow occur in SetterCallWith, so we'll do it when
we're doing setters.

Docs:
https://sites.google.com/a/chromium.org/dev/blink/webidl/blink-idl-extended-attributes#TOC-CallWith-m-a-

Style note:
Per recent use of 'include' as a mutable parameter (adding includes
is a side effect, when the function primarily does a computation),
I'm doing the same here with 'contents'.
This avoids having to return and unpack 3 values
(main value - here call_with_arguments - plus contents and includes)
and declaring and returning local variables for contents and includes.
It does make the function call slightly longer, but this
does make explicit that we're modifying these values.
(I think this is clearer.)

Also minor cleanup/simplification to some code by alancutter@,
and adding comments in templates to make grepping easier.

BUG=239771

Review URL: https://codereview.chromium.org/26209002

git-svn-id: svn://svn.chromium.org/blink/trunk@159008 bbb929c8-8fbe-4397-9dbb-9b2b20218538