CSSParser::parseImageSet() doesn't need a parameter.
https://bugs.webkit.org/show_bug.cgi?id=117617

Patch by Jaehun Lim <ljaehun.lim@samsung.com> on 2013-06-14
Reviewed by Darin Adler.

parseImageSet() can get m_valueList directly.
And minor fixes.

No new tests, no behavior change.

* css/CSSParser.cpp:
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseContent):
(WebCore::CSSParser::parseFillImage):
(WebCore::CSSParser::parseBorderImage):
(WebCore::CSSParser::parseImageSet):
* css/CSSParser.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151597 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove front-end from the WebCore Xcode project.
https://bugs.webkit.org/show_bug.cgi?id=117640

Reviewed by Darin Adler.

* WebCore.xcodeproj/project.pbxproj:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151598 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Clicking on snapshotting plug-ins does not restart them
https://bugs.webkit.org/show_bug.cgi?id=117620
<rdar://problem/13821729>

Follow-up review comments from Darin Adler, with some
discussion on IRC.

Sprinkle OVERRIDE on virtual functions where needed. Also
make sure that the Event is a MouseEvent before casting to it.

* html/HTMLPlugInElement.h: Move defaultEventHandler back to protected and add OVERRIDE.
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::defaultEventHandler): Check for MouseEvent and
use toMouseEvent().
* html/HTMLPlugInImageElement.h: Sprinkle some OVERRIDEs, and move defaultEventHandler
to private.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151599 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Potential use-after-free with an event fired at a HTMLMediaElement which is currently being deleted
https://bugs.webkit.org/show_bug.cgi?id=117466

Reviewed by Oliver Hunt.
        
Merge https://chromium.googlesource.com/chromium/blink/+/f4200a0093b3d9376f703961615359ec7fb712b4
        
If an event is created using as target an HTMLMediaElement which is
currently being deleted it becomes a heap-use-after free situation.

The GenericEventQueue instance is already owned by the HTMLMediaElement,
and there already is an underlying mechanism to set the target of the
event to NULL, if their target is owner of the queue.

In order to avoid creating this reference in the first place, we enqueue
the event with a NULL target to defer the refcount increment until the
timer for dispatching the event happens (which won't happen at all if
garbage collection is already destroying the objects).

Source/WebCore: 

Test: media/track/media-element-enqueue-event-crash.html

* dom/GenericEventQueue.cpp:
(WebCore::GenericEventQueue::enqueueEvent): Don't ASSERT if the event has no target.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::~HTMLMediaElement): Close the event queue so it won't try to
    dispatch any pending events.
(WebCore::HTMLMediaElement::scheduleEvent): Don't set the event target, it will happen just
    prior to event dispatch.
(WebCore::HTMLMediaElement::stop): Close the event queue.

LayoutTests: 

* media/track/media-element-enqueue-event-crash-expected.txt: Added.
* media/track/media-element-enqueue-event-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151600 268f45cc-cd09-0410-ab3c-d52691b4dbfc