Crash in WebCore::Element::cloneElementWithoutChildren.
https://bugs.webkit.org/show_bug.cgi?id=105949

Reviewed by Ryosuke Niwa.

RefPtr |ancestors| vector since its elements can be destroyed from mutation events
fired in CompositeEditCommand::appendNode.

No new tests. The testcase relies on recursive DOM mutations and does not minimize.

* editing/InsertParagraphSeparatorCommand.cpp:
(WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock):
(WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock):
(WebCore::InsertParagraphSeparatorCommand::doApply):
* editing/InsertParagraphSeparatorCommand.h:
(InsertParagraphSeparatorCommand):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138657 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HTML preload scanner doesn't need to remember whether we're scanning the body
https://bugs.webkit.org/show_bug.cgi?id=105945

Reviewed by Eric Seidel.

As far as I can tell, no one uses this state.

* html/parser/CSSPreloadScanner.cpp:
(WebCore::CSSPreloadScanner::CSSPreloadScanner):
(WebCore::CSSPreloadScanner::scan):
(WebCore::CSSPreloadScanner::emitRule):
* html/parser/CSSPreloadScanner.h:
(CSSPreloadScanner):
* html/parser/HTMLPreloadScanner.cpp:
(WebCore::PreloadTask::preload):
(WebCore::HTMLPreloadScanner::HTMLPreloadScanner):
(WebCore::HTMLPreloadScanner::processToken):
* html/parser/HTMLPreloadScanner.h:
(HTMLPreloadScanner):
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::preload):
* loader/cache/CachedResourceLoader.h:
(CachedResourceLoader):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138658 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a failing test expectation for the bug 105954.

* platform/mac-wk2/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138659 268f45cc-cd09-0410-ab3c-d52691b4dbfc