Heap-use-after-free regression
https://bugs.webkit.org/show_bug.cgi?id=113337

Reviewed by Abhishek Arya and Alexey Proskuryakov.

Source/WebCore: 

Use RefPtr instead of raw pointer in m_associatedFormControls.

* dom/Document.cpp:
(WebCore::Document::didAssociateFormControlsTimerFired):
* dom/Document.h:
(Document):
* loader/EmptyClients.h:
(WebCore::EmptyChromeClient::didAssociateFormControls):
* page/ChromeClient.h:
(WebCore::ChromeClient::didAssociateFormControls):

Source/WebKit/chromium: 

* src/ChromeClientImpl.cpp:
(WebKit::ChromeClientImpl::didAssociateFormControls):
* src/ChromeClientImpl.h:
(ChromeClientImpl):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146935 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Clean up last failing expectations from solid color layer patch.

* platform/chromium-mac-lion/platform/chromium/virtual/softwarecompositing/reflections/animation-inside-reflection-expected.png:
* platform/chromium-mac-lion/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-absolute-expected.txt:
* platform/chromium-mac-lion/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-fixed-expected.txt:
* platform/chromium-mac-lion/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-relative-expected.txt:
* platform/chromium-mac-lion/platform/chromium/virtual/softwarecompositing/transitions/scale-transition-no-start-expected.png:
* platform/chromium-mac-snowleopard/platform/chromium/virtual/softwarecompositing/reflections/animation-inside-reflection-expected.png:
* platform/chromium-mac-snowleopard/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-absolute-expected.txt:
* platform/chromium-mac-snowleopard/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-fixed-expected.txt:
* platform/chromium-mac-snowleopard/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-relative-expected.txt:
* platform/chromium-mac-snowleopard/platform/chromium/virtual/softwarecompositing/transitions/scale-transition-no-start-expected.png:
* platform/chromium-mac/platform/chromium/virtual/softwarecompositing/reflections/animation-inside-reflection-expected.png:
* platform/chromium-mac/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-absolute-expected.txt:
* platform/chromium-mac/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-fixed-expected.txt:
* platform/chromium-mac/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-relative-expected.txt:
* platform/chromium-mac/platform/chromium/virtual/softwarecompositing/transitions/scale-transition-no-start-expected.png:
* platform/chromium-win-xp/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-absolute-expected.txt:
* platform/chromium-win-xp/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-fixed-expected.txt:
* platform/chromium-win-xp/platform/chromium/virtual/softwarecompositing/rtl/rtl-iframe-relative-expected.txt:
* platform/chromium-win/platform/chromium/virtual/softwarecompositing/reflections/animation-inside-reflection-expected.png:
* platform/chromium-win/platform/chromium/virtual/softwarecompositing/transitions/scale-transition-no-start-expected.png:
* platform/chromium/TestExpectations:
* platform/chromium/platform/chromium/virtual/softwarecompositing/overflow/composited-scrolling-creates-a-stacking-container-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146936 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make the Web Inspector console work in strict mode with JavaScriptCore.

https://webkit.org/b/65829
rdar://problem/11271238

Reviewed by Joseph Pecoraro.

* inspector/InjectedScriptSource.js:
(InjectedScript.prototype._evaluateOn): Don't use 'eval' parameter (it isn't
allowed in strict mode). Swap window.eval with our known eval instead.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146937 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Exclusions] The radius of a circle should be computed based on the shorter available dimension
https://bugs.webkit.org/show_bug.cgi?id=113255

Reviewed by Julien Chaffraix.

When we decide what should be the radius of a circle, we should choose the smallest available space. For instance when the
width or height is not resolvable for the circle we should not have a radius for it. This change modifies the behavior to
use the smaller available space, so we won't render unnecessary circle shapes.

Source/WebCore: 

Test: fast/exclusions/shape-inside/shape-inside-on-nested-container-with-unresolved-height.html

* rendering/ExclusionShape.cpp:
(WebCore::ExclusionShape::createExclusionShape):

LayoutTests: 

* fast/exclusions/shape-inside/shape-inside-on-nested-container-with-unresolved-height-expected.html: Added.
* fast/exclusions/shape-inside/shape-inside-on-nested-container-with-unresolved-height.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146938 268f45cc-cd09-0410-ab3c-d52691b4dbfc