CSP: Suppress stored credentials when sending cross-origin violation reports.

The spec recently changed to mandate that cross-origin violation reports be POSTed
without cookies[1]. This patch changes PingLoader::PingLoader to accept a
StoredCredentials argument, and ensures that PingLoader::sendViolationReport sets
it correctly based on the origins of the protected resource and the reporting endpoint.

Two tests are included, which required the addition of CORS headers to 
http/tests/cookies/resources/setCookies.cgi in order to synchronously set cookies
cross-origin via XHR. Additionally, the reporting endpoint was updated to write the
cookie header into the output, and then clear any set cookies so as not to leak into
other tests.

[1]: https://dvcs.w3.org/hg/content-security-policy/rev/788b0b653c39

BUG=238107

Review URL: https://chromiumcodereview.appspot.com/14704008

git-svn-id: svn://svn.chromium.org/blink/trunk@149791 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Layout root not getting laid out before renderer is destroyed.

Disable tests that are failing due to security mitigation.

BUG=238363
TBR=dglazkov@chromium.org, aarya@chromium.org

Review URL: https://codereview.chromium.org/14618007

git-svn-id: svn://svn.chromium.org/blink/trunk@149792 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 149769 "Revert 149745 "Improve mitigation from r109406 to..."
See bug 238363

> Revert 149745 "Improve mitigation from r109406 to reset layout r..."
> 
> > Improve mitigation from r109406 to reset layout root in cases when document is getting destroyed.
> > 
> > BUG=209604
> > TEST=No test since it is flaky and will be tracked in a seperate functional bug to analyze why RenderSVGRoot is left as a layout root. Fix tested under ASAN.
> > R=schenney@chromium.org
> > 
> > Review URL: https://codereview.chromium.org/14846011
> 
> TBR=inferno@chromium.org
> 
> Review URL: https://codereview.chromium.org/15005003

TBR=fsamuel@chromium.org

Review URL: https://codereview.chromium.org/15016003

git-svn-id: svn://svn.chromium.org/blink/trunk@149793 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Make Range constructable

http://dom.spec.whatwg.org/#interface-range

Now we can do `new Range()` instead of `document.createRange()`.

BUG=237901

Review URL: https://chromiumcodereview.appspot.com/14904005

git-svn-id: svn://svn.chromium.org/blink/trunk@149794 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add myself as an OWNER of WebRuntimeFeatures.* since i'm the world-expert on that file.

Review URL: https://chromiumcodereview.appspot.com/14732004

git-svn-id: svn://svn.chromium.org/blink/trunk@149795 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix ASSERT failure again about m_expectScrollUpdateEnd

m_expectScrollUpdateEnd is not reset if a fling is handled in the main
thread. Simplify the logic by just resetting it in handleGestureFling()
because we are not expecting a ScrollUpdateEnd from the client on flings.

BUG=237926

Review URL: https://chromiumcodereview.appspot.com/14941003

git-svn-id: svn://svn.chromium.org/blink/trunk@149796 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Make all RuntimeEnabledFeatures default to false, and make StableFeatures list explicit.

I used the patch in https://codereview.chromium.org/14872007/ to confirm that this
does not change behavior of either DRT or ContentShell.

There are however 3 risks for behavior change in this patch:

1.  Code which may have been using a RuntimeEnabledFeature before
    RenderThreadImpl::WebKitInitialized was called could now see
    a different value.  I expect the risk of this to be low.
2.  LayoutTests which were depending on enable(false) calls in
    WebRuntimeFeatures::enableStableFeatures() to "reset" features
    between tests may now bleed into later tests.  Use of
    RuntimeEnabledFeatures inside layout tests is in general
    broken at this time, so I wouldn't be surprised if such
    already occurs before this patch.  If I introduced new bleed
    hopefully the tests will catch it.
3.  Features in the shipping product (which is harder for me to test)
    could have changed if I made an error in
    enabledStableFeatures().  I've read over that code several times
    so I believe that not to be the case.  I suspect that now that
    we have a full list of "stable" features there are some
    we may not intend to have on. :)

I also removed the ability to even specify a "default" in RuntimeEnabledFeatures.in.  Now all features always default to false.

BUG=237740
R=abarth@chromium.org

Review URL: https://codereview.chromium.org/14756003

git-svn-id: svn://svn.chromium.org/blink/trunk@149797 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Allow defining named grid lines on the grid element

This change adds parsing, style resolution and getComputedStyle
support for named grid lines at the grid element level (ie extends
our <track-list> support). Per the specification, we allow multiple
grid lines with the same name.

To fully support resolving the grid lines to a position on our
grid, we need to add the parsing at the grid item's level (which
means extending our <grid-line> support). This will be done in a
follow-up change.

BUG=234192
TEST=fast/css-grid-layout/named-grid-line-get-set.html

Review URL: https://chromiumcodereview.appspot.com/14786002

git-svn-id: svn://svn.chromium.org/blink/trunk@149798 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove new-run-webkit-httpd.

No longer needed now that Chromium calls the identical run-blink-httpd:
https://src.chromium.org/viewvc/chrome?revision=198457&view=revision

BUG=none

Review URL: https://chromiumcodereview.appspot.com/14737008

git-svn-id: svn://svn.chromium.org/blink/trunk@149799 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert "Change TestResultServer to use python 2.7."

This reverts commit r149707. Didn't realize that we need to switch
over to the high replication data store to using python 2.7.
We don't currently have a good way to migrate because we store blob
keys in the datastore. Maybe we should just switch and live with the
temporary data loss.

TBR=eseidel@chromium.org

Review URL: https://codereview.chromium.org/14833004

git-svn-id: svn://svn.chromium.org/blink/trunk@149800 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Create WebInbandTextTrack and WebInbandTextTrackClient 
interfaces so that WebMediaPlayer implementations can add
and remove inband text tracks from the HTMLMediaElement. 

This change just provide the plumbing between the
WebMediaPlayerClient interface and the existing
InbandTextTrack infrastructure in core/platform/graphics 
that HTMLMediaElement uses for inband text tracks.

BUG=230708
TEST=None. No user visible functionality has changed.

Review URL: https://chromiumcodereview.appspot.com/13968007

git-svn-id: svn://svn.chromium.org/blink/trunk@149801 bbb929c8-8fbe-4397-9dbb-9b2b20218538