Fix a race condition in InputTypeNames::image().

This function is not thread-safe, but TokenPreloadScanner::StartTagScanner::
processAttribute() calls it in a parser thread. if InputTypeNames::image() is
called concurrently, one of them can return a null reference.

BUG=318989
TEST=none; This bug is very timing-depedent.

Review URL: https://codereview.chromium.org/68103017

git-svn-id: svn://svn.chromium.org/blink/trunk@161989 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add timeout expectation for fast/line-grid/line-align-left-edges.html

TBR=yurys
BUG=313659

Review URL: https://codereview.chromium.org/72253002

git-svn-id: svn://svn.chromium.org/blink/trunk@161990 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Eliminate "FractionConversion" from CSSPrimitiveValue::convertToLength

The FractionConversion argument in CSSPrimitiveValue::convertToLength
doesn't seem to actually have a purpose. It is for converting numbers
into Length(x * 100, Percent), but this case shouldn't be reachable.
The original patch introducing it[1] doesn't shed any light either.

The only way I could find to get into this conversion was in the fast
path for parsing transforms, where e.g. translate(0) would get the 0
parsed as a number and not a <length>. This patch fixes this parser
error and removes the now unused FractionConversion argument. Note
that we can probably also merge the two Fixed conversions, as the
two only differ in clamping large numbers (probably unintended).

[1] https://bugs.webkit.org/show_bug.cgi?id=74913

BUG=

Review URL: https://codereview.chromium.org/71253002

git-svn-id: svn://svn.chromium.org/blink/trunk@161991 bbb929c8-8fbe-4397-9dbb-9b2b20218538
DevTools: more timeline / memory cleanup (mostly styles).

TBR=vsevik

Review URL: https://codereview.chromium.org/72413002

git-svn-id: svn://svn.chromium.org/blink/trunk@161992 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Rename es => exceptionState in bindings/

sed replace, basically:
sed -ri 's/\<es\>([^-])/exceptionState\1/g' \
    $(grep -rlE '\<es\>' *)
Slightly tricky b/c some URLs using '#es-...' to link to
Web IDL spec.

TBR=haraken

Review URL: https://codereview.chromium.org/68893018

git-svn-id: svn://svn.chromium.org/blink/trunk@161993 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Use [ImplementedAs=defaultStatus] for Window.defaultstatus.

This CL use [ImplementedAs=defaultStatus] for Window.defaultstatus
and remove unnecessary code from DOMWindow.
Because 'defaultstatus' is an alias of defaultStatus.

Review URL: https://codereview.chromium.org/69953018

git-svn-id: svn://svn.chromium.org/blink/trunk@161994 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Always include |instance| & |proto| vars in Configure*Template()

Currently there's a complex test
$accessCheck or @runtimeEnabledAttributes or @normalFunctions or
$hasConstants
(Which is mostly "is the interface only attributes?".)
...determining whether to include |instance| and |proto| variables,
specifically the following block of code:
v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
UNUSED_PARAM(instance);
UNUSED_PARAM(proto);

This CL removes the check, always including it, hence simplifying the CGs.
It thus adds these lines to the about 300 IDL files that are just attributes
(or otherwise fit these conditions).

Is there other impact from this?

Review URL: https://codereview.chromium.org/60443007

git-svn-id: svn://svn.chromium.org/blink/trunk@161995 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[CSS Shapes] Empty polygons with non-zero shape-padding cause an ASSERT crash

PolygonShape::shapePaddingBounds() and PolygonShape::shapeMarginBounds() no longer attempt to compute a new FloatPolygon when the original is empty, i.e. when it has less than three vertices.

This patch fixes the clusterfuzz failure reported here: https://code.google.com/p/chromium/issues/detail?id=314402

BUG=319069, 314402

Review URL: https://codereview.chromium.org/68263018

git-svn-id: svn://svn.chromium.org/blink/trunk@161996 bbb929c8-8fbe-4397-9dbb-9b2b20218538