Use-after-free in SliderThumbElement::dragFrom
https://bugs.webkit.org/show_bug.cgi?id=123873

Reviewed by Andreas Kling.

Source/WebCore: 

Ref the SliderThumbElement since it could go away inside dragFrom.

Test: fast/forms/range/range-type-change-onchange-2.html

* html/RangeInputType.cpp:
(WebCore::RangeInputType::handleMouseDownEvent):

LayoutTests: 

Merge https://chromium.googlesource.com/chromium/blink/+/04a23bfca2d04101a1828d36ff36c29f3a24f34b

* fast/forms/range/range-type-change-onchange-2-expected.txt: Added.
* fast/forms/range/range-type-change-onchange-2.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158724 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Mac Mavericks rebaseline after r158714.

* platform/mac/fast/forms/textAreaLineHeight-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158725 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add more tests for formaction, formenctype, formmethod, formnovalidate, and formtarget attributes
https://bugs.webkit.org/show_bug.cgi?id=123876

Reviewed by Andreas Kling.

Merge tests from https://chromium.googlesource.com/chromium/blink/+/5f4ccd416fec39a6878af66e87bda191cc59ea7e
so that we won't introduce regressions they had.

* fast/forms/formaction-attribute-expected.txt:
* fast/forms/formaction-attribute.html:
* fast/forms/formmethod-attribute-input-2-expected.txt: Added.
* fast/forms/formmethod-attribute-input-2.html: Added.
* fast/forms/formtarget-attribute-input-2-expected.txt: Added.
* fast/forms/formtarget-attribute-input-2.html: Added.
* fast/forms/interactive-validation-formnovalidate-2-expected.txt: Added.
* fast/forms/interactive-validation-formnovalidate-2.html: Added.
* fast/forms/mailto/formenctype-attribute-input-2-expected.txt: Added.
* fast/forms/mailto/formenctype-attribute-input-2.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158726 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Widget's position change should not initiate layout, only when its size changes.
https://bugs.webkit.org/show_bug.cgi?id=123860

Reviewed by Andreas Kling.

RenderWidgets initiate unnecessary layouts while scrolling when they are embedded to
overflow:scroll containers. Scroll position change doesn't dirty the render tree
so it should not trigger layout either.

.:

* ManualTests/layouts-on-renderwidgets-while-scrolling.html: Added.

Source/WebCore:

Manual test added. Unfortunately we can't test against the number of layouts yet.

* rendering/RenderWidget.cpp:
(WebCore::RenderWidget::setWidgetGeometry):
(WebCore::RenderWidget::updateWidgetGeometry):
(WebCore::RenderWidget::updateWidgetPosition):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158727 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Address the review comment after r158724.

* html/RangeInputType.cpp:
(WebCore::RangeInputType::handleMouseDownEvent):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158728 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion failure end < m_runCount in WebCore::BidiRunList<WebCore::BidiRun>::reverseRuns
https://bugs.webkit.org/show_bug.cgi?id=123863

Reviewed by Andreas Kling.

Source/WebCore: 

Merge https://chromium.googlesource.com/chromium/blink/+/cbaa92c763a37d89eeabd01658e522219299290c

Test: fast/text/bidi-reverse-runs-crash.html

* platform/text/BidiResolver.h:
(WebCore::BidiResolver<Iterator, Run>::createBidiRunsForLine): Don't reverse the runs if there's
nothing to be reversed.

LayoutTests: 

* fast/text/bidi-reverse-runs-crash-expected.txt: Added.
* fast/text/bidi-reverse-runs-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158729 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderBlockFlow should only expose its line boxes as RootInlineBox.
<https://webkit.org/b/123878>

The line boxes attached directly to a RenderBlockFlow are always
RootInlineBox objects, so call sites should always use the tightly
typed firstRootBox() and lastRootBox().

This allows the compiler to devirtualize calls to member functions
of RootInlineBox that are marked FINAL.

Reviewed by Antti Koivisto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158730 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a test for queries whose leftmost selector matches the root node
https://bugs.webkit.org/show_bug.cgi?id=123877

Reviewed by Andreas Kling.

Merge https://chromium.googlesource.com/chromium/blink/+/22981c70bf93e8a07ee7b4d68a4522aee21b26ce
so that we won't introduce the regression they had.

* fast/selectors/querySelector-leftmost-selector-matches-rootNode-expected.txt: Added.
* fast/selectors/querySelector-leftmost-selector-matches-rootNode.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158731 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GStreamer] Override label() and language() in Audio and VideoTrackPrivateGStreamer
https://bugs.webkit.org/show_bug.cgi?id=123836

The tests are currently flakey because we only get the label and language if we get
tags after the track client is set.

Patch by Brendan Long <b.long@cablelabs.com> on 2013-11-06
Reviewed by Philippe Normand.

No new tests because the tests already exist (this fixes flakeyness).

* platform/graphics/gstreamer/AudioTrackPrivateGStreamer.h: Override label() and language() to use m_label and m_language.
* platform/graphics/gstreamer/VideoTrackPrivateGStreamer.h: Same.
* platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h: Make m_label and m_language protected so they can be used in the functions above.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158732 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reinstate an annoying assertion that I accidentally commented out.

* loader/icon/IconDatabase.cpp:
(WebCore::IconDatabase::synchronousIconForPageURL):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158733 268f45cc-cd09-0410-ab3c-d52691b4dbfc