SMIL timers can still fire after the containing document has been torn down
<https://webkit.org/b/123291>

Reviewed by Darin Adler.

Source/WebCore:

Ensure that the timers get paused when the document is preparing to be torn down.

Test: svg/animations/smil-timers-not-disabled-crash.html

* dom/Document.cpp:
(WebCore::Document::dropChildren):
(WebCore::Document::commonTeardown):
(WebCore::Document::prepareForDestruction):
* dom/Document.h:

LayoutTests:

Add a test that triggers the crash; unfortunately it triggers it after
the test is done, causing the next test to time out or crash.

* svg/animations/smil-timers-not-disabled-crash-expected.txt: Added.
* svg/animations/smil-timers-not-disabled-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158627 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement base64url encoding from RFC 4648
https://bugs.webkit.org/show_bug.cgi?id=123767

Reviewed by Sam Weinig.

No tests yet, will be covered by JWK tests for WebCrypto.

* wtf/text/Base64.cpp:
(WTF::base64EncodeInternal):
(WTF::base64Encode):
(WTF::base64URLEncode):
(WTF::base64DecodeInternal):
(WTF::base64Decode):
(WTF::base64URLDecode):
* wtf/text/Base64.h:
(WTF::base64URLEncode):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158628 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: AXShowMenu doesn't always work.
https://bugs.webkit.org/show_bug.cgi?id=123649

Reviewed by Chris Fleizach.

No new tests, the change occurs in a code path that forces the context menu to show which
locks up DRT if we try to test it (platform menu is shown). The change itself gives the mouse
event handler a chance to handle our platform mouse event BEFORE the event ends up in the show
context menu machinery. This is necessary because without it, the element will not become
focused. Without focus, accessibility shows different/less menu items than a mouse click. The
end result is that context menus shown via accessibility are consistent with menus shown via click.

* page/ContextMenuController.cpp:
(WebCore::ContextMenuController::showContextMenuAt):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158629 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Regions][CSS Shapes] Content in region doesn't respect shape-outside after initial layout pass
<https://webkit.org/b/114829>

Source/WebCore:

Although we set the size of a shape for shape-outside in RenderBlockFlow::insertFloatingObject based on the
float's size, the actual height of the float is not always resolved at that point. (Look at cases when the shape
has percentage based height or percentage based radius.) ShapeInfo::setShapeSize triggers a layout for 0 height
value, which will be overriden later, when RenderBlockFlow::positionNewFloats sets the actual size of the float (shape).
Thus it doesn't make sense to set the shape's size in insertFloatingObject and run those extra unnecessary layout passes,
since it'll be overriden anyways. I moved the shape size setting logic into RenderBlockFlow::positionNewFloats.

The problem showed up when we had a shape-outside ellipse with percentage based radius, and we inserted the content
with JavaScript into a region flow. The content has been layed out based on the 0 border radius, and relayout hasn't been
triggered when it flew into the flow. This change sets the shape size only when we already have the height of the float,
so the radius(es) can be resolved correctly, thus no unnecessary layout passes will happen and the layout will be correct as well.

Reviewed by David Hyatt.

Test: fast/shapes/shape-outside-floats/shape-outside-floats-layout-after-initial-layout-pass.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::insertFloatingObject): Remove setting the size of the shape.
(WebCore::RenderBlockFlow::positionNewFloats): Set the size of the shape here.

LayoutTests:

Reviewed by David Hyatt.

* fast/shapes/shape-outside-floats/shape-outside-floats-layout-after-initial-layout-pass-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-layout-after-initial-layout-pass.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158630 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CTTE: RenderFrameBase's widget is always a FrameView.
<https://webkit.org/b/123771>

Delete widget() from RenderFrameBase and supplant a childView()
that returns FrameView*. Strip away unnecessary casts and asserts.

Reviewed by Antti Koivisto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158631 268f45cc-cd09-0410-ab3c-d52691b4dbfc