CSS systemcolors should work in svg properties using <color>.

This affects the 'stop-color', 'flood-color' and 'lighting-color'
properties.

R=
BUG=234936

Review URL: https://chromiumcodereview.appspot.com/14108013

git-svn-id: svn://svn.chromium.org/blink/trunk@149844 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Deny cross-origin access to 'window.history'.

Currently, we allow cross-origin access to certain methods on
'window.history'. This is contrary to both the spec, and the existing
behavior of both Gecko and IE[1]. This patch drops the custom
security checks on the history object, denying cross-origin access
to the object entirely.

[1]: https://bug839867.bugzilla.mozilla.org/attachment.cgi?id=712247

Original patch from Adam Barth <abarth@chromium.org> on
http://webkit.org/b/106641.

BUG=237080

Review URL: https://chromiumcodereview.appspot.com/14198015

git-svn-id: svn://svn.chromium.org/blink/trunk@149846 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Rebaselined v8 bindings tests after crrev.com/14852007

Review URL: https://chromiumcodereview.appspot.com/15014005

git-svn-id: svn://svn.chromium.org/blink/trunk@149847 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Simplify and add caching for accessible bounding box calculation.

There were several mostly-redundant methods to compute the
bounding box rect of an accessible object. Simplified those all
to just one, elementRect(), which returns the absolute-coordinate
bounding box of the object in frame coordinates.

Adds a system to cache the rect so that the computation of the
absolute coordinates is really fast when it hasn't moved.
Relies on the fact that a RenderBox has a frameRect in local
coordinates that can be accessed directly; no computation is
needed.

Each AccessibleRenderObject caches its element rect and frame
rect lazily, along with a flag indicating if they're dirty.
If the frame rect changes, it invalidates all of its
children (marks them as dirty). When querying the (global) element
rect, it checks all of its parents - if none of them are dirty,
it can use the cached element rect.

I believe that the runtime to recompute the bounding rect of
every element in the tree is O(n * d), where d is the depth.
This is fine, lots of other accessibility code also requires a
quick walk up the parent chain; there's no easy way around this.

Perhaps we should rename elementRect and frameRect while we're
at it? How about elementRect -> absoluteRect and frameRect ->
localRect?

BUG=222636

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=149754

Review URL: https://chromiumcodereview.appspot.com/14740025

git-svn-id: svn://svn.chromium.org/blink/trunk@149848 bbb929c8-8fbe-4397-9dbb-9b2b20218538
callTheAdoptionAgency should work asynchronously

Rather than manipulating the DOM tree directly,
HTMLTreeBuilder::callTheAdoptionAgency should indirect its modifications
through the HTMLConstructionSite, which can use its task queue to make sure the
operations occur in a consistent order and on a clean runtime stack.

This CL is a followup to
https://src.chromium.org/viewvc/blink?view=revision&revision=149823 that makes
the rest of the operations in callTheAdoptionAgency asynchronous.

Review URL: https://chromiumcodereview.appspot.com/14759017

git-svn-id: svn://svn.chromium.org/blink/trunk@149849 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add test case that documents all global constructors

This test cases prints the name of all global constructors so that we can better
highlight changes in those.

Review URL: https://chromiumcodereview.appspot.com/14705010

git-svn-id: svn://svn.chromium.org/blink/trunk@149850 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove CodeGenerator.pm

R=eseidel@chromium.org
BUG=230254

Review URL: https://codereview.chromium.org/14611004

git-svn-id: svn://svn.chromium.org/blink/trunk@149851 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Rename [CacheAttributeForGC] with [KeepAttributeAliveForGC]

R=abarth,eseidel

Review URL: https://chromiumcodereview.appspot.com/14850008

git-svn-id: svn://svn.chromium.org/blink/trunk@149852 bbb929c8-8fbe-4397-9dbb-9b2b20218538