Merge 180701 "Fix a crash for extractSmartClipData"

> Fix a crash for extractSmartClipData
> 
> Position::document() returns null if -webkit-user-select is set to none.
> This CL prevents the crash in this case. Also adds a test to make sure
> that the crash does not happen and clip text and clip html are empty.
> 
> TEST=passed WebViewTest
> BUG=402371
> 
> Review URL: https://codereview.chromium.org/455133003

TBR=changwan@chromium.org

Review URL: https://codereview.chromium.org/485293005

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@180878 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180720 "Hide video controls after touch from hideMediaCont..."

> Hide video controls after touch from hideMediaControlsTimerFired.
> 
> BUG=401159
> 
> Review URL: https://codereview.chromium.org/441193003

TBR=igsolla@chromium.org

Review URL: https://codereview.chromium.org/508563002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@180894 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180582 "DevTools: [Elements] fix ctrl-z behavior."

> DevTools: [Elements] fix ctrl-z behavior.
> 
> There used to be an assumption that ctrl-z event is coming from elements
> tree outline. This turned out to be wrong in case of focused styles
> sidebar pane, which caused ctrl-z event to be ignored.
> 
> BUG=405058
> R=pfeldman
> 
> Review URL: https://codereview.chromium.org/484223002

TBR=lushnikov@chromium.org

Review URL: https://codereview.chromium.org/505183002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@180905 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180456 "DevTools: [SSP] Do not re-show color popover after..."

> DevTools: [SSP] Do not re-show color popover after going full-screen
> 
> R=eustas, lushnikov
> BUG=404555
> 
> Review URL: https://codereview.chromium.org/486633002

TBR=apavlov@chromium.org

Review URL: https://codereview.chromium.org/504243002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@180907 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180681 "Defer call to updateWidgetPositions() outside of R..."

> Defer call to updateWidgetPositions() outside of RenderLayerScrollableArea.
> 
> updateWidgetPositions() can destroy the render tree, so it should never
> be called from inside RenderLayerScrollableArea. Leaving it there allows
> for the potential of use-after-free bugs.
> 
> BUG=402407
> R=vollick@chromium.org
> 
> Review URL: https://codereview.chromium.org/490473003

TBR=hartmanng@chromium.org

Review URL: https://codereview.chromium.org/502413003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@180914 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180725 "DevTools: [SSP] update SSP when css model gets ena..."

> DevTools: [SSP] update SSP when css model gets enabled.
> 
> There was a typo in the code responsible for the styles sidebar pane
> update whenever the css model gets enabled. The patch fixes the typo.
> 
> BUG=400000
> TBR=pfeldman
> R=vsevik
> 
> Review URL: https://codereview.chromium.org/495933002

TBR=lushnikov@chromium.org

Review URL: https://codereview.chromium.org/508273002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@180996 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180629 "[DevTools] Do not instantiate WebInspector.Toolbox..."

> [DevTools] Do not instantiate WebInspector.Toolbox in main.
> 
> Toolbox creates itself in a separate DOMContentLoaded listener.
> 
> BUG=391566,405084
> 
> Review URL: https://codereview.chromium.org/487343002

TBR=dgozman@chromium.org

Review URL: https://codereview.chromium.org/514943004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181019 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180590 "Check m_contentsLayer before reaching into it"

> Check m_contentsLayer before reaching into it
> 
> Use clearContentsLayerIfUnregistered set m_contentsLayer to NULL
> in case it is now an invalid pointer.
> 
> BUG=399783 (for the crash)
> BUG=403682 (maybe)
> 
> Review URL: https://codereview.chromium.org/488473002

TBR=ccameron@chromium.org

Review URL: https://codereview.chromium.org/520433003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181063 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180436 "Regression: r170111 Tapping listbox items should f..."

> Regression: r170111 Tapping listbox items should fire change/input event
> 
> BUG=403184
> 
> Review URL: https://codereview.chromium.org/486583002

TBR=keishi@chromium.org

Review URL: https://codereview.chromium.org/520513002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181069 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180791 "Fix tap target consistency with link highlighting ..."

> Fix tap target consistency with link highlighting and hover/active
> 
> Touch adjustment doesn't always return the correct node for a point.
> This used to be masked by extra hit tests, but in crbug.com/381728
> I attempted to remove redundant hit tests for better performance.
> I added an explicit redundant hit-test back in crbug.com/396652 but
> only for the tap event handling, not for GestureShowPress.  This moves
> that temporary additional hit-test back so that it applies to all
> types of gesture events that involve touch adjustment.
> 
> 
> BUG=405508
> 
> Review URL: https://codereview.chromium.org/499433003

TBR=rbyers@chromium.org

Review URL: https://codereview.chromium.org/523693002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181104 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180477 "Fix selection residue in sub-pixel positioned element"

> Fix selection residue in sub-pixel positioned element
> 
> We are inconsistent when invalidating and painting sub-pixel positioned
> selections. See the bug for details.
> 
> This change add back the enclosingIntRect() calls that were removed in
> http://src.chromium.org/viewvc/blink?view=rev&revision=177408. This is
> needed before we fix the inconsistency.
> 
> BUG=394698
> TEST=editing/selection/subpixel-positioned-selection.html
> 
> Review URL: https://codereview.chromium.org/464143003

TBR=wangxianzhu@chromium.org

Review URL: https://codereview.chromium.org/523523003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181108 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180804 "Fix a bug in Image::imageForDefaultFrame() when im..."

> Fix a bug in Image::imageForDefaultFrame() when image anim. is finished
> 
> Image::imageForDefaultFrame() is supposed to return the poster frame
> of an animated image (or the first frame) but it was returning the
> current frame when called on an image for which the animation is
> finished (the laest frame then).
> 
> This, because the Image::maybeAnimated() method returns false when the
> animation is finished.
> 
> A new method isAnimated() has been added that only checks the number
> of frames in the image to decide if the image is animated or not.
> 
> BUG=286673,405161
> 
> Review URL: https://codereview.chromium.org/474353002

TBR=piotaixr@chromium.org

Review URL: https://codereview.chromium.org/519893002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181112 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180796 "Fix accalerated 2D canvas not explicitly invalidat..."

> Fix accalerated 2D canvas not explicitly invalidating the canvas content layer on update.
> 
> The the call to RenderObject::invalidatePaintRectangle in
> HTMLCanvasElement only propagates to the canvas' containing layer
> and not the child canvas layer that actually has the canvas content
> in the case of an accelerated canvas. This is not a problem as far as
> graphics updates are concerned, but it fails to activate the
> compositor's rate limiter. The regression was caused by r176815 and
> continued to exist after r179637 (patches that refactor canvas
> invalidations).
> 
> BUG=404955
> 
> Review URL: https://codereview.chromium.org/462403003

TBR=junov@chromium.org

Review URL: https://codereview.chromium.org/519913002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181115 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180930 "Let FrameSelection::updateAppearance call layout e..."

> Let FrameSelection::updateAppearance call layout explicitly for range.
> 
> In L1608 selection::visibleStart(), we create VisilePosition which constructor
>  can call layout.
> It can change Node::renderer() and Position::isCandidate() value.
> The situation happens when user selects an autocomlete item in input element.
> Thus we call layout explicitly.
> 
> BUG=404560, 404969
> 
> Review URL: https://codereview.chromium.org/492983002

TBR=yoichio@chromium.org

Review URL: https://codereview.chromium.org/525233002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181141 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180542 "Fix crash by adding a form control to an element."

> Fix crash by adding a form control to an element.
> 
> This CL fixes a null pointer dereference in the following scenario:
> 
> 1. A form control and a <form> element are associated by HTML parser, and the
>   <form> is not an ancestor of the form control.
> 2. Their common ancestor is detached from the document.
> 3. GC happens. The <form> is collected and the form control survives.
> 4. The form control is added to an element.
> 
> Usually FormAssociatedElement::m_form is never null if
> FormAssociatedElement::m_formWasSetByParser is true. However it can be null.
> Blink r179263 [1] exposed this issue because we stopeed to support null Node
> pointer in highestAncestorOrSelf()
> 
> [1] http://src.chromium.org/viewvc/blink?view=revision&revision=179263
> 
> BUG=403088
> 
> Review URL: https://codereview.chromium.org/481363002

TBR=tkent@chromium.org

Review URL: https://codereview.chromium.org/531443002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181142 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180861 "Remove blank items from ExternalPopupMenu"

> Remove blank items from ExternalPopupMenu
> 
> This is a regression caused by https://codereview.chromium.org/415343003/
> The list with "display: none" items should be trimmed, before being given
> to the platform for display.
> Modified test - https://codereview.chromium.org/475733002/
> 
> BUG=398051,403299
> R=keishi@chromium.org
> 
> Review URL: https://codereview.chromium.org/475723002

TBR=sudarshan.p@samsung.com

Review URL: https://codereview.chromium.org/525233003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181143 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180941 "Editing: Fix a crash in FrameSelection::invalidate..."

> Editing: Fix a crash in FrameSelection::invalidateCaretRect.
> 
> Node::renderer() can be null and invalidateLocalCaretRect(node->renderer()) calls
> a renderer function. It causes crash.
> CaretBase::repaintCaretForLocalRect(node) invalidates a rectangle in renderer
>  if renderer is not null. It does not repaint but invalidate so I rename it to 
> invalidateLocalCaretRect.
> 
> Call that CaretBase::invalidateLocalCaretRect instead of invalidateLocalCaretRect,
> 
> 
> BUG=404553
> 
> Review URL: https://codereview.chromium.org/495903002

TBR=yoichio@chromium.org

Review URL: https://codereview.chromium.org/526293002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181226 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180745 "Fix touch scrolling of main frame scrollbars"

> Fix touch scrolling of main frame scrollbars
> 
> Touch adjustment isn't aware of scrollbars, so we bail out of touch
> adjustment for gesture events that occur directly on top of a scrollbar
> in bestClickableNodeForHitTestResult.  In r177164 I broke this for the
> main frame scrollbar case by moving the main-frame scrollbar check
> from before touch adjustment to after it.
> 
> This fixes the issue by moving the check back to just after the hit
> test.
> 
> BUG=403744
> 
> Review URL: https://codereview.chromium.org/492933002

TBR=rbyers@chromium.org

Review URL: https://codereview.chromium.org/527323002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181237 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180866 "Fix crash in Canvas 2D related to GPU reset"

> Fix crash in Canvas 2D related to GPU reset
> 
> This change resolves a crash that occurs when attempting
> to release resources held by a 2D canvas that has already
> been torn down due to a GL context reset.
> 
> BUG=364447
> TEST=blink_platform_unittests Canvas2DLayerBridgeTest.testNoDrawOnContextLost
> 
> Review URL: https://codereview.chromium.org/495073003

TBR=junov@chromium.org

Review URL: https://codereview.chromium.org/527413002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181246 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 180901 "Revert of Oilpan: Prepare moving DateTimeChooser t..."

> Revert of Oilpan: Prepare moving DateTimeChooser to Oilpan
> 
> Reverting r176293
> 
> Reason for revert:
> We need to call closePopup() in the destructor
> 
> BUG=401363
> 
> Review URL: https://codereview.chromium.org/488173007

TBR=keishi@chromium.org

Review URL: https://codereview.chromium.org/529173004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2125@181363 bbb929c8-8fbe-4397-9dbb-9b2b20218538