Merge 176819 "Update WebNode::getElementsByTagName so that it re..."

> Update WebNode::getElementsByTagName so that it returns only HTML elements.
> 
> A temporary change to fix a bug. All of callsites of this function in
> Chromium expect that it returns only HTML elements.
> The function name and the behavior doesn't match. We should fix this
> inconsistency soon.
> 
> BUG=387315
> R=abarth@chromium.org
> 
> Review URL: https://codereview.chromium.org/351763003

TBR=tkent@chromium.org

Review URL: https://codereview.chromium.org/395633005

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178112 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177788 "Change brand-color to theme-color and ship it."

> Change brand-color to theme-color and ship it.
> 
> BUG=383941
> 
> Review URL: https://codereview.chromium.org/379973002

TBR=michaelbai@chromium.org

Review URL: https://codereview.chromium.org/388743004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178115 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177121 "Avoid creating nested StyleResolverState"

> Avoid creating nested StyleResolverState
> 
> Creating a new StyleResolverState while in the context of a
> style recalc is completely unnecessary for the purposes of
> StyleResolver::createAnimatableValueSnapshot().
> 
> Moving the StyleResolverState creation inside createAnimatableValueSnapshot()
> to only where it's necessary fixes crashes involving HTMLOptionElements
> attaching themselves to a shadow DOM tree.
> 
> BUG=387225
> 
> Review URL: https://codereview.chromium.org/358793003

BUG=387225
TBR=alancutter@chromium.org

Review URL: https://codereview.chromium.org/390003008

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178121 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177359 "[WebSocket] Task creation should be separated from..."

> [WebSocket] Task creation should be separated from task posting.
> 
> Having a complex argument as a waitForMethodCompletion may keep alive
> temporary objects which must be killed before posting a task to another
> thread.
> 
> BUG=390174
> 
> Review URL: https://codereview.chromium.org/368453003

TBR=yhirano@chromium.org, amineer@chromium.org

Review URL: https://codereview.chromium.org/391833004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178129 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 176815 "Redraw only dirty area for accelerated 2D Canvas."

> Redraw only dirty area for accelerated 2D Canvas.
> 
> When 2D Canvas got it's own layer, the whole canvas was getting
> updated instead of only the dirty rect.
> 
> BUG=382958
> 
> Review URL: https://codereview.chromium.org/341213002

TBR=heejin.r.chung@samsung.com, senorblanco@chromium.org

Review URL: https://codereview.chromium.org/397653002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178176 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177383 "Timeline: fix 'Range'/Pie Chart overlap when timel..."

> Timeline: fix 'Range'/Pie Chart overlap when timeline details pan is shrunk
> 
> BUG=386523
> 
> Review URL: https://codereview.chromium.org/362163004

TBR=caseq@chromium.org

Review URL: https://codereview.chromium.org/398483004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178179 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 178176 "Merge 176815 "Redraw only dirty area for accelera..."

> Merge 176815 "Redraw only dirty area for accelerated 2D Canvas."
> 
> > Redraw only dirty area for accelerated 2D Canvas.
> > 
> > When 2D Canvas got it's own layer, the whole canvas was getting
> > updated instead of only the dirty rect.
> > 
> > BUG=382958
> > 
> > Review URL: https://codereview.chromium.org/341213002
> 
> TBR=heejin.r.chung@samsung.com, senorblanco@chromium.org
> 
> Review URL: https://codereview.chromium.org/397653002

TBR=junov@chromium.org

Review URL: https://codereview.chromium.org/397173002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178293 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177401 "DevTools: [CSS] fix style ranges updating"

> DevTools: [CSS] fix style ranges updating
> 
> DevTools CSSOM objects (like WebInspector.CSSRule,
> WebInspector.CSSStyleDeclaration) are addressed by their ranges in source code
> (aka "source ranges"). Whenever some property gets changed, all the
> source ranges that lay afterwards in the same stylesheet have to be updated.
> 
> Unfortunately, there was a typo in this bookkeeping operation. This patch
> fixes it and covers with a testcase.
> 
> BUG=390300
> R=apavlov, vsevik
> 
> Review URL: https://codereview.chromium.org/368013002

TBR=lushnikov@chromium.org

Review URL: https://codereview.chromium.org/393943008

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178373 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177428 "Split list marker updating into two steps"

> Split list marker updating into two steps
> 
> This patch reverts r164210[1] and fixes it in a different way. A list
> marker can be parented on different renderers and changing a list
> marker to being "inside" can change the parent. This patch splits the
> reparent and update steps from invalidating list marker parent's width.
> This refactoring has a few advantages such as removing the
> preferredLogicalWidthsDirty check and not dirtying the marker's child
> lines since these steps happen naturally as part of reparenting the
> marker renderer.
> 
> Detailed changes:
> 1) updateMarkerLocation is now a private implementation detail of
> RenderListItem.
> 2) The reparent and update steps have been refactored out of
> updateMarkerLocation. updateMarkerLocation now reparents and updates
> the marker while updateMarkerLocationAndInvalidateWidth adds a width
> invalidation step that's necessary only during layout (before layout it
> wouldn't do anything).
> 3) The comment "Sanity check the location of our marker." has been
> removed--there is no sanity in the render list marker code.
> 4) HTMLLIElement::attach now just does the reparent and update steps
> instead of also invalidating the marker's width.
> 
> [1] https://src.chromium.org/viewvc/blink?view=rev&revision=164210
> 
> BUG=301196,390569
> 
> Review URL: https://codereview.chromium.org/368733002

TBR=pdr@chromium.org

Review URL: https://codereview.chromium.org/399843004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178381 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177453 "Fix use-of-uninitialized-value in TransformationMa..."

> Fix use-of-uninitialized-value in TransformationMatrix::blend()
> 
> TransformationMatrix::blend() was attempting to blend between non-invertable
> matricies. This resulted in garbage stack variables being used.
> This patch ensures that blend() will fall back to a 50% step interpolation
> when one of the sides are not invertable.
> 
> BUG=389316
> 
> Review URL: https://codereview.chromium.org/352793004

TBR=alancutter@chromium.org

Review URL: https://codereview.chromium.org/405063002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178530 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 178488 "Use LayoutUnit::fromFloatRound for setting scroll ..."

> Use LayoutUnit::fromFloatRound for setting scroll values
> 
> Change Elemenet::setScrollLeft and setScrollTop to use LayoutUnit::
> fromFloatRound instead of lroundf. This ensures that no unnecessary type
> conversion takers place and that the values are clamped properly.
> 
> R=leviw@chromium.org
> BUG=393464
> TEST=fast/scrolling/scroll-max-value.html
> 
> Review URL: https://codereview.chromium.org/400633005

TBR=eae@chromium.org

Review URL: https://codereview.chromium.org/400973004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178570 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 178314 "Fix crash when a node being touched moves to a new..."

> Fix crash when a node being touched moves to a new document
> 
> This is a low-risk fix to restore behavior in this edge-case scenario
> to what it was in M35.  See bug 394339 for discussion on what the
> behavior really should be in this case.
> 
> BUG=393822
> 
> Review URL: https://codereview.chromium.org/394883003

TBR=rbyers@chromium.org

Review URL: https://codereview.chromium.org/404823004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178578 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 178302 "Avoid crash in FontFallbackList when LastResortFal..."

> Avoid crash in FontFallbackList when LastResortFallbackFont is null
> 
> Blink r176963 made FontFallbackList::determinePrimarySimpleFontData crash
> when getLastResortFallbackFont() returns null, but callers may be able to
> handle a NULL return (see also http://crbug.com/383542#c23).
> This patch lets determinePrimarySimpleFontData() propagate NULL returns
> to the callers.
> 
> BUG=389536,390272,390284
> 
> Review URL: https://codereview.chromium.org/390183005

TBR=ksakamoto@chromium.org

Review URL: https://codereview.chromium.org/410463003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178579 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177813 "Fix InputMethodController::setCompositionFromExist..."

> Fix InputMethodController::setCompositionFromExistingText
> 
> IME only knows plain text characters, while Chrome sees extra collapsed white spaces, thus IME and Chrome may assign different numeric values to the same position. E.g. when you put the cursor at the beginning of the input field in http://jsfiddle.net/N2sp3/7/show/, while IME thinks the composition starts at position 0, Chrome sees the leading new line in html and thus thinks the starting position is 1.
> 
> Currently InputMethodController::setCompositionFromExistingText receives plain text composition offsets from IME, compositionStart and compositionEnd, and simply assigns them to m_compositionStart and m_compositionEnd. The former are plain text offsets excluding collapsed white spaces, while the later are used in a way that assumes collapsed white spaces are included, thus simple assignment such as m_compositionStart = compositionStart will give incorrect results when there are collapsed white spaces.
> 
> Instead Chrome should convert the offsets by calling PlainTextRange::createRange.
> 
> BUG=376909
> TEST=load the example URL http://jsfiddle.net/N2sp3/7/show/ on android, make sure the input method is the default english keyboard, delete characters from the end, and confirm that all characters can be deleted properly.
> 
> Review URL: https://codereview.chromium.org/352183003

TBR=guohui@chromium.org

Review URL: https://codereview.chromium.org/408023002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178590 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177903 "Always emits an object replacement char when compu..."

> Always emits an object replacement char when computing a range
> 
> This is a followup of my previous CL https://codereview.chromium.org/297003003/ that emits an object replacement char in InputMethodController::setSelectionOffsets. The previous CL was intended to fix the issue 311448 that an image element cannot be easily deleted with android keyboard. Unfortunately the previous CL did not fix the issue 311448 completely, and introduced regressions.
> 
> The reason is that Chrome only emits object replacement chars for replaced elements in InputMethodController::setSelectionOffsets, and ignores replaced elements in all other cases, thus
> 
> 1. IME still does not see the image element, thus (in most cases) Chrome still can not delete an image element. Try the test case at http://jsfiddle.net/CuDUL/2/ with android default english keyboard on canary, put the caret after the image and press 'Backspace', you will see Chrome move the caret before the image instead of deleting the image.
> 
> 2. Chrome internally has inconsistent knowledge about plain text offsets when the input contains replaced elements. InputMethodController::setSelectionOffsets assumes the input plain text offsets include replaced elements, while everywhere else plain text offsets exclude replaced elements, thus the offsets are often incorrectly used. Try http://jsfiddle.net/CuDUL/7/, put the cursor at the end of 'hello', you will see Chrome automatically move the caret left by 1.
> 
> To fix the issue, Chrome should always emit an object replacement char when computing a range or plainTextRange.
> 
> BUG=311448
> 
> Review URL: https://codereview.chromium.org/368423002

TBR=guohui@chromium.org

Review URL: https://codereview.chromium.org/408933004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178593 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177947 "LayoutTest editing/selection/move-left-right.html ..."

> LayoutTest editing/selection/move-left-right.html needs a separate baseline for XP
> 
> BUG=311448
> TBR=guohui@chromium.org,falken@chromium.org
> 
> Review URL: https://codereview.chromium.org/388843003

TBR=junov@chromium.org

Review URL: https://codereview.chromium.org/408943002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178594 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177953 "Auto-rebaseline for r177947"

> Auto-rebaseline for r177947
> 
> http://src.chromium.org/viewvc/blink?view=revision&revision=177947
> 
> BUG=311448
> TBR=junov@chromium.org
> 
> Review URL: https://codereview.chromium.org/383223002

TBR=ojan@chromium.org

Review URL: https://codereview.chromium.org/401373002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178596 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177716 "querySelector() should not match deep in the multi..."

> querySelector() should not match deep in the multiple shadows.
> 
> querySelector() used to match deep in the shadow trees, exposed by a test:
> http://jsfiddle.net/UwFP2/1/
> which is different result from when the same selector is specified in CSS.
> 
> This CL fixes it by checking if the last matched element lives in the same
> TreeScope as its scoping host of querySelector().
> 
> BUG=390301
> TEST=pass all existing layout tests, pass the updated layout test.
> 
> Review URL: https://codereview.chromium.org/365003003

TBR=kochi@chromium.org

Review URL: https://codereview.chromium.org/402353002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178612 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 177716 "querySelector() should not match deep in the multi..."

Fix previous merge at r178612, fix compilation.

> querySelector() should not match deep in the multiple shadows.
> 
> querySelector() used to match deep in the shadow trees, exposed by a test:
> http://jsfiddle.net/UwFP2/1/
> which is different result from when the same selector is specified in CSS.
> 
> This CL fixes it by checking if the last matched element lives in the same
> TreeScope as its scoping host of querySelector().
> 
> BUG=390301
> TEST=pass all existing layout tests, pass the updated layout test.
> 
> Review URL: https://codereview.chromium.org/365003003

TBR=kochi@chromium.org

Review URL: https://codereview.chromium.org/402373002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178614 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 178223 "Fixed the bug of resolving the form "action" attri..."

> Fixed the bug of resolving the form "action" attribute.
> 
> In some scenarios, as described in the bug, the form "action" is not correctly resolved. This is due to the fact that the change of "m_action" to KURL in CL 311033003 required that base URLs during the parsing of action attribute. However, base URL is not always available during this stage. So returning back "m_action" to a string and defer the logic of resolving action URL during the "form submission" creation.
> 
> BUG=388664
> 
> Review URL: https://codereview.chromium.org/382193005

TBR=mohammed@chromium.org

Review URL: https://codereview.chromium.org/405353002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/2062@178617 bbb929c8-8fbe-4397-9dbb-9b2b20218538