Support invalidation sets for :-webkit-any selectors.

Traverse the selectorList() like we do for :host to find features for
invalidation sets. Relevance for 351613 is that we need to support this in
order to implement efficient invalidation sets for :hover with
childrenAffectedByHover due to UA stylesheet rules.

R=esprehn
BUG=356125,351613

Review URL: https://codereview.chromium.org/210973004

git-svn-id: svn://svn.chromium.org/blink/trunk@170212 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Ensured that any failure to create a WebGL context dispatches a webglcontextcreationerror

BUG=352282

Review URL: https://codereview.chromium.org/214963003

git-svn-id: svn://svn.chromium.org/blink/trunk@170213 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove repaint.js include from css3/filters tests

BUG=345027

Review URL: https://codereview.chromium.org/207153002

git-svn-id: svn://svn.chromium.org/blink/trunk@170214 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Do not update attributes in HTMLBodyElement::insertedInto.

Use didNotifySubtreeInsertionsToDocument instead.

BUG=356095
TEST=automated
R=morrita@chromium.org

Review URL: https://codereview.chromium.org/212793007

git-svn-id: svn://svn.chromium.org/blink/trunk@170216 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix crash in MemoryCache::replace.

It's possible that MemoryCache::replace will try to evict a resource that has
already been evicted. If there is another resource present in its place, it
won't get evicted, but will get partially overwritten. In that partial
overwrite, we leave references to it in the LRU lists, leading to later
crashes.

BUG=357174
TEST=MemoryCacheTest.RemoveDuringRevalidation

Review URL: https://codereview.chromium.org/214773004

git-svn-id: svn://svn.chromium.org/blink/trunk@170217 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert of Make start/stop loading notifications per-frame (https://codereview.chromium.org/183793002/)

Reason for revert:
Possibly causing content_browsertests EndToEnd to fail.

See: http://build.chromium.org/p/chromium.webkit/builders/Linux%20Tests%20%28dbg%29/builds/2095/steps/content_browsertests/logs/stdio

Output:
[20917:20917:0327/122353:3268961829:INFO:CONSOLE(0)] "Uncaught TypeError: Cannot convert undefined or null to object", source: http://127.0.0.1:34379/files/web_ui_mojo.html (0)
[20917:20917:0327/122353:3269022437:INFO:CONSOLE(28)] "Uncaught TypeError: undefined is not a function", source: http://127.0.0.1:34379/files/web_ui_mojo.js (28)
BrowserTestBase signal handler received SIGTERM. Backtrace:
#0 0x000000a593be base::debug::StackTrace::StackTrace()
#1 0x000002bfc17b content::(anonymous namespace)::DumpStackTraceSignalHandler()
#2 0x7f9c3e4ab4a0 <unknown>
#3 0x7f9c3e55da43 __poll
#4 0x7f9c42aabff6 <unknown>
#5 0x7f9c42aac124 g_main_context_iteration
#6 0x000000aaaf5f base::MessagePumpGlib::RunWithDispatcher()
#7 0x000000a8e802 base::RunLoop::Run()
#8 0x00000058256e content::(anonymous namespace)::WebUIMojoTest_EndToEnd_Test::RunTestOnMainThread()

Original issue's description:
> Make start/stop loading notifications per-frame
> 
> Also, make ProgressTracker a frame-level concept rather than a page-level concept and merge it with FrameLoader's FrameProgressTracker helper. Send per-frame progress change notifications accordingly.
> 
> This depends on https://codereview.chromium.org/180113003/ landing in chromium.
> 
> BUG=347643
> 
> Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=170192

TBR=abarth@chromium.org,japhet@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=347643

Review URL: https://codereview.chromium.org/215533004

git-svn-id: svn://svn.chromium.org/blink/trunk@170218 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Prevent a null crash when window.history is called during detach.

In certain rare cases, history.{push,replace}State are called when during
plugin detach. In this case, it's possible for the state modification to be
requested on a frame that is half-way detached. The Document is still live,
but the DocumentLoader is gone. Exit early in this case.

BUG=356424

Review URL: https://codereview.chromium.org/215183002

git-svn-id: svn://svn.chromium.org/blink/trunk@170219 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Don't access compositing state for blending in RenderLayer add/remove child

Code to update the blending status in the RenderLayer hierarchy when a child is added or removed current invokes paintsWithBlendMode which calls compositingState() when it should not. This patch removes the compositing state check in this case, which means we may do more work.

All existing tests pass.

R=senorblanco@chromium.org
BUG=343759

Review URL: https://codereview.chromium.org/211103007

git-svn-id: svn://svn.chromium.org/blink/trunk@170220 bbb929c8-8fbe-4397-9dbb-9b2b20218538