Unreviewed, rolling out r171218.
https://bugs.webkit.org/show_bug.cgi?id=135055

Made fast/dom/HTMLObjectElement/beforeload-set-text-
crash.xhtml crash (Requested by ap on #webkit).

Reverted changeset:

"REGRESSION (r169105): Crash in selection"
https://bugs.webkit.org/show_bug.cgi?id=134303
http://trac.webkit.org/changeset/171218

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171222 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Unreviewed gardening. Removing failure expectations for tests now passing.

* platform/gtk/TestExpectations: Removed failure expectations.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171223 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r171207.
https://bugs.webkit.org/show_bug.cgi?id=135056

Broke multiple tests on Yosemite (Requested by ap on #webkit).

Reverted changeset:

"Fixed position elements are misplaced when a WK1 view has
contentInsets set"
https://bugs.webkit.org/show_bug.cgi?id=135031
http://trac.webkit.org/changeset/171207

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171224 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION: Crash when typing into text field that clears itself on iOS

<https://bugs.webkit.org/show_bug.cgi?id=135044>
<rdar://problem/17640443>

Reviewed by Darin Adler.

* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::requestAutocorrectionData):
wordRangeFromPosition() returns null in some cases; null check range
before dereferencing it. Moved some variable declarations around to
better match our style.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171225 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add timeout for transition end. Speculative layout test fix.

* fast/layers/no-clipping-overflow-hidden-added-after-transform.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171226 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Revert r169735 since it broke Timeline, and fix bug 129696 in a more targeted way.

REGRESSION (r169735): Web Inspector: Timeline tree outline missing data until collapse-expand.
https://bugs.webkit.org/show_bug.cgi?id=134845

Reviewed by Joseph Pecoraro.

* UserInterface/Views/DOMTreeElement.js:
(WebInspector.DOMTreeElement.prototype.adjustCollapsedRange): Use button isteand of assuming
item.listItemElement will be ready to use. The listItemElement node is lazily created.
* UserInterface/Views/TreeOutline.js:
(TreeOutline.prototype.appendChild): Don't attach unless _childrenListNode exists.
(TreeOutline.prototype.insertChild): Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171227 268f45cc-cd09-0410-ab3c-d52691b4dbfc