Revert 160318 "Remove TreatNullAs=NullString for media interfaces"

> Remove TreatNullAs=NullString for media interfaces
> 
> The spec doesn't have special null handling here:
> http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html
> 
> The updated test was run in Firefox Nightly (with media.webvtt.enabled),
> IE11 Release Preview and Opera 12.16 (Presto 2.12.388). Everything
> passes, with these exceptions:
> 
> No other browser supports the mediaGroup property.
> 
> The preload default value is "metadata" in IE11 and Presto, and "" in
> Firefox. The spec suggests "metadata". Bugs filed:
> https://code.google.com/p/chromium/issues/detail?id=310450
> https://bugzilla.mozilla.org/show_bug.cgi?id=929890
> 
> BUG=310298
> 
> Review URL: https://codereview.chromium.org/35803004

TBR=philipj@opera.com

Review URL: https://codereview.chromium.org/98793007

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164124 bbb929c8-8fbe-4397-9dbb-9b2b20218538
removed ] to fix syntax issue

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164130 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164199 "Image changes need to push a frame on the compositor"

> Image changes need to push a frame on the compositor
> 
> BUG=328069
> R=esprehn@chromium.org, vollick@chromium.org
> 
> Review URL: https://codereview.chromium.org/118933002

TBR=shawnsingh@chromium.org

Review URL: https://codereview.chromium.org/117463005

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164347 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 162160 "Fix render tree construction when inlines are inse..."

> Fix render tree construction when inlines are inserted in reverse after a block in a continuation
> 
> When inserting inlines after a block inside of an inline continuation, if we insert inline
> content in reverse DOM order, we can (depending on when we attach) end up appending the renderers
> in the wrong location, leading to visual aberrations. Since Blink r158839, we always attach in
> reverse DOM order, which makes this bug easier to run into.
> 
> The fix is in RenderInline, where we should always attach behind our beforeChild if we're
> inserting an inline and beforeChild is an inline, regardless of other continuation state.
> 
> Big thanks to Elliott for the test case!
> 
> BUG=318805
> 
> Review URL: https://codereview.chromium.org/68013006

TBR=leviw@chromium.org

Review URL: https://codereview.chromium.org/122013003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164419 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164278 "Fix render tree creation in blocks with multiple a..."

> Fix render tree creation in blocks with multiple anonymous blocks and mixed inlines/out of flow children
> 
> Out of flow children weren't being inserted into anonymous blocks following the same rules as inlines,
> which had the effect of breaking a later search for the correct anonymous block to attach other
> inline renderers in the middle of the containing block. This had the effect of the resulting inlines
> being separated into different anonymous blocks (and hence visually) when they all should all be
> siblings of the same anonymous block.
> 
> BUG=318839
> 
> Review URL: https://codereview.chromium.org/120603002

TBR=leviw@chromium.org

Review URL: https://codereview.chromium.org/98613007

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164420 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164210 "Crash reparenting a floating inline list item with..."

> Crash reparenting a floating inline list item without a list
> 
> When a list item isn't in a list, without adjusting the style we instruct
> the renderer to behave as if its marker is inside. Floats are layed out
> late in line layout, and if the list item is moved and the marker already
> created, updateMarkerLocation would mark the chain through its containing
> block as needing layout towards the end of that block's layout, and
> therefor with stale pointers.
> 
> There's no reason to defer calling updateMarkerLocation in this case.
> This change gets the marker's renderer properly positioned during
> attach.
> 
> BUG=301196
> 
> Review URL: https://codereview.chromium.org/75683002

TBR=leviw@chromium.org

Review URL: https://codereview.chromium.org/105293005

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164421 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164245 "Include m_attachedElement in MediaSourceBase::hasP..."

> Include m_attachedElement in MediaSourceBase::hasPendingActivity() condition.
> 
> m_attachedElement needs to be added to hasPendingActivity() so that a reference
> is held the entire time it is considered "attached" to an HTMLMediaElement. This
> includes the brief period it is attached, but not open yet.
> 
> BUG=330026
> 
> Review URL: https://codereview.chromium.org/112373005

TBR=acolwell@chromium.org

Review URL: https://codereview.chromium.org/118323005

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164422 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 163945 "Fix assertion failure in FormAssociatedElement::fo..."

> Fix assertion failure in FormAssociatedElement::formRemovedFromTree.
> 
> This is a regression by Blink r163680 [1].
> FormAssociatedElement::formRemovedFromTree can be called with
> m_deletionHasBegun. We should not update the reference counter in it.
> 
> Removing RefPtr<> for HTMLFormElement::m_pastNamesMap magically fixes the
> original problem.
> 
> This CL has no tests. I couldn't make a test which works as a layout test.
> 
> [1] http://src.chromium.org/viewvc/blink?revision=163680&view=revision
> 
> BUG=326854,328456
> 
> Review URL: https://codereview.chromium.org/113423005

TBR=tkent@chromium.org

Review URL: https://codereview.chromium.org/99743004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164445 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164455 "Fix WebMediaPlayerClientImpl so it only holds its ..."

> Fix WebMediaPlayerClientImpl so it only holds its reference to the MediaSource while opening.
> 
> The WebMediaPlayerClientImpl was holding onto its MediaSource reference
> much longer than it needed to. Under certain circumstances it can hold
> the last reference to the MediaSource, which can lead to crashes when
> the MediaSource is destroyed as part of WebMediaPlayerClientImpl
> destruction during document teardown.
> 
> This change fixes the crashes by only allowing WebMediaPlayerClientImpl
> to hold the reference for the mimimal time it needs to. It only needs
> to hold the reference while opening the MediaSource. Once the
> MediaSource is open, the reference is cleared so it can't cause problems
> later.
> 
> 
> BUG=330026
> TEST=LayoutTests/http/tests/media/media-source/mediasource-gc-after-decode-error-crash.html
> 
> Review URL: https://codereview.chromium.org/107933008

TBR=acolwell@chromium.org

Review URL: https://codereview.chromium.org/101193009

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164516 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 163906 "[SVG] SetValue() called on parent tear-offs should..."

> [SVG] SetValue() called on parent tear-offs should recursively update child tear-offs.
> 
> SVGPropertyTearOff<SVGTransform> is special as it can have SVGMatrixTearOff as its child tearoff.
> The child SVGMatrixTearOff references inside parent SVGPropertyTearOff<SVGTransform>'s m_value.
> 
> SVGPropertyTearOff<SVGTransform>::SetValue() is a method which update m_value, but it didn't care about its child which would also be referencing m_value.
> This patch fixes SetValue() so that m_value of child tearoffs are also recursively updated.
> 
> BUG=327729
> 
> Review URL: https://codereview.chromium.org/103693004

TBR=kouhei@chromium.org

Review URL: https://codereview.chromium.org/125253003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164518 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164495 "Protect Frame object against destruction during DO..."

> Protect Frame object against destruction during DOMWindow::find()
> 
> This patch changes DOMWindow::find(), JavaScript exposed function, to keep associated Frame object to DOMWindow, hold in |m_frame|, during |Editor::findString()| call. |Editor::findString()| can update render tree by calling Document::updateLayout() and it can run user scripts which destruct Frame object, via event handler, e.g. focus, blur, and so on.
> 
> BUG=331232
> TEST=LayoutTests/fast/dom/Window/window-find-crash.html
> 
> Review URL: https://codereview.chromium.org/103553007

TBR=yosin@chromium.org

Review URL: https://codereview.chromium.org/130333002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164722 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164328 "[DevTools] Disable emulation UI elements when emul..."

> [DevTools] Disable emulation UI elements when emulation itself is disabled.
> 
> This was broken because we have two conditions to check:
> - whether inspected page is on real device;
> - whether emulation is enabled.
> Second condition was ignored.
> 
> This change also applies emulation on first click on 'Emulate screen' checkbox.
> 
> BUG=330504
> 
> Review URL: https://codereview.chromium.org/118513004

TBR=dgozman@chromium.org

Review URL: https://codereview.chromium.org/131563002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164766 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164006 "Ensure the current frame is not lost during testin..."

> Ensure the current frame is not lost during testing of whether a style
> update is needed.
> 
> BUG=315889
> 
> Review URL: https://codereview.chromium.org/109263007

TBR=mikelawther@chromium.org

Review URL: https://codereview.chromium.org/132883002

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164818 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164913 "Revert "Explicit space required around NOT/ONLY/AN..."

> Revert "Explicit space required around NOT/ONLY/AND in CSS MQ."
> 
> This reverts commit 5f1d4100b0537f0b9aa7efc9bd8d44d618442f78.
> 
> Conflicts:
> 
> 	Source/core/css/CSSGrammar.y.in
> 
> BUG=333035
> 
> Review URL: https://codereview.chromium.org/134893002

TBR=eseidel@chromium.org

Review URL: https://codereview.chromium.org/130823003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@164914 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164536 "Avoid drawing SVG image content when the image is ..."

> Avoid drawing SVG image content when the image is of zero size.
> 
> R=pdr
> BUG=330420
> 
> Review URL: https://codereview.chromium.org/109753004

TBR=schenney@chromium.org

Review URL: https://codereview.chromium.org/140783011

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@165329 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164554 "Handle overflow detection in WebGLRenderingContext."

> Handle overflow detection in WebGLRenderingContext.
> 
> BUG=328203
> TEST=
> 
> Review URL: https://codereview.chromium.org/101463007

TBR=zmo@chromium.org

Review URL: https://codereview.chromium.org/138033022

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@165334 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 163903 "Update the first letter when the first line is cha..."

> Update the first letter when the first line is changed by adding a new text at its start.
> 
> CSS first-letter property does not work properly when the first letter is changed
> by DOM scripting. This patch allows us to update the first letter and remaining text when the
> first letter is changed.
> 
> The original patch was reverted due to use-after-frees on ClusterFuzz.
> https://codereview.chromium.org/49943002
> 
> BUG=92797
> TEST=fast/css/first-letter-block-change.html
> 
> Review URL: https://codereview.chromium.org/51953006

TBR=joone.hur@intel.com

Review URL: https://codereview.chromium.org/132233019

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@165337 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 165334 "Merge 164554 "Handle overflow detection in WebGLR..."

> Merge 164554 "Handle overflow detection in WebGLRenderingContext."
> 
> > Handle overflow detection in WebGLRenderingContext.
> > 
> > BUG=328203
> > TEST=
> > 
> > Review URL: https://codereview.chromium.org/101463007
> 
> TBR=zmo@chromium.org
> 
> Review URL: https://codereview.chromium.org/138033022

TBR=karen@chromium.org

Review URL: https://codereview.chromium.org/142063003

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@165339 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 165337 "Merge 163903 "Update the first letter when the fi..."

> Merge 163903 "Update the first letter when the first line is cha..."
> 
> > Update the first letter when the first line is changed by adding a new text at its start.
> > 
> > CSS first-letter property does not work properly when the first letter is changed
> > by DOM scripting. This patch allows us to update the first letter and remaining text when the
> > first letter is changed.
> > 
> > The original patch was reverted due to use-after-frees on ClusterFuzz.
> > https://codereview.chromium.org/49943002
> > 
> > BUG=92797
> > TEST=fast/css/first-letter-block-change.html
> > 
> > Review URL: https://codereview.chromium.org/51953006
> 
> TBR=joone.hur@intel.com
> 
> Review URL: https://codereview.chromium.org/132233019

TBR=karen@chromium.org

Review URL: https://codereview.chromium.org/141953006

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@165340 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Merge 164845 "Fix bad cast to XPath::Filter in XPathGrammar.y"

> Fix bad cast to XPath::Filter in XPathGrammar.y
> 
> In XPathGrammar.y, we cast the Expression to Filter before passing it to the
> Path constructor. This is wrong as the Expression is not necessarily of type
> XPath::Filter. For example, in fast/xpath/id-simple.html, it has type
> XPath::Function.
> 
> I noticed this bug when marking the XPath::Filter class as FINAL. The
> fast/xpath/id-simple.html test started crashing as the call to
> Filter::evaluate() was resolved at compile time instead of using the vtable at
> runtime. Since the object is actually a XPath::Function and not a XPath::Filter
> in this test, this was causing trouble.
> BUG=333155
> R=abarth, esprehn
> 
> Review URL: https://codereview.chromium.org/131593003

TBR=ch.dumez@samsung.com

Review URL: https://codereview.chromium.org/143943004

git-svn-id: svn://svn.chromium.org/blink/branches/chromium/1700@165492 bbb929c8-8fbe-4397-9dbb-9b2b20218538