REGRESSION(r164133): Selection disappears after scrolling on nytimes.com
https://bugs.webkit.org/show_bug.cgi?id=135361

Reviewed by Ryosuke Niwa.

Ensure that when a RenderElement, part of the current selection is removed,
we recalculate and update the selection soon after layout.

Source/WebCore:
Test: fast/dynamic/selection-gets-cleared-when-part-of-it-gets-removed.html

* editing/FrameSelection.cpp:
(WebCore::FrameSelection::setNeedsSelectionUpdate):
(WebCore::FrameSelection::didLayout): didLayout name reflects its functionality better.
(WebCore::FrameSelection::layoutDidChange): Deleted.
* editing/FrameSelection.h: : move some functions to private.
* page/FrameView.cpp:
(WebCore::FrameView::performPostLayoutTasks):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::willBeDestroyed):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeChildInternal):
* rendering/RenderInline.cpp:
(WebCore::RenderInline::willBeDestroyed):

LayoutTests:
* fast/dynamic/selection-gets-cleared-when-part-of-it-gets-removed-expected.html: Added.
* fast/dynamic/selection-gets-cleared-when-part-of-it-gets-removed.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171718 268f45cc-cd09-0410-ab3c-d52691b4dbfc
BuildFix: JavaScriptCore/bytecode/StructureSet.h:262:77: warning.
https://bugs.webkit.org/show_bug.cgi?id=135287

Reviewed by Darin Adler.

The set() method tries to use a part of the old value (the reservedFlag bit) which
was not defined when the constructor is called. Initialize m_pointer to 0 explicitely.

* bytecode/StructureSet.h:
(JSC::StructureSet::StructureSet):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171719 268f45cc-cd09-0410-ab3c-d52691b4dbfc