Update initial border style of <textaera> and <select> for non-Mac.

Use solid #a9a9a9 borders. This matches the native theme.  This border
style affects <textarea> and <select> elmeents only if they have
author styles and we don't use the native theme. This CL needs to
update a lot of rendering tests though the new border is not rendered.

BUG=332311
TEST=automated

Review URL: https://codereview.chromium.org/136643005

git-svn-id: svn://svn.chromium.org/blink/trunk@166363 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[Font Load Events] Fix crash by calling FontFaceSet methods on unattached documents

Unattached documents do not have FontSelector. FontFaceSet cannot do
meaningful things for those, but at least it should not crash.
This patch adds check for Document::isActive() to each method entry.

BUG=53213
TEST=fast/css/fontfaceset-unattached-document.html

Review URL: https://codereview.chromium.org/141133008

git-svn-id: svn://svn.chromium.org/blink/trunk@166364 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add missing runtime flag check for CSS variables in CSS parser

Without this check invalid expressions involving var() were being let
through while CSS variables were disabled.

BUG=339733

Review URL: https://codereview.chromium.org/142553004

git-svn-id: svn://svn.chromium.org/blink/trunk@166365 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert of Implement a binding layer for oilpan and move Gamepad to oilpan (https://codereview.chromium.org/148553004/)

Reason for revert:
Broke Oilpan once again (http://build.chromium.org/p/chromium.webkit/builders/WebKit%20Mac%20Oilpan%20%28dbg%29/builds/156):
NavigatorGamepad.cpp:55:26: error: conversion from 'int' to 'PassRefPtrWillBeRawPtr<WebCore::Gamepad>' (aka 'WTF::RawPtr<WebCore::Gamepad>') is ambiguous


Original issue's description:
> Implement a binding layer for oilpan and move Gamepad to oilpan
> 
> - The key of the binding layer change is as follows:
> 
> --- Add |isGarbageCollected| field to WrapperTypeInfo. This flag is used to distinguish if the object is in oilpan's heap or not.
> --- For oilpan's objects, we add one extra internal field to a DOM wrapper and store a persistent handle to the oilpan object. This will increase the size of DOM wrappers by one word. For non-oilpan's objects, we don't add the extra internal field.
> 
> - As one example, this CL moves Gamepad and GamepadList to oilpan's heap, using transition types. (For this kind of simple hierarchy, we don't need to use transition types, but I'm intentionally using transition types in order to implement a binding layer that support transition types.)
> 
> Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=166306
> 
> Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=166360

TBR=ager@chromium.org,vegorov@chromium.org,erik.corry@gmail.com,zerny@chromium.org,wibling@chromium.org,nbarth@chromium.org,tkent@chromium.org,haraken@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/151283004

git-svn-id: svn://svn.chromium.org/blink/trunk@166366 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Update input[type=range]'s step base handling to match spec.

The HTML spec recently shifted to using 'value' as the first fallback
option for an input element's "step base" (if no 'min' attribute),

 http://www.whatwg.org/specs/web-apps/current-work/#concept-input-min-zero

Also bring type=range elements into line with that, including using
that step base when clamping values to the supported range.

R=
BUG=339194

Review URL: https://codereview.chromium.org/152753002

git-svn-id: svn://svn.chromium.org/blink/trunk@166367 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Draw find-in-page text highlight markers for svg text.

This patch fixes find-in-page highlight markers in SVG, including both
<text> and <textPath>.

Previously, SVGRootInlineBox::paint and SVGInlineFlowBox::paint computed
DocumentMarker rects (this manifests as small yellow highlights on the
page's scrollbar) but didn't actually draw the highlight on the text.
This patch extracts out computeTextMatchMarkerRectForRenderer and
re-uses the logic in SVGInlineTextBox::paintTextMatchMarker which both
computes the DocumentMarker rects and draws the text highlights. A
comment has been added in InlineTextBox.h explaining how
paintTextMatchMarker works.

This patch also cleans up some messy paint() callsites which
unnecessarily created FloatPoints.

BUG=56580

Review URL: https://codereview.chromium.org/148673004

git-svn-id: svn://svn.chromium.org/blink/trunk@166368 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Mark fast/forms/select-multiple-rtl.html as NeedsRebaseline following r166363

TBR=tkent@chromium.org, fmalita@chromium.org

Review URL: https://codereview.chromium.org/151283005

git-svn-id: svn://svn.chromium.org/blink/trunk@166369 bbb929c8-8fbe-4397-9dbb-9b2b20218538