Gardening: Mark two webaudio tests failing

Which are:

- webaudio/dynamicscompressor-simple.html
- webaudio/realtimeanalyser-fft-scaling.html

BUG=349523
TBR=rtoy@chromium.org

Review URL: https://codereview.chromium.org/183063009

git-svn-id: svn://svn.chromium.org/blink/trunk@168512 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Input type Number maximum value increase

Number input type maximum value increased from float to double. Float allowed only max value of 3.402823466e38, it has now been increased to 1.7976931348623158e+308, by using double.

InvalidStateError exception is removed from NumberInputType::setValueAsDouble and NumberInputType::setValueAsDecimal, as HTMLInputType::setValueAsNumber checks if value is infinite.
As NumberInputType functions will not be called, they have been removed.

HTMLParserIdioms has also been updated as the functions are triggered in NumberInputType functions and has check for max values, thus updated.

R=tkent, ch.dumez@samsung.com
BUG=336020
TEST=Max value number can hold and exception thrown in case higher value than double is set

Review URL: https://codereview.chromium.org/172223003

git-svn-id: svn://svn.chromium.org/blink/trunk@168513 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Gardening: Mark RTCPeerConnection-lifetime.html crashy

TBR=tommyw@chromium.org
BUG=349528

Review URL: https://codereview.chromium.org/187413005

git-svn-id: svn://svn.chromium.org/blink/trunk@168514 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Gardening: Mark worker-reload-repeated.html crashy.

TBR=kinuko@chromium.org, tyoshino@chromium.org
BUG=349537

Review URL: https://codereview.chromium.org/186723006

git-svn-id: svn://svn.chromium.org/blink/trunk@168515 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Auto-rebaseline for r168491

http://src.chromium.org/viewvc/blink?view=revision&revision=168491

BUG=313447
TBR=jchaffraix@chromium.org

Review URL: https://codereview.chromium.org/181233009

git-svn-id: svn://svn.chromium.org/blink/trunk@168516 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add /resources/shape.gif

Trying to add this first before https://codereview.chromium.org/186783003/

NOTRY=true

Review URL: https://codereview.chromium.org/187673007

git-svn-id: svn://svn.chromium.org/blink/trunk@168517 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Mac: Update CSS appearance for input[type=color][list].

r168130 updated -webkit-appearance:menulist-button implementation. We should
update the CSS ruleset for input[type=color][list] too because it uses
menulist-button when it is styled.

BUG=345609
TEST=automated

Review URL: https://codereview.chromium.org/180163012

git-svn-id: svn://svn.chromium.org/blink/trunk@168519 bbb929c8-8fbe-4397-9dbb-9b2b20218538
HashTraits<RawPtr> uses 'nullptr'

It is now agreed in blink that 'nullptr' is used
to represent a null value for smart pointers.
This patch makes HashTraits<RawPtr> use 'nullptr_t'
as 'EmptyValueType' making it consistent with
HashTraits<RefPtr> and HashTraits<OwnPtr>.

Review URL: https://codereview.chromium.org/185903002

git-svn-id: svn://svn.chromium.org/blink/trunk@168520 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix a bug in Range::didSplitTextNode() that may yield an invalid Range object.

Range::didSplitTextNode() fails to update RangeBoundaryPoint's
m_childBeforeBoundary correctly, if either boundary point is located
immediately after the split text node. This change fixes this bug and adds
a couple of unit tests that make sure text splits are handled correctly.

This is a bug I found while I was investigating on a ClusterFuzz crash. The bug
above was the root cause of the crash. The crash happens in the following way:
  1. Range::surroundContents() removes some nodes during its operation,
     which causes DOMNodeRemoved event to fire *before* surroundContents()
     completes.
  2. A user-supplied event handler does something causing text to split.
  3. Due to the bug above, Range's boundary points may get into an inconsistent
     state; i.e. m_start may be located *after* m_end.
  4. If certain conditions are met, an invalid Range object created during
     Range::surroundContents() causes a crash within checkDeleteExtract().
  5. Sad face.

This change adds a new layout test that reproduces this crash.

BUG=343798

Review URL: https://codereview.chromium.org/178543013

git-svn-id: svn://svn.chromium.org/blink/trunk@168521 bbb929c8-8fbe-4397-9dbb-9b2b20218538