Tentative fix for crash during GestureTap handling

In r178098 I changed EventHandler::HandleGestureTap to re-use only
the needed portions of mouse event handling, rather than fully simulating
a real mouse event.  Since that change we've seen a few crashes reported
inside of HandleGestureTap that look like they could be due to a null
m_frame->document() or null m_frame->page().  I've tried unsuccessfully
to reproduce such crashes, but I noticed that the original mouse handling
code adds a ref to the FrameView for the duration of the function. I've
re-added that ref in HandleGestureTap in the hopes it'll address these
crashes.

I've also added a test that verifies removing an iframe during the
middle of a tap being handled in it doesn't cause any problems. I wasn't
able to get this to crash, but it's still good test coverage to have.

BUG=399020,398982

Review URL: https://codereview.chromium.org/433953002

git-svn-id: svn://svn.chromium.org/blink/trunk@179337 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix treemaps view of the flakiness dashboard.

This broke when times_ms.json files were changes to store and
require a build number when uploading/querying. Unfortunately,
they store 0 instead of the actual build number and buildnumber=latest
appears to not work, so use buildnumber=0 for now.

NOTRY=true

Review URL: https://codereview.chromium.org/431023002

git-svn-id: svn://svn.chromium.org/blink/trunk@179338 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Follow-up fixes for WorkerThread.

In my initial patch (https://codereview.chromium.org/438523002/) to move WorkerThread to WebThread there were two issues:
* When WorkerThread::stop is called, it doesn't kill the debug message queue
* The shared timer didn't account for WorkerGlobalScope in closing state.

This CL fixes those two issues.

BUG=301515

Review URL: https://codereview.chromium.org/436663002

git-svn-id: svn://svn.chromium.org/blink/trunk@179339 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Simply V8 wrapper generation for Event objects

When trying to determine what kind of wrapper to produce, we'd iterate
over core event types (exiting early) then try iterating over module
event types. If the latter yielded an empty handle we'd wrap the
object as just a V8Event, which is bogus. This could happen in a
worker if the object was indeed a module event type, but the worker
had been asynchronously stopped and v8 was politely failing to produce
a wrapper.

Remove the fallback case, and instead assert if we make it as far as
module event type iteration and no match is found.

BUG=395411
R=abarth,tasak

Review URL: https://codereview.chromium.org/424813007

git-svn-id: svn://svn.chromium.org/blink/trunk@179340 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add WebSecurityOrigin::CanAccessFeatureRequiringSecureOrigin.

Exposes |SecurityOrigin::canAccessFeatureRequiringSecureOrigin| to
embedders such as Chromium.

BUG=362214

Review URL: https://codereview.chromium.org/428643007

git-svn-id: svn://svn.chromium.org/blink/trunk@179341 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert BidiResolver::createBidiRunsForLine changes

Revert the following changes (temporarily):
  r179177 e328f38 "Have BidiRunList destructor delete runs"
  r179068 db7714a "Fix loop condition in BidiRunList::replaceRunWithRun"
  r178879 2b6511b "Change BidiResolver::createBidiRunsForLine to take r"

The change to BidiResolver in r178879 caused a bug in the handling of
isolates in certain edge cases that is proving more complicated than
expected to fix. Rather than leaving things partially broken on trunk
this change reverts the change in question. Once I've come up with a
satisfactory solution I plan to reland the changes mentioned above.

R=leviw@chromium.org
BUG=398339

Review URL: https://codereview.chromium.org/433923003

git-svn-id: svn://svn.chromium.org/blink/trunk@179342 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Mark before-unload-return-bad-value as slow

TBR=alancutter@chromium.org
NOTRY=true
BUG=399419

Review URL: https://codereview.chromium.org/436563003

git-svn-id: svn://svn.chromium.org/blink/trunk@179343 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Mark transformed-focused-text-input as flaky mac image

TBR=alancutter@chromium.org
NOTRY=true
BUG=399430

Review URL: https://codereview.chromium.org/432123002

git-svn-id: svn://svn.chromium.org/blink/trunk@179344 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Support TypeError and RangeError in private scripts

This is a split from the CL to move ScriptRegexp to Blink-in-JS (See https://codereview.chromium.org/428633008/).

This CL improves PrivateScriptRunner::throwDOMExceptionInPrivateScriptIfNeeded so that it can handle TypeError and RangeError.

BUG=341031
TEST=fast/dom/private_script_unittest.html

Review URL: https://codereview.chromium.org/431893005

git-svn-id: svn://svn.chromium.org/blink/trunk@179346 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Always notify the MediaPlayer of any seek.

This change removes short circuit logic for seeking to the current position.
There are certain situations, like seeking to a truncated duration, where the
HTMLMediaElement is not in the best position to determine whether a call to
the MediaPlayer is necessary or not. This change allows the
MediaPlayer/WebMediaPlayer implementation to determine what the best course
of action should be. This also makes the seeking behavior more spec
compliant because even a seek to the current position should have the
seeking attribute be true until a stable state occurs. This is guaranteed
when calling into the MediaPlayer and allows all seeks to be treated the
same at the HTMLMediaElement level.

BUG=266631
TEST=LayoutTests/media/video-seek-to-current-position.html

Review URL: https://codereview.chromium.org/431903003

git-svn-id: svn://svn.chromium.org/blink/trunk@179347 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Mark link-rel-prefetch-and-subresource flaky

TBR=alancutter@chromium.org
NOTRY=true
BUG=399459

Review URL: https://codereview.chromium.org/431153003

git-svn-id: svn://svn.chromium.org/blink/trunk@179348 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Let RenderBox's visual overflow include the whole focus ring

Previously visual overflow might not cover the whole focus ring.

Include focus ring in visual overflow to ensure the whole focus ring
is invalidated when needed.

Key change is in RenderBox::computeVisualEffectOverflowExtent().

Other changes are just to add 'const' to addFocusRingRects().

BUG=398512, 396225
TEST=transforms/transform-focus-ring-repaint.html

Review URL: https://codereview.chromium.org/427873002

git-svn-id: svn://svn.chromium.org/blink/trunk@179349 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert of Enable Oilpan by default for websockets/ (https://codereview.chromium.org/429293003/)

Reason for revert:
Causes crashes in websocket browser tests

e.g. http://build.chromium.org/p/chromium.webkit/builders/Linux%20ChromiumOS%20Tests%20%28dbg%29%281%29/builds/533/steps/browser_tests/logs/stdio

Bisected locally to find this revision.

Original issue's description:
> Enable Oilpan by default for websockets/
> 
> This CL basically just drops WillBe types from websocket objects. Non-trivial parts are:
> 
> - Changed MockWebSocketChannelClient from RefCountedGarbageCollected to GarbageCollectedFinalized since it doesn't need to be RefCounted.
> 
> - Marked AllowCrossThreadAccessWrapper as STACK_ALLOCATED, and intentionally allowed to use a raw pointer to T*. Ideally this should be Member<T> if T inherits from GarbageCollected, but I don't want to introduce another template magic just to distinguish Member<T> from T* on stack-allocated objects. Added a comment about it.
> 
> BUG=340522
> 
> Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=179336

TBR=oilpan-reviews@chromium.org,tyoshino@chromium.org,yhirano@chromium.org,ricea@chromium.org,tkent@chromium.org,haraken@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=340522

Review URL: https://codereview.chromium.org/429453008

git-svn-id: svn://svn.chromium.org/blink/trunk@179351 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: Replace Document& with RawPtrWillBeMember<Document>

Document& in on-heap objects should be RawPtrWillBeMember<Document> and traced.

BUG=340522

Review URL: https://codereview.chromium.org/434003002

git-svn-id: svn://svn.chromium.org/blink/trunk@179352 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Cleanup: Simplify platform unittests targets.

It is seems redundant to have a separate target only for the main()
entry.

It looks cleaner to have everything contained into a single target imo.

BUG=None
TEST=blink_heap_unittests,blink_platform_unittests
R=tkent@chromium.org

Review URL: https://codereview.chromium.org/430933005

git-svn-id: svn://svn.chromium.org/blink/trunk@179353 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: Replace Node& with RawPtrWillBeMember<Node>

This CL makes the following classes STACK_ALLOCATED, and replaces Node& with RawPtrWillBeMember<Node>.

- StyleResolverParentScope
- TreeScopeAdopter
- StyleSheetCandidate
- NodeWithIndex
- NodeChildRemovalTracker
- ChildFrameDisconnector
- SubframeLoadingDisabler

BUG=340522

Review URL: https://codereview.chromium.org/435683004

git-svn-id: svn://svn.chromium.org/blink/trunk@179354 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Simplify the code in FrameView::updateLayoutAndStyleIfNeededRecursive a little bit.

Review URL: https://codereview.chromium.org/435793002

git-svn-id: svn://svn.chromium.org/blink/trunk@179355 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Have getChildNodes() take a ContainerNode in argument

Have getChildNodes() take a ContainerNode in argument instead of a Node as
this utility function only makes sense for ContainerNodes. Also, this lets
the compiler generate slighter more efficient code.

This CL also makes use of getChildNodes() in more places to avoid code
duplication.

R=adamk@chromium.org

Review URL: https://codereview.chromium.org/435733002

git-svn-id: svn://svn.chromium.org/blink/trunk@179356 bbb929c8-8fbe-4397-9dbb-9b2b20218538
MSE: Fix flaky mediasource-append-buffer.html test

Media source specification's end of stream algorithm is currently
underspecified when no media data is buffered, and implementation may
transition beyond 'ended' to 'closed' MediaSource readyState.

This change updates the layout test to cover the well-specified case
when there is media data buffered prior to endOfStream() and removes the
flaky fail expectation. Later tests will be added to cover the currently
underspecified cases, once correct behavior is defined and implemented.

BUG=399188
R=acolwell@chromium.org
TEST=mediasource-append-buffer.html passed 100/100 attempts with 8 content_shells in parallel locally on linux

Review URL: https://codereview.chromium.org/417163006

git-svn-id: svn://svn.chromium.org/blink/trunk@179357 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Move Node/ContainerNode's traverseToChildAt() to NodeTraversal

Move Node/ContainerNode's traverseToChildAt() to NodeTraversal and rename to
childAt() as this method does DOM Tree traversal and we already have a utility
class for this.

R=adamk@chromium.org

Review URL: https://codereview.chromium.org/425223005

git-svn-id: svn://svn.chromium.org/blink/trunk@179358 bbb929c8-8fbe-4397-9dbb-9b2b20218538