Subpixel rendering: Incorrect repaint rect cuts off content's right edge after move.
https://bugs.webkit.org/show_bug.cgi?id=129652

Reviewed by Simon Fraser.

When repaint rect is adjusted in order to take the distance from renderer into account,
the accumulated fraction value need to be added too. This is always a positive value.

Source/WebCore:

Test: fast/borders/hidpi-border-clipping-right-after-move.html

* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):

LayoutTests:

* fast/borders/hidpi-border-clipping-right-after-move-expected.html: Added.
* fast/borders/hidpi-border-clipping-right-after-move.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165050 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] Selection remains after reload.
https://bugs.webkit.org/show_bug.cgi?id=129648
<rdar://problem/16207547>

Reviewed by Sam Weinig.

We normally clear the selection when resigninig first responder but
that doesn't get called when reloading the page or when navigating with
back/forward buttons. The correct place to do this is when we get
_didCommitLoadForMainFrame where we already stop assisting the node.
The method we call into webselectionassistant is resignedFirstResponder
which takes care of clearing the selection and removing the selection view.

* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView _stopAssistingNode]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165051 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Remove WebInspector.EventHandler in favor of WebInspector.EventListenerSet
https://bugs.webkit.org/show_bug.cgi?id=129185

Patch by Diego Pino Garcia <dpino@igalia.com> on 2014-03-04
Reviewed by Timothy Hatcher.

* UserInterface/Base/EventHandler.js: Removed.
* UserInterface/Main.html: Don't include EventHandler.js.
* UserInterface/Views/SourceCodeTextEditor.js:
(WebInspector.SourceCodeTextEditor.prototype._dismissPopover):
(WebInspector.SourceCodeTextEditor.prototype._trackPopoverEvents):
Use EventListenerSet instead of EventHandler.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165052 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SVGPropertyTearOffs should detachChildren before deleting its value.
<http://webkit.org/b/129618>
<rdar://problem/15661617>

Reviewed by Maciej Stachowiak.

Merged from Blink (patch by kouhei@chromium.org):
https://src.chromium.org/viewvc/blink?revision=158563&view=revision
http://crbug.com/296276

Test: svg/transforms/svg-matrix-tearoff-crash.html

NOTE: The test does not reproduce a crash on WebKit using
JavaScriptCore.

* svg/properties/SVGPropertyTearOff.h:
(WebCore::SVGPropertyTearOff::setValue):
(WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
- Call detachChildren() if m_value is a copy.  The original
  Blink patch did not modify the destructor code path, although
  that seems obvious via code inspection.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165053 268f45cc-cd09-0410-ab3c-d52691b4dbfc