Merge WebKit at branches/chromium/742 r88085: Initial merge by git.

Change-Id: I0501b484b9528e31b0026e5ad64416dd6541cdde

7 files changed, 35 insertions, 20 deletions

diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 276df56..2d22fa9 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -534,21 +534,31 @@ void ContainerNode::removeChildren()
         m_firstChild = next;
         if (n == m_lastChild)
             m_lastChild = 0;
-
-        if (n->attached())
-            n->detach();
-
         removedChildren.append(n.release());
     }
-    allowEventDispatch();
 
     size_t removedChildrenCount = removedChildren.size();
+    size_t i;
+
+    // Detach the nodes only after properly removed from the tree because
+    // a. detaching requires a proper DOM tree (for counters and quotes for
+    // example) and during the previous loop the next sibling still points to
+    // the node being removed while the node being removed does not point back
+    // and does not point to the same parent as its next sibling.
+    // b. destroying Renderers of standalone nodes is sometimes faster.
+    for (i = 0; i < removedChildrenCount; ++i) {
+        Node* removedChild = removedChildren[i].get();
+        if (removedChild->attached())
+            removedChild->detach();
+    }
+
+    allowEventDispatch();
 
     // Dispatch a single post-removal mutation event denoting a modified subtree.
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
     dispatchSubtreeModifiedEvent();
 
-    for (size_t i = 0; i < removedChildrenCount; ++i) {
+    for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
         if (removedChild->inDocument())
             removedChild->removedFromDocument();
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 8c22da8..60d3af1 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -1527,6 +1527,8 @@ bail_out:
     clearNeedsStyleRecalc();
     clearChildNeedsStyleRecalc();
     unscheduleStyleRecalc();
+
+    m_inStyleRecalc = false;
     
     // Pseudo element removal and similar may only work with these flags still set. Reset them after the style recalc.
     if (m_styleSelector) {
@@ -1542,7 +1544,6 @@ bail_out:
     }
     RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
-    m_inStyleRecalc = false;
 
     // If we wanted to call implicitClose() during recalcStyle, do so now that we're finished.
     if (m_closeAfterStyleRecalc) {
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index ca2ed30..50d4997 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -99,6 +99,9 @@ void EventDispatcher::dispatchScopedEvent(Node* node, PassRefPtr<Event> event)
 
 void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> underlyingEvent, bool sendMouseEvents, bool showPressedLook)
 {
+    if (node->disabled())
+        return;
+
     EventDispatcher dispatcher(node);
 
     if (!gNodesDispatchingSimulatedClicks)
@@ -160,8 +163,8 @@ PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Nod
     }
 
     if (!diverged) {
-        // The relatedTarget is a parent or shadowHost of the target.
-        if (isShadowRootOrSVGShadowRoot(m_node.get()))
+        // The relatedTarget is an ancestor or shadowHost of the target.
+        if (m_node->shadowHost() == relatedTarget.get())
             lowestCommonBoundary = m_ancestors.begin();
     } else if ((*firstDivergentBoundary) == m_node.get()) {
         // Since ancestors does not contain target itself, we must account
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index c7bf90d..1fe30ad 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -206,6 +206,7 @@ public:
 #endif
 
     virtual bool isMediaControlElement() const { return false; }
+    virtual bool isMediaControls() const { return false; }
     bool isStyledElement() const { return getFlag(IsStyledElementFlag); }
     virtual bool isFrameOwnerElement() const { return false; }
     virtual bool isAttributeNode() const { return false; }
diff --git a/Source/WebCore/dom/XMLDocumentParser.cpp b/Source/WebCore/dom/XMLDocumentParser.cpp
index a5d3c08..67d90d9 100644
--- a/Source/WebCore/dom/XMLDocumentParser.cpp
+++ b/Source/WebCore/dom/XMLDocumentParser.cpp
@@ -294,7 +294,7 @@ void XMLDocumentParser::insertErrorMessageBlock()
     // Create elements for display
     ExceptionCode ec = 0;
     Document* document = this->document();
-    Element* documentElement = document->documentElement();
+    RefPtr<Element> documentElement = document->documentElement();
     if (!documentElement) {
         RefPtr<Element> rootElement = document->createElement(htmlTag, false);
         document->appendChild(rootElement, ec);
diff --git a/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp b/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
index 85cf285..d806456 100644
--- a/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
+++ b/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
@@ -847,12 +847,16 @@ void XMLDocumentParser::endElementNs()
         return;
     }
 
+    // JavaScript can detach the parser.  Make sure this is not released
+    // before the end of this method.
+    RefPtr<XMLDocumentParser> protect(this);
+
     exitText();
 
-    Node* n = m_currentNode;
+    RefPtr<Node> n = m_currentNode;
     n->finishParsingChildren();
 
-    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n))) {
+    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n.get()))) {
         popCurrentNode();
         ExceptionCode ec;
         n->remove(ec);
@@ -864,7 +868,7 @@ void XMLDocumentParser::endElementNs()
         return;
     }
 
-    Element* element = static_cast<Element*>(n);
+    Element* element = static_cast<Element*>(n.get());
 
     // The element's parent may have already been removed from document.
     // Parsing continues in this case, but scripts aren't executed.
@@ -893,10 +897,6 @@ void XMLDocumentParser::endElementNs()
         // FIXME: Script execution should be shared between
         // the libxml2 and Qt XMLDocumentParser implementations.
 
-        // JavaScript can detach the parser.  Make sure this is not released
-        // before the end of this method.
-        RefPtr<XMLDocumentParser> protect(this);
-
         if (scriptElement->readyToBeParserExecuted())
             scriptElement->executeScript(ScriptSourceCode(scriptElement->scriptContent(), document()->url(), m_scriptStartPosition));
         else if (scriptElement->willBeParserExecuted()) {
diff --git a/Source/WebCore/dom/XMLDocumentParserQt.cpp b/Source/WebCore/dom/XMLDocumentParserQt.cpp
index 6219bcd..dd9d504 100644
--- a/Source/WebCore/dom/XMLDocumentParserQt.cpp
+++ b/Source/WebCore/dom/XMLDocumentParserQt.cpp
@@ -556,10 +556,10 @@ void XMLDocumentParser::parseEndElement()
 {
     exitText();
 
-    Node* n = m_currentNode;
+    RefPtr<Node> n = m_currentNode;
     n->finishParsingChildren();
 
-    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n))) {
+    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n.get()))) {
         popCurrentNode();
         ExceptionCode ec;
         n->remove(ec);
@@ -572,7 +572,7 @@ void XMLDocumentParser::parseEndElement()
         return;
     }
 
-    Element* element = static_cast<Element*>(n);
+    Element* element = static_cast<Element*>(n.get());
 
     // The element's parent may have already been removed from document.
     // Parsing continues in this case, but scripts aren't executed.