Merge changes If869bd58,I18c371c9,I7c46eab4

* changes:
  Cherry-pick WebKit change r92139 to fix a LayoutTest crash
  Cherry-pick WebKit change r87227 as a prerequisite for r92139
  Cherry-pick WebKit change r85267 as a prerequisite for r92139

7 files changed, 31 insertions, 28 deletions

diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 0b6fd35..613bf4a 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -1194,7 +1194,8 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
     documentStyle->setVisuallyOrdered(document->visuallyOrdered());
     documentStyle->setZoom(frame ? frame->pageZoomFactor() : 1);
     documentStyle->setPageScaleTransform(frame ? frame->pageScaleFactor() : 1);
-    
+    documentStyle->setUserModify(document->inDesignMode() ? READ_WRITE : READ_ONLY);
+
     Element* docElement = document->documentElement();
     RenderObject* docElementRenderer = docElement ? docElement->renderer() : 0;
     if (docElementRenderer) {
@@ -1236,6 +1237,15 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
     return documentStyle.release();
 }
 
+static inline bool isAtShadowBoundary(Element* element)
+{
+    if (!element)
+        return false;
+
+    ContainerNode* parentNode = element->parentNode();
+    return parentNode && parentNode->isShadowBoundary();
+}
+
 // If resolveForRootDefault is true, style based on user agent style sheet only. This is used in media queries, where
 // relative units are interpreted according to document root element style, styled only with UA stylesheet
 
@@ -1278,6 +1288,10 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
         initForStyleResolve(e, defaultParent);
     }
 
+    // Don't propagate user-modify into shadow DOM
+    if (isAtShadowBoundary(e))
+        m_style->setUserModify(RenderStyle::initialUserModify());
+
     m_checker.m_matchVisitedPseudoClass = matchVisitedPseudoClass;
 
     m_style = RenderStyle::create();
@@ -1772,15 +1786,6 @@ static void addIntrinsicMargins(RenderStyle* style)
     }
 }
 
-static inline bool isAtShadowBoundary(Element* element)
-{
-    if (!element)
-        return false;
-
-    ContainerNode* parentNode = element->parentNode();
-    return parentNode && parentNode->isShadowBoundary();
-}
-
 void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parentStyle, Element *e)
 {
     // Cache our original display.
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 1b5f55b..7fc628c 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -4083,6 +4083,8 @@ void Document::setTransformSource(PassOwnPtr<TransformSource> source)
 void Document::setDesignMode(InheritedBool value)
 {
     m_designMode = value;
+    for (Frame* frame = m_frame; frame && frame->document(); frame = frame->tree()->traverseNext(m_frame))
+        frame->document()->scheduleForcedStyleRecalc();
 }
 
 Document::InheritedBool Document::getDesignMode() const
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 0967ef5..ec5c423 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -770,7 +770,7 @@ bool Node::isContentEditable() const
 
 bool Node::rendererIsEditable(EditableLevel editableLevel) const
 {
-    if (document()->inDesignMode() || (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable()))
+    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable() && !shadowTreeRootNode())
         return true;
 
     // Ideally we'd call ASSERT(!needsStyleRecalc()) here, but
@@ -1614,7 +1614,7 @@ SVGUseElement* Node::svgShadowHost() const
 }
 #endif
 
-Node* Node::shadowAncestorNode()
+Node* Node::shadowAncestorNode() const
 {
 #if ENABLE(SVG)
     // SVG elements living in a shadow tree only occur when <use> created them.
@@ -1622,18 +1622,18 @@ Node* Node::shadowAncestorNode()
     // but the actual shadow tree element - as main difference to the HTML forms
     // shadow tree concept. (This function _could_ be made virtual - opinions?)
     if (isSVGElement())
-        return this;
+        return const_cast<Node*>(this);
 #endif
 
     Node* root = shadowTreeRootNode();
     if (root)
         return root->shadowHost();
-    return this;
+    return const_cast<Node*>(this);
 }
 
-Node* Node::shadowTreeRootNode()
+Node* Node::shadowTreeRootNode() const
 {
-    Node* root = this;
+    Node* root = const_cast<Node*>(this);
     while (root) {
         if (root->isShadowRoot() || root->isSVGShadowRoot())
             return root;
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 08b1921..76355c3 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -218,8 +218,8 @@ public:
     virtual bool isShadowBoundary() const { return false; }
     virtual bool canHaveLightChildRendererWithShadow() const { return false; }
 
-    Node* shadowAncestorNode();
-    Node* shadowTreeRootNode();
+    Node* shadowAncestorNode() const;
+    Node* shadowTreeRootNode() const;
     bool isInShadowTree();
     // Node's parent, shadow tree host, or SVG use.
     ContainerNode* parentOrHostNode() const;
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index c9649d0..4f1bc93 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -1316,8 +1316,10 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(PassRefPtr<Node> passedStar
     RefPtr<Node> node = startNode;
     while (node) {
         RefPtr<Node> next = node->nextSibling();
-        removeNode(node);
-        appendNode(node, element);
+        if (node->isContentEditable()) {
+            removeNode(node);
+            appendNode(node, element);
+        }
         if (node == endNode)
             break;
         node = next;
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index b2b57a2..82e33d1 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -682,11 +682,6 @@ void HTMLElement::setContentEditable(Attribute* attr)
         attr->decl()->removeProperty(CSSPropertyWordWrap, false);
         attr->decl()->removeProperty(CSSPropertyWebkitNbspMode, false);
         attr->decl()->removeProperty(CSSPropertyWebkitLineBreak, false);
-    } else if (equalIgnoringCase(enabled, "inherit")) {
-        addCSSProperty(attr, CSSPropertyWebkitUserModify, CSSValueInherit);
-        attr->decl()->removeProperty(CSSPropertyWordWrap, false);
-        attr->decl()->removeProperty(CSSPropertyWebkitNbspMode, false);
-        attr->decl()->removeProperty(CSSPropertyWebkitLineBreak, false);
     } else if (equalIgnoringCase(enabled, "plaintext-only")) {
         addCSSProperty(attr, CSSPropertyWebkitUserModify, CSSValueReadWritePlaintextOnly);
         addCSSProperty(attr, CSSPropertyWordWrap, CSSValueBreakWord);
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.h b/Source/WebCore/html/shadow/TextControlInnerElements.h
index 2340970..886fbf8 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.h
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.h
@@ -101,9 +101,8 @@ private:
 
     virtual void detach();
     virtual bool isSpinButtonElement() const { return true; }
-    // FIXME: shadowAncestorNode() should be const.
-    virtual bool isEnabledFormControl() const { return static_cast<Element*>(const_cast<SpinButtonElement*>(this)->shadowAncestorNode())->isEnabledFormControl(); }
-    virtual bool isReadOnlyFormControl() const { return static_cast<Element*>(const_cast<SpinButtonElement*>(this)->shadowAncestorNode())->isReadOnlyFormControl(); }
+    virtual bool isEnabledFormControl() const { return static_cast<Element*>(shadowAncestorNode())->isEnabledFormControl(); }
+    virtual bool isReadOnlyFormControl() const { return static_cast<Element*>(shadowAncestorNode())->isReadOnlyFormControl(); }
     virtual void defaultEventHandler(Event*);
     void startRepeatingTimer();
     void stopRepeatingTimer();