Merge from Chromium at DEPS revision 40.0.2214.114

This commit was generated by merge_to_master.py.

Change-Id: Ie8781168d914bfc29842cf6fcd49bf0642769fb0

14 files changed, 63 insertions, 113 deletions

diff --git a/Source/bindings/core/v8/CustomElementBinding.cpp b/Source/bindings/core/v8/CustomElementBinding.cpp
index b9622e2df..04526ea0b 100644
--- a/Source/bindings/core/v8/CustomElementBinding.cpp
+++ b/Source/bindings/core/v8/CustomElementBinding.cpp
@@ -39,10 +39,13 @@ PassOwnPtr<CustomElementBinding> CustomElementBinding::create(v8::Isolate* isola
 }
 
 CustomElementBinding::CustomElementBinding(v8::Isolate* isolate, v8::Handle<v8::Object> prototype)
-    : m_isolate(isolate)
-    , m_prototype(isolate, prototype)
+    : m_prototype(isolate, prototype)
 {
     ASSERT(!m_prototype.isEmpty());
 }
 
+CustomElementBinding::~CustomElementBinding()
+{
+}
+
 } // namespace blink
diff --git a/Source/bindings/core/v8/CustomElementBinding.h b/Source/bindings/core/v8/CustomElementBinding.h
index c30bfab76..406ab3a51 100644
--- a/Source/bindings/core/v8/CustomElementBinding.h
+++ b/Source/bindings/core/v8/CustomElementBinding.h
@@ -40,15 +40,10 @@ namespace blink {
 class CustomElementBinding {
 public:
     static PassOwnPtr<CustomElementBinding> create(v8::Isolate*, v8::Handle<v8::Object> prototype);
-
-    ~CustomElementBinding() { }
-
-    v8::Handle<v8::Object> prototype() { return m_prototype.newLocal(m_isolate); }
+    ~CustomElementBinding();
 
 private:
     CustomElementBinding(v8::Isolate*, v8::Handle<v8::Object> prototype);
-
-    v8::Isolate* m_isolate;
     ScopedPersistent<v8::Object> m_prototype;
 };
 
diff --git a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp
index a4f7f4128..da5c4f58a 100644
--- a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp
+++ b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp
@@ -92,7 +92,6 @@ static void weakCallback(const v8::WeakCallbackData<T, ScopedPersistent<T> >& da
 V8CustomElementLifecycleCallbacks::V8CustomElementLifecycleCallbacks(ScriptState* scriptState, v8::Handle<v8::Object> prototype, v8::Handle<v8::Function> created, v8::Handle<v8::Function> attached, v8::Handle<v8::Function> detached, v8::Handle<v8::Function> attributeChanged)
     : CustomElementLifecycleCallbacks(flagSet(attached, detached, attributeChanged))
     , ContextLifecycleObserver(scriptState->executionContext())
-    , m_owner(0)
     , m_scriptState(scriptState)
     , m_prototype(scriptState->isolate(), prototype)
     , m_created(scriptState->isolate(), created)
@@ -124,27 +123,18 @@ V8PerContextData* V8CustomElementLifecycleCallbacks::creationContextData()
 
 V8CustomElementLifecycleCallbacks::~V8CustomElementLifecycleCallbacks()
 {
-    if (!m_owner)
-        return;
-
-    v8::HandleScope handleScope(m_scriptState->isolate());
-    if (V8PerContextData* perContextData = creationContextData())
-        perContextData->clearCustomElementBinding(m_owner);
 }
 
 bool V8CustomElementLifecycleCallbacks::setBinding(CustomElementDefinition* owner, PassOwnPtr<CustomElementBinding> binding)
 {
-    ASSERT(!m_owner);
-
     V8PerContextData* perContextData = creationContextData();
     if (!perContextData)
         return false;
 
-    m_owner = owner;
-
-    // Bindings retrieve the prototype when needed from per-context data.
+    // The context is responsible for keeping the prototype
+    // alive. This in turn keeps callbacks alive through hidden
+    // references; see CALLBACK_LIST(SET_HIDDEN_VALUE).
     perContextData->addCustomElementBinding(owner, binding);
-
     return true;
 }
 
@@ -156,33 +146,28 @@ void V8CustomElementLifecycleCallbacks::created(Element* element)
     if (!executionContext() || executionContext()->activeDOMObjectsAreStopped())
         return;
 
-    element->setCustomElementState(Element::Upgraded);
-
     if (!m_scriptState->contextIsValid())
         return;
+
+    element->setCustomElementState(Element::Upgraded);
+
     ScriptState::Scope scope(m_scriptState.get());
     v8::Isolate* isolate = m_scriptState->isolate();
     v8::Handle<v8::Context> context = m_scriptState->context();
     v8::Handle<v8::Object> receiver = m_scriptState->world().domDataStore().get(element, isolate);
-    if (!receiver.IsEmpty()) {
-        // Swizzle the prototype of the existing wrapper. We don't need to
-        // worry about non-existent wrappers; they will get the right
-        // prototype when wrapped.
-        v8::Handle<v8::Object> prototype = m_prototype.newLocal(isolate);
-        if (prototype.IsEmpty())
-            return;
-        receiver->SetPrototype(prototype);
-    }
+    if (receiver.IsEmpty())
+        receiver = toV8(element, context->Global(), isolate).As<v8::Object>();
+
+    // Swizzle the prototype of the wrapper.
+    v8::Handle<v8::Object> prototype = m_prototype.newLocal(isolate);
+    if (prototype.IsEmpty())
+        return;
+    receiver->SetPrototype(prototype);
 
     v8::Handle<v8::Function> callback = m_created.newLocal(isolate);
     if (callback.IsEmpty())
         return;
 
-    if (receiver.IsEmpty())
-        receiver = toV8(element, context->Global(), isolate).As<v8::Object>();
-
-    ASSERT(!receiver.IsEmpty());
-
     InspectorInstrumentation::willExecuteCustomElementCallback(element);
 
     v8::TryCatch exceptionCatcher;
diff --git a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h
index 6c73468f0..b4849b019 100644
--- a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h
+++ b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h
@@ -65,7 +65,6 @@ private:
 
     V8PerContextData* creationContextData();
 
-    CustomElementDefinition* m_owner;
     RefPtr<ScriptState> m_scriptState;
     ScopedPersistent<v8::Object> m_prototype;
     ScopedPersistent<v8::Function> m_created;
diff --git a/Source/bindings/core/v8/V8PerContextData.cpp b/Source/bindings/core/v8/V8PerContextData.cpp
index 65ebdac28..691c079bf 100644
--- a/Source/bindings/core/v8/V8PerContextData.cpp
+++ b/Source/bindings/core/v8/V8PerContextData.cpp
@@ -46,7 +46,6 @@ V8PerContextData::V8PerContextData(v8::Handle<v8::Context> context)
     , m_constructorMap(m_isolate)
     , m_contextHolder(adoptPtr(new gin::ContextHolder(m_isolate)))
     , m_context(m_isolate, context)
-    , m_customElementBindings(adoptPtr(new CustomElementBindingMap()))
     , m_activityLogger(0)
     , m_compiledPrivateScript(m_isolate)
 {
@@ -134,25 +133,9 @@ v8::Local<v8::Object> V8PerContextData::prototypeForType(const WrapperTypeInfo*
 
 void V8PerContextData::addCustomElementBinding(CustomElementDefinition* definition, PassOwnPtr<CustomElementBinding> binding)
 {
-    ASSERT(!m_customElementBindings->contains(definition));
-    m_customElementBindings->add(definition, binding);
+    m_customElementBindings.append(binding);
 }
 
-void V8PerContextData::clearCustomElementBinding(CustomElementDefinition* definition)
-{
-    CustomElementBindingMap::iterator it = m_customElementBindings->find(definition);
-    ASSERT_WITH_SECURITY_IMPLICATION(it != m_customElementBindings->end());
-    m_customElementBindings->remove(it);
-}
-
-CustomElementBinding* V8PerContextData::customElementBinding(CustomElementDefinition* definition)
-{
-    CustomElementBindingMap::const_iterator it = m_customElementBindings->find(definition);
-    ASSERT_WITH_SECURITY_IMPLICATION(it != m_customElementBindings->end());
-    return it->value.get();
-}
-
-
 static v8::Handle<v8::Value> createDebugData(const char* worldName, int debugId, v8::Isolate* isolate)
 {
     char buffer[32];
diff --git a/Source/bindings/core/v8/V8PerContextData.h b/Source/bindings/core/v8/V8PerContextData.h
index ee1b5ea5c..238c9746c 100644
--- a/Source/bindings/core/v8/V8PerContextData.h
+++ b/Source/bindings/core/v8/V8PerContextData.h
@@ -88,8 +88,6 @@ public:
     V8NPObjectMap* v8NPObjectMap() { return &m_v8NPObjectMap; }
 
     void addCustomElementBinding(CustomElementDefinition*, PassOwnPtr<CustomElementBinding>);
-    void clearCustomElementBinding(CustomElementDefinition*);
-    CustomElementBinding* customElementBinding(CustomElementDefinition*);
 
     V8DOMActivityLogger* activityLogger() const { return m_activityLogger; }
     void setActivityLogger(V8DOMActivityLogger* activityLogger) { m_activityLogger = activityLogger; }
@@ -120,8 +118,8 @@ private:
     ScopedPersistent<v8::Context> m_context;
     ScopedPersistent<v8::Value> m_errorPrototype;
 
-    typedef WTF::HashMap<CustomElementDefinition*, OwnPtr<CustomElementBinding> > CustomElementBindingMap;
-    OwnPtr<CustomElementBindingMap> m_customElementBindings;
+    typedef Vector<OwnPtr<CustomElementBinding> > CustomElementBindingList;
+    CustomElementBindingList m_customElementBindings;
 
     // This is owned by a static hash map in V8DOMActivityLogger.
     V8DOMActivityLogger* m_activityLogger;
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index eaf16ebae..e4db3d316 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -3249,38 +3249,4 @@ void Element::trace(Visitor* visitor)
     ContainerNode::trace(visitor);
 }
 
-v8::Handle<v8::Object> Element::wrap(v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
-{
-    if (isCustomElement())
-        return wrapCustomElement(creationContext, isolate);
-    return ContainerNode::wrap(creationContext, isolate);
-}
-
-v8::Handle<v8::Object> Element::wrapCustomElement(v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
-{
-    // It's possible that no one except for the new wrapper owns this object at
-    // this moment, so we have to prevent GC to collect this object until the
-    // object gets associated with the wrapper.
-    RefPtrWillBeRawPtr<Element> protect(this);
-
-    ASSERT(!DOMDataStore::containsWrapper(this, isolate));
-
-    ASSERT(!creationContext.IsEmpty());
-    v8::Handle<v8::Context> context = creationContext->CreationContext();
-
-    if (!isUpgradedCustomElement() || DOMWrapperWorld::world(context).isIsolatedWorld())
-        return ContainerNode::wrap(creationContext, isolate);
-
-    const WrapperTypeInfo* wrapperType = wrapperTypeInfo();
-    v8::Handle<v8::Object> wrapper = V8DOMWrapper::createWrapper(creationContext, wrapperType, toScriptWrappableBase(), isolate);
-    if (wrapper.IsEmpty())
-        return v8::Handle<v8::Object>();
-
-    V8PerContextData* perContextData = V8PerContextData::from(context);
-    if (perContextData)
-        wrapper->SetPrototype(perContextData->customElementBinding(customElementDefinition())->prototype());
-
-    return V8DOMWrapper::associateObjectWithWrapper(isolate, this, wrapperType, wrapper);
-}
-
 } // namespace blink
diff --git a/Source/core/dom/Element.h b/Source/core/dom/Element.h
index 62e268b04..240253a03 100644
--- a/Source/core/dom/Element.h
+++ b/Source/core/dom/Element.h
@@ -489,8 +489,6 @@ public:
 
     virtual void trace(Visitor*) override;
 
-    virtual v8::Handle<v8::Object> wrap(v8::Handle<v8::Object> creationContext, v8::Isolate*) override;
-
 protected:
     Element(const QualifiedName& tagName, Document*, ConstructionType);
 
diff --git a/Source/core/editing/DeleteSelectionCommand.cpp b/Source/core/editing/DeleteSelectionCommand.cpp
index e2165e8ee..64e69390a 100644
--- a/Source/core/editing/DeleteSelectionCommand.cpp
+++ b/Source/core/editing/DeleteSelectionCommand.cpp
@@ -845,7 +845,10 @@ void DeleteSelectionCommand::doApply()
     if (placeholder) {
         if (m_sanitizeMarkup)
             removeRedundantBlocks();
-        insertNodeAt(placeholder.get(), m_endingPosition);
+        // handleGeneralDelete cause DOM mutation events so |m_endingPosition|
+        // can be out of document.
+        if (m_endingPosition.inDocument())
+            insertNodeAt(placeholder.get(), m_endingPosition);
     }
 
     rebalanceWhitespaceAt(m_endingPosition);
diff --git a/Source/core/editing/VisibleSelection.cpp b/Source/core/editing/VisibleSelection.cpp
index d8c63bbee..4ac0ed595 100644
--- a/Source/core/editing/VisibleSelection.cpp
+++ b/Source/core/editing/VisibleSelection.cpp
@@ -747,7 +747,7 @@ Element* VisibleSelection::rootEditableElement() const
 
 Node* VisibleSelection::nonBoundaryShadowTreeRootNode() const
 {
-    return start().deprecatedNode() ? start().deprecatedNode()->nonBoundaryShadowTreeRootNode() : 0;
+    return start().deprecatedNode() && !start().deprecatedNode()->isShadowRoot() ? start().deprecatedNode()->nonBoundaryShadowTreeRootNode() : 0;
 }
 
 VisibleSelection::ChangeObserver::ChangeObserver()
diff --git a/Source/core/rendering/RenderMediaControls.cpp b/Source/core/rendering/RenderMediaControls.cpp
index 71201e55f..996d76091 100644
--- a/Source/core/rendering/RenderMediaControls.cpp
+++ b/Source/core/rendering/RenderMediaControls.cpp
@@ -106,7 +106,8 @@ static bool paintMediaPlayButton(RenderObject* object, const PaintInfo& paintInf
     if (!hasSource(mediaElement))
         return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
 
-    return paintMediaButton(paintInfo.context, rect, mediaControlElementType(object->node()) == MediaPlayButton ? mediaPlay : mediaPause);
+    Image * image = !object->node()->isMediaControlElement() || mediaControlElementType(object->node()) == MediaPlayButton ? mediaPlay : mediaPause;
+    return paintMediaButton(paintInfo.context, rect, image);
 }
 
 static bool paintMediaOverlayPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
diff --git a/Source/platform/audio/HRTFDatabaseLoader.cpp b/Source/platform/audio/HRTFDatabaseLoader.cpp
index 4731ec45d..79f1fc2c5 100644
--- a/Source/platform/audio/HRTFDatabaseLoader.cpp
+++ b/Source/platform/audio/HRTFDatabaseLoader.cpp
@@ -71,20 +71,23 @@ HRTFDatabaseLoader::HRTFDatabaseLoader(float sampleRate)
 HRTFDatabaseLoader::~HRTFDatabaseLoader()
 {
     ASSERT(isMainThread());
-
-    MutexLocker locker(m_lock);
     waitForLoaderThreadCompletion();
-    m_hrtfDatabase.clear();
 }
 
 void HRTFDatabaseLoader::load()
 {
     ASSERT(!isMainThread());
-    MutexLocker locker(m_lock);
-    if (!m_hrtfDatabase) {
-        // Load the default HRTF database.
-        m_hrtfDatabase = HRTFDatabase::create(m_databaseSampleRate);
+    m_thread->attachGC();
+
+    {
+        MutexLocker locker(m_lock);
+        if (!m_hrtfDatabase) {
+            // Load the default HRTF database.
+            m_hrtfDatabase = HRTFDatabase::create(m_databaseSampleRate);
+        }
     }
+
+    m_thread->detachGC();
 }
 
 void HRTFDatabaseLoader::loadAsynchronously()
@@ -92,10 +95,10 @@ void HRTFDatabaseLoader::loadAsynchronously()
     ASSERT(isMainThread());
 
     MutexLocker locker(m_lock);
-    if (!m_hrtfDatabase && !m_databaseLoaderThread) {
+    if (!m_hrtfDatabase && !m_thread) {
         // Start the asynchronous database loading process.
-        m_databaseLoaderThread = adoptPtr(Platform::current()->createThread("HRTF database loader"));
-        m_databaseLoaderThread->postTask(new Task(WTF::bind(&HRTFDatabaseLoader::load, this)));
+        m_thread = WebThreadSupportingGC::create("HRTF database loader");
+        m_thread->postTask(new Task(WTF::bind(&HRTFDatabaseLoader::load, this)));
     }
 }
 
@@ -107,7 +110,7 @@ bool HRTFDatabaseLoader::isLoaded()
 
 void HRTFDatabaseLoader::waitForLoaderThreadCompletion()
 {
-    m_databaseLoaderThread.clear();
+    m_thread.clear();
 }
 
 } // namespace blink
diff --git a/Source/platform/audio/HRTFDatabaseLoader.h b/Source/platform/audio/HRTFDatabaseLoader.h
index 27d001788..74408b2cf 100644
--- a/Source/platform/audio/HRTFDatabaseLoader.h
+++ b/Source/platform/audio/HRTFDatabaseLoader.h
@@ -29,9 +29,9 @@
 #ifndef HRTFDatabaseLoader_h
 #define HRTFDatabaseLoader_h
 
+#include "platform/WebThreadSupportingGC.h"
 #include "platform/audio/HRTFDatabase.h"
 #include "platform/heap/Handle.h"
-#include "public/platform/WebThread.h"
 #include "wtf/HashMap.h"
 #include "wtf/ThreadingPrimitives.h"
 
@@ -77,7 +77,7 @@ private:
     Mutex m_lock;
     OwnPtr<HRTFDatabase> m_hrtfDatabase;
 
-    OwnPtr<WebThread> m_databaseLoaderThread;
+    OwnPtr<WebThreadSupportingGC> m_thread;
 
     float m_databaseSampleRate;
 };
diff --git a/Source/web/WebDevToolsFrontendImpl.cpp b/Source/web/WebDevToolsFrontendImpl.cpp
index 0ccaa2073..8e1a33fd6 100644
--- a/Source/web/WebDevToolsFrontendImpl.cpp
+++ b/Source/web/WebDevToolsFrontendImpl.cpp
@@ -160,7 +160,23 @@ void WebDevToolsFrontendImpl::windowObjectCleared()
             "InspectorFrontendHost.loaded = function() {};"
             "InspectorFrontendHost.hiddenPanels = function() { return ""; };"
             "InspectorFrontendHost.localizedStringsURL = function() { return ""; };"
-            "InspectorFrontendHost.close = function(url) { };";
+            "InspectorFrontendHost.close = function(url) { };"
+            ""
+            "(function() {"
+            "function getValue(property)"
+            "{"
+            "    if (property == 'padding-left') {"
+            "        return {"
+            "            getFloatValue: function() { return this.__paddingLeft; },"
+            "            __paddingLeft: parseFloat(this.paddingLeft)"
+            "        };"
+            "    }"
+            "    throw new Error('getPropertyCSSValue is undefined');"
+            "}"
+            ""
+            "window.CSSStyleDeclaration.prototype.getPropertyCSSValue = getValue;"
+            "window.CSSPrimitiveValue = { CSS_PX: 'CSS_PX' };"
+            "})();";
         scriptController->executeScriptInMainWorld(installAdditionalAPI, ScriptController::ExecuteScriptWhenScriptsDisabled);
     }
 }