Cloning a textarea element without a dirty value flag does not call SetValue() and thus gets no max length. This makes sure it always gets one before setting selection range.

Differential Revision: https://phabricator.services.mozilla.com/D99734

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1682313
gecko-commit: 80e51db676d263d2563f2ef10a1c50c617e2853e
gecko-reviewers: masayuki

Differential Revision: https://phabricator.services.mozilla.com/D99632

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1682159
gecko-commit: b90e93c4aa5c76dfe14a05f8e7bcbdfbcc78c24f
gecko-reviewers: edgar

When an HTMLImageElement's 'src' is set to the empty string, the state
of the image request will be 'broken', and thus the promise should be
rejected with an InvalidStateError exception per the rules at [1].

Move the intrinsic size check below the image existence check, and use
a more direct method of getting at the size (no need to go through the
BitmapImageSource interface when we're already fiddling with internals).

Also add a check for IsLoaded() to better match the spec wording
'fully decodable'.

[1] https://wicg.github.io/shape-detection-api/#image-sources-for-detection

Bug: 789511
Change-Id: I69ac4a9081cfff7f9c7c8f7edf39667e3dd1eb4d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2587165
Reviewed-by: Reilly Grant <reillyg@chromium.org>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#837140}

…ascript url

Previous fix(https://chromium-review.googlesource.com/c/chromium/src/+/2181318)
on uninitialized frame policy in javascript url
navigation does not include a test case because it is a security
fix.

Since the fix has landed in M84 which is stable right now, this CL
adds the test case for the fix.

Bug: 1074340
Change-Id: Ia10a972183b02cdac28a2f29cabb7f13caf168e5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2297708
Commit-Queue: Charlie Hu <chenleihu@google.com>
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837169}

…m capabilities. (web-platform-tests#26741)

* [wdspec] Session fixture has to deep update custom capabilities.

Differential Revision: https://phabricator.services.mozilla.com/D98459

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1680114
gecko-commit: 6e45b8c280e020d31f69085bf5b77d5b4186ce27
gecko-reviewers: webdriver-reviewers, jgraham

* Fix use of iteritems in WebDriver helpers

Differential Revision: https://phabricator.services.mozilla.com/D99253

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1680114
gecko-commit: d3fa09337a9a4cbf8233e49295baa5e57dbedd57
gecko-reviewers: whimboo, webdriver-reviewers

These APIs have been deprecated since Aug 2018 [1], disabled by default
since Oct 2019 [2], and removed from Origin Trial support since Oct
2020 [3]. This CL removes the code to support these two features
completely.

This is being done in one large CL for two reasons:
 1. It is hard to untangle all of the dependencies of this code to
    be able to land this in multiple CLs.
 2. Doing this in a single CL will allow the effects (progressions,
    hopefully, but we'll see) to be more easily tracked.

[1] https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/h-JwMiPUnuU/sl79aLoLBQAJ
[2] https://chromium-review.googlesource.com/c/chromium/src/+/1850795
[3] https://chromium-review.googlesource.com/c/chromium/src/+/2458126

Bug: 937746, 1157927, 1158001
Fixed: 1129465
Fixed: 1157500
Change-Id: I45d77960fa77e2bba3f5b301e3fb7372bb659c4f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2586019
Commit-Queue: Mason Freed <masonfreed@chromium.org>
Reviewed-by: Yu Han <yuzhehan@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Robert Kaplow <rkaplow@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837213}

This is a reland of c7326b7f5dd47cddf6ff99d98fd1b7be1f54f922

Canvases may have different color formats than N32, and when we pull
the content of them into a cpu bitmap through SkImage::toLegacyBitmap()
we need to convert that to N32 format if we're going to send the bitmap
over IPC due to security restrictions of the BitmapN32 mojom type.

This does that conversion in the blink ShapeDetector and adds a test with
a float16 color format canvas which would cause the IPC sending to be
dropped (and the renderer to crash).

TBR=dcheng

Original change's description:
> Use skia.mojom.BitmapN32 in Detection mojoms
>
> These bitmaps are safer for transport from untrustworthy sources since
> all bitmaps should be in N32 format and the browser can make bad
> assumptions as a result.
>
> R=dcheng@chromium.org, reillyg@chromium.org
>
> Bug: 1144462
> Change-Id: I7d02cb187c62be37259f445a182f8c971aa03661
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2580483
> Commit-Queue: danakj <danakj@chromium.org>
> Reviewed-by: Reilly Grant <reillyg@chromium.org>
> Reviewed-by: Daniel Cheng <dcheng@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#835685}

Bug: 1144462
Change-Id: I23ef3df85049a7111830c5d272c02b69f9d7cd38
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593827
Commit-Queue: danakj <danakj@chromium.org>
Reviewed-by: Reilly Grant <reillyg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837241}

All functionality related to InputMethodKeyboard* were designed to handle the onscreen / virtual keyboard. The class is not directly related to InputMethods. Hence, should be renamed to VirtualKeyboard*.

Bug: 1158633
Change-Id: I06569bcae62755826bfc7dcf479a29dd90db7175
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2592207
Reviewed-by: Scott Violet <sky@chromium.org>
Reviewed-by: Darren Shen <shend@chromium.org>
Commit-Queue: Keith Lee <keithlee@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837272}

When an offscreen canvas doesn't have a placeholder canvas (such as
when new OffscreenCanvas(width, height) is called to create an offscreen
canvas in javascript), the corresponding C++ object is OffscreenCanvas,
not HTMLCanvasElement. This change obtains the XRSystem object from
the OffscreenCanvas so that MakeXrCompatible can be called on it.

Bug: 1154424
Change-Id: I4fb1c7005a8c3a41cc4ddcd457c81c4bec4464ab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2578710
Reviewed-by: Brandon Jones <bajones@chromium.org>
Commit-Queue: Patrick To <patrto@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#837356}

This CL makes a number of improvements:

* It removes the http/https specific assumption that pathnames always
  consist of at least a leading slash.
* Resolve relative pathnames for both patterns and URL input.  This is
  only done if the baseURL is a standard URL with a pathname containing
  slashes.
* Canonicalizes URL input values.
* Validates pattern values are ASCII, but does not perform any encoding
  or canonicalization yet.

Bug: 1141510
Change-Id: I6db1afe77f6dd1d15ccb2e96a51412a31257efba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2579989
Commit-Queue: Ben Kelly <wanderview@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837371}

This CL add the logic, for both Legacy and LayoutNG, for handling
trailing ideographic spaces when the white-space CSS property is set to
'break-spaces' value.

The CSS Text specification states [1] that we must prevent handing or
collapsing the advance width of any space, including other space
separator like ideographic spaces, hence the overflowing spaces must
wrap to the next line.

However, the spec also states in the description of the 'break-spaces'
value [2] that breaking opportunities exists 'after' any space; hence,
breaking before the first ideographic space of the sequence is not
allowed, so it may overflow in that case.

[1] https://drafts.csswg.org/css-text-3/#white-space-phase-2
[2] https://drafts.csswg.org/css-text-3/#valdef-white-space-break-spaces

Bug: 1155633
Change-Id: Id34f05cb3457516fcb20a4731606425ec943a255
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2584854
Commit-Queue: Javier Fernandez <jfernandez@igalia.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837379}

…tform-tests#26918)

Executing a javascript: URL does not commit a new document, and
executing a javascript: URL in a srcdoc iframe does not change the
fact that this is a srcdoc iframe. (cf
https://crrev.com/c/2464930). On the other side, the algorithm for
computing the referrer of a srcdoc iframe defers to the parent:
https://w3c.github.io/webappsec-referrer-policy/#strip-url

Bug: 1043895
Change-Id: I144aa288204f9e92d1b41b0f3c64bc0d6274f10f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2582045
Reviewed-by: David Van Cleve <davidvc@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837504}

When parsing a referrer policy from a meta tag, we were trying to
update the PolicyContainer (and with it, the PolicyContainerHost in
the Browser process) without checking for it not to be
nullptr. However, the PolicyContainer is nullptr for LocalFrames which
have no RenderFrameHost counterpart in the browser, which are used for
rendering SVG images. As a consequence, there are cases in which a
meta tag in an SVG image made the renderer crash.

This change adds a nullptr check to fix this.

Bug: 1158034, 1130587
Change-Id: Ia0b5c51b4d1d68cfd7329da8c5e153bdef7deb3c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593000
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837507}

…e/panner-distance-clamping.html (web-platform-tests#26926)

Make sure the test prints its PASS lines in a consistent order to address flakiness as part of the
WebKit test suite.

Co-authored-by: Chris Dumez <cdumez@apple.com>

We should ignore layout shift if the object was ineligible for layout
shift tracking during the previous paint invalidation. Add
LayoutObject::ShouldSkipNextLayoutShiftTracking() and set it during
paint invalidation if the object is ineligible for layout shift
tracking. In the next paint invalidation, if the flag is true, skip
layout shift tracking and reset the flag.

This also applies to content-visibility:auto for which we cleared
LayoutBox's previous size to prevent layout shift tracking for the next
cycle. The new flag is basically equivalent to the old method, but also
covers more cases, e.g. the old method would fail if the object had
visual overflow because PreviousPhysicalVisualOverflowRect() was not
based on PreviousSize() and empty.

Bug: 1152869
Change-Id: I000489dd8093dab8d2ab3605ad4ce3bd39fd11b0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2591367
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837627}

…tem-focus.html (web-platform-tests#26845)

* Add html/interaction/focus/document-level-focus-apis/document-has-system-focus.html

* Ensure document has focus as precondition.

* Try to have popup steal focus in more browsers.

* Move event handlers earlier to avoid possible race.

This CL rewrites the tests contained in charset-tests.html,
chromium-tests.html,and comma-tests.html.

It also creates httpCookieTest (inside cookie-test.js) and rewrites
tests to use it.

The idea is that we probably want to have a domCookieTest in the future,
and this will make it less messy.

Relates to web-platform-tests#26190

Bug: 1152798
Change-Id: If5fa785b5b14c2596445ab1c7ac0926209f04314

Co-authored-by: Mike Taylor <miketaylr@chromium.org>

Source: https://github.com/w3c/webref/blob/5360e8c/ed/idl/mediastream-recording.idl
Build: https://travis-ci.org/w3c/webref/builds/209181719

This is part of adding type reflections to the WebAssembly JS-API. This
adds a new property on the WebAssembly.Memory, WebAssembly.Table &
WebAssembly.Global objects. It exposes the current type or the object in
a format which is compatible with the constructor for type's
constructor.

Differential Revision: https://phabricator.services.mozilla.com/D90702

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1651725
gecko-commit: dff33d0b33c8fb168966504f5562572ddec72a8e
gecko-reviewers: lth

Change "p3" color space to "display-p3". This is the name used in the
specification and in the CSS color level 4 specification (which is
shipping on Safari). Of note is that is that the color gamut media
queries use "p3" instead of "display-p3". This could be intentional
(reflecting the P3 *primaries* common to DCI P3 and Display P3 *color
spaces*), or may be accidental.

Change ImageDataColorSettings to ImageDataSettings. Right now all of
the settings are for color, but the spec doesn't put color in the name
because of future plans to add other settings (like premultiplied
alpha).

The largest remaining inconsistency is that "pixelFormat" versus
"storageFormat" and "uint8" versus "unorm8".

R=yiyix
TBR=fserb

Bug: 1083693
Change-Id: I8e6d476a17fd2fca8da6b7901bb1098253a61559
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2594269
Commit-Queue: ccameron <ccameron@chromium.org>
Reviewed-by: Yi Xu <yiyix@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837682}

Bug: 1152869
Change-Id: Ie68a761a3cd2a81dcdd3de6d2469d64146c3f596
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2591907
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Steve Kobes <skobes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837687}

The offsets stored in NGLink are "paint offsets", which include any
offsets caused by relative positioning. The fragment builder, on the
other hand, expects "layout offsets", which shouldn't include that. The
fragment builder adds the relative offset on its own at the right time.

I struggled with coming up with a very sensible test, since
fragmentation of out-of-flow descendants is incorrectly affected by the
inset specified on their relatively positioned containing block (see
crbug.com/1158387 and crbug.com/1158756 ).

Bug: 1079031
Change-Id: I803dd89a11be2ba9179e20ea06d0b709d08ab534
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593005
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Alison Maher <almaher@microsoft.com>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837692}

The block size may be a percentage, in which case we would think the
extent is definite on the final pass through this function, even if
it is an indefinite percentage. Fix this by using BlockLengthUnresolvable.

R=ikilpatrick@chromium.org, mstensho@chromium.org

Bug: 1154572
Change-Id: Ia70dc730d4fee2005904942afa4020f9074f4eee
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595248
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Auto-Submit: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837699}

This used to crash, because we ignored layout abortions on floats,
and would attempt to use the fragment (which is nullptr).

Bug: 829028
Change-Id: I04c44030d33182fd3020e8091228668d7f8a7190
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2592805
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837713}

This used to fail a DCHECK when nested multicol was specified on a
fieldset at an outer fragmentainer boundary, but apart from that, it
worked fine, because BreakBeforeChildIfNeeded() correctly detects the
situation (abortion) and inserts a break before. Just move the DCHECK a
bit down.

No code changes are required for legends, as they are monolithic. Just
replace the TODO with a proper comment, and keep the DCHECK (the legend
test also passes without the code changes in this CL).

Bug: 829028
Change-Id: I62bf97f9bd04c185f86e93103f204cc6d872c438
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595288
Reviewed-by: Alison Maher <almaher@microsoft.com>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837755}

This CL adds an explicit [Exposed=(Window,Worker,Worklet)] declaration
to the ReadableStreamDefaultController WebIDL file as it was added
in a new version of the Streams spec, based on whatwg/streams#963.

Intent To Ship: https://groups.google.com/a/chromium.org/g/blink-dev/c/yZuxrW9zhAs/m/6bXDaW2mAwAJ

Bug: 1093862
Change-Id: I2bd0c759d856c176037231adbe7e679ccea945c8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2570755
Reviewed-by: Yoav Weiss <yoavweiss@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Commit-Queue: Nidhi Jaju <nidhijaju@google.com>
Cr-Commit-Position: refs/heads/master@{#837841}

Before this patch, <input type=checkbox> and <input type=radio> can be
left in an active state if you press the spacebar down to toggle it, and
then press tab to move focus away before releasing the spacebar.

This patch calls SetActive(false) on the blur event for these input
types, which clears the active state in this case.

The test uses test_driver.Actions(), which isn't supported by the layout
test runner but works just fine in the separate wpt runner in the wpt
github repo.
I wrote the test and verified that it works well with the separate wpt
test runner, then wrote a TestExpectations line against the bug to track
the issue with the layout test runner: crbug.com/893480

Fixed: 1157510
Change-Id: I13a0900277dbfccc87ba81ffd684b12430665e10
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2594107
Reviewed-by: Mason Freed <masonfreed@chromium.org>
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837867}

Source: https://github.com/w3c/webref/blob/5703bf6/ed/idl/webxr-hand-input.idl
Build: https://travis-ci.org/w3c/webref/builds/209241518

Per [1], mmultiscripts can only have one in-flow <mprescripts/> child so
this CL fixes IsValidMultiscript() to align with the specification.
It also makes similar adjustment for the corresponding fatal checks in
NGMathScriptsLayoutAlgorithm::GatherChildren (rather than just checking
the index of a previous <mprescripts> is nonzero, which does not work if
there is no post-scripts). This fixes an assertion about node not being
laid out due to the fact that the mmultiscripts algorithm only performs
layout of at most one <mprescript>.

[1] https://mathml-refresh.github.io/mathml-core/#prescripts-and-tensor-indices-mmultiscripts

Bug: 1158375, 6606
Change-Id: I26964b2ef287585392db7f1854251b4b21075aef
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593643
Commit-Queue: Frédéric Wang <fwang@igalia.com>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837987}

wdspec launches Firefox using geckodriver. This was going through a
different codepath to the other wpt tests and in particular it wasn't
setting the correct environment variables.

This patch factors the environment variable setting out into a
function that can be called both when starting Firefox normally and
before invoking pytest. This isn't perfect, but does allow more code
sharing between the two paths.

Differential Revision: https://phabricator.services.mozilla.com/D97490

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678044
gecko-commit: c4756cf7f5f109cfd552399a3fe14694ce91de11
gecko-reviewers: maja_zf

…decodebytes.

Differential Revision: https://phabricator.services.mozilla.com/D98960

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1681101
gecko-commit: dd50d2d0bf6290c464701bbdf428cfdc3f151a05
gecko-reviewers: webdriver-reviewers, jgraham

Before this patch, event handlers registered at the target of the event,
which get fired during the AT_TARGET event phase, get fired in order of
when they are registered without any regard for which handlers are
capture and which ones are bubble.

This patch fires all capture handlers before bubble handlers during the
AT_TARGET event phase.

WebKit implemented the same behavior here:
https://trac.webkit.org/changeset/236002/webkit

I2S: https://groups.google.com/a/chromium.org/forum/?fromgroups#!topic/blink-dev/30jv38uD_84

Fixed: 1052152
Change-Id: I87752225dbcef7d07fccf9a6999711bdf5fbad20
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2581814
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Reviewed-by: Mason Freed <masonfreed@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838108}

Replace TODO with comment.

If the inline-size of the contents of the multicol container is 0, an
empty overflow rectangle will be produced, even if block-size is
non-zero, and we'd fail balancing of blocks that are freely breakable
inside, if initial column block-size is 0. The space shortage reporting
machinery (which is what we use in subsequent column layout passes)
really only works for content that we cannot (or at least don't want to)
break inside. We'd also get log2(N)-ish relayouts (where N is the total
block-size of the contents).

So it looks like we need to keep CalculateColumnContentBlockSize(),
after all. I tried to get rid of it here, before I realized that it
would cause trouble:
https://chromium-review.googlesource.com/c/chromium/src/+/2597308

Add a test that demonstrates this. Note that
external/wpt/css/css-multicol/baseline-006.html also tests this, but
that's not the main point with that test.

Bug: 829028
Change-Id: I24516a5956f9e60f47c87cf51db2683feded1eeb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595540
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838116}

Kenneth Christiansen ran into a few interop issues while trying to get
his polyfill implementation to pass the WPT tests.  In particular, it
seems browsers and nodejs do not agree on hostnames with characters like
'|', '^', etc.

This CL removes these test cases for now.  Solving URL interop issues
is outside of the scope of URLPattern.  It simply builds on top of the
platforms existing URL canonicalization behavior.

Kenneth also suggested testing a protocol with a dash in it.

Bug: 1141510
Change-Id: I5bdf75b93545dd59592d6be9c7870f4367f7b0dc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2596113
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: Ben Kelly <wanderview@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838172}

Without this patch, anchors can be stuck in the :active state if
contenteditable is enabled before :active is removed.

The special logic for anchors and contenteditable was added a long time
ago [1], and the purpose was to prevent anchors from being clicked and
navigating the page while in contenteditable.

This patch makes SetActive capable of removing :active during
contenteditable, which preserves the original intention of preventing
anchors from navigating during contenteditable.

[1] http://crrev.com/1d651243ad5b85bac9ebc8611a991a23d72d2f95

Fixed: 1007941
Change-Id: Ib51b846e99fd212a478f1278b3568bda4e5886a0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595978
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Reviewed-by: Mason Freed <masonfreed@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838208}

The issue is that nsTextControlFrame might have a different used padding
then the editing root block and thus the editing root's scrolled
content, etc, because its padding doesn't match the style.

This causes TextOverflow code to miscompute the content area size, which
is sadness and causes the overflow markers to go over the padding box.

The REFLOW_ROOT condition was introduced in bug 157846 and only
partially takes care of the issue. This fix supersedes it, so we can
remove it.

Differential Revision: https://phabricator.services.mozilla.com/D99838

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1577530
gecko-commit: fd07538e12316562b6479e77af02c7b2b0f94d43
gecko-reviewers: heycam

… is specified, and this is covered once non-native-theme is enabled.

MANUAL PUSH: Remove just-introduced orange test CLOSED TREE

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1577530
gecko-commit: 5ef9fa2708b2ba34de8a3674b328476fdf92908c

Depends on D99358

Differential Revision: https://phabricator.services.mozilla.com/D99359

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678545
gecko-commit: 2246b7b99f0f334084ae8898d433c75234f23aa5
gecko-reviewers: ckerschb

This verifies intersection observer properly reflects
overflow-clip-margin on an ancestor.

BUG=1157843
TEST=test only change

Change-Id: I9c9839294df8ffb88b42947aa87c7cc5222f5a6d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593812
Reviewed-by: Stefan Zager <szager@chromium.org>
Reviewed-by: vmpstr <vmpstr@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838232}

Differential Revision: https://phabricator.services.mozilla.com/D99666

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1668658
gecko-commit: d935544227af3d68a19eae4d11d9765b56062be3
gecko-reviewers: smaug, jgraham

Use testdriver Action API to simulate mouse actions in
css/selectors/focus-visible-006.html and
css/selectors/focus-visible-008.html.

Bug: 1145677
Change-Id: Id25c6120f1dbd489d4c803ee979e67ad5ef49f8c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2551818
Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
Commit-Queue: Lan Wei <lanwei@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838271}

This CL makes Chromium to align with the spec and
other browsers (Firefox/Safari).

Bug: 1160101
Change-Id: I30e38acc8cfe80781eb68bf602938362aafc1f1d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2597755
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838358}

…ests#26868)

This is a quick fix for the wpt import from upstream:
https://chromium-review.googlesource.com/c/chromium/src/+/2595735

Bug: 1159946
Change-Id: Ie72dd6135ab6b6d6f6505a93eda4a2a4c58e1f96
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2597043
Commit-Queue: Rakib Hasan <rmhasan@google.com>
Reviewed-by: Rakib Hasan <rmhasan@google.com>
Cr-Commit-Position: refs/heads/master@{#838393}

We can't clip with a proper visual rect that includes effects from
filters during pre-paint, because filters may not have been updated yet.
Since the visual rect no longer include bounds from filters, clipping
to them is too restrictive.

Drop said clipping from LayoutSVGResourceMasker::ResourceBoundingBox().
This in turn means that the |mask_content_boundaries_| member field as
well as the code to compute it is dead, so remove them as well.

Bug: 1153600
Change-Id: I633deccba1a841750b4ef920725b59526b9846e6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2566822
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#838440}

This enables the full 'filter' property syntax on SVG elements.

Since SVG elements expect effects of zoom to be included in their local
transform, we have to take care to undo zoom from any Length parameters
when building the filter chain.

Bug: 109224
Change-Id: Ib7f6050f57cc2723d1396f05424da788df675188
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595416
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#838451}

Currently, when a multi-column is a containing block for an OOF
positioned element, the corresponding column is mistaken for the
containing block, which causes various DCHECK failures. Columns are not
allowed to be containing blocks, so this change ensures that we skip
over columns when placing OOF positioned elements.

Bug: 1158706
Change-Id: Id969b91a8f472d34b4767ffe891a3405770e8443

Once upon a time, we created a WPT for OOFs in multi-columns - with a
tiny harmless nit that swooped in at the last second.

Since then, we created a bunch of similar tests by copying the initial
test and duplicating the nit every time in every test.

This CL cleans up that nit in every test I could find it.

Bug: N/A
Change-Id: I19a53bca22719f8f0193d02bf94d13700a1e823d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2598541
Reviewed-by: Alison Maher <almaher@microsoft.com>
Commit-Queue: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#838487}

Following https://chromium-review.googlesource.com/c/chromium/src/+/2570755,
this CL updates the interface object WPT expectations to remove Streams
API interface classes that have already been exposed.

Bug: 1093862
Change-Id: Ibdce3585a8b34b3aeef40e3fae610af733ebdc79
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595553
Reviewed-by: Adam Rice <ricea@chromium.org>
Commit-Queue: Nidhi Jaju <nidhijaju@google.com>
Cr-Commit-Position: refs/heads/master@{#838599}

…on for compressible flex items.

Also, add test for various types of <input> in row flex
containers (flex-item-compressible-001.html) and in column flex
containers (flex-item-compressible-002.html).

Note: Google Chrome 89 and Safari 14 fail the subtests that have a
definite value inside a calc expression in
flex-item-compressible-001.html. They also fail the entire
flex-item-compressible-002.html because they don't support <input> in
vertical writing-mode (i.e. <input> is still horizontal in vertical
writing mode).

Differential Revision: https://phabricator.services.mozilla.com/D99952

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1585485
gecko-commit: a605cd5254503b3de8827ce2789abd6e60292018
gecko-reviewers: dholbert

Bug: 1022182
Change-Id: I98d3897fdc99d42a0b6bb09461bfb228068ddd02
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2586206
Commit-Queue: Hiroki Nakagawa <nhiroki@chromium.org>
Auto-Submit: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Makoto Shimazu <shimazu@chromium.org>
Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838619}

This reverts commit 9d0120f3d75be146445be64e770063d03f3049c7.

Reason for revert:

Very close to 100% failure rate since check-in, on bot "WebKit Linux Leak":
https://ci.chromium.org/p/chromium/builders/ci/WebKit%20Linux%20Leak/21884

Error message:

Retrying 19 unexpected failures, attempt 1 of 3...
Sharding tests ...
Starting 8 workers ...
[18/19] external/wpt/css/selectors/focus-visible-006.html failed unexpectedly (leak detected: ({"numberOfLiveContextLifecycleStateObservers":[2,4],"numberOfLiveDocuments":[1,2],"numberOfLiveNodes":[4,40],"numberOfLiveResourceFetchers":[1,2],"numberOfLiveResources":[0,5]}))
stopping content_shell(pid 14917) timed out, killing it
[19/19] external/wpt/referrer-policy/gen/worker-classic.http-rp/strict-origin-when-cross-origin/worker-classic.http.html failed unexpectedly (test timed out)

Original change's description:
> Simulate user inputs in focus-visible tests in css/selectors/
>
> Use testdriver Action API to simulate mouse actions in
> css/selectors/focus-visible-006.html and
> css/selectors/focus-visible-008.html.
>
> Bug: 1145677
> Change-Id: Id25c6120f1dbd489d4c803ee979e67ad5ef49f8c
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2551818
> Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
> Commit-Queue: Lan Wei <lanwei@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#838271}

TBR=lanwei@chromium.org,mustaq@chromium.org,chromium-scoped@luci-project-accounts.iam.gserviceaccount.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 1145677
Change-Id: Ie2e39aa960a80dd0ab5b9ec881ae9305c4294760
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2599530
Reviewed-by: Finnur Thorarinsson <finnur@chromium.org>
Commit-Queue: Finnur Thorarinsson <finnur@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838637}

…platform-tests#26762)

…platform-tests#26765)

Differential Revision: https://phabricator.services.mozilla.com/D100207

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1682307
gecko-commit: 079ae6e08d0d77fbf369751b0f823f530c396b60
gecko-reviewers: emilio

This doesn't make sense since tests are running on the device, not
locally.

Differential Revision: https://phabricator.services.mozilla.com/D99246

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: c9931fc09331f62ca4e8a1d8fb3ceb7e619799ea
gecko-reviewers: karlcow

Differential Revision: https://phabricator.services.mozilla.com/D99254

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: c584e6f853e63362b9aa8406554db7e5ec344683
gecko-reviewers: bc

Differential Revision: https://phabricator.services.mozilla.com/D99255

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: 4fbd1c323b6d59414c56fcc1fa958639ea4b5243
gecko-reviewers: karlcow

This makes Linux match Windows and macOS, and avoids a py3-only bug
where mozrunner desctructors can end up being called incorrectly in
the child process, so causing tests to fail.

To do this correctly turns out to require using an explicit context
which we pass down to everywhere we use multiprocessing. That's
because wptrunner isn't usually invoked directly but from a frontend
like `wpt run` or `mach`. Therefore spawned processed don't go through
the same entrypoint as the initial process and so don't set the
context themselves.

This unfortunately requires backwards-incompatible changes in mozlog,
so that will need to be released for this to land upstream.

Differential Revision: https://phabricator.services.mozilla.com/D99247

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: 38d6e1fcab14e49dbdb2c0953542f33ec259b740
gecko-reviewers: karlcow, bc

The change in behaviour of the gc in Python 3 means that __del__ is
being called in cases where it previously wasn't, and this can have
unfortunate side effects where __del__ is being used to clean up
resources.

In particular with web-platform-tests running on Android, we end up
closing the test application unexpectedly. That causes widespread test
failures.

In general using __del__ for this kind of cleanup is problematic
because it's not defined exactly when, or if, it's called. It's much
better to require explcit cleanup (and better still to make that
scope-based, using a context manager, although this patch doesn't do
so).

Therefore we add an option to only do explicit cleanup. This is
currently opt-in to make the breakage as small as possible, but
ultimately ought to be the default and only behaviour. We also change
the wpt android runner to use this behaviour.

Differential Revision: https://phabricator.services.mozilla.com/D99256

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: 4a753391c683c7a470182558c1384414daec8aca
gecko-reviewers: whimboo

The problem was that classes defined in functions can't be recreated in
child processes. So we need to make the classes global instead.

Differential Revision: https://phabricator.services.mozilla.com/D99250

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: 3ab9b82d7122fc10b37d0fb68252e1440629ca99
gecko-reviewers: karlcow

This test was previously stable but seems to run a litle slower in
Python 3 so we see some timeouts. Make the timeout longer so avoid the
failure.

Differential Revision: https://phabricator.services.mozilla.com/D99435

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: 4967a4a57ab2a658e026e09d6b363876a9018831
gecko-reviewers: karlcow

Differential Revision: https://phabricator.services.mozilla.com/D99881

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678663
gecko-commit: 4d41b11ea020d4b4bf697fa62dd48cf6f4920463
gecko-reviewers: emilio

Differential Revision: https://phabricator.services.mozilla.com/D96184

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1674743
gecko-commit: 17658a2394cf21d332184a5f78f8dec6637c8a4d
gecko-reviewers: hsivonen

… in OOP iframe

This suppress unnecessary blur and focus actions in the framer, we would need
to find a way to notify framer that the focus has moved to OOP iframe to
dispatch corresponding blur event, see bug 1677474.

Differential Revision: https://phabricator.services.mozilla.com/D97158

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1674702
gecko-commit: 15ceb99908caea1e4a0d82113fc08a7ef23d976d
gecko-reviewers: hsivonen

The shell script runs a python line that uses an old-style print, so it
broke (silently!) when we switched to python3.

…ts#26970)

This commit fixes `spec` entries in `META.yml` files that were pointing to the
wrong URL (either because the URL is a broken link, redirects to a newer URL,
or targets the GitHub repository instead of the spec itself), so that it becomes
easier to map specifications to WPT folders based on the URL of their
Editor/Living Draft.

This commit also adds several `META.yml` files to folders that cannot easily be
mapped to a spec because their name does not match the spec's shortname.

Since r807457 we changed the TextBreakIterator default's behavior so
that it breaks always after a space, instead of before any space run.
In order to implement this new behavior, we needed to compute as well
the end of the non-hangable run of the Item being processed.

In the mentioned change, we forgot to apply this behavior in the code
path used when the soft-hypenation is not enabled. This CL fixes that
by determining the non-hangable run end in that case.

Bug: 1158747
Change-Id: I1a1324b3d775c24e44aa29b097c45e626d0ad76f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2597581
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838749}

Use testdriver Action API to simulate mouse actions in
css/selectors/focus-visible-006.html and
css/selectors/focus-visible-008.html.

TBR=lanwei@chromium.org,mustaq@chromium.org

Bug: 1145677
Change-Id: I41347fbe7a1fc2c1d88c548b0f2f6ef86ee75154
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2600018
Reviewed-by: Lan Wei <lanwei@chromium.org>
Commit-Queue: Lan Wei <lanwei@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838751}

7 wpt tests were failing because of font aliasing in most browsers.
See
https://wpt.fyi/results/css/CSS2/tables?label=experimental&label=master&aligned
fixed-table-layout-017/023

Switching the font to Ahem eliminated antialiasing, and makes test pass.

Ahem font made some text too wide for containing cell. I've shortened the
text when this happened.

Change-Id: I754444e8f5f9105958642361bc4cd758f92e635f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2600621
Auto-Submit: Aleks Totic <atotic@chromium.org>
Commit-Queue: David Grogan <dgrogan@chromium.org>
Reviewed-by: David Grogan <dgrogan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838825}

…-tests#26983)

Adds META.yml files with `spec` entries to folders that could only be associated
with specifications by comparing the folder's name with the spec's shortname.

Source: https://github.com/w3c/webref/blob/a56faec/ed/idl/dom.idl
Build: https://travis-ci.org/w3c/webref/builds/210235866

The supposed fix didn't actually fix them in that case. We didn't
notice because it didn't actually change the behaviour of the code on
Linux where they pass either way.

The API is a subset but (ironically) we can't pickle a module

This CL adds feature SyncXHR to document policy. It will be controlled
by both document policy and feature policy during the migration period,
i.e. If either policy disabled the feature, the feature will be disabled.

Bug: 1146505
Change-Id: I2a2d776da13be9f659bc0369fb5a19a94f5c18ee
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2523440
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Charlie Hu <chenleihu@google.com>
Cr-Commit-Position: refs/heads/master@{#838966}

There were some crashes caused by nested slots (e.g.
<slot><slot>Content</slot></slot>) being removed from the tree.
These crashes were triggered by [1], which removed Shadow DOM v0, but
my theory is that due to the old V0 shadow root code, more calls were
being made to SlotAssignment::RecalcAssignment(). Now that the V0 code
is gone, it has exposed some missing code.

Three issues are being fixed here:
 1. In Node::CheckSlotChange(), while removing the inner nested slot,
    the parent_slot will have already been removed from the tree, so we
    only need to call DidSlotChange if not. This used to be a DCHECK.
 2. In TreeOrderedMap::Get(), while removing a key that previously had
    more than one element, we may walk the tree and find that none of
    the pre-existing elements are present. I.e. we're in a RemoveScope.
    In this case, the key should be removed from the map.
 3. In SlotAssignment::DidRemoveSlotInternal(), given web-platform-tests#2 above, we can
    just early-out if the slot isn't present in the map.

I added a test for the crash conditions (variations on removing nested
named and unnamed slots), plus I added a test for the TreeOrderedMap
class, since there was none previously. The last test in the set
documents the new Get() behavior. I also tried to improve some of the
comments along the way. Finally, this CL rolls back a mitigation [2]
previously landed for this crash.

[1] https://chromium-review.googlesource.com/c/chromium/src/+/2586019
[2] https://chromium-review.googlesource.com/c/chromium/src/+/2595967

Bug: 1159328, 1159727
Change-Id: I47fbf33b2313b9ae2efe229443af6e8c9a1920a9
Cq-Do-Not-Cancel-Tryjobs: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2597040
Commit-Queue: Mason Freed <masonfreed@chromium.org>
Reviewed-by: Yu Han <yuzhehan@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Auto-Submit: Mason Freed <masonfreed@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838974}

Differential Revision: https://phabricator.services.mozilla.com/D99291

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1681615
gecko-commit: 2a7e04756c232eb775140500ef2d370fa608eb50
gecko-reviewers: masayuki

Differential Revision: https://phabricator.services.mozilla.com/D99740

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1682450
gecko-commit: c4a59b084d7b4c96d5e1ea02e6adb5774b07d6c9
gecko-reviewers: baku

The issue here is caused (a bit surprisingly) by the counter-reset
declaration.

The underlying issue is that counter-reset causes us to rebuild the
frame tree for the whole `<body>`, in order to rebuild the counter tree.

That makes the geometry frame not get its updated style (because the
frame goes away), and the next frame getting constructed getting a null
aOldComputedStyle (as expected, as it's a new frame).

We can't rely on the cached path not to change while there's no frame,
so clear it out when there's no old style.

The test is a simpler version of the test-case, where instead of
`counter-reset`, I use `display: none` to trigger the bogus codepath.

Differential Revision: https://phabricator.services.mozilla.com/D100237

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1683652
gecko-commit: c38b504a94295b09dce13d91e04ff9714b0eb67b
gecko-reviewers: longsonr

…owRoot"

This reverts commit dbfed21f94881a2918223792ebde3476b8fd69e6.

Reason for revert:

Findit (https://goo.gl/kROfz5) identified CL at revision 838974 as the
culprit for failures in the build cycles as shown on:
https://analysis.chromium.org/waterfall/culprit?key=ag9zfmZpbmRpdC1mb3ItbWVyRAsSDVdmU3VzcGVjdGVkQ0wiMWNocm9taXVtL2RiZmVkMjFmOTQ4ODFhMjkxODIyMzc5MmViZGUzNDc2YjhmZDY5ZTYM

Sample Failed Build: https://ci.chromium.org/b/8860163671563368608

Sample Failed Step: webkit_unit_tests

Original change's description:
> Fix several crashes when nested slots are removed from a ShadowRoot
>
> There were some crashes caused by nested slots (e.g.
> <slot><slot>Content</slot></slot>) being removed from the tree.
> These crashes were triggered by [1], which removed Shadow DOM v0, but
> my theory is that due to the old V0 shadow root code, more calls were
> being made to SlotAssignment::RecalcAssignment(). Now that the V0 code
> is gone, it has exposed some missing code.
>
> Three issues are being fixed here:
>  1. In Node::CheckSlotChange(), while removing the inner nested slot,
>     the parent_slot will have already been removed from the tree, so we
>     only need to call DidSlotChange if not. This used to be a DCHECK.
>  2. In TreeOrderedMap::Get(), while removing a key that previously had
>     more than one element, we may walk the tree and find that none of
>     the pre-existing elements are present. I.e. we're in a RemoveScope.
>     In this case, the key should be removed from the map.
>  3. In SlotAssignment::DidRemoveSlotInternal(), given web-platform-tests#2 above, we can
>     just early-out if the slot isn't present in the map.
>
> I added a test for the crash conditions (variations on removing nested
> named and unnamed slots), plus I added a test for the TreeOrderedMap
> class, since there was none previously. The last test in the set
> documents the new Get() behavior. I also tried to improve some of the
> comments along the way. Finally, this CL rolls back a mitigation [2]
> previously landed for this crash.
>
> [1] https://chromium-review.googlesource.com/c/chromium/src/+/2586019
> [2] https://chromium-review.googlesource.com/c/chromium/src/+/2595967
>
> Bug: 1159328, 1159727
> Change-Id: I47fbf33b2313b9ae2efe229443af6e8c9a1920a9
> Cq-Do-Not-Cancel-Tryjobs: true
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2597040
> Commit-Queue: Mason Freed <masonfreed@chromium.org>
> Reviewed-by: Yu Han <yuzhehan@chromium.org>
> Reviewed-by: Joey Arhar <jarhar@chromium.org>
> Auto-Submit: Mason Freed <masonfreed@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#838974}

Change-Id: I97202c545f74df090124e82775fe79ce978d3d63
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: 1159328, 1159727
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2601758
Cr-Commit-Position: refs/heads/master@{#839038}

Before this patch, in the first subtest, the image flex item's final
width is 104px. This is because the floating flex container uses
shrink-wrapping to obtain its inline-size, and the flex item's
min-content contribution to the flex container is 104px (100px height *
1/1 aspect-ratio + 4px border). That makes the single-line flex
container's final cross-size 104px, stretching the item's cross size to
the flex container's cross size.

This test is meant to test min-height:auto behavior, so this patch adds
a constraint to the flex container's cross size so that the flex item's
cross size (width) won't get stretched.

Differential Revision: https://phabricator.services.mozilla.com/D100302

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1670830
gecko-commit: 83c08ef3251b25cb4322e800cddeb53d7c9ee0e0
gecko-reviewers: dholbert

This brings in the following updates to better associate folders with specs:

- document-policy => link to Document Policy spec
- html/cross-origin-embedder-policy => proposal was integrated into HTML spec
- html/cross-origin-opener-policy => proposal was integrated into HTML spec
- installedapps => link to Get Installed Related Apps API
- js => update URL to use tc39.es domain name
- measure-memory => link to Measure Memory API
- native-file-system => link to File System Access
- screen_enumartion => link to Multi-Screen Window Placement spec
- webrtc-extensions => fix broken link
- x-frame-options => target multipage version (consistent with other folders)

box-shadow-radius-001-ref.html -> box-shadow-radius-000-ref.html

Bug: 1159514
Change-Id: I3611c3bf85143b038da652c4f28e66d2378439a3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2600693
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#839103}