1. Only process ChildrenChanged() for the included root of a change.
For example, if a <div id="root" style="display:none"> will be
included because it is a potential relation target. If descendants
change, the only ChildrenChanged() necessary to process is on #root.
2. Share common code for detaching a node and queuing up the appropriate
children changes. This simplifies ProcessInvalidatedObjects()
by removing one of the inner loops, and enables a follow-up CL to
remove the outer loop as well.

#1 results in a massive speedup for display none toggles. In
combination with other recent changes in
DetachAndRemoveFromChildrenOfAncestors(), is 7x faster for
many-nodes-toggle-display-none in perf_tests . This change alone
accounts for about half of the overall improvement.

Follow-ups:
- Restore lifecycle check by processing deferred children changes via
nodes_with_pending_children_changed_ and not queuing via the
traditional mechanism. While doing this, look for opportunities to
consolidate more children changed events.
- Remove outer loop from ProcessInvalidatedObjects().

Bug: None
Change-Id: I80466fda792cd0ca6dd051065a42ba702e4cc8b1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2946971
Reviewed-by: Dominic Mazzoni <[email protected]>
Commit-Queue: Aaron Leventhal <[email protected]>
Cr-Commit-Position: refs/heads/master@{#891343}

1. Use GetWithoutInvalidation() instead of Get() in DCHECKs.
We should never call Get() inside of a DCHECK(), because this can
lead to a different code path depending on whether DCHECKs are enabled.

2. Get() should not cause immediate side effects. At most, it should
queue up an invalidation for later processing.

Fixing #1 and #2 were required in order to get past a first set of
errors introduced by the new test.

3. The actual fix -- avoid infinite loop by calling a special
new SlotAssignmentWillChange(), rather than ChildrenChanged(),
where a minimal GetWithoutInvalidation() is called that does not
lead to IsShadowContentRelevantForAccessibility() => FirstChild() =>
RecalcAssignedNodes() => ChildrenChanged() ... (infinite loop).

A simpler potential fix is in CL:2965317 but requires more
research. It's also mentioned in a TODO comment.

Bug: 1219311
Change-Id: Iafaa289f241a851404ce352715d2970172a2e5f8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2961158
Reviewed-by: Joey Arhar <[email protected]>
Reviewed-by: Mason Freed <[email protected]>
Reviewed-by: Dominic Mazzoni <[email protected]>
Commit-Queue: Aaron Leventhal <[email protected]>
Cr-Commit-Position: refs/heads/master@{#892778}

Relative offsets should be applied after fragmentation. Since we perform
layout for OOFs once they reach the fragmentation context root (if
applicable), we fail to apply any relative offsets at the correct time
in the case of inline containing blocks. See CL:2851595 for how this
was handled for the non-inline case.

The changes required to accomplish this for inline containing blocks
include:

1. We currently store an accumulated relative offset in
NGContainingBlock inside the OOF node, which is any relative offset from
the containing block to the fragmentation context root. We also need to
store an accumulated relative offset from the inline container to the
containing block in order to properly apply all relative offsets at the
time of fragmentation.

A new struct, NGInlineContainer, was added to the OOF node to hold the
inline container object and the accumulated relative offset to the
containing block.

2. A relative offset was also added to the InlineContainingBlockGeometry
struct so that we have access to the relative offset from #1 when
creating the ContainingBlockInfo for the inline container.

3. The way that relative offsets are applied to inlines, it didn't seem
straightforward to separate the relative offset from the normal
offset, like we had in CL:2851595. Instead, store the relative offset
for the inline and subtract it out from the OOF static position once
it reaches the containing block, and subtract it from the containing
block rect offset when determining the ContainingBlockInfo for the
inline container.

4. Store the total relative offset (from the inline container to the
fragmentation context root) in ContainingBlockInfo. This relative
offset will then be applied after fragmentation is complete for the OOF
as a result of CL:2851595.

Bug: 1079031
Change-Id: I7198fec4c01e05ca54c51b2f215569b75b0b869e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2995308
Commit-Queue: Alison Maher <[email protected]>
Reviewed-by: Morten Stenshorne <[email protected]>
Reviewed-by: Koji Ishii <[email protected]>
Cr-Commit-Position: refs/heads/master@{#902060}

******************************************************************
*** SHERIFFS: please don't revert this CL if it causes web_tests
              to flake/fail. If that happens, the cause is a bad
              test. Please mark that test as flaky/fail in
              TestExpectations, with a new crbug. Please block the
              new bug against crbug.com/1395228. Thanks!
******************************************************************

Prior to this CL, a test like this:

```
<script>
window.onload = () => {
  test((t) => { ... }, 'test 1');
  test((t) => { ... }, 'test 2');
  test((t) => { ... }, 'test 3');
};
</script>
```

would not run anything after test #1. The issue is that the testharness
immediately adds a window load handler that marks `all_loaded = true`,
and that ends the tests as soon as the first result from the first test
is processed. (The test runner waits for the first test because
`Tests.prototype.all_done()` also waits until `this.tests.length > 0`.)
There were various mitigating corner cases, such as if you started
the list of tests with a promise_test(), that would increment a
counter that kept the rest of the tests alive. Etc.

With this CL, the testharness-added window.onload handler runs a
setTimeout(0), so that `all_loaded` is only set to true after all of
the tests are loaded by any window.onload handler.

This exposed a few tests that should have been failing but were
masked by the lack of test coverage - bugs have been filed for
those. Also, several tests that were working around this via various
means are also cleaned up in this CL. I'm sure there are more of
those.

Bug: 1395228,1395226,1307772
Change-Id: I6f12b5922186af4e1e06808ad23b47ceac68559c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4074305
Reviewed-by: Weizhong Xia <[email protected]>
Auto-Submit: Mason Freed <[email protected]>
Reviewed-by: Mason Freed <[email protected]>
Commit-Queue: Mason Freed <[email protected]>
Reviewed-by: Xianzhu Wang <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1081558}

This reverts commit 4a03c6c459fdbf11976a424aa02a1d094484134c.

Reason for revert:

This has caused tests in upstream WPT to fail, blocking unrelated PRs. It was still possible to upstream this because those tests weren't triggered on the change due to a bug:
web-platform-tests#37623

There was an attempted fix for this:
web-platform-tests#37549

But, quoting jgraham from the WPT Matrix chat:

> the actual fix failed a test I wrote and now I need to spend some more time investigating

Original change's description:
> WPT: Allow `window.onload` to contain multiple `test()`s
>
> ******************************************************************
> *** SHERIFFS: please don't revert this CL if it causes web_tests
>               to flake/fail. If that happens, the cause is a bad
>               test. Please mark that test as flaky/fail in
>               TestExpectations, with a new crbug. Please block the
>               new bug against crbug.com/1395228. Thanks!
> ******************************************************************
>
> Prior to this CL, a test like this:
>
> ```
> <script>
> window.onload = () => {
>   test((t) => { ... }, 'test 1');
>   test((t) => { ... }, 'test 2');
>   test((t) => { ... }, 'test 3');
> };
> </script>
> ```
>
> would not run anything after test #1. The issue is that the testharness
> immediately adds a window load handler that marks `all_loaded = true`,
> and that ends the tests as soon as the first result from the first test
> is processed. (The test runner waits for the first test because
> `Tests.prototype.all_done()` also waits until `this.tests.length > 0`.)
> There were various mitigating corner cases, such as if you started
> the list of tests with a promise_test(), that would increment a
> counter that kept the rest of the tests alive. Etc.
>
> With this CL, the testharness-added window.onload handler runs a
> setTimeout(0), so that `all_loaded` is only set to true after all of
> the tests are loaded by any window.onload handler.
>
> This exposed a few tests that should have been failing but were
> masked by the lack of test coverage - bugs have been filed for
> those. Also, several tests that were working around this via various
> means are also cleaned up in this CL. I'm sure there are more of
> those.
>
> Bug: 1395228,1395226,1307772
> Change-Id: I6f12b5922186af4e1e06808ad23b47ceac68559c
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4074305
> Reviewed-by: Weizhong Xia <[email protected]>
> Auto-Submit: Mason Freed <[email protected]>
> Reviewed-by: Mason Freed <[email protected]>
> Commit-Queue: Mason Freed <[email protected]>
> Reviewed-by: Xianzhu Wang <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1081558}

Bug: 1395228,1395226,1307772
Change-Id: Icbddad3a8bb47473bcbc331f424661b9041addf2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4111318
Reviewed-by: David Baron <[email protected]>
Commit-Queue: Philip Jägenstedt <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1085925}

In the case that a popover contains an invoker that points back to that
invoker, the tab navigation code used to get confused. E.g.:

```
<div id="menu" popover>
  <button autofocus popoverhidetarget="menu">Button #1</button>
  <button popoverhidetarget="menu">Button #2</button>
</div>
```

In this case, trying to tab between the first and second button would
break because the second button appeared to be an invoker for a new
popover, when in reality it was an invoker for the same popover.

Fixed: 1399601
Bug: 1307772
Change-Id: I276370d7c8eee0dd32f0c89da202a0d3777bf911
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4133482
Commit-Queue: Mason Freed <[email protected]>
Auto-Submit: Mason Freed <[email protected]>
Commit-Queue: Joey Arhar <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1089080}

…each time of the loop

There are 2 possible scenarios which are not handled by the method.

1. Moving content node to new `<blockquote>` has already been moved to outside
of the editing host.
2. There is no container to insert new `<blockquote>`, e.g., in an inline
editing host.

In the case #1, we should ignore the ex-child node.  In the case #2, we should
abort it.  Note that Chrome inserts `<blockquote>` even if there is no proper
container.  However, such behavior is disagreed in interop-2023.  Therefore,
it's okay just to abort it for now.

Depends on D180781

Differential Revision: https://phabricator.services.mozilla.com/D180782

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1756237
gecko-commit: 42f3f3ab11b47f1d56d8bcd6a128398539dd1f23
gecko-reviewers: m_kato

…eb-platform-tests#40504)

* [wdspec] browsingContext.print: fix rounding error in page.py test

[pytest](https://github.com/web-platform-tests/wpt/blob/7a087d54be8b6c0ca0181a86dc1ff0b28461c383/webdriver/tests/support/image.py)
uses:

    def cm_to_px(cm): return round(cm * 96 / 2.54)

[js](https://github.com/web-platform-tests/wpt/blob/7a087d54be8b6c0ca0181a86dc1ff0b28461c383/tools/wptrunner/wptrunner/print_pdf_runner.html)
uses:

    const viewport = page.getViewport({ scale: 96. / 72. });
    ...
    canvas.height = viewport.height;
    canvas.width = viewport.width;

This produces a rounding error, even though the dimension is correct:

    >       assert cm_to_px(expected_dimensions["height"]) == height
    E       assert 454 == 453
    E         +454
    E         -453

The inconsistency of rounding in both ends becomes clear when we
eliminate "round" in the pytest side:

    >       assert cm_to_px(expected_dimensions["height"]) == height
    E       assert 453.54330708661416 == 453
    E         +453.54330708661416
    E         -453

There are multiple ways to fix this issue.

Option #1: Use "floor" instead of "round" in pytest.

Option #2: Use a range in the assertion comparison, allowing a
difference of up to +-1.0. This is what this PR does.

The comparison is performed in
[`assert_pdf_dimensions`](https://github.com/web-platform-tests/wpt/blob/b6107cc1ac8b9c2800b4c8e58af719b8e4d9b8db/webdriver/tests/support/fixtures_bidi.py#L210).

The problematic part is .96 / .72 which evaluates to 4/3 = 1.333333....

* use floor in cm_to_px instead of round

* compare to floor and to round instead of a range

* Revert "compare to floor and to round instead of a range"

This reverts commit 63f894e.

* Revert "use floor in cm_to_px instead of round"

This reverts commit 7e65d91.

Because of the order of operations for Clone(), previous to this CL,
the typical sequence would be:

 1. Clone the element
 2. Clone the children of the element (recursing to step #1).
 3. AppendChild() each cloned child to its parent cloned element.
 4. (in the caller of Clone) AppendChild the cloned element to its
    eventual parent.

Because each AppendChild triggers a call to Node::InsertedInto() for
*all descendants of the appended element* [1], the fact that the tree
is constructed bottom-up (leaf nodes first) means that InsertedInto()
is called N^2 times, where N is the depth of the cloned tree.

Because clone-and-append is a very common pattern, this CL adds an
`append_to` argument to `Clone()`, which appends to the parent before
appending the children.

This CL also adds a perf test for this scenario (cloning a deep tree).
Locally, on a debug build, this test gives 0.13 runs/s before this CL,
and 0.40 runs/s after, for a 3.1X speedup.

[1] https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/dom/container_node.cc;l=1006;drc=5d60017dba57e86d477634812e1340127734f8a7

Bug: 1453291
Change-Id: Icdd75c45aa5ecc4fe8bb5d1ff0b7a2b27bec2171
Cq-Do-Not-Cancel-Tryjobs: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4728983
Reviewed-by: David Baron <[email protected]>
Commit-Queue: David Baron <[email protected]>
Auto-Submit: Mason Freed <[email protected]>
Commit-Queue: Mason Freed <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1177922}

…rners

We had two issues:
1.  Before we had fast rounded corners, we always created mask layers
for rounded corner clips, and the mask layer made the scroll begin
unreliable and fall back to the main thread. With fast rounded corners,
the scrolls were treated as reliable without checking if the point is
in or out of the rounded corners.
2. If the scroller has a rounded corner by itself (instead of from an
ancestor), as we only create InnerBorderRadiusClip for the contents,
the compositor doesn't actually know which part of the layer bounds
is transparent to hit test (e.g. if the scroller has a border which
is outside of the InnerBorderRadiusClip). Now with HitTestOpaqueness,
such layers have HitTestOpaqueness::kMixed.

This CL changes the behavior of
LayerTreeImpl::FindLayersUpToFirstOpaqueToHitTest (renamed from
FindLayerUpToFirstScrollableOrOpaqueToHitTest):
- For issue #1: LayerImpl::OpaqueToHitTest() also checks whether the
  layer is affected by any fast rounded corners;
- For issue #2: FindLayerUpToFirstOpaqueToHitTest checks only
  OpaqueToHitTest() (without checking IsScrollerOrScrollbar())
  because a hit test on a scrollable layer is reliable only if it's
  opaque to hit test.

Bug: 40277896
Change-Id: I1acb16f2c6790760661e8239ea1599035f83ea51
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5466909
Commit-Queue: Xianzhu Wang <[email protected]>
Reviewed-by: Steve Kobes <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1291538}

WebRTC is one form of network communication that should
be disabled when window.fence.disableUntrustedNetwork is called
in a fenced frame. However,

1. We don't have any identified use cases for WebRTC in fenced frames
2. The revocation process would be more involved than other forms of
network access, which would provide little benefit per #1.
3. Entirely disabling WebRTC PeerConnection instead is beneficial for privacy and does not break existing fenced frame use cases.

This CL disables RTCPeerConnection construction entirely in fenced
frames, regardless of whether window.fence.disableUntrustedNetwork
was called or not. The change is behind an existing flag so that
it does not ship until other forms of network revocation do.

Disabling RTCPeerConnection *can* be handled entirely by the renderer,
but a compromised renderer could potentially circumvent this to
construct a peer connection anyway. A follow-up CL will add
a browser-side control to ensure that this does not occur.

Change-Id: Iaa2caaddeee70852179332dd89c5dbbac3ffcfbf
Bug: 41488151
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5527514
Reviewed-by: Guido Urdaneta <[email protected]>
Commit-Queue: Andrew Verge <[email protected]>
Reviewed-by: Liam Brady <[email protected]>
Reviewed-by: Shivani Sharma <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1319162}

See https://drafts.csswg.org/css-pseudo-4/#first-text-line

1. For a block container that establishes an inline formatting context,
the "first formatted line" is its first line box, if it has one.
Otherwise, there is no first formatted line.

2. Otherwise, for a block container that has block children, look inside
the first in-flow block child (if any) and do #1 if it establishes an
inline formatting context. Otherwise, do #2.

In short, we don't need to search for line boxes in blocks after the
first block child. If there is no line in the first child, there's no
"first formatted line".

There's no spec for "last formatted line", but apply the same logic.
I.e. if the last block child has no line, there's no "last formatted
line".

This allows us to simplify things a bit, especially when it comes to
re-laying out (kTextBoxTrimEndDidNotApply). The only case where we need
this now is for blocks inside inlines: If the last formatted line is
inside a block-in-inline, we need to go back and re-lay it out if it
turns out to be the last line (which isn't something we can check inside
block-in-inline layout). Note: When adding support for block
fragmentation, trimming at a fragmentainer's block end will be another
case where we need to re-lay out.

The motivation for this change was text box trimming inside block
fragmentation (upcoming CL), and be able to add support for that and
still be reasonably confident that it won't become too complicated.

This fixes one existing test. Some other existing tests had to be
updated because of this change (they were making incorrect assumptions
about first/last formatted line). As a result of that, some new refs had
to be added, since other tests were piggy-backing on the same ref.

Bug: 40254880, 367766472
Change-Id: I3fcc53af86353725b1f5705a5528493a72bf2e69
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5952979
Commit-Queue: Morten Stenshorne <[email protected]>
Reviewed-by: Koji Ishii <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1373765}

This implements the core Sanitizer logic. This is still missing
spec-mandated handling of "javascript:" URLs, and will have to be
updated as the spec develops. But other than that, the basics are now
there.

------------------

This a re-land of crrev.com/c/5922125. Patch set #1 is the original version,
as reviewed and submitted there. Patch set #2 contains the fix. Analysis of
the bug is in https://issues.chromium.org/issues/356601280#comment16

Bug: 356601280, 379235386, 379246316
Change-Id: I06d4a9a378330cc76015e3922b9e288d9503881a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6021482
Reviewed-by: Yifan Luo <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Commit-Queue: Daniel Vogelheim <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1385522}

Remove AILanguageDetectorFactory and expose create and availability
statically on LanguageDetector.

This is a followup change to CLs crrev.com/c/6402873,
crrev.com/c/6402775.

Note: This change is a cherry-pick of crrev.com/c/6397965.
Some changes have been made as part of rebasing + fixing previous
CQ test failures. PS #1 represents the cherry-picked change prior
to rebase + minor edits.

Fixed: 402165734
Change-Id: Id384ebe31ccfe9e0efd65dd7c890cd66875a9ed8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6403274
Reviewed-by: Mike Wasserman <[email protected]>
Commit-Queue: Christine Hollingsworth <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1439000}

…& compile_module_script to fix the inline script reporting wrong line issue (web-platform-tests#39415)

Originally, the function compile_module_script hardwires the value 1 when invoking CompileOptionsWrapper::new(). This is fine if the script is written in separate JS file, but for inline scripts, it will cause confusion if the <script> tag doesn't start from line #1.

Credits to JDM for actually pointing out which functions to fix.

Testing: There are WPT tests for this change, specifically: tests/wpt/tests/html/semantics/scripting-1/the-script-element/module/evaluation-error-5.html
Signed-off-by: RichardTjokroutomo <[email protected]>