DL: Remove display lock fuzzer, and add css keywords for render-subtree.

This patch does two things:
1. Removes the display locking fuzzer, since its dictionary is testing
   a now non-existent javascript api. It is also seems to be leaky
   (see referenced bug as an example)
2. Adds render-subtree keywords to the css fuzzer's dictionary, so that
   that fuzzer exercises the render-subtree code.

R=chrishtr@chromium.org, rakina@chromium.org

Bug: 1031946
Change-Id: Ic21b353a38d651c42e9179806f71670ae5e72e5c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1986887Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: vmpstr <vmpstr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#728261}

third_party/blink/renderer/core/css/css.dict

@@ -923,6 +923,9 @@
 "fieldtext"
 "canvas"
 "canvastext"
+"invisible"
+"skip-activation"
+"skip-viewport-activation"
 
 # at-rules
 "@charset"
@@ -1275,6 +1278,7 @@
 "r"
 "range"
 "region-fragment"
+"render-subtree"
 "rest"
 "rest-after"
 "rest-before"

third_party/blink/renderer/core/display_lock/BUILD.gn

@@ -2,7 +2,6 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("//testing/libfuzzer/fuzzer_test.gni")
 import("//third_party/blink/renderer/core/core.gni")
 
 blink_core_sources("display_lock") {
@@ -27,15 +26,3 @@ blink_core_sources("display_lock") {
     "//third_party/blink/renderer/bindings/core/v8:bindings_core_v8_generated",
   ]
 }
-
-fuzzer_test("display_lock_fuzzer") {
-  sources = [
-    "display_lock_fuzzer.cc",
-  ]
-  deps = [
-    "//content/test/fuzzer:fuzzer_support",
-  ]
-
-  seed_corpus = "//third_party/blink/web_tests/wpt_internal/display-lock"
-  dict = "display_lock.dict"
-}

third_party/blink/renderer/core/display_lock/DEPS

-specific_include_rules = {
-  "display_lock_fuzzer.cc" : [ "+content/test/fuzzer/fuzzer_support.h" ],
-}

third_party/blink/renderer/core/display_lock/display_lock.dict

-"rendersubtree=''"
-"rendersubtree='invisible'"
-"rendersubtree='invisible activatable'"
-"updateRendering()"
-"content-size"

third_party/blink/renderer/core/display_lock/display_lock_fuzzer.cc

-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/test/fuzzer/fuzzer_support.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_runtime_features.h"
-#include "third_party/blink/public/web/web_local_frame.h"
-#include "third_party/blink/public/web/web_view.h"
-#include "third_party/blink/public/web/web_widget.h"
-
-static content::Env* env;
-
-bool Initialize() {
-  blink::WebRuntimeFeatures::EnableDisplayLocking(true);
-  env = new content::Env();
-  return true;
-}
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  static bool initialized = Initialize();
-  // Suppress unused variable warning.
-  (void)initialized;
-
-  // Only handle reasonable size inputs.
-  if (size < 1 || size > 10000)
-    return 0;
-
-  std::string data_as_string(reinterpret_cast<const char*>(data), size);
-  int num_rafs = std::hash<std::string>()(data_as_string) % 10;
-  env->adapter->LoadHTML(data_as_string, "");
-
-  // Delay each frame 17ms which is roughly the length of a frame when running
-  // at 60fps.
-  auto frame_delay = base::TimeDelta::FromMillisecondsD(17);
-
-  for (int i = 0; i < num_rafs; ++i) {
-    base::RunLoop run_loop;
-    blink::scheduler::GetSingleThreadTaskRunnerForTesting()->PostDelayedTask(
-        FROM_HERE, run_loop.QuitClosure(), frame_delay);
-    run_loop.Run();
-
-    env->adapter->GetMainFrame()
-        ->View()
-        ->MainFrameWidget()
-        ->UpdateAllLifecyclePhases(
-            blink::WebWidget::LifecycleUpdateReason::kTest);
-  }
-  return 0;
-}