Don't substitute GestureFlingStarts with GestureScrollEnds when bubbling

We were substituting GFS events with GSE events when bubbling scroll
from an OOPIF. This was done to prevent an OOPIF based guest from
consuming a fling that is intended for bubbling (see crbug.com/770852).
It seems that this can lead to an invalid input event stream.

Fortunately, the main concern in that bug was with GestureScrollUpdates.
The fling was a minor issue. The filtering of GSU events is still
valid, so we only remove the GFS substitution.

Bug: 770852, 806940, 802085
Change-Id: I647471ea4ff94396ef6e6af21fb89e1841a0eaf7
Reviewed-on: https://chromium-review.googlesource.com/899878Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Commit-Queue: Kevin McNee <mcnee@chromium.org>
Cr-Commit-Position: refs/heads/master@{#534160}

content/browser/renderer_host/render_widget_host_view_child_frame.cc

@@ -720,34 +720,6 @@ void RenderWidgetHostViewChildFrame::PreProcessTouchEvent(
   }
 }
 
-void RenderWidgetHostViewChildFrame::ProcessGestureEvent(
-    const blink::WebGestureEvent& event,
-    const ui::LatencyInfo& latency) {
-  if (wheel_scroll_latching_enabled() && is_scroll_sequence_bubbling_ &&
-      (event.GetType() == blink::WebInputEvent::kGestureFlingStart) &&
-      frame_connector_) {
-    // For GestureFlingStarts, we send a GestureScrollEnd to the child in order
-    // to conclude the scrolling sequence but without allowing the child to
-    // actually fling if the child attempts to consume scroll.
-    // We bubble the fling to the target intended to consume it.
-    frame_connector_->BubbleScrollEvent(event);
-
-    blink::WebGestureEvent scroll_end(event);
-    scroll_end.SetType(blink::WebInputEvent::kGestureScrollEnd);
-    scroll_end.data.scroll_end.inertial_phase =
-        blink::WebGestureEvent::kUnknownMomentumPhase;
-    scroll_end.data.scroll_end.delta_units =
-        blink::WebGestureEvent::kPrecisePixels;
-    // Since we've just bubbled the fling, the |frame_connector_| knows that
-    // the sequence has ended, so it will just drop this synthesised GSE when
-    // we get the ack.
-    host_->ForwardGestureEvent(scroll_end);
-    return;
-  }
-
-  RenderWidgetHostViewBase::ProcessGestureEvent(event, latency);
-}
-
 viz::SurfaceId RenderWidgetHostViewChildFrame::GetCurrentSurfaceId() const {
   return viz::SurfaceId(frame_sink_id_, last_received_local_surface_id_);
 }

content/browser/renderer_host/render_widget_host_view_child_frame.h

@@ -145,8 +145,6 @@ class CONTENT_EXPORT RenderWidgetHostViewChildFrame
   viz::FrameSinkId GetFrameSinkId() override;
   viz::LocalSurfaceId GetLocalSurfaceId() const override;
   void PreProcessTouchEvent(const blink::WebTouchEvent& event) override;
-  void ProcessGestureEvent(const blink::WebGestureEvent& event,
-                           const ui::LatencyInfo& latency) override;
   viz::SurfaceId GetCurrentSurfaceId() const override;
   gfx::PointF TransformPointToRootCoordSpaceF(
       const gfx::PointF& point) override;

content/browser/site_per_process_hit_test_browsertest.cc

@@ -2366,9 +2366,8 @@ IN_PROC_BROWSER_TEST_F(
 }
 #endif  // defined(USE_AURA) || defined(OS_ANDROID)
 
-// Disabled for flakiness: https://crbug.com/802085.
 IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
-                       DISABLED_InputEventRouterTouchpadGestureTargetTest) {
+                       InputEventRouterTouchpadGestureTargetTest) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_nested_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));