GitLab

These have been failing consistently on all CrOS bots for a few days.
This disables them while crbug.com/1123300 works on a fix.

Bug: 1123300
Change-Id: I3694b6a36b083649e9b498c4db4e6bbf5ab28125
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386599
Commit-Queue: Ben Pastene <bpastene@chromium.org>
Commit-Queue: Alex Newcomer <newcomer@chromium.org>
Reviewed-by: Alex Newcomer <newcomer@chromium.org>
Reviewed-by: Connie Wan <connily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803297}

With the changes to make the window cycle list more interactive, the
window cycle event filter checks whether mouse events occur within the
window cycle view. However, if the cycle view does not exist, it will
crash.

This CL makes it so IsEventInCycleView() returns false if the cycle
view does not exist.

      MouseEventWhenCycleViewDoesNotExist

Test: InteractiveWindowCycleControllerTest.
Bug: 1067327
Change-Id: I9eae1f60c2a58e5c5e8b3eba751f003249358a77
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2380551
Commit-Queue: Jeremy Chinsen <chinsenj@chromium.org>
Reviewed-by: Xiaoqian Dai <xdai@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803296}

Enables threaded compositing and cross-origin iframe layerization to allow WPTs to pass.

Bug: 910421
Change-Id: Id79d93eb23c36181c0091a7ee8b4164387ea9308
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2380813Reviewed-by: Stefan Zager <szager@chromium.org>
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Cr-Commit-Position: refs/heads/master@{#803295}

Same-document navigations (such as history.pushState() calls) cause
associated DidStartNavigation() and DidFinishNavigation()
calls. However, since this isn't considered a load,
DocumentOnLoadCompletedInMainFrame() is sensibly not called.

ThumbnailReadinessTracker assumed DidStartNavigation eventually lead
to a DocumentOnLoadCompletedInMainFrame call (or an error). This meant
that pages using history.pushState(), such as YouTube, had
never-ending thumbnail capture.

This CL fixes the never-ending capture.

Bug: 1120940
Change-Id: Ia298d384b44bcc2b860260826952898972daf480
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382426Reviewed-by: Dana Fried <dfried@chromium.org>
Commit-Queue: Collin Baker <collinbaker@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803294}

Bug: b/1105579
Change-Id: I4386bf3189ad395921086a2f876d79adfd8e6224
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2366154
Commit-Queue: Ilya Sherman <isherman@chromium.org>
Reviewed-by: Ilya Sherman <isherman@chromium.org>
Reviewed-by: Josh Nohle <nohle@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803293}

pkl@ left the team. eugenebut@ is familiar with this metric.

Bug: None
Change-Id: I729cc98e1db0b4974bcfbf5c12fa2149546fc2bd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2381071
Auto-Submit: Eugene But <eugenebut@chromium.org>
Reviewed-by: Steven Holte <holte@chromium.org>
Commit-Queue: Steven Holte <holte@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803292}

Will always try to check for LUCI_CONTEXT to have a sink and upload if
it does.

Bug: 1104238
Change-Id: I37d7de2a6e9ea72d43b5ef17874b11f2eca242cc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382892
Commit-Queue: benjamin joyce <bjoyce@chromium.org>
Commit-Queue: Peter Wen <wnwen@chromium.org>
Reviewed-by: Nodir Turakulov <nodir@chromium.org>
Reviewed-by: Peter Wen <wnwen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803291}

https://chromium.googlesource.com/chromium/tools/depot_tools.git/+log/6c37d40bb531..473462adb6b1

2020-08-31 ddoman@chromium.org [resultdb] move the cipd pin of infra/tools/rdb

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/depot-tools-chromium-autoroll
Please CC ajp@google.com,apolito@google.com,ehmaldonado@google.com,sokcevic@google.com on the revert to ensure that a human
is aware of the problem.

To report a problem with the AutoRoller itself, please file a bug:
https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/master/autoroll/README.md

Bug: chromium:1121678
Tbr: ajp@google.com,apolito@google.com,ehmaldonado@google.com,sokcevic@google.com
Change-Id: I51b681d8af7a00bfb0f5b94878b46a189f4ca005
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386255Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#803290}

WrapPositionVector was not wrapping the position around when it equaled
the end of the buffer.  This caused an extra zero value to be output
in this case.

Examination of WrapIndexVector also indicates a related logic error
because there's no >= intrinsic, so we used < but got the logic wrong.

The NEON version appears to be correct, so just added additional
comments to match the SSE2 version.

Added one test to make sure the delay is correct (based on the bug
report).

Bug: 1123023
Test: the-delaynode-interface/delay-test.html
Change-Id: Ibcb09573c53d62e926a332307d07601110b91aa3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382656Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Hongchan Choi <hongchan@chromium.org>
Commit-Queue: Raymond Toy <rtoy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803289}

In cros, if a user swipes upward with three fingers on their touchpad
it opens overview mode.

As an ongoing effort to improve the interactivity of the window cycle
list, this CL makes it so the aforementioned gesture closes the window
cycle list if it is open.

Test: InteractiveWindowCycleListGestureHandlerTest.VerticalScroll
Bug: 1067327
Change-Id: Ic8ea6f9d39b0df065c836fc9155aaa6b77446f36
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382330
Commit-Queue: Jeremy Chinsen <chinsenj@chromium.org>
Reviewed-by: Xiaoqian Dai <xdai@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803288}

https://chromium.googlesource.com/angle/angle.git/+log/7b5439987f75..e1e6f2940c25

2020-08-31 sugoi@google.com Make copyTexImage2D robust when source area is out of bounds
2020-08-31 tobine@google.com Vulkan: Add transient flag to command pool
2020-08-31 cwallez@chromium.org Suppress flaky failure on Win Intel OpenGL

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/angle-chromium-autoroll
Please CC cwallez@google.com on the revert to ensure that a human
is aware of the problem.

To report a problem with the AutoRoller itself, please file a bug:
https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/master/autoroll/README.md

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win-asan;luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:linux-swangle-try-x64;luci.chromium.try:win-swangle-try-x86
Bug: None
Tbr: cwallez@google.com
Change-Id: Ia1fb1ed9fceb3eefc0404eb7b33c5369490abeb4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386080Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#803287}

This method was just introduced in a recent uprev.

Change-Id: I00b853c2f1f6540a7e84f487ee44ba5125678ed6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382677Reviewed-by: James Vecore <vecore@google.com>
Commit-Queue: Ryan Hansberry <hansberry@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803286}

Android 11 by default restricts package status queries:
https://developer.android.com/preview/privacy/package-visibility

Add explicit <queries> entries to declare this dependency.

Bug: 1122210
Change-Id: I51c9457b85031c089da40854d10a1ad3b4abe918
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2378735
Commit-Queue: Klaus Weidner <klausw@chromium.org>
Reviewed-by: Michael Thiessen <mthiesse@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803285}

ModalDialogManager.dismissDialog() may call onLastDialogDismissed()
even if nothing was hidden. BrowserViewController was assuming this
never happened. This matters on
BrowserViewController.onLastDialogDismissed() assumed mTab was non-null.
The fix is to add a null check to BrowserViewController.

BUG=1121388
TEST=covered by test

Change-Id: I2c806018a635d9434bf10c653b2615ea645b8e04
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382880
Commit-Queue: Scott Violet <sky@chromium.org>
Reviewed-by: Evan Stade <estade@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803284}

Test for encryption failure now also moved to storage_unittest and
storage_queue_unittest.

Also, record digest has been removed from report_queue and not added
to Storage yet: will do it later.

Bug: b:153649905
Change-Id: Iaa75c86b76a1accaf1fe2b8d6aba71d109c42f8c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385783
Commit-Queue: Leonid Baraz <lbaraz@chromium.org>
Reviewed-by: Zach Trudo <zatrudo@google.com>
Cr-Commit-Position: refs/heads/master@{#803283}

Fix use-after-move (potential) bugs found by the
"bugprone-use-after-move" clang-tidy check.

Bug: 1122844
Change-Id: I9183ee204a4e775c25f1e4a5d60628b4e8adb794
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2383013Reviewed-by: Sadrul Chowdhury <sadrul@chromium.org>
Commit-Queue: Maksim Ivanov <emaxx@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803282}

Record user actions on the password check view, as well as where the
password check view was opened from.

Bug: 1123019
Change-Id: I7004dedade8d85c3490580476ff2721a82f7057f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2379902
Commit-Queue: Jesse Doherty <jwd@chromium.org>
Auto-Submit: Ioana Pandele <ioanap@chromium.org>
Reviewed-by: Jesse Doherty <jwd@chromium.org>
Reviewed-by: Friedrich [CET] <fhorschig@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803281}

TBR=bling-team@google.com

Change-Id: I57e76c35e585997d759a220770c08e5b1814e6a8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386220Reviewed-by: Internal Frameworks Autoroller <bling-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Internal Frameworks Autoroller <bling-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#803280}

This change explicitly sets the location of the Jet Database Engine's
checkpoint file, "edb.chk". Its location is set to the same log folder
as other log files.

If the checkpoint file's location is not explicitly set, it defaults
to the current directory. This causes browser_tests to leave "edb.chk"
behind in the source directory after running.

Bug: 1119540
Change-Id: I2c61f102b6e5fa3ad87ea7c629b3a9d7943c8c6b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2380962Reviewed-by: Ilya Sherman <isherman@chromium.org>
Commit-Queue: Jesse McKenna <jessemckenna@google.com>
Cr-Commit-Position: refs/heads/master@{#803279}

Bug: 1119945
Change-Id: I888b739114e838a223cdfae39eead1578783a5fb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2374666
Commit-Queue: Rebekah Potter <rbpotter@chromium.org>
Auto-Submit: dpapad <dpapad@chromium.org>
Reviewed-by: Rebekah Potter <rbpotter@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803278}

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/fuchsia-sdk-chromium-autoroll
Please CC cr-fuchsia+bot@chromium.org on the revert to ensure that a human
is aware of the problem.

To report a problem with the AutoRoller itself, please file a bug:
https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/master/autoroll/README.md

Cq-Include-Trybots: luci.chromium.try:fuchsia-arm64-cast;luci.chromium.try:fuchsia-x64-cast
Tbr: cr-fuchsia+bot@chromium.org
Change-Id: Ia23f40a94286438c632efec2dfe15dbfa77f56f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386515Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#803277}

- Parameterize the tests to run with both flag states
- Fix logic in ConvertPageCoordToScreenCoord to account for the new
  PDF Viewer's differing UI layout.

Bug: 1120279
Change-Id: I3a04ef5234fd7ef89355698d604393cdc2f013d8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2383190
Commit-Queue: Rebekah Potter <rbpotter@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803276}

Change-Id: Ie573df232846ff9cb548d0aedbc69536f86afe08
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385925
Commit-Queue: Clark DuVall <cduvall@chromium.org>
Auto-Submit: John Abd-El-Malek <jam@chromium.org>
Reviewed-by: Clark DuVall <cduvall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803275}

This is one of a series of CLs to implement ScreenTime.

This CL:
* Adds a new overlay modality above the web content area for the
ScreenTime blocking view overlay
* Adds and integrates no-op supported overlay coordinator classes.

Bug: 1123704
Change-Id: Idee3417df9dee7cd15b8fcc93e4ee6944a5e530e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386535Reviewed-by: Chris Lu <thegreenfrog@chromium.org>
Commit-Queue: edchin <edchin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803274}

This implements the copy image function behind a flag in the frontend.
This gives an opportunity to folks interested in testing this
implementation a chance to test it on real devices.

Bug: 827333
Change-Id: I15b6f2e103686d2978ed1085f69f6179b2b3e246
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382210
Commit-Queue: Alexander Nohe <nohe@chromium.org>
Reviewed-by: Luciano Pacheco <lucmult@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803273}

Recent experiment shows that there is no huge impact on crash rates. So this CL is going to change the default mode to use HeapMojoWrapperMode::kWithContextObserver.

Bug: 1049056
Change-Id: I801a57fdacc6195b95aef9d9fa6f1a896595f9b8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2383406Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803272}

Fix use-after-move (potential) bugs found by the
"bugprone-use-after-move" clang-tidy check.

Bug: 1122844
Change-Id: I3d80f691b83d5e2439a3daf786cffd67b0eb4daa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382851Reviewed-by: Takumi Fujimoto <takumif@chromium.org>
Commit-Queue: Maksim Ivanov <emaxx@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803271}

Switch to holding the AndroidFontLookupImpl instance as a static
singleton. Otherwise, the renderer side would unnecessarily instantiate
one per renderer process.

This change results in a StaticFieldLeak lint warning for holding an
object with a Context member variable as a static field, which could be
a memory leak. It's safe in this situation because the context is the
application context.

This CL also cleans up the InterfaceRegistrar to remove unnecessary
references to Context. Since https://crrev.com/2828353002, it has not
been necessary to hold a pointer to Android context to be passed through
JNI, so this Registry param was no longer necessary.

Bug: 1111148
Change-Id: I4dcf23c682b29bfd167add5274782aa4d1f0a81a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2380748
Commit-Queue: Natalie Chouinard <chouinard@chromium.org>
Reviewed-by: Ted Choc <tedchoc@chromium.org>
Reviewed-by: Brandon Wylie <wylieb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803270}

See bug for rationale.

Bug: 1123709
Change-Id: I514e681e731d578a045da6fbfd70558bca0d22d1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386338
Commit-Queue: Dana Fried <dfried@chromium.org>
Commit-Queue: Collin Baker <collinbaker@chromium.org>
Reviewed-by: Collin Baker <collinbaker@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803269}

Using wpt-import in Chromium 8283230e.

Note to sheriffs: This CL imports external tests and adds
expectations for those tests; if this CL is large and causes
a few new failures, please fix the failures by adding new
lines to TestExpectations rather than reverting. See:
https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md

Directory owners for changes in this CL:
bokan@chromium.org:
  external/wpt/scroll-to-text-fragment

NOAUTOREVERT=true
TBR=lpz@google.com

No-Export: true
Change-Id: If9f8d751455f5e1713bc9f95ce98c9dab7c1ba84
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2386155Reviewed-by: WPT Autoroller <wpt-autoroller@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: WPT Autoroller <wpt-autoroller@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#803268}

With the new jobs api, concurrent marking tasks get a lower priority
than before. We've seen cases where that means no concurrent marking
tasks are executed, which leads to long GC times.

I've seen a trace that contains a GC from 10.8s to 13.2s (2.4s in
total). During this GC there are no concurrent marking tasks because
wasm compilation tasks are given a higher priority.

However, as long as GC is running, the mutator thread pays the cost of
write barriers. Thus it is in our interest to finish marking as soon as
possible.

This CL raises the priority of concurrent marking tasks for the current
gc cycle if there was no concurrent progress being made for a
significant portion of the expected marking duration.

Bug: 1119552
Change-Id: I1934e72df171b63292513b63be1ddee925806718
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2378305Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803267}

Mirroring Service and Media Remoting code don't depend on extensions
any more.  This updates the BUILD file to reflect that.

It also deletes CastTransportHostFilter which is unused.

Bug: 879012,1120230
Change-Id: Ia2962b352566ac90a198420952be0480f617b4d5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2367735Reviewed-by: Yuri Wiitala <miu@chromium.org>
Commit-Queue: mark a. foltz <mfoltz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803266}

No functional change.

Bug: none
Change-Id: I5b40407cbb9a4219bc606ad3001b28da3b92fbf2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2384330Reviewed-by: Peter Boström <pbos@chromium.org>
Commit-Queue: Peter Boström <pbos@chromium.org>
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803265}

The old date time picker is not used due to UI issues like min width
of the dialogs and button matching. Currently we use standard Android
date time picker widgets.

This CL simply deletes unused code.

Bug: NONE
Change-Id: Iae797aa8ea2d45b7125458d9d1468fcc5a2598ae
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382013Reviewed-by: David Trainor <dtrainor@chromium.org>
Reviewed-by: Hesen Zhang <hesen@chromium.org>
Commit-Queue: Xing Liu <xingliu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803264}

To check that webview partition did not change during the flows. Change
of the partition might lead to the failure of extraction authentication
token out of the cookie jar. Which usually break enrollment or login.

Also this CL aling enrollment tests more to the existing behavior - use
Gaia to login first before the enrollment.

Change-Id: Ied949ccba7e0b29384efd98e05d41ccc8dd4a72c
Fixed: 1119411
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2376852
Commit-Queue: Roman Sorokin [CET] <rsorokin@chromium.org>
Reviewed-by: Roman Aleksandrov <raleksandrov@google.com>
Cr-Commit-Position: refs/heads/master@{#803263}

Seeing a relatively low instance of crashes due to promoting some
DCHECKs to CHECKs where printing was tracking down a bug and also found
an issue with our code.

There are two other cases where in principle this crash could be caused,
but I think we can rule both of them out:
1. We separately capture a local subframe (unlikely as the IPCs are
   serviced sequentially in arrival order so the after print would
   already be issued by the time the subframe is handled)
2. We capture a remote frame (before/after print are not dispatched to
   remote frames).

Bug: 1123437
Change-Id: I141502e07170976c84867fa869cdc6353dad12fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385762Reviewed-by: Mehran Mahmoudi <mahmoudi@chromium.org>
Commit-Queue: Calder Kitagawa <ckitagawa@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803262}

Bug: 1110914
Change-Id: I5d6375da9a9e9855e5a8b568fcd9914e39fa94f1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2382228Reviewed-by: Aaron Tagliaboschi <aarontag@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803261}

Commit 229623d7 has introduced the following
code in cookie_monster.cc.

// If this is the first cookie in |cookies_| with this key, increment the
// |num_keys_| counter.
bool different_prev =
    inserted == cookies_.begin() || std::prev(inserted)->first != key;
bool different_next =
    inserted == cookies_.end() || std::next(inserted)->first != key;
if (different_prev && different_next)
  ++num_keys_;

The "inserted" iterator is something that has been returned from
std::multimap::insert. At first glance it looks reasonable. The code
tries to determine if there are already similar elements with the same
key in the map. Unfortunately the expression calculating the value of
different_next can potentially use the end iterator to the map. The
"inserted == cookies_.end()" part of the expression will always evaluate
to false since the newly inserted element has to be in the map and
cookies_.end() points to the first element outside the map. If the
inserted happens to be the last element in the map the second part of
the expression will grab the end iterator by calling std::next(inserted)
and then will try to use it leading to invalid memory access.

Given the fact that cookies_ is a std::multimap we should not even need
to calculate the value of different_next. It should always be true.

  "If the container has elements with equivalent key, inserts at the
  upper bound of that range.(since C++11)"

See: https://en.cppreference.com/w/cpp/container/multimap/insert

Bug: 1120240
Change-Id: I8928c294ac4daf72349a2331b31b017c1d015da0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2368872Reviewed-by: Maksim Orlovich <morlovich@chromium.org>
Commit-Queue: Piotr Tworek <ptworek@vewd.com>
Cr-Commit-Position: refs/heads/master@{#803260}

TBR=dmazzoni@chromium.org

Bug: 1123641
Change-Id: I9c8133010d7c86c6495d0e39ca56ed63241a9304
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385928Reviewed-by: Gang Wu <gangwu@chromium.org>
Commit-Queue: Gang Wu <gangwu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803259}

And wires up parsing of overflow:clip. This also
makes it so that if clip is set along one axis, it's
set along the other (similar to visible).

BUG=1087667
TEST=none

Change-Id: I3377d2122cf9ec2d5f938c9c67d92778a4337915
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2380314Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803258}