GitLab

I've narrowed down the linked crash to a bad m_owner pointer in Frame. I've
added two temporary magic values to help diagnose where this is coming from:

In Frame I added a magic value beside the m_owner element to guard against
heap corruption.

In HTMLFrameOwnerElement I added a magic value that should help us catch when
m_owner is not pointing to an HTMLFrameOwnerElement sooner.

In both cases, we should also be able to see if either m_owner of Frame has
already been destructed.

Also turned the ASSERT in ~HTMLFrameOwnerElement into a RELEASE_ASSERT in
case we're destroying it without disconnecting it from the Frame.

BUG=519752

Review URL: https://codereview.chromium.org/1369003003

Cr-Commit-Position: refs/heads/master@{#351150}

VideoFrame::visible_rect could be different than natural_size when the
VideoFrame is coming from a media stream that is from a camera.
crrev.com/1358883003 is planning to convert the video frames coming from
different media sources.

This CL crops VideoFrame using visible_rect when it gets converted to
a new VideoFrame backed by GpuMemoryBuffers.

BUG=

Review URL: https://codereview.chromium.org/1371683002

Cr-Commit-Position: refs/heads/master@{#351149}

Changes:
  - Moves --enable-features/--disable-features flags to content from
    chrome.
  - Copies their content when starting renderers.
  - In renderer_main.cc, creates and registers a FeatureList initialized
    with those flags.

BUG=526169

Review URL: https://codereview.chromium.org/1355613002

Cr-Commit-Position: refs/heads/master@{#351148}

BUG=535373

Review URL: https://codereview.chromium.org/1361153004

Cr-Commit-Position: refs/heads/master@{#351147}

This refactoring of CustomTabsConnection has two benefits:
- Move the client and session handling logic away from CustomTabsConnection.
- Simplify locking in CustomTabsConnection, as it is all handled by
  ClientManager.

Some methods in CustomTabsConnection are now simple pass-through. These
will be removed in a subsequent CL. Leaving these here means that no
test code is affected.

Review URL: https://codereview.chromium.org/1370473002

Cr-Commit-Position: refs/heads/master@{#351146}

This addresses a review comment from https://codereview.chromium.org/1373903002/ that I forgot to fix there.

TBR=andybons@chromium.org

Review URL: https://codereview.chromium.org/1370293002

Cr-Commit-Position: refs/heads/master@{#351145}

There is a problem on A1 devices where sdcard/ is read only. This remounts / with write
permission to push files to /sdcard then resets it to read only.

BUG=

Review URL: https://codereview.chromium.org/1370873002

Cr-Commit-Position: refs/heads/master@{#351144}

Revert of [DevTools] Do not use AboutToNavigateRenderFrame in DevToolsUIBindings. (patchset #1 id:1 of https://codereview.chromium.org/1360143003/ )

Reason for revert:
This patch added a race. It should be using DidStartNavigationToPendingEntry instead.

Original issue's description:
> [DevTools] Do not use AboutToNavigateRenderFrame in DevToolsUIBindings.
>
> DidStartProvisionalLoadForFrame is enough here.
>
> BUG=none
>
> Committed: https://crrev.com/ee6eca69ffbd1d510d02397df5047f27cc256e8e
> Cr-Commit-Position: refs/heads/master@{#350974}

TBR=pfeldman@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1369413002

Cr-Commit-Position: refs/heads/master@{#351143}

  In order to roll GN cdc76669..1b1e7e8c (r350849:r351089) and pick up
  the following changes:

  1b1e7e8c GN: Schedule config loads for sub-configs.
  c5598930 GN: Don't allow nested things inside template invocations.
  1c3192f7 Enhance GN documentation.
  e1bbf321 [GN]: Fix bug in roller script with try servers

TBR=dpranke@chromium.org
CQ_EXTRA_TRYBOTS=tryserver.chromium.mac:mac_chromium_gn_rel;tryserver.chromium.win:win8_chromium_gn_dbg,win_chromium_gn_x64_rel

Review URL: https://codereview.chromium.org/1370133006

Cr-Commit-Position: refs/heads/master@{#351142}

This patch address a bunch of issues people have found in the roll_gn script:

- Fixes yet another bug where we weren't waiting for the try jobs
  to finish.
- Fixes a bug where we were adding an extra '\n' onto the DEPS file
  in the final roll CL.
- Closes the 'build_gn' CL once the build has completed.
- Adds better logging at the end of the 'wait' and 'roll_buildtools' steps.
- Removes mac_chromium_gn_rel from CQ_EXTRA_TRYBOTS, since
  it is part of the default set now.

R=brettw@chromium.org, andybons@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1372203003

Cr-Commit-Position: refs/heads/master@{#351141}

BUG=536887

Review URL: https://codereview.chromium.org/1377523002

Cr-Commit-Position: refs/heads/master@{#351140}

This moves the checking of error-conditions from
SVGFEConvolveMatrixElement::build to SkImageFilter build time
(FEConvolveMatrix::createImageFilter), with the change in behavior that
an feConvolveMatrix primitive that is "in error" now produces
transparent black rather than fail the chain (for 'filter' - is ignored
for '-webkit-filter'). This new behavior matches Gecko.
The 'order' vs. size('kernelMatrix') checking is also strengthed / made
more obvious by explicitly failing when overflowing the (positive) int
range. (And avoids depending on signed overflow.)
Also introduce a helper FilterEffect::createTransparentBlack and use in
FEConvolveMatrix and FEImage, and drop a bunch of unused accessor
methods on FEConvolveMatrix.

BUG=533457

Review URL: https://codereview.chromium.org/1376473002

Cr-Commit-Position: refs/heads/master@{#351139}

Like the Options page, the Languages section of MD Settings,
among others, will need access to information about the CrOS
user for enabling, disabling and decorating controls.

We prefer using HTML imports (e.g. cr.html), ergo, this CL.

BUG=512497
R=dbeam@chromium.org

Review URL: https://codereview.chromium.org/1373923002

Cr-Commit-Position: refs/heads/master@{#351138}

This gives us the size decreases from  https://crbug.com/159847#c39

BUG=159847

Review URL: https://codereview.chromium.org/1371863002

Cr-Commit-Position: refs/heads/master@{#351137}

cc/blink will go away eventually with the repo merge. We should avoid
subclassing from there as per danakj@'s suggestion.

BUG=none

Review URL: https://codereview.chromium.org/1373003002

Cr-Commit-Position: refs/heads/master@{#351136}

We shouldn't expose the type unsafe API for creating events, instead lets
expose constructors for the actual event objects. I also removed most of
the functionality of WebDOMCustomEvent since it's only used by the IPCEcho
testing system. As this system has no tests checked in and seems to be only
used by local benchmarking we should probably remove it, but lets do that
in a future patch.

Review URL: https://codereview.chromium.org/1367333002

Cr-Commit-Position: refs/heads/master@{#351135}

This is a bit of cleanup and extra test coverage before introducing a
NavigationEntry for the initial blank page.

BUG=524208
TEST=No behavior change.

Review URL: https://codereview.chromium.org/1372133002

Cr-Commit-Position: refs/heads/master@{#351134}

After the changes the test:

- Continues to test cross-site / multiple-renderer-processes case.

- Starts to verify that frame links got correctly replaced with
  local paths (this uses a separate code path from replacing links
  of other, non-frame savable resources).

- Starts to test that deduplication of savable resources happens across frames
  (deduplication got moved into the browser process in
  https://chromium.googlesource.com/chromium/src/+/6af746b740287560dbc9e85d22738000bc72b521).

BUG=526786

Review URL: https://codereview.chromium.org/1362973003

Cr-Commit-Position: refs/heads/master@{#351133}

BUG=535980

Review URL: https://codereview.chromium.org/1369723003

Cr-Commit-Position: refs/heads/master@{#351132}

BUG=514340

Review URL: https://codereview.chromium.org/1366203003

Cr-Commit-Position: refs/heads/master@{#351131}

BUG=528940
R=skobes@chromium.org,pdr@chromium.org

Before this change:

https://codereview.chromium.org/1295933003

... blocks with overflow:auto would delay updating their scrollbars until
after all flex layout was finished.  After the change, scrollbar info is
updated immediately during the course of layout.  Flex items may run
layout multiple times during flex layout; if a flex item has auto scrollbars,
it may create and destroy its scrollbars multiple times.

Aside from being a performance problem, this can cause WebScrollbarThemePainter
to point to a stale Scrollbar object.  If a flex item has scrollbars prior to
layout; then the flex item destroys and creates scrollbars during layout; and
at the end of layout, it still has a scrollbar; then
CompositedDeprecatedPaintLayerMapping::updateOverflowControlsLayers will not
update the WebScrollbarThemePainter with the final Scrollbar object.

We could fix this in updateOverflowControlsLayers, but that wouldn't address
the performance issue of needlessly creating and destroying scrollbars during
flex layout.  This patch avoids destroying scrollbars that are no longer
deemed necessary, until after all flexing is finished.

Review URL: https://codereview.chromium.org/1357423007

Cr-Commit-Position: refs/heads/master@{#351130}

Revert of exclude PhishingDOMFeatureExtractorTest.* browser_tests on Dr. Memory bots (patchset #1 id:1 of https://codereview.chromium.org/1371193003/ )

Reason for revert:
I'm reverting the relevant CL, https://codereview.chromium.org/1373993002/

so this exclusion is no longer necessary.

Original issue's description:
> exclude PhishingDOMFeatureExtractorTest.* browser_tests on Dr. Memory bots
>
> TBR=erikchen@chromium.org
> BUG=536891
> NOTRY=true
>
> Committed: https://crrev.com/2b4bfec5eab7ab8986557934ef9bd27e87c8e22b
> Cr-Commit-Position: refs/heads/master@{#351107}

TBR=zhaoqin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=536891

Review URL: https://codereview.chromium.org/1375743002

Cr-Commit-Position: refs/heads/master@{#351129}

Revert of ipc: Change the timing of the construction of the attachment broker. (patchset #3 id:40001 of https://codereview.chromium.org/1367013003/ )

Reason for revert:
Still causes problems in at least one Dr. Memory test. https://code.google.com/p/chromium/issues/detail?id=536891
Requires further investigation - Reverting for now

Original issue's description:
> ipc: Change the timing of the construction of the attachment broker.
>
> This CL ensures that the privileged attachment broker is constructed earlier in
> the process of creating a child process. This fixes a race condition for single
> process mode where the child thread's attachment broker would become the global
> attachment broker.
>
> BUG=534539
>
> Committed: https://crrev.com/8758b4bd5bd210552606fa39d084aef7e786abd1
> Cr-Commit-Position: refs/heads/master@{#350899}

TBR=avi@chromium.org,tsepez@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=534539

Review URL: https://codereview.chromium.org/1373993002

Cr-Commit-Position: refs/heads/master@{#351128}

Switch libvpx from static_library to none
https://codereview.chromium.org/1365973002

R=blundell@chromium.org,tomfinegan@chromium.org
BUG=534943

Review URL: https://codereview.chromium.org/1369553003

Cr-Commit-Position: refs/heads/master@{#351127}

These flags were getting large and out of control, so it's nice to separate them from the generic compiler stuff. Also, this allows us to duplicate the GYP state where the sanitizer flags are not set on the sanitizer options helper code itself.

Review URL: https://codereview.chromium.org/1361323003

Cr-Commit-Position: refs/heads/master@{#351126}

TBR=jsbell@chromium.org
BUG=536881
NOTRY=true

Review URL: https://codereview.chromium.org/1377503002

Cr-Commit-Position: refs/heads/master@{#351125}

This is fixed in ToT (was fixed in M46), so remove the workaround.

BUG=chrome-os-partner:36554

Review URL: https://codereview.chromium.org/1373033002

Cr-Commit-Position: refs/heads/master@{#351124}

BUG=535125

Review URL: https://codereview.chromium.org/1360153003

Cr-Commit-Position: refs/heads/master@{#351123}

TBR=creis@chromium.org
BUG=536907
NOTRY=true

Review URL: https://codereview.chromium.org/1373973002

Cr-Commit-Position: refs/heads/master@{#351122}

BUG=536293

Review URL: https://codereview.chromium.org/1375573002

Cr-Commit-Position: refs/heads/master@{#351121}

For media_stream_audio example, add 'audioCapture' permission
For media_stream_video example, add 'videoCapture' permission

Missing these permissions will cause NavigatorUserMediaError

BUG=NONE
TEST=Build the app and load it into Chrome, you should see it's working.

Review URL: https://codereview.chromium.org/1374513002

Cr-Commit-Position: refs/heads/master@{#351120}

Bookmarked origins still have to request the permission but will get it
without any user interaction.

BUG=533197

Review URL: https://codereview.chromium.org/1356813002

Cr-Commit-Position: refs/heads/master@{#351119}

Added maxWidth:screen.width and maxHeight:screen.height constrains for video in webkitGetUserMedia().Therefore, the stream may have higher resolution than 640*480 which is default in webkitGetUserMedia().

Review URL: https://codereview.chromium.org/1321453004

Cr-Commit-Position: refs/heads/master@{#351118}

Update the ARC 'getting started' doc to include information about
32-bit x86 targets and ARC.

BUG=None
R=mkearney@chromium.org

Review URL: https://codereview.chromium.org/1347713002

Cr-Commit-Position: refs/heads/master@{#351117}

Page scale factor is updated when a main frame is committed. But that is
not enough because when WebView is invisible, there won't be main frame
commits.

In order to get page scale factor updates even when WebView is
invisible, check page scale factor change when the layout is updated.

BUG=520089

Review URL: https://codereview.chromium.org/1368193002

Cr-Commit-Position: refs/heads/master@{#351116}

BUG=528228
TEST=none

Review URL: https://codereview.chromium.org/1374793002

Cr-Commit-Position: refs/heads/master@{#351115}

BUG=512643

Review URL: https://codereview.chromium.org/1369463004

Cr-Commit-Position: refs/heads/master@{#351114}

Remove FaviconHandler::PageChangedSinceFaviconWasRequested() since both
- FaviconHandler::url_ changes (FaviconHandler::FetchFavicon())
- The NavigationController's last committed URL changes
  (NavigationControllerImpl::RendererDidNavigate())
only as a result of NavigatorImpl::DidNavigate()

BUG=517089
TEST=None

Review URL: https://codereview.chromium.org/1272413002

Cr-Commit-Position: refs/heads/master@{#351113}

This should prevent all commands run via timeout_retry.Run from triggering the
20-minute buildbot timeout. In particular, this should prevent long-running
gtest suites, e.g. the webrtc perf tests, from timing out.

BUG=

Review URL: https://codereview.chromium.org/1370133004

Cr-Commit-Position: refs/heads/master@{#351112}

Previously we would directly pass developer-provided icons on to the
Android NotificationManager, but this has led to OOM errors on devices
with less memory when developers provide, supposedly, large icons.

Starting from this CL, we ensure that icons are at most the size at
which they will be presented to the user.

TBR=mvanouwerkerk (reviewed in CL 1362943002)
BUG=529980

Review URL: https://codereview.chromium.org/1372163002

Cr-Commit-Position: refs/heads/master@{#351111}