merge_pr_60602

WebKit export of https://bugs.webkit.org/show_bug.cgi?id=316951 (#60602)

merge_pr_60598

webnn: raise input rank limit to 5 for isNaN and isInfinite on TFLite

This CL raises the input rank limit from 4 to 5 for isNaN and isInfinite
on the TFLite backend, unifying the rank limit at 5 across all
element-wise logical operators. It also adds 5-D conformance tests for
both operators.

Bug: 522844899
Change-Id: I15bfeb676df8773da6b1282d9bf7ff7741a89b5b
Cq-Include-Trybots: luci.chromium.try:win11-blink-rel, mac14.arm64-blink-rel, mac14-blink-rel, mac15.arm64-blink-rel, mac15-blink-rel, linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7927875
Commit-Queue: Hu, Ningxin ningxin.hu@intel.com
Reviewed-by: Hu, Ningxin ningxin.hu@intel.com
Reviewed-by: Reilly Grant reillyg@chromium.org
Cr-Commit-Position: refs/heads/main@{#1646337}

merge_pr_60597

[aria-actions] Add ariaActionsElements IDL reflection

Add the FrozenArray? ariaActionsElements attribute to the
AriaRelationshipAttributes mixin so authors can mutate aria-actions
references via the AOM IDL surface, this is the same pattern used for
ariaControlsElements, ariaDescribedByElements, etc.

Bug: 408036582, 514751946
Change-Id: I4a40a77bbe646cbe5175c41e5334ce424bc0b3c8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7852708
Commit-Queue: Jacques Newman janewman@microsoft.com
Reviewed-by: Dan Clark daniec@microsoft.com
Cr-Commit-Position: refs/heads/main@{#1646349}

merge_pr_60596

WebKit export of https://bugs.webkit.org/show_bug.cgi?id=61855 (#60596)

merge_pr_60583

layout: Adjust corner radii for inset box shadows

Inset box shadows refer to the padding box, not the border box. However,
the value from border-radius needs to apply to the border box.

Therefore, we need to adjust the border-radius by the border sizes
before applying it to the inset box shadow.

Signed-off-by: Oriol Brufau obrufau@igalia.com

merge_pr_60595

[CE] Block untrusted activation and fire onerror event

This change moves the error attribute from the
HTMLUserMediaElementMediaStream supplement to the core
HTMLUserMediaElement. It also adds a check in DefaultEventHandler to
ensure that DOMActivate events on <usermedia> elements are fully
trusted. Untrusted activations will now result in an InvalidStateError
being set on the element and an error event being dispatched.

Spec: https://w3c.github.io/mediacapture-extensions/#the-usermedia-html-element
Bug: 519075914
Change-Id: I763a83dc27c207107e42ae1845a1ca1771433ee0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7889738
Auto-Submit: Ravjit Uppal ravjit@chromium.org
Commit-Queue: Joey Arhar jarhar@chromium.org
Reviewed-by: Joey Arhar jarhar@chromium.org
Cr-Commit-Position: refs/heads/main@{#1646246}

merge_pr_60587

[highlights] Don't leak color onto user-select:none text

When text is user-select:none, its ::selection overlay is ignored:
HighlightPaintingStyle() skips color resolution for the selection layer.
This left the layer's foreground colors out of
properties_using_current_color, so ComputeParts() never re-resolved them
per part. The selection layer therefore kept the color of whatever layer
preceded it during layer construction -- e.g. a custom highlight -- and
leaked that color onto text the custom highlight did not cover, whenever
the text was selected (such as via Ctrl+A).

Mark the ignored selection's foreground colors (current, fill and
emphasis) as coming from the previous layer so that ComputeParts()
resolves them per part against the layer that is actually below the
selection. The selection background is left transparent, matching the
existing suppression of selection backgrounds on non-selectable text, so
only the previously buggy foreground changes.

Bug: 516004705
Change-Id: Ie0e00e7ad7174e6907fae020a57c375376d9b77c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7923406
Reviewed-by: Stephen Chenney schenney@chromium.org
Auto-Submit: Fernando Fiori ffiori@microsoft.com
Reviewed-by: Fernando Fiori ffiori@microsoft.com
Commit-Queue: Fernando Fiori ffiori@microsoft.com
Cr-Commit-Position: refs/heads/main@{#1646067}

merge_pr_60578

deps: Upgrade to WebRender 0.69

Signed-off-by: Martin Robinson mrobinson@igalia.com

merge_pr_60576

layout: Add a crash test for #45008

This wasn't done when the issue was fixed in taffy.

Signed-off-by: Martin Robinson mrobinson@igalia.com
Co-authored-by: Oriol Brufau obrufau@igalia.com

merge_pr_60575

Normalize algorithm before copying input buffers

SubtleCrypto's encrypt(), decrypt(), sign(), verify(), digest() and
importKey() copied the bytes of their BufferSource arguments
(data/signature/keyData) into an internal buffer before normalizing
the algorithm. The Web Crypto specification mandates the opposite order:
normalize the algorithm first, then get a copy of the bytes.

This ordering is observable because normalizing an algorithm reads
members off the author-supplied algorithm dictionary, which can run a
JavaScript getter (e.g. get name()). That getter can mutate, restore,
detach or transfer the input buffer. Snapshotting the bytes too early
captured the pre-getter state, diverging from the spec and from
Firefox/Safari, and failing the WebCryptoAPI "...altered/transferred ...
during call" subtests in Chrome and Edge.

Reorder these methods to normalize-then-copy, mirroring the already
spec-compliant unwrapKey(). No other behavior changes: the copies are
still consumed by the same Platform crypto calls; only the moment the
bytes are snapshotted moves to after normalization.

Rebaseline the affected WebCryptoAPI WPT expectations. Additionally,
migrate the Blink-internal coverage to the spec-based WPT tests. The
internal tests asserted the old copy-before-normalize behavior; the
encrypt/verify cases are already covered by encrypt_decrypt/aes.js and
sign_verify/{ecdsa,eddsa}.js, and a new "Key data altered during call"
case is added to import_export/symmetric_importKey.js for the importKey
case.

Big: 522216177
Change-Id: I5a9ed9bc3dadd0cec83392d304226ec4f1fb03ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7916509
Commit-Queue: Javier Fernandez jfernandez@igalia.com
Reviewed-by: Mike West mkwst@chromium.org
Cr-Commit-Position: refs/heads/main@{#1645819}