Skip to content

Rebase - #72

Merged
karlseguin merged 2654 commits into
forkfrom
rebase
Jun 22, 2026
Merged

Rebase#72
karlseguin merged 2654 commits into
forkfrom
rebase

Conversation

@karlseguin

Copy link
Copy Markdown
Contributor

No description provided.

nt1m and others added 30 commits May 29, 2026 22:49
…ests/css/css-view-transitions/massive-element-below-viewport-offscreen-old.html (#60291)

https://bugs.webkit.org/show_bug.cgi?id=305737

Co-authored-by: Cameron McCormack <heycam@apple.com>
This is an incremental step (1/2) towards full negative playbackRate
support in AudioBufferSourceNode.

Pre-calculating grain_duration_ assuming forward playback fails when
playbackRate dynamically flips to negative, rendering the fixed
boundary invalid. This CL instead sets the duration to infinity
when unspecified, allowing the node to stop organically at the
buffer boundaries regardless of the playback direction. It also
enables negative clamping in ComputePlaybackRate.

  the-audio-api/the-audiobuffersourcenode-interface/
  audiobuffersource-playbackrate-dynamic-direction.html

Bug: 40719652
Test: third_party/blink/web_tests/external/wpt/webaudio/
Change-Id: I87c7dd404fa168d908374c7c13bc9a668a1281f7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7876495
Reviewed-by: Michael Wilson <mjwilson@chromium.org>
Commit-Queue: Mahesh Kannan <kmaheshb@google.com>
Cr-Commit-Position: refs/heads/main@{#1638840}
Add column and row versions of all the subgrid gap tests that exist in
grid. This requires handling subgrid extra margins (due to margin,
border and/or padding at subgrid edges, or due to subgrid gaps) in
subgridded item contributions during track sizing. This will be
implemented in a follow up change.

A chunk of tests are marked as failing as a result. Note that some of
the refs may not be 100% correct yet, but I will make sure to double
check all of the expectations as part of implementing the actual fix
(which will result in differing behavior from grid).

Bug: 343257585
Change-Id: I34eec0170a99978d8df78f1b66fde15b08b120b7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7861306
Reviewed-by: Kurt Catti-Schmidt <kschmi@microsoft.com>
Reviewed-by: Kevin Babbitt <kbabbitt@microsoft.com>
Commit-Queue: Alison Maher <almaher@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1638874}
Differential Revision: https://phabricator.services.mozilla.com/D296935

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=2005007
gecko-commit: 567230e612806099ad17c6fa9bb704bc0b7e6034
gecko-commit-git: 5f837dd775a3152d21f541d9f58b130987243368
gecko-reviewers: firefox-style-system-reviewers, emilio, dshin
Differential Revision: https://phabricator.services.mozilla.com/D302984

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=2043078
gecko-commit: 517f32cbaabce6a555e9bc6d96d8c996b48b346f
gecko-commit-git: b0ad9c3d5cb27c0b0fa477ff6c4b3cd65902372c
gecko-reviewers: sajidanwar
Thanks to the recent changes by Sajid and the changes in bug 2043078,
which make color components properly return numbers for type-checking
purposes, this is now trivial.

We could add an "allowed but only numbers" or so, but type checking will
basically deal with it (in fact we should probably allow parsing
~everything all the time and rely on unit() doing the type-checking).

Differential Revision: https://phabricator.services.mozilla.com/D303375

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1951206
gecko-commit: 84b5d08285154e0c7b1feb1604dc5302ca2ae024
gecko-commit-git: 8a7d2d52762439c5a429d6a73e0c272046d309e2
gecko-reviewers: sajidanwar
Canvas should be tainted when a pattern contains cross origin
image content. Verify that this is the case. Also add a test
for a canvas filter that uses an SVG feImage, and a
drawElementImage case for a pattern that contains a feImage.

Bug: 514609778
Change-Id: Iea19f30665f4cd114e678259cb18063fd3ae60bb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7880261
Reviewed-by: Philip Rogers <pdr@chromium.org>
Auto-Submit: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Stephen Chenney <schenney@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639075}
This exposes some interop issues in <select>.

Blink and WebKit hit the equivalent of
https://issues.chromium.org/issues/40571175 so they fail the "no slot"
tests, even though they indeed do not have a slot.
Add testing for additional display keyword combinations that are supported by
the current CSS specification but reify as unsupported valued in Typed OM.

Differential Revision: https://phabricator.services.mozilla.com/D301787

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=2041086
gecko-commit: 236706981b3a5c6ecaa47e5c34392d547ab049b7
gecko-reviewers: emilio, firefox-style-system-reviewers, Oriol
…tly for both fragments and feImageElements

See https://www.w3.org/TR/media-frags/#valid-uri-spatial

Differential Revision: https://phabricator.services.mozilla.com/D303672

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=2041697
gecko-commit: 8a14073c7a1bebaa3f738e3913bf08cea2d7d1b7
gecko-reviewers: firefox-svg-reviewers, jwatt
…ctly

Also fix a mess in WebVTT due to e7c5d8b which didn't update the .dat file and instead percent-encoded manually.

First step towards #27868.
Signed-off-by: Richard Tjokroutomo <richard.tjokro2@gmail.com>
Signed-off-by: Richard Tjokroutomo <richard.tjokro2@gmail.com>
This test demonstrates an interop bug with dialog.requestClose() and closedby.
This patch rewrites the flaky `test-analyser-output.html` WPT test
to be 100% deterministic by replacing the legacy, real-time
ScriptProcessorNode-based verification with OfflineAudioContext.

- Replaced legacy `AudioContext` and `ScriptProcessorNode` with
  `OfflineAudioContext` running at both 44.1kHz and 48kHz.
- Replaced `helpers.js` usage with direct WPT `promise_test` and
  `assert_approx_equals` element-by-element comparison.
- Removed the flaky test expectation from TestExpectations.

TAG=agy
CONV=1685e534-e673-43a5-8c7a-8d8084e0ee42

Bug: 40170551
Test: external/wpt/webaudio/the-audio-api/the-analysernode-interface/test-analyser-output.html
Change-Id: I90300a4443b4328c8330b80917cff4a4da76aec8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7886243
Reviewed-by: Mahesh Kannan <kmaheshb@google.com>
Commit-Queue: Hongchan Choi <hongchan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639405}
Parsing of <grid-line> differs depending on if the span ident is present
or not.

Previously we'd parse an integer up front, but at this stage we don't
know the correct range.

Instead refactor the code (using savepoints) to match the specification
more closely.

Bug: 515750295
Change-Id: I036a88f6971c609f3131303f2cd875da51c3644c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7879775
Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639406}
In `GiveItemsFinalPositionAndSizeForFragmentation`, when a row flex item
breaks across a fragmentainer, we subtract the already-advanced offset
from `line_cross_size` to get the remaining cross-size for the current
fragment. When the row is bounded by the parent (e.g. max-height: 0) but
the row's stitched offset is bumped past its content size to align with
a fragmentainer break, this subtraction makes the resulting cross size
negative.

The negative value is then passed as the block available_size to
`BuildSpaceForLayout`, leading us to hit a DCHECK.

Clamp the result to zero to ensure the cross size never goes negative.

Bug: 515776659
Change-Id: Ibea3ffc5ebf2744d55bb3c10bf8a94cfa9c71a28
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7884136
Commit-Queue: Alison Maher <almaher@microsoft.com>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639431}
The HTML parse will process the is= attribute and put the element into
custom element state. When later on the is= attribute is removed by the
Sanitizer, the element is still upgraded because it's been marked as
a custom element.

This change prevents the is=-related custom element to be processed,
when the streaming Sanitizer will remove it.

Bug: 492963096, 513844247, 517171036
Change-Id: I7b10f55b6dd9d568336c731ee8a8c2a52254371f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7883146
Reviewed-by: Noam Rosenthal <nrosenthal@google.com>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639435}
Ahmad-S792 and others added 28 commits June 10, 2026 08:51
For subgrids whose final position isn't known at sizing time (e.g.
inside a grid-lanes ancestor that places after sizing), the accumulated
edge extra margins propagated to a nested subgrid must account for the
largest contribution the subgrid could pick up at any candidate
position. Previously we only forwarded the parent's accumulated edge
margins, which under-reserved space when a parent gap could land
immediately outside the subgrid's boundary.

Update `CreateSubgridTrackCollection` so that when the subgrid is
auto-placed in its parent, the start/end accumulated extra margins are
computed as follows:

 - If the subgrid spans every track of the parent, no parent gap can
 ever be adjacent to the subgrid's boundary; forward the parent's
 accumulated edge margins as-is.
 - If the parent has exactly one more track than the subgrid, the
 subgrid can only ever have a parent gap on one side. Reserve the
 half-gutter contribution on whichever side currently carries the
 smaller accumulated edge margin so we don't double-count.
 - Otherwise, take max(accumulated edge margin, parent gutter delta /
 2) on both sides, since any combination of start/end positions is
 possible.

Add a bit more test coverage, although a follow up change will be needed
to get the true largest final accumulation numbers, which will be
handled in a follow up change and will likely lead to some changes to
existing test expectations in some cases.

Bug: 343257585
Change-Id: I0742fef87af1008ba43a07f557f31281c24344c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7897846
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Alison Maher <almaher@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1644722}
This WPT was failing on Windows because of forced rounding from DWrite.
Though certainly not ideal, that is not the space this test is
attempting to cover, so this change updates the test to ensure the
initial underline position expected from the font is a whole number, so
that the test is only testing the text-underline-offset impact, and not
the platform-specific font-reading code.

For more details:
The expected values for close_underline (UNDO=200) and far_underline
(UNDO=1000) are 2.15625 and 9.375 respectively (if my math is correct),
which when rounded to final pixels become 2 and 9.

The starting underline position for the font (default UNDO=500) comes
to 4.6875px, but DWrite returns this underlinePosition as an INT16,
which in this case is rounded to 5.

This means that on Windows, after applying the text-underline-offsets
of -2.5px and 4.6px, the positions became 2.5px and 9.6px, which
when rounded to final pixels became 3 and 10 (instead of the expected
2 and 9).

Other platforms do not encounter this problem because they either
return the underline position from the font in a float, or in more
granular units.

This change overrides the default UNDO=500 with UNDO=640, which
comes to exactly 6px.

Fix: 1140324
Change-Id: I5845eb8d258f0879427b9f203e063937afb9a035
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7913911
Commit-Queue: Hoch Hochkeppel <mhochk@microsoft.com>
Reviewed-by: Kurt Catti-Schmidt <kschmi@microsoft.com>
Reviewed-by: Dominik Röttsches <drott@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644739}
ServiceWorkerHost is responsible for brokering WebSocket and
WebTransport connections within the worker. For proper integration with
Connection Allowlist, the host now provides the ServiceWorkerVersion's
network_restrictions_id when creating those connections.

Note that once this CL is merged, WebSocket and WebTransport should
have full coverage across documents, dedicated, shared, and service
workers.

Bug: 492462310
Fixed: 492462310
Change-Id: If9700eef886901e5ad20ea02981637f0c5c1c016
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7902842
Reviewed-by: Shivani Sharma <shivanisha@chromium.org>
Commit-Queue: Andrew Verge <averge@chromium.org>
Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644755}
This change allows an accelerated video frame to be painted into a
display list which is passed to another thread, and then rasterized from
the other thread.

The downside is that the PaintCanvasVideoRenderer cache is effectively
disabled, so if a single video frame is painted multiple times it will
be forced to use multiple GPU shared images. This seems like an unlikely
circumstance and fixing it would be complicated, so this CL punts.

Bug: 435230899
Change-Id: Ic51cac7aba434412293e0b72437dc0bf4a5edd31
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7900160
Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Commit-Queue: Stefan Zager <szager@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Commit-Queue: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644771}
This CL modifies blink::AnimationTrigger's play-forwards and
play-backwards behaviors so that they do not auto-rewind if the
animation is already finished in the target direction.

CSSWG resolution:
w3c/csswg-drafts#13643 (comment)

We are getting this PSA ready to accompany this change:
https://chromestatus.com/feature/5071640598806528

Bug: 390314945
Change-Id: Id9bcb06c8e0833141c5a61feb8dbec5a0397bfd6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7902733
Commit-Queue: David A <awogbemila@chromium.org>
Reviewed-by: Kevin Ellis <kevers@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644772}
Bug: 521861823
Change-Id: Idd76c57c027c2f7e2585c1525ab14932deea2c9e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7919507
Commit-Queue: Kevin Ellis <kevers@chromium.org>
Reviewed-by: David A <awogbemila@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644815}
This is a reland of commit 6c3c7a1a61db01bcf82d2658a30b3632619c3b92

This reland updates the WPT expected results on Mac, as the
mac15-x64-rel-tests bot caught some failures in the newly added tests.

Original change's description:
> WebNN: Fix Pool2d ceil_mode to check both spatial dimensions
>
> The previous code only compared the height dimension's floor output
> size against the WebNN output height to determine ceil_mode. When
> only the width dimension required ceiling rounding (e.g., input
> [1,1,5,5], window [3,2], strides [2,2], roundingType:"ceil"), the
> height check passed with floor, so ceil_mode=0 was emitted.
>
> This caused a shape mismatch between Chromium's WebNN operand
> descriptors (e.g., [1,1,2,3]) and ORT's actual execution shape
> (e.g., [1,1,2,2]). The mismatch invalidated gather/scatter index
> sanitization: indices valid for the WebNN shape could be out of
> bounds for ORT's smaller tensor, enabling OOB read/write on
> execution providers that do not validate indices at dispatch time.
>
> Fix: compute CalculateConv2dOutputSize for both height and width,
> and set ceil_mode=1 when either dimension needs ceiling rounding.
> ONNX Pool's ceil_mode is a single global attribute, so setting it
> when any dimension requires ceiling is both correct and safe (ceiling
> of an integer is itself).
>
> This CL also added some conformance tests for this scenario.
>
> Bug: 519241091
> Change-Id: I9dc92f5f81687286eaf6aca8468032fe152360d7
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7901552
> Reviewed-by: Hu, Ningxin <ningxin.hu@intel.com>
> Reviewed-by: Reilly Grant <reillyg@chromium.org>
> Commit-Queue: Xu, Mingming1 <mingming1.xu@intel.com>
> Cr-Commit-Position: refs/heads/main@{#1643553}

Bug: 519241091,521419439
Change-Id: I4ec18fc7d0fb91d64a292178e2630c437d0bb76d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7909424
Commit-Queue: Hu, Ningxin <ningxin.hu@intel.com>
Reviewed-by: Reilly Grant <reillyg@chromium.org>
Reviewed-by: Hu, Ningxin <ningxin.hu@intel.com>
Cr-Commit-Position: refs/heads/main@{#1644829}
If the <reference-box> for overflow-clip-margin was content-box we
didn't invalidate our clip if the padding changed. Mark the LayoutBox as
needing a paint-property update for this case.

Change-Id: I009e2ca39161e2d6aba8cb2390b78444376aa559
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7914267
Reviewed-by: David Baron <dbaron@chromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644874}
This UA style rule was preventing overflow:hidden from doing anything
when set from author styles.

Fixed: 521434907
Change-Id: I2d41b122b76a82c02efda61bfdb9fdc524f91951
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7919309
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644873}
This gives us better coverage.

Differential Revision: https://phabricator.services.mozilla.com/D304961

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=2045230
gecko-commit: 4bca04155b988c0d98e01f10429567e89bb7db96
gecko-commit-git: 0c8c2d7a8ddb354e0c37f7024e77691d54ede11a
gecko-reviewers: gfx-reviewers, lsalzman
This reduces the effect and frequency of #51981, where we frequently
saw timeouts from the H2 server, because we no longer repeatedly
create new threads and new queues when we receive further events after
StreamEnded, or an event with a reference to a StreamEnded.

See the state diagram in
https://httpwg.org/specs/rfc9113.html#StreamStates, noting that
receiving StreamEnded only closes the connection when the stream is in
the half-closed (local) state.

This also means we treat a stream as closed when we send/receive a
RST_STREAM frame.
For simpler usage with Lightpanda WPT test runner, we override the
default testharnessreport.
Some tests define their own format (and maybe name) function in the global
namespace, which causes issues. If testharnessport.js is last, then those tests
break. If it comes before, then the report gets invalid name/format.
Some tests define their own update function which causes a conflict, e.g.
css/geometry/support/dommatrix-test-util.js.
@karlseguin

Copy link
Copy Markdown
Contributor Author

@krichprollsch I suggest running ./wpt manifest after pulling this locally. Maybe like me, you'll forget that you once did this. The file is added in .gitignore, and the wpt.yaml action executes it on each run.

@karlseguin
karlseguin merged commit d715e1c into fork Jun 22, 2026
13 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.