merge_pr_48614

Fenced frame: Prevent file://localhost/* files from loading.

Fenced frames are meant to be able to load the following URLs with a
default constructor:

• about:blank URLs
• https://* URLs
• http://localhost URLs

The net::IsLocalhost() check that is currently being used for the last
case is only checking that the URL starts with "localhost", not that
the scheme is http/https. This allows the fenced frame to load URLs like file://localhost/path/to/file. This CL tightens the check to also
check that the scheme is HTTP. The "https://localhost/" case will
still be covered by the "https://" check.

Bug: 368628042
Change-Id: If53573f5701c28e5674ecb524191cddc12b950fe
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5902121
Reviewed-by: Shivani Sharma [email protected]
Commit-Queue: Liam Brady [email protected]
Cr-Commit-Position: refs/heads/main@{#1368957}

merge_pr_48612

[Selection API] Use composed DOM tree for getComposedRanges

We update the implementation of getComposedRanges to use the cached
selection in DOM Tree to find start/end endpoints. These endpoints
are composed because they are not restricted to be within one TreeScope,
unlike the range associated with the selection.

We also remove the old logic of adding composed_range_ in Range to cache
flat tree endpoints.

Change-Id: Iee7807f74348d09a4b1e7c3dbb4ebe514bde874c
Bug: 356905057
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5921292
Commit-Queue: Di Zhang [email protected]
Reviewed-by: Mason Freed [email protected]
Reviewed-by: Siye Liu [email protected]
Cr-Commit-Position: refs/heads/main@{#1368897}

merge_pr_48611

[reading-flow] display: contents participate in the flow

From CSSWG resolution [1]:

display:contents focusable element occurs immediately before its first child in visual order

[1] w3c/csswg-drafts#9230 (comment)

Currently, reading flow items in display: contents are ignored and
display: contents elements are visited last in the focus order.
That means we lose that order information.

We update the algorithm so when we loop reading items and find one that
is not in the focus scope, we traverse its parent to find an ancestor
that is. This element can then be added in the reading flow instead.

We update A11Y to behave the same way as focus navigation. Since the
A11Y tree uses LayoutTreeBuilder, we update the algorithm to loop
through each reading flow item's ancestor until its parent is the
LayoutTreeBuilderTraversal::Parent. This element can then be added in
the reading flow instead.

Change-Id: I1c3c3ab3a6548611af9a2cfddecc9d889b0ecb14
Bug: 371024057
Bug: 40932006
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5924454
Commit-Queue: Di Zhang [email protected]
Reviewed-by: Mason Freed [email protected]
Cr-Commit-Position: refs/heads/main@{#1368523}

merge_pr_48605

Fix always failing assertion due to using incorrect element name

The object element in the document has "exposed_object_with_name" as the
name, but the assertion was checking for name "exposed_object". This
meant that this assertion would never ever be successful.

merge_pr_48601

Implement togggle events for Dialog show/showModal/close

whatwg/html#10091

This also slightly refactors FireToggleEvent to allow to to
accomodate both popovers and now also dialogs

Differential Revision: https://phabricator.services.mozilla.com/D225449

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1876762
gecko-commit: a8b51403fa4f1dd6d936826f2a5b14c670426f3d
gecko-reviewers: smaug

merge_pr_48600

Destroy popover close watchers on hidepopover

Differential Revision: https://phabricator.services.mozilla.com/D223880

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1921363
gecko-commit: 49ce9d42094458fa66352c121d2f59eca257cda2
gecko-reviewers: smaug

merge_pr_48595

[wdspec] Add wdspec tests for image cache network requests

Depends on D224505

Cross browser tests are added for basic image cache scenarios.
An additional mozilla specific wdspec test is added to cover scenarios where the behavior is implementation defined.

Differential Revision: https://phabricator.services.mozilla.com/D224506

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1886518
gecko-commit: f22ae80101e8c95fad6918a2d8d941d7413242b1
gecko-reviewers: webdriver-reviewers, Sasha

merge_pr_48594

part 6) Add javascript-url navigation via form-submission tests for Trusted Types.

Differential Revision: https://phabricator.services.mozilla.com/D223596

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1921008
gecko-commit: 999a70cf9b2dcc6fc81fc8fbe9f7a811f6056db5
gecko-reviewers: tschuster

merge_pr_48593

webnn: Support gather nd in tflite converter

Implement WebNN gather_nd operation with TFLite GATHER_ND builtin
operator.

Refine clamp operation with the min and max for unsupported range.

Bug: 40206287
Change-Id: I2a332e93dc712676a06636b1cb8be4fa4fbc8eed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5925040
Reviewed-by: ningxin hu [email protected]
Reviewed-by: Austin Sullivan [email protected]
Commit-Queue: Junwei Fu [email protected]
Cr-Commit-Position: refs/heads/main@{#1368689}

merge_pr_48588

WebNN: Implement logicalAnd, logicalOr, and logicalXor in DirectML

This CL also updates incorrect values in test cases.

Bug: 368222740
Change-Id: I09164f48bff3b1796f2d1b62fb7ea6ca275637c6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5916907
Reviewed-by: ningxin hu [email protected]
Commit-Queue: Patrick To [email protected]
Cr-Commit-Position: refs/heads/main@{#1368628}