Publish DEPS for 76.0.3809.132

• DEPS[diff]

Incrementing VERSION to 76.0.3809.132

[email protected]

Change-Id: I4be41e2a449287a1d23aacfb5a0b7c117b0aed08
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1768827
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1035}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Fix missing user gesture on new window navigations for <a> and <svg>-<a>

(cherry picked from commit 34734c86d5236ccf24a14419f5f17d8022d891dd)

(cherry picked from commit 608d748831182d0cc70c792193c463f338785ec3)

Bug: 993149
Change-Id: I0d2cb6238d3adf421f074c74124191898f901af7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1758923
Commit-Queue: Michael Thiessen <[email protected]>
Reviewed-by: Yaron Friedman <[email protected]>
Reviewed-by: Nate Chapin <[email protected]>
Cr-Original-Original-Commit-Position: refs/heads/master@{#688180}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1769020
Reviewed-by: Michael Thiessen <[email protected]>
Cr-Original-Commit-Position: refs/branch-heads/3865@{#553}
Cr-Original-Branched-From: 0cdcc6158160790658d1f033d3db873603250124-refs/heads/master@{#681094}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1769302
Cr-Commit-Position: refs/branch-heads/3809@{#1034}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/UrlOverridingTest.java[diff]
• third_party/blink/renderer/core/html/html_anchor_element.cc[diff]
• third_party/blink/renderer/core/svg/svg_a_element.cc[diff]

Add regression tests for App links in new windows

(cherry picked from commit ac885a013d8ffb49ba519685d8ca2c145e016955)

(cherry picked from commit 8ef915541d7d5cdb48a737271b3c229f0481253a)

Bug: 993149
Change-Id: Iaf4645c45aad15d0b70b3091415659dd6e37514c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1756845
Commit-Queue: Michael Thiessen <[email protected]>
Commit-Queue: Yaron Friedman <[email protected]>
Auto-Submit: Michael Thiessen <[email protected]>
Reviewed-by: Yaron Friedman <[email protected]>
Cr-Original-Original-Commit-Position: refs/heads/master@{#687475}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1768939
Reviewed-by: Michael Thiessen <[email protected]>
Cr-Original-Commit-Position: refs/branch-heads/3865@{#552}
Cr-Original-Branched-From: 0cdcc6158160790658d1f033d3db873603250124-refs/heads/master@{#681094}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1769166
Cr-Commit-Position: refs/branch-heads/3809@{#1033}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/UrlOverridingTest.java[diff]
• chrome/test/data/android/url_overriding/open_window_from_link_user_gesture.html[Added - diff]
• chrome/test/data/android/url_overriding/open_window_from_svg_user_gesture.html[Added - diff]

HttpCache::Transaction: Read buffer length to be correctly set

It is possible in case of partial requests for transactions to go from
reading the response body back to reading headers for the next range
and then back to reading the response body.
In some code paths the |io_buf_len_| is set to the headers length and
then used as the length of the read buffer provided by the calling site
which is incorrect. More details in
https://bugs.chromium.org/p/chromium/issues/detail?id=986211#c66

This CL fixes the issue by having a separate member field read_buf_len_
which is only set to length of the read buffer provided by the calling
site in Read().

Manually verified the asan issue reproduced while loading the site
http://mahokubota.com doesn't come after this patch.

(cherry picked from commit 67e27fe0335de80a8256405f67844ad97ca3bac2)

Bug: 986211
Change-Id: I223656e7e1eb8906d1e0415fac184faea1042b6f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1747389
Reviewed-by: Josh Karlin <[email protected]>
Reviewed-by: Shivani Sharma <[email protected]>
Commit-Queue: Shivani Sharma <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#686118}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1768822
Cr-Commit-Position: refs/branch-heads/3809@{#1032}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• net/http/http_cache_transaction.cc[diff]
• net/http/http_cache_transaction.h[diff]

Incrementing VERSION to 76.0.3809.131

[email protected]

Change-Id: I3b3406a67fb498169dba37d4c3228c7227af1379
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1767536
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1031}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

[M76]Start timeout after allowlist check is done

Previously, Timeout task never gets scheduled if OnGetDomFeatures() doesn't get called.
Move Timeout task schedule into OnWhitelistCheckDone() to make sure it always gets called.

(cherry picked from commit 21d23ea529fe750fc61bd0051bec321449e2bace)

Bug: 977719
Change-Id: I9cf5cd390f68e6f9275cf79cb8f19a9bd046001a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1736517
Reviewed-by: Daniel Rubery <[email protected]>
Reviewed-by: Nathan Parker <[email protected]>
Reviewed-by: Varun Khaneja <[email protected]>
Commit-Queue: Xinghui Lu <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#688221}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1766841
Cr-Commit-Position: refs/branch-heads/3809@{#1030}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• components/safe_browsing/password_protection/password_protection_request.cc[diff]
• components/safe_browsing/password_protection/password_protection_request.h[diff]
• components/safe_browsing/password_protection/password_protection_service_unittest.cc[diff]

Incrementing VERSION to 76.0.3809.130

[email protected]

Change-Id: I0137f11a43067aa22e8d374f2cf06da303796bff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1762918
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1029}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Validate lowest float cache when necessary.

FloatingObjects has a method LowestFloatLogicalBottom(), which
calculates and caches the lowest FloatingObject if this information
isn't already calculated and cached.

Then there's the method LowestFloatingObject(), which would return that
FloatingObject, if it was cached, and nullptr otherwise.

So: One method that calculates it if needed, and one that relies on the
cache and otherwise returns something bogus.

The layout code is quite well peppered with calls to
LowestFloatLogicalBottom(), so it requires significant amounts of bad
luck to trigger a cache miss, and then another heap of bad luck to
actually cause a crash from that.

But it was NOT impossible.

The fix is to rebuild the cache if needed in LowestFloatingObject().
Letting it return nullptr if the cache was invalid caused us to fail to
propagate an overhanging float upon relayout, breaking some sort of link
to subsequent blocks, so that when the float later on was removed, we'd
fail to remove it from all the block flows that referred to it.

The test included in this CL is as minimal as I could get it, but still
not super-simple. Here's what went wrong:

There is a float somewhat nested inside a container. This container has
some siblings, one being an infinitely tall beast with a large negative
(also infinite) block-start margin. Another sibling is empty, so that we
can collapse through it. Then there's a last, pretty decent, sibling
container, except that it contains another float. Because we're dealing
with infinite LayoutUnit values, the engine cannot quite agree with
itself whether the first float intrudes into the last sibling or not,
and this is important when it comes to determining whether the float
intrudes into the last container or not. When we lay out initially, we
find it to intrude, and add it to the list.

We then change the first float ever so slightly, to trigger relayout.
This will break the magical chain of FloatingObject references to the
first float (because the cache was invalid, and therefore incorrectly
report that there's no float there). The last container (the one
previously referred to as "decent") has a reference to the float that
just got relaid out, because at some point it was thought to intrude. If
we had laid out this container again now, we'd clear the FloatingObject
list and the float would be gone from the list. But we don't lay it out
again, because the relevant part of the engine decides that the float
doesn't intrude, contrary to what the part of the engine that caused it
to be added in the first place concluded.

Then, we'll remove the float (display:none), and we'll fail to remove it
from all block flows that referenced it. The last container still has a
reference to the hungover (or actually now dead) float.

(cherry picked from commit 9d58aaeae429cc26b83044de69d07f01620af085)

Bug: 989305
Change-Id: I498344fc5b6426cf8225441d2dab195659e31112
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1738556
Commit-Queue: Emil A Eklund <[email protected]>
Reviewed-by: Emil A Eklund <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#684357}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1762246
Reviewed-by: Morten Stenshorne <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1028}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• third_party/blink/renderer/core/layout/floating_objects.cc[diff]
• third_party/blink/renderer/core/layout/floating_objects.h[diff]
• third_party/blink/web_tests/fast/block/float/remove-float-overhanging-infinite-negative-margins-and-tall-blocks-crash.html[Added - diff]

Incrementing VERSION to 76.0.3809.129

[email protected]

Change-Id: Iea37a7831680c998717b3e36f317c177b563d65f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1762452
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1027}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.128

[email protected]

Change-Id: I5f1f39b341f3f8fe59358078ff5411e730d120ed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1759053
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1026}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.127

[email protected]

Change-Id: I03b749f06c27bb6235bc17c52ad7dd7ac80d3a6b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1760283
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1025}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.126

[email protected]

Change-Id: I0d13fe3216c6cfd6e8d75c709537aa82a966a55f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1760270
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1024}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.125

[email protected]

Change-Id: I453b7aa56608125db9a151364311af303d24349b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1758973
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1023}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.124

[email protected]

Change-Id: I4d9fdb6eb5be10b795ba10299a8c7665b4eeb51c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1757132
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1022}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

[ChromeDriver] Fix array serialization when Array.toJSON is present

When web page adds toJSON function to Array prototype, ChromeDriver
incorrectly calls this function while doing JSON serialization of
array objects. This is incorrect, as the W3C WebDriver spec
(https://w3c.github.io/webdriver/#dfn-internal-json-clone-algorithm)
explicitly specifies that implementation should check for collection
before looking for the toJSON function.

(cherry picked from commit 467762ad7491e22e5462a414dd9e4605f4e78b16)

Bug: chromium:994295, chromedriver:3084
Change-Id: Ib2ed0c79833a6ca557d33595687efd70ade7d8c8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1749617
Commit-Queue: John Chen <[email protected]>
Reviewed-by: Caleb Rouleau <[email protected]>
Reviewed-by: Rohan Pavone <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#687307}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1758400
Reviewed-by: John Chen <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1021}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/test/chromedriver/js/call_function.js[diff]
• chrome/test/chromedriver/js/call_function_test.html[diff]

Incrementing VERSION to 76.0.3809.123

[email protected]

Change-Id: I68c74a22e3217974feeb58c70f048b9e2b45c829
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1757346
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1020}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.122

[email protected]

Change-Id: Icf90af29deb311624e20c73d28989edf1e6df983
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1756167
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1019}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

[ios] Switches a callsite back to PostTaskWithTraits().

This code landed on trunk as a call to PostTask(), but that method
signature did not exist in M76 and M77.  Switching back to the legacy
API will let us cherrypick this CL to the branch and fix the build.
Afterwards, this CL can be reverted on trunk.

BUG=994313

Change-Id: Id691ea0f171f2ac3095a5a446a5dc2fed1364d01
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1756158
Reviewed-by: Kariah Davis <[email protected]>
Reviewed-by: Peter Lee <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1018}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• ios/chrome/browser/metrics/ios_chrome_metrics_service_client.mm[diff]

Incrementing VERSION to 76.0.3809.121

[email protected]

Change-Id: I52de97a0f13447b477c34ac63e2c52eac0d6f31a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1756245
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1017}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Revert "Enable Persistent Histograms on iOS"

This reverts commit d9fd02e5336801e5bc102ca1d0a36ef2bc7c0fd5.

CleanupBrowserMetricsDataFiles() is added to remove all accumulated
BrowserMetrics/ files.

(cherry picked from commit e9bd0a25cc75299c476106e7c533a2092e936b9b)

Bug: 992946
Change-Id: I29c96bf49101c1954185208ca80b6e432e91e8c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1755004
Reviewed-by: Rohit Rao <[email protected]>
Commit-Queue: Peter Lee <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#687104}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1755417
Reviewed-by: Peter Lee <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1016}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• ios/chrome/browser/ios_chrome_field_trials.cc[diff]
• ios/chrome/browser/ios_chrome_field_trials.h[diff]
• ios/chrome/browser/metrics/ios_chrome_metrics_service_client.mm[diff]

Incrementing VERSION to 76.0.3809.120

[email protected]

Change-Id: I0b3e581ead92d6eed73895856f79f97711930ccc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1754240
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1015}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.119

[email protected]

Change-Id: Ib7629797f9b1612af87f6ce8603c8bc72e596174
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1753202
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1014}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Always unregister placeholder image in canvas

It's possible that it has been disposed but its ID still exists. This
can lead to UAP bugs.

(cherry picked from commit 2df8ea19c5bba87209e452cea8473c05ea7d5250)

Bug: 978793
Change-Id: Idb4639cb78110878a28ab3c50807174343a66033
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1744642
Reviewed-by: Fernando Serboncini <[email protected]>
Reviewed-by: Aaron Krajeski <[email protected]>
Commit-Queue: Fernando Serboncini <[email protected]>
Commit-Queue: Aaron Krajeski <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#685345}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1752076
Cr-Commit-Position: refs/branch-heads/3809@{#1013}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• third_party/blink/renderer/core/html/canvas/html_canvas_element.cc[diff]

Incrementing VERSION to 76.0.3809.118

[email protected]

Change-Id: Ib379648f55c6bdc78dd1f2b6743290c4533f1f22
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1750048
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1012}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Don't load demo apps from cache in Offline Demo Mode.

DemoExtensionsExternalLoader loads apps from Offline Demo Mode
Resources, then promptly overwrites them with apps it has cached.

This means that if the device is offline and hasn't cached the demo
apps, the apps will become uninstalled shortly after being installed.

As a quick fix, prevent loading from the cache in Offline Demo Mode.
This is intended as a highly mergeable, low-risk fix that we can merge
into Stable. Afterwards, a proper fix would allow us to still use the
cache.

Bug: 991453
Change-Id: I51679f3667191f17c1dc3af3711cc36b6a9a34e6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1743252
Reviewed-by: Toni Baržić <[email protected]>
Commit-Queue: Michael Giuffrida <[email protected]>
Cr-Commit-Position: refs/heads/master@{#685073}
(cherry picked from commit e6c2733aba60ebbed080d1d980ff18cc55631849)

[email protected]

Change-Id: I51679f3667191f17c1dc3af3711cc36b6a9a34e6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1747382
Reviewed-by: Michael Giuffrida <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1011}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/browser/chromeos/login/demo_mode/demo_extensions_external_loader.cc[diff]
• chrome/browser/chromeos/login/demo_mode/demo_session.cc[diff]

Incrementing VERSION to 76.0.3809.117

[email protected]

Change-Id: I05d848854639345cdc3b04bd0bc54a1b037e3587
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1745570
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1010}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Do not apply CORB to application/x-www-form-urlencoded.

[email protected]

(cherry picked from commit 782f209df2a0e99d8fa7c89c2c09568a3a47aa7d)

Bug: 990853, 802836
Change-Id: I7aeba7f34ae3257a8c0d7900a4f266f872273304
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1739646
Commit-Queue: Charlie Reis <[email protected]>
Auto-Submit: Łukasz Anforowicz <[email protected]>
Reviewed-by: Charlie Reis <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#684464}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1747739
Reviewed-by: Łukasz Anforowicz <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1009}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• services/network/cross_origin_read_blocking.cc[diff]
• services/network/cross_origin_read_blocking_unittest.cc[diff]
• third_party/blink/web_tests/external/wpt/fetch/corb/script-resource-with-nonsniffable-types.tentative.sub.html[diff]

[ChromeDriver] Fix callFunction with customized Object.prototype

When a web page puts user-defined functions in Object.prototype,
the JavaScript callFunction script can fail to deserialize many
types of object. This is now fixed.

(cherry picked from commit c245d4f14dbc91f7dab90f6ac334678bc34dc36a)

Bug: chromium:992815, chromedriver:3074
Change-Id: I85c2a7c5f8fe1aabacd084f772f7a9a0c4de732f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1745720
Reviewed-by: Caleb Rouleau <[email protected]>
Commit-Queue: John Chen <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#685751}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1747730
Reviewed-by: John Chen <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1008}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/test/chromedriver/js/call_function.js[diff]
• chrome/test/chromedriver/js/call_function_test.html[diff]

[remoting][FTL] Restart stream when server closes stream with OK

We had set up timer to restart the stream every 13 minutes. Per
discussion w/ Tachyon SWEs this causes OOMs and load balancing problems
in the Tachyon backend. We should restart the stream only when the
server closes the stream with a OK status.

This CL implements this and removes the stream lifetime timer.

(cherry picked from commit ff8acf061aac3e73760bb85a918abe9bc86574ee)

Bug: 992473
Change-Id: I132b5e32ce544cb748f197f32142189acea7a034
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1745414
Reviewed-by: Jamie Walch <[email protected]>
Commit-Queue: Yuwei Huang <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#685756}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1747233
Cr-Commit-Position: refs/branch-heads/3809@{#1007}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• remoting/signaling/ftl_message_reception_channel.cc[diff]
• remoting/signaling/ftl_message_reception_channel.h[diff]
• remoting/signaling/ftl_message_reception_channel_unittest.cc[diff]

Incrementing VERSION to 76.0.3809.116

[email protected]

Change-Id: I2e8ff652de71c9a595799aabe8140173182e7fe6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1747387
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1006}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.115

[email protected]

Change-Id: I4be0fac8701d0d9ed95e5efe9fe30cc9f5b8856a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1745812
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1005}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.114

[email protected]

Change-Id: Ic34bd4d9dd989ed26d698bc3a619a4df18c070e4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1747250
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1004}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.113

[email protected]

Change-Id: Ida5d0d63136415f364483acdd40f792d6f66914c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1745618
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1003}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.112

[email protected]

Change-Id: I76876b237a983af429ef076b86ef76a4eef8905c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1744946
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1002}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.111

[email protected]

Change-Id: Ied2f191319060d4a1edc5414adbb7bca01a551f3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1743097
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#1001}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

M76-respin: Disable enforcing having a NavigationRequest at commit time.

This patch:
https://chromium-review.googlesource.com/c/chromium/src/+/1127885
enforced having a matching NavigationRequest in DidCommitNavigation

Data shows this has been reached from the beginning in 76.0.3790.0
This means no regression happened, it was already broken for a long
time. We just didn't have ways to check this before.

This patch removes this "enforcement" in M76 to prevent further crashes.

Data also shows this seems to be fixed in M77. Probably thanks to:
https://chromium-review.googlesource.com/c/chromium/src/+/1547521

Bug: 983914
Change-Id: I17995c0c06271756f5e8aa817e5a00bd318453e3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1731895
Reviewed-by: Arthur Sonzogni <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#1000}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• content/browser/frame_host/render_frame_host_impl.cc[diff]

[Merge to M76] Update AImageReader max images for android MediaPlayer.

Update AImageReader in android MediaPlayer path to use max_images of 2
instead of 3.

This is a follow up CL of similar changes done in MCVD path -
https://chromium-review.googlesource.com/c/chromium/src/+/1678292

This change is to reduce the memory usage footprint.

(cherry picked from commit 12925ef8d3cc83c020b7156ba7d35f50f950ab02)

Bug: 981098
Change-Id: I9d9e629f21e38a607c41ff7df951a5ee5d482e54
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1688203
Auto-Submit: vikas soni <[email protected]>
Reviewed-by: Frank Liberato <[email protected]>
Reviewed-by: Greg Kerr <[email protected]>
Commit-Queue: vikas soni <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#676155}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1744282
Reviewed-by: vikas soni <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#999}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• gpu/ipc/common/android/surface_owner_android.cc[diff]

[GID] Trigger toolbar layout after transitioning from tab switcher state

Width of location bar depends on mTabSwitcherState
(ToolbarPhone.updateUnfocusedLocationBarLayoutParams).
After toolbar transitions from TAB_SWITCHER to STATIC_TAB state,
location bar  width should be updated. Because toolbar view doesn't
request layout at the end of transition, location bar is displayed
incorrectly. This CL introduces requestLayout() at the end of tab
switcher state transition.

BUG=974745
R=​[email protected]

(cherry picked from commit 5a7f7fe9ce6f1ca40cb9bcfb349b627e07e684c0)

Change-Id: I884cc1bd3d2a04b4d2ec4c667b38dc40acace559
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1698941
Commit-Queue: Pavel Yatsuk <[email protected]>
Reviewed-by: Theresa <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#678928}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1741294
Reviewed-by: Pavel Yatsuk <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#998}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/android/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarPhone.java[diff]

Incrementing VERSION to 76.0.3809.110

[email protected]

Change-Id: I63126bbaa3c7d52a9b1b9039db5d667053c74bc8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1743136
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#997}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.109

[email protected]

Change-Id: Ieaac9d413bb97cec3f9ec4c0488c6b0cc0a7c20f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1742566
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#996}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

OOR-CORS: Disabled by default on Android 76 Stable

kOutOfBlinkCors is disabled on WebView 76 by server distributed
configurations, but still the first run can take the hard coded
default behavior.

This patch will fix issues that happen only at the first run.

Bug: 991107
Change-Id: Id64d384cff56dd2ebdb7b71ff336a9a77f3dd313
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1741334
Reviewed-by: Yutaka Hirano <[email protected]>
Cr-Commit-Position: refs/branch-heads/3809@{#995}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• services/network/public/cpp/features.cc[diff]

Incrementing VERSION to 76.0.3809.108

[email protected]

Change-Id: I2693a8f296e6c085362242a42172d3a9c2f316da
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1740827
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#994}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Setting version to 76.0.3809.107

[email protected]

Change-Id: I82fd40a901c392cd4fbe8aa4a201229ff92e29a3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1738636
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#993}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.102

[email protected]

Change-Id: Id6d6347ac4f1bc29af20e5e2025c28b681256ab9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1736116
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#992}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]

Incrementing VERSION to 76.0.3809.101

[email protected]

Change-Id: Iabb4a904e91bc81e5d59130ea0b64f25eadf9df9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1734743
Reviewed-by: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/3809@{#991}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}

• chrome/VERSION[diff]