Add grid/flex layout support for <fieldset>

Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

This is the updated version of http://crrev.com/2150003005 that passes failed ClusterFuzz tests.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679, 375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001 (http://crrev.com/2150003005#ps290001)

Committed: https://crrev.com/94405829a3ffa94bff257bb14650170f7422bad0
Cr-Commit-Position: refs/heads/master@{#415577}

[Gleb Lanbin, 2016-08-06 01:21:09]

The CQ bit was checked by glebl@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-06 01:21:23]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-06 02:25:39]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-06 02:25:40]

Dry run: Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Gleb Lanbin, 2016-08-06 03:51:52]

The CQ bit was checked by glebl@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-06 03:52:03]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-06 05:05:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-06 05:05:45]

Dry run: This issue passed the CQ dry run.

[Gleb Lanbin, 2016-08-06 05:55:03]

Description was changed from

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)
==========

to

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

This is the updated version of http://crrev.com/2150003005 that passes failed
ClusterFuzz tests.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)
==========

[Gleb Lanbin, 2016-08-06 05:55:04]

glebl@chromium.org changed reviewers:
+ cbiesinger@chromium.org, dmazzoni@chromium.org

[Gleb Lanbin, 2016-08-06 05:55:05]

Description was changed from

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)
==========

to

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

This is the updated version of http://crrev.com/2150003005 that passes failed
ClusterFuzz tests.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)
==========

[Gleb Lanbin, 2016-08-06 05:55:06]

glebl@chromium.org changed reviewers:
+ cbiesinger@chromium.org, dmazzoni@chromium.org

[dmazzoni, 2016-08-08 15:22:46]

Rubberstamp lgtm

Could you clarify what code changed to fix the clusterfuzz failure?

[Gleb Lanbin, 2016-08-08 15:56:26]

On 2016/08/08 15:22:46, dmazzoni wrote:
> Rubberstamp lgtm
> 
> Could you clarify what code changed to fix the clusterfuzz failure?

ClusterFuzz found several issues. Here are some of them:
1) the fieldset's anonymous block got deleted in
destroyAndCleanupAnonymousWrappers when one of children is invalidated. So
LayoutObject::destroyAndCleanupAnonymousWrappers was updated to prevent deleting
anonymous wrappers if parent explicitly created them.

2) re: Heap-use-after-free at LayoutFieldset::adjustInnerStyle. This one had
security severity: high. 
This was fixed by moving the code to LayoutObject::updateAnonymousChildStyle
which is recommended way to set styles on an anonymous child.

[cbiesinger, 2016-08-08 16:15:53]

lgtm

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/core/layout/LayoutFieldset.cpp (right):

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/layout/LayoutFieldset.cpp:222:
LayoutFlexibleBox::styleDidChange(diff, oldStyle);
I don't think you need this override anymore?

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/layout/LayoutFieldset.cpp:246: // Let legend
block to be the 2nd for correct layout positioning.
Eh, it's already second in tree order, so it will be second by default, right?
But I'm fine either way.

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h (right):

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h:62: virtual
LayoutObject* layoutSpecialExcludedChild(bool relayoutChildren,
SubtreeLayoutScope&) {return nullptr;};
Didn't notice this earlier but please the remove the final semicolon and add
spaces around "return nullptr;", like in orderIterator() below

[Gleb Lanbin, 2016-08-08 17:26:51]

Patchset #3 (id:40001) has been deleted

[Gleb Lanbin, 2016-08-08 17:27:06]

thanks for the review

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/core/layout/LayoutFieldset.cpp (right):

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/layout/LayoutFieldset.cpp:222:
LayoutFlexibleBox::styleDidChange(diff, oldStyle);
On 2016/08/08 16:15:53, cbiesinger wrote:
> I don't think you need this override anymore?

done, it's a leftover from debugging.

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/layout/LayoutFieldset.cpp:246: // Let legend
block to be the 2nd for correct layout positioning.
On 2016/08/08 16:15:53, cbiesinger wrote:
> Eh, it's already second in tree order, so it will be second by default, right?
> But I'm fine either way.

Done.

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h (right):

https://codereview.chromium.org/2215133005/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h:62: virtual
LayoutObject* layoutSpecialExcludedChild(bool relayoutChildren,
SubtreeLayoutScope&) {return nullptr;};
On 2016/08/08 16:15:53, cbiesinger wrote:
> Didn't notice this earlier but please the remove the final semicolon and add
> spaces around "return nullptr;", like in orderIterator() below

Done.

[cbiesinger, 2016-08-08 17:29:32]

https://codereview.chromium.org/2215133005/diff/60001/third_party/WebKit/Sour...
File third_party/WebKit/Source/core/layout/LayoutFieldset.cpp (right):

https://codereview.chromium.org/2215133005/diff/60001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/layout/LayoutFieldset.cpp:232:
childStyle.setOrder(1);
Oh sorry, I should have pointed this one out too -- you should remove this one.
Though it may not matter since the <legend> is special anyway.

[Gleb Lanbin, 2016-08-31 03:20:09]

The CQ bit was checked by glebl@chromium.org

[Gleb Lanbin, 2016-08-31 03:20:10]

The patchset sent to the CQ was uploaded after l-g-t-m from
cbiesinger@chromium.org, dmazzoni@chromium.org
Link to the patchset: https://codereview.chromium.org/2215133005/#ps80001
(title: "fixed more ClusterFuzz tests")

[commit-bot: I haz the power, 2016-08-31 03:20:26]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-31 03:28:07]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-31 03:28:09]

Try jobs failed on following builders:
  linux_android_rel_ng on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/linux_androi...)

[Gleb Lanbin, 2016-08-31 04:25:24]

The CQ bit was checked by glebl@chromium.org

[commit-bot: I haz the power, 2016-08-31 04:25:39]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-31 07:22:47]

Description was changed from

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

This is the updated version of http://crrev.com/2150003005 that passes failed
ClusterFuzz tests.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)
==========

to

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

This is the updated version of http://crrev.com/2150003005 that passes failed
ClusterFuzz tests.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)
==========

[commit-bot: I haz the power, 2016-08-31 07:22:49]

Committed patchset #4 (id:80001)

[commit-bot: I haz the power, 2016-08-31 07:24:39]

Description was changed from

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

This is the updated version of http://crrev.com/2150003005 that passes failed
ClusterFuzz tests.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)
==========

to

==========
Add grid/flex layout support for <fieldset>

This adds grid/flex layout support for <fieldset> by
introducing an anonymous inner block that is used to
layout fieldset's underlying blocks without interfering
with the special paint flow used to render <legend>
element.

This is the updated version of http://crrev.com/2150003005 that passes failed
ClusterFuzz tests.

W3C/CSS WG discussion:
https://github.com/w3c/csswg-drafts/issues/321

Testing:
- All affected tests' results were verified to make sure
that there are no differences in pixel test results between
old and new version of LayoutFieldSet.
- 2 more tests were added
(fieldset-display-{flex|grid}.html)
- verified interoperability of fieldset(display: flex)
with Firefox(one of 2 browsers that support fieldset's flex
layout)

BUG=262679,375693
TEST=fast/forms/fieldset/fieldset-display-flex.html;
fast/forms/fieldset/fieldset-display-grid.html

Committed: https://crrev.com/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Cr-Commit-Position: refs/heads/master@{#409303}

patch from issue 2150003005 at patchset 290001
(http://crrev.com/2150003005#ps290001)

Committed: https://crrev.com/94405829a3ffa94bff257bb14650170f7422bad0
Cr-Commit-Position: refs/heads/master@{#415577}
==========

[commit-bot: I haz the power, 2016-08-31 07:24:40]

Patchset 4 (id:??) landed as
https://crrev.com/94405829a3ffa94bff257bb14650170f7422bad0
Cr-Commit-Position: refs/heads/master@{#415577}