chore: cherry-pick b2cc7b7ac538 from chromium (#42096)

* chore: cherry-pick b2cc7b7ac538 from chromium

* chore: update patches

---------

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -4,8 +4,12 @@
 	"onCreateCommand": ".devcontainer/on-create-command.sh",
 	"updateContentCommand": ".devcontainer/update-content-command.sh",
 	"workspaceFolder": "/workspaces/gclient/src/electron",
-	"forwardPorts": [6080, 5901],
+	"forwardPorts": [8088, 6080, 5901],
 	"portsAttributes": {
+		"8088": {
+			"label": "Goma Control Panel",
+			"onAutoForward": "silent"
+		},
 		"6080": {
 			"label": "VNC web client (noVNC)",
 			"onAutoForward": "silent"
@@ -27,7 +31,8 @@
 			]
 		},
 		"vscode": {
-			"extensions": ["joeleinbinder.mojom-language",
+			"extensions": [
+				"joeleinbinder.mojom-language",
 				"rafaelmaiolla.diff",
 				"surajbarkale.ninja",
 				"ms-vscode.cpptools",

.devcontainer/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   buildtools:
-    image: ghcr.io/electron/devcontainer:3d8d44d0f15b05bef6149e448f9cc522111847e9
+    image: ghcr.io/electron/devcontainer:9a43c14f5c19be0359843299f79e736521373adc
 
     volumes:
       - ..:/workspaces/gclient/src/electron:cached

.devcontainer/on-create-command.sh

@@ -39,7 +39,6 @@ if [ ! -f $buildtools/configs/evm.testing.json ]; then
   write_config() {
     echo "
         {
-            \"goma\": \"$1\",
             \"root\": \"/workspaces/gclient\",
             \"remotes\": {
                 \"electron\": {
@@ -49,7 +48,7 @@ if [ ! -f $buildtools/configs/evm.testing.json ]; then
             \"gen\": {
                 \"args\": [
                     \"import(\\\"//electron/build/args/testing.gn\\\")\",
-                    \"import(\\\"/home/builduser/.electron_build_tools/third_party/goma.gn\\\")\"
+                    \"use_remoteexec = true\"
                 ],
                 \"out\": \"Testing\"
             },
@@ -57,26 +56,18 @@ if [ ! -f $buildtools/configs/evm.testing.json ]; then
                 \"CHROMIUM_BUILDTOOLS_PATH\": \"/workspaces/gclient/src/buildtools\",
                 \"GIT_CACHE_PATH\": \"/workspaces/gclient/.git-cache\"
             },
-            \"\$schema\": \"file:///home/builduser/.electron_build_tools/evm-config.schema.json\"
+            \"\$schema\": \"file:///home/builduser/.electron_build_tools/evm-config.schema.json\",
+            \"configValidationLevel\": \"strict\",
+            \"reclient\": \"$1\",
+            \"goma\": \"none\",
+            \"preserveXcode\": 5
         }
     " >$buildtools/configs/evm.testing.json
   }
 
-  # Start out as cache only
-  write_config cache-only
+  write_config remote_exec
 
-  e use testing
-
-  # Attempt to auth to the goma service via codespaces tokens
-  # if it works we can use the goma cluster
-  export NOTGOMA_CODESPACES_TOKEN=$GITHUB_TOKEN
-  if e d goma_auth login; then
-    echo "$GITHUB_USER has GOMA access - switching to cluster mode"
-    write_config cluster
-  fi
+  e use testing 
 else
   echo "build-tools testing config already exists"
-
-  # Re-auth with the goma cluster regardless.
-  NOTGOMA_CODESPACES_TOKEN=$GITHUB_TOKEN e d goma_auth login || true
 fi

.github/CODEOWNERS

@@ -11,9 +11,6 @@ DEPS                                    @electron/wg-upgrades
 /docs/breaking-changes.md               @electron/wg-releases
 /npm/                                   @electron/wg-releases
 /script/release                         @electron/wg-releases
-appveyor.yml                            @electron/wg-releases
-appveyor-bake.yml                       @electron/wg-releases
-appveyor-woa.yml                        @electron/wg-releases
 
 # Security WG
 /lib/browser/devtools.ts                @electron/wg-security

.github/workflows/issue-labeled.yml

@@ -8,24 +8,6 @@ permissions:  # added using https://github.com/step-security/secure-workflows
   contents: read
 
 jobs:
-  issue-labeled-with-status:
-    name: status/{confirmed,reviewed} label added
-    if: github.event.label.name == 'status/confirmed' || github.event.label.name == 'status/reviewed'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate GitHub App token
-        uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
-        id: generate-token
-        with:
-          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-          org: electron
-      - name: Set status
-        uses: dsanders11/project-actions/edit-item@82e99438bd44a14ad18d92d036dbc25cbfb9a8c4 # v1.2.0
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-          project-number: 90
-          field: Status
-          field-value: ✅ Triaged
   issue-labeled-blocked:
     name: blocked/* label added
     if: startsWith(github.event.label.name, 'blocked/')

.github/workflows/issue-opened.yml

@@ -25,44 +25,3 @@ jobs:
           field-value: ${{ github.event.issue.user.login }}
           project-number: 90
           token: ${{ steps.generate-token.outputs.token }}
-  set-labels:
-    if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate GitHub App token
-        uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
-        id: generate-token
-        with:
-          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-          org: electron
-      - run: npm install mdast-util-from-markdown@2.0.0 unist-util-select@5.1.0
-      - name: Add labels
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          ISSUE_BODY: ${{ github.event.issue.body }}
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            const { fromMarkdown } = await import('${{ github.workspace }}/node_modules/mdast-util-from-markdown/index.js');
-            const { select } = await import('${{ github.workspace }}/node_modules/unist-util-select/index.js');
-
-            const [ owner, repo ] = '${{ github.repository }}'.split('/');
-            const issue_number = ${{ github.event.issue.number }};
-
-            const tree = fromMarkdown(process.env.ISSUE_BODY);
-
-            const labels = [];
-
-            const gistUrl = select('heading:has(> text[value="Testcase Gist URL"]) + paragraph > text', tree)?.value.trim();
-            if (gistUrl !== undefined && gistUrl.startsWith('https://gist.github.com/')) {
-              labels.push('has-repro-gist');
-            }
-
-            if (labels.length) {
-              await github.rest.issues.addLabels({
-                owner,
-                repo,
-                issue_number,
-                labels,
-              });
-            }

.github/workflows/update_appveyor_image.yml

@@ -6,23 +6,22 @@ on:
   schedule:
     - cron: '0 8 * * 1-5' # runs 8:00 every business day (see https://crontab.guru)
 
-permissions: {}
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
   bake-appveyor-image:
     name: Bake AppVeyor Image
+    permissions:
+      contents: write
+      pull-requests: write  # to create a new PR with updated Appveyor images
     runs-on: ubuntu-latest
     steps:
-    - name: Generate GitHub App token
-      uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
-      id: generate-token
-      with:
-        creds: ${{ secrets.APPVEYOR_UPDATER_GH_APP_CREDS }}
     - name: Checkout
       uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         fetch-depth: 0
-        token: ${{ steps.generate-token.outputs.token }}
     - name: Yarn install
       run: |
         node script/yarn.js install --frozen-lockfile
@@ -50,24 +49,26 @@ jobs:
         diff -w -B appveyor.yml appveyor2.yml > appveyor.diff || true
         patch -f appveyor.yml < appveyor.diff
         rm appveyor2.yml appveyor.diff
-        git add appveyor.yml
     - name: (Optionally) Generate Commit Diff for WOA
       if: ${{ env.APPVEYOR_IMAGE_VERSION }}
       run: |
         diff -w -B appveyor-woa.yml appveyor-woa2.yml > appveyor-woa.diff || true
         patch -f appveyor-woa.yml < appveyor-woa.diff
         rm appveyor-woa2.yml appveyor-woa.diff
-        git add appveyor-woa.yml
-    - name: (Optionally) Commit to Branch
+    - name: (Optionally) Commit and Pull Request
       if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      uses: dsanders11/github-app-commit-action@1dd0a2d22c564461d3f598b6858856e8842d7a16 # v1.1.0
+      uses: peter-evans/create-pull-request@b1ddad2c994a25fbc81a28b3ec0e368bb2021c50 # v6.0.0
       with:
-        message: 'build: update appveyor image to latest version'
-        ref: bump-appveyor-image
-        token: ${{ steps.generate-token.outputs.token }}
-    - name: (Optionally) Create Pull Request
-      if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      run: |
-        printf "This PR updates appveyor.yml to the latest baked image, ${{ env.APPVEYOR_IMAGE_VERSION }}.\n\nNotes: none" | gh pr create --head bump-appveyor-image --label no-backport --label semver/none --title 'build: update appveyor image to latest version' --body-file=-
-      env:
-        GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+        token: ${{ secrets.GITHUB_TOKEN }}
+        commit-message: 'build: update appveyor image to latest version'
+        committer: GitHub <noreply@github.com>
+        author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+        signoff: false
+        branch: bump-appveyor-image
+        delete-branch: true
+        reviewers: electron/wg-releases
+        title: 'build: update appveyor image to latest version'
+        labels: semver/none,no-backport
+        body: |
+          This PR updates appveyor.yml to the latest baked image, ${{ env.APPVEYOR_IMAGE_VERSION }}.
+          Notes: none

.markdownlint.json

@@ -1,3 +1,17 @@
 {
-  "extends": "@electron/lint-roller/configs/markdownlint.json"
+  "extends": "@electron/lint-roller/configs/markdownlint.json",
+  "no-angle-brackets": true,
+  "no-inline-html": {
+    "allowed_elements": [
+      "br",
+      "details",
+      "img",
+      "li",
+      "summary",
+      "ul",
+      "unknown",
+      "Tabs",
+      "TabItem",
+    ]
+  }
 }

BUILD.gn

@@ -475,6 +475,7 @@ source_set("electron_lib") {
     "//net:extras",
     "//net:net_resources",
     "//printing/buildflags",
+    "//services/device/public/cpp/bluetooth:bluetooth",
     "//services/device/public/cpp/geolocation",
     "//services/device/public/cpp/hid",
     "//services/device/public/mojom",
@@ -502,7 +503,6 @@ source_set("electron_lib") {
     "//ui/native_theme",
     "//ui/shell_dialogs",
     "//ui/views",
-    "//ui/views/controls/webview",
     "//v8",
     "//v8:v8_libplatform",
   ]
@@ -638,6 +638,7 @@ source_set("electron_lib") {
       "//ui/gtk:gtk_config",
       "//ui/linux:linux_ui",
       "//ui/linux:linux_ui_factory",
+      "//ui/views/controls/webview",
       "//ui/wm",
     ]
     if (ozone_platform_x11) {
@@ -666,6 +667,7 @@ source_set("electron_lib") {
     deps += [
       "//components/crash/core/app:crash_export_thunks",
       "//ui/native_theme:native_theme_browser",
+      "//ui/views/controls/webview",
       "//ui/wm",
       "//ui/wm/public",
     ]
@@ -699,6 +701,8 @@ source_set("electron_lib") {
     sources += [
       "shell/browser/printing/print_view_manager_electron.cc",
       "shell/browser/printing/print_view_manager_electron.h",
+      "shell/browser/printing/printing_utils.cc",
+      "shell/browser/printing/printing_utils.h",
       "shell/renderer/printing/print_render_frame_helper_delegate.cc",
       "shell/renderer/printing/print_render_frame_helper_delegate.h",
     ]
@@ -855,7 +859,7 @@ if (is_mac) {
     if (is_asan) {
       # crashpad_handler requires the ASan runtime at its @executable_path.
       sources += [ "$root_out_dir/libclang_rt.asan_osx_dynamic.dylib" ]
-      public_deps += [ "//build/config/sanitizers:copy_sanitizer_runtime" ]
+      public_deps += [ "//build/config/sanitizers:copy_asan_runtime" ]
     }
   }
 
@@ -1463,8 +1467,10 @@ dist_zip("hunspell_dictionaries_zip") {
 }
 
 copy("libcxx_headers") {
-  sources = libcxx_headers + libcxx_licenses +
-            [ "//buildtools/third_party/libc++/__config_site" ]
+  sources = libcxx_headers + libcxx_licenses + [
+              "//buildtools/third_party/libc++/__assertion_handler",
+              "//buildtools/third_party/libc++/__config_site",
+            ]
   outputs = [ "$target_gen_dir/electron_libcxx_include/{{source_root_relative_dir}}/{{source_file_part}}" ]
 }
 

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '124.0.6359.0',
+    '124.0.6367.119',
   'node_version':
     'v20.11.1',
   'nan_version':

appveyor-woa.yml

@@ -29,7 +29,7 @@
 
 version: 1.0.{build}
 build_cloud: electronhq-16-core
-image: e-124.0.6359.0
+image: e-123.0.6312.5
 environment:
   GIT_CACHE_PATH: C:\Users\appveyor\libcc_cache
   ELECTRON_OUT_DIR: Default
@@ -39,7 +39,7 @@ environment:
   MOCHA_MULTI_REPORTERS: "@marshallofsound/mocha-appveyor-reporter, tap"
   DEPOT_TOOLS_WIN_TOOLCHAIN: 1
   DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: "https://dev-cdn.electronjs.org/windows-toolchains/_"
-  GYP_MSVS_HASH_27370823e7: 28622d16b1
+  GYP_MSVS_HASH_7393122652: 3ba76c5c20
   PYTHONIOENCODING: UTF-8
 
   matrix:

appveyor.yml

@@ -29,7 +29,7 @@
 
 version: 1.0.{build}
 build_cloud: electronhq-16-core
-image: e-124.0.6359.0
+image: e-123.0.6312.5
 environment:
   GIT_CACHE_PATH: C:\Users\appveyor\libcc_cache
   ELECTRON_OUT_DIR: Default
@@ -39,7 +39,7 @@ environment:
   MOCHA_MULTI_REPORTERS: "@marshallofsound/mocha-appveyor-reporter, tap"
   DEPOT_TOOLS_WIN_TOOLCHAIN: 1
   DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: "https://dev-cdn.electronjs.org/windows-toolchains/_"
-  GYP_MSVS_HASH_27370823e7: 28622d16b1
+  GYP_MSVS_HASH_7393122652: 3ba76c5c20
   PYTHONIOENCODING: UTF-8
 
   matrix:

chromium_src/BUILD.gn

@@ -33,6 +33,8 @@ static_library("chrome") {
     "//chrome/browser/devtools/visual_logging.h",
     "//chrome/browser/extensions/global_shortcut_listener.cc",
     "//chrome/browser/extensions/global_shortcut_listener.h",
+    "//chrome/browser/file_system_access/file_system_access_features.cc",
+    "//chrome/browser/file_system_access/file_system_access_features.h",
     "//chrome/browser/icon_loader.cc",
     "//chrome/browser/icon_loader.h",
     "//chrome/browser/icon_manager.cc",

docs/api/app.md

@@ -41,6 +41,10 @@ that was used to open the application, if it was launched from Notification Cent
 You can also call `app.isReady()` to check if this event has already fired and `app.whenReady()`
 to get a Promise that is fulfilled when Electron is initialized.
 
+**Note**: The `ready` event is only fired after the main process has finished running the first
+tick of the event loop. If an Electron API needs to be called before the `ready` event, ensure
+that it is called synchronously in the top-level context of the main process.
+
 ### Event: 'window-all-closed'
 
 Emitted when all windows have been closed.

docs/api/client-request.md

@@ -17,6 +17,8 @@ following properties:
     method.
   * `url` string (optional) - The request URL. Must be provided in the absolute
     form with the protocol scheme specified as http or https.
+  * `headers` Record\<string, string | string[]\> (optional) - Headers to be sent
+    with the request.
   * `session` Session (optional) - The [`Session`](session.md) instance with
     which the request is associated.
   * `partition` string (optional) - The name of the [`partition`](session.md)

docs/api/dialog.md

@@ -174,7 +174,7 @@ dialog.showOpenDialog(mainWindow, {
     * `dontAddToRecent` _Windows_ - Do not add the item being saved to the recent documents list.
   * `securityScopedBookmarks` boolean (optional) _macOS_ _mas_ - Create a [security scoped bookmark](https://developer.apple.com/library/content/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW16) when packaged for the Mac App Store. If this option is enabled and the file doesn't already exist a blank file will be created at the chosen path.
 
-Returns `string | undefined`, the path of the file chosen by the user; if the dialog is cancelled it returns `undefined`.
+Returns `string`, the path of the file chosen by the user; if the dialog is cancelled it returns an empty string.
 
 The `browserWindow` argument allows the dialog to attach itself to a parent window, making it modal.
 
@@ -207,7 +207,7 @@ The `filters` specifies an array of file types that can be displayed, see
 Returns `Promise<Object>` - Resolve with an object containing the following:
 
 * `canceled` boolean - whether or not the dialog was canceled.
-* `filePath` string (optional) - If the dialog is canceled, this will be `undefined`.
+* `filePath` string - If the dialog is canceled, this will be an empty string.
 * `bookmark` string (optional) _macOS_ _mas_ - Base64 encoded string which contains the security scoped bookmark data for the saved file. `securityScopedBookmarks` must be enabled for this to be present. (For return values, see [table here](#bookmarks-array).)
 
 The `browserWindow` argument allows the dialog to attach itself to a parent window, making it modal.

docs/api/environment-variables.md

@@ -51,6 +51,18 @@ Unsupported options are:
 --http-parser
 ```
 
+If the [`nodeOptions` fuse](../tutorial/fuses.md#L27) is disabled, `NODE_OPTIONS` will be ignored.
+
+### `NODE_EXTRA_CA_CERTS`
+
+See [Node.js cli documentation](https://github.com/nodejs/node/blob/main/doc/api/cli.md#node_extra_ca_certsfile) for details.
+
+```sh
+export NODE_EXTRA_CA_CERTS=/path/to/cert.pem 
+```
+
+If the [`nodeOptions` fuse](../tutorial/fuses.md#L27) is disabled, `NODE_EXTRA_CA_CERTS` will be ignored.
+
 ### `GOOGLE_API_KEY`
 
 Geolocation support in Electron requires the use of Google Cloud Platform's
@@ -92,6 +104,8 @@ you would when running the normal Node.js executable, with the exception of the
 These flags are disabled owing to the fact that Electron uses BoringSSL instead of OpenSSL when building Node.js'
 `crypto` module, and so will not work as designed.
 
+If the [`runAsNode` fuse](../tutorial/fuses.md#L13) is disabled, `ELECTRON_RUN_AS_NODE` will be ignored.
+
 ### `ELECTRON_NO_ATTACH_CONSOLE` _Windows_
 
 Don't attach to the current console session.

docs/api/menu-item.md

@@ -38,18 +38,18 @@ See [`Menu`](menu.md) for examples.
     `Menu.buildFromTemplate`.
   * `id` string (optional) - Unique within a single menu. If defined then it can be used
     as a reference to this item by the position attribute.
-  * `before` string[] (optional) - Inserts this item before the item with the specified label. If
+  * `before` string[] (optional) - Inserts this item before the item with the specified id. If
     the referenced item doesn't exist the item will be inserted at the end of  the menu. Also implies
     that the menu item in question should be placed in the same “group” as the item.
-  * `after` string[] (optional) - Inserts this item after the item with the specified label. If the
+  * `after` string[] (optional) - Inserts this item after the item with the specified id. If the
     referenced item doesn't exist the item will be inserted at the end of
     the menu.
   * `beforeGroupContaining` string[] (optional) - Provides a means for a single context menu to declare
     the placement of their containing group before the containing group of the item
-    with the specified label.
+    with the specified id.
   * `afterGroupContaining` string[] (optional) - Provides a means for a single context menu to declare
     the placement of their containing group after the containing group of the item
-    with the specified label.
+    with the specified id.
 
 **Note:** `acceleratorWorksWhenHidden` is specified as being macOS-only because accelerators always work when items are hidden on Windows and Linux. The option is exposed to users to give them the option to turn it off, as this is possible in native macOS development.
 

docs/api/menu.md

@@ -336,16 +336,16 @@ browser windows.
 
 You can make use of `before`, `after`, `beforeGroupContaining`, `afterGroupContaining` and `id` to control how the item will be placed when building a menu with `Menu.buildFromTemplate`.
 
-* `before` - Inserts this item before the item with the specified label. If the
+* `before` - Inserts this item before the item with the specified id. If the
   referenced item doesn't exist the item will be inserted at the end of
   the menu. Also implies that the menu item in question should be placed in the same “group” as the item.
-* `after` - Inserts this item after the item with the specified label. If the
+* `after` - Inserts this item after the item with the specified id. If the
   referenced item doesn't exist the item will be inserted at the end of
   the menu. Also implies that the menu item in question should be placed in the same “group” as the item.
 * `beforeGroupContaining` - Provides a means for a single context menu to declare
-  the placement of their containing group before the containing group of the item with the specified label.
+  the placement of their containing group before the containing group of the item with the specified id.
 * `afterGroupContaining` - Provides a means for a single context menu to declare
-  the placement of their containing group after the containing group of the item with the specified label.
+  the placement of their containing group after the containing group of the item with the specified id.
 
 By default, items will be inserted in the order they exist in the template unless one of the specified positioning keywords is used.
 

docs/api/session.md

@@ -818,15 +818,10 @@ win.webContents.session.setCertificateVerifyProc((request, callback) => {
     * `top-level-storage-access` -  Allow top-level sites to request third-party cookie access on behalf of embedded content originating from another site in the same related website set using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `window-management` - Request access to enumerate screens using the [`getScreenDetails`](https://developer.chrome.com/en/articles/multi-screen-window-placement/) API.
     * `unknown` - An unrecognized permission request.
+    * `fileSystem` - Request access to read, write, and file management capabilities using the [File System API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_API).
   * `callback` Function
     * `permissionGranted` boolean - Allow or deny the permission.
-  * `details` Object - Some properties are only available on certain permission types.
-    * `externalURL` string (optional) - The url of the `openExternal` request.
-    * `securityOrigin` string (optional) - The security origin of the `media` request.
-    * `mediaTypes` string[] (optional) - The types of media access being requested, elements can be `video`
-      or `audio`
-    * `requestingUrl` string - The last URL the requesting frame loaded
-    * `isMainFrame` boolean - Whether the frame making the request is the main frame
+  * `details` [PermissionRequest](structures/permission-request.md)  | [FilesystemPermissionRequest](structures/filesystem-permission-request.md) | [MediaAccessPermissionRequest](structures/media-access-permission-request.md) | [OpenExternalPermissionRequest](structures/open-external-permission-request.md) - Additional information about the permission being requested.
 
 Sets the handler which can be used to respond to permission requests for the `session`.
 Calling `callback(true)` will allow the permission and `callback(false)` will reject it.
@@ -1428,26 +1423,6 @@ is emitted.
 Returns `string | null` - The absolute file system path where data for this
 session is persisted on disk.  For in memory sessions this returns `null`.
 
-#### `ses.clearData()`
-
-Returns `Promise<void>` - resolves when all data has been cleared.
-
-This method clears many different types of data, inlcuding:
-
-* Cache
-* Cookies
-* Downloads
-* IndexedDB
-* Local Storage
-* Service Workers
-* And more...
-
-This method clears more types of data and is more thourough than the
-`clearStorageData` method, however it is currently less configurable than that
-method.
-
-For more information, refer to Chromium's [`BrowsingDataRemover` interface](https://source.chromium.org/chromium/chromium/src/+/main:content/public/browser/browsing_data_remover.h).
-
 ### Instance Properties
 
 The following properties are available on instances of `Session`:

docs/api/structures/filesystem-permission-request.md

@@ -0,0 +1,5 @@
+# FilesystemPermissionRequest Object extends `PermissionRequest`
+
+* `filePath` string (optional) - The path of the `fileSystem` request.
+* `isDirectory` boolean (optional) - Whether the `fileSystem` request is a directory.
+* `fileAccessType` string (optional) - The access type of the `fileSystem` request. Can be `writable` or `readable`.

docs/api/structures/media-access-permission-request.md

@@ -0,0 +1,5 @@
+# MediaAccessPermissionRequest Object extends `PermissionRequest`
+
+* `securityOrigin` string (optional) - The security origin of the request.
+* `mediaTypes` string[] (optional) - The types of media access being requested - elements can be `video`
+  or `audio`.

docs/api/structures/open-external-permission-request.md

@@ -0,0 +1,3 @@
+# OpenExternalPermissionRequest Object extends `PermissionRequest`
+
+* `externalURL` string (optional) - The url of the `openExternal` request.

docs/api/structures/permission-request.md

@@ -0,0 +1,4 @@
+# PermissionRequest Object
+
+* `requestingUrl` string - The last URL the requesting frame loaded.
+* `isMainFrame` boolean - Whether the frame making the request is the main frame.

docs/api/structures/window-open-handler-response.md

@@ -1,7 +0,0 @@
-# WindowOpenHandlerResponse Object
-
-* `action` string - Can be `allow` or `deny`. Controls whether new window should be created.
-* `overrideBrowserWindowOptions` BrowserWindowConstructorOptions (optional) - Allows customization of the created window.
-* `outlivesOpener` boolean (optional) - By default, child windows are closed when their opener is closed. This can be
-  changed by specifying `outlivesOpener: true`, in which case the opened window will not be closed when its opener is closed.
-* `createWindow` (options: BrowserWindowConstructorOptions) => WebContents (optional) - If specified, will be called instead of `new BrowserWindow` to create the new child window and event [`did-create-window`](../web-contents.md#event-did-create-window) will not be emitted. Constructed child window should use passed `options` object. This can be used for example to have the new window open as a BrowserView instead of in a separate window.

docs/api/web-contents.md

@@ -1288,7 +1288,7 @@ Ignore application menu shortcuts while this web contents is focused.
 
 #### `contents.setWindowOpenHandler(handler)`
 
-* `handler` Function\<[WindowOpenHandlerResponse](structures/window-open-handler-response.md)\>
+* `handler` Function\<{action: 'deny'} | {action: 'allow', outlivesOpener?: boolean, overrideBrowserWindowOptions?: BrowserWindowConstructorOptions}\>
   * `details` Object
     * `url` string - The _resolved_ version of the URL passed to `window.open()`. e.g. opening a window with `window.open('foo')` will yield something like `https://the-origin/the/current/path/foo`.
     * `frameName` string - Name of the window provided in `window.open()`
@@ -1303,8 +1303,11 @@ Ignore application menu shortcuts while this web contents is focused.
       be set. If no post data is to be sent, the value will be `null`. Only defined
       when the window is being created by a form that set `target=_blank`.
 
-  Returns `WindowOpenHandlerResponse` - When set to `{ action: 'deny' }` cancels the creation of the new
-  window. `{ action: 'allow' }` will allow the new window to be created.
+  Returns `{action: 'deny'} | {action: 'allow', outlivesOpener?: boolean, overrideBrowserWindowOptions?: BrowserWindowConstructorOptions}` - `deny` cancels the creation of the new
+  window. `allow` will allow the new window to be created. Specifying `overrideBrowserWindowOptions` allows customization of the created window.
+  By default, child windows are closed when their opener is closed. This can be
+  changed by specifying `outlivesOpener: true`, in which case the opened window
+  will not be closed when its opener is closed.
   Returning an unrecognized value such as a null, undefined, or an object
   without a recognized 'action' value will result in a console error and have
   the same effect as returning `{action: 'deny'}`.
@@ -1315,26 +1318,6 @@ submitting a form with `<form target="_blank">`. See
 [`window.open()`](window-open.md) for more details and how to use this in
 conjunction with `did-create-window`.
 
-An example showing how to customize the process of new `BrowserWindow` creation to be `BrowserView` attached to main window instead:
-
-```js
-const { BrowserView, BrowserWindow } = require('electron')
-
-const mainWindow = new BrowserWindow()
-
-mainWindow.webContents.setWindowOpenHandler((details) => {
-  return {
-    action: 'allow',
-    createWindow: (options) => {
-      const browserView = new BrowserView(options)
-      mainWindow.addBrowserView(browserView)
-      browserView.setBounds({ x: 0, y: 0, width: 640, height: 480 })
-      return browserView.webContents
-    }
-  }
-})
-```
-
 #### `contents.setAudioMuted(muted)`
 
 * `muted` boolean

docs/development/build-instructions-gn.md

@@ -110,22 +110,51 @@ $ export CHROMIUM_BUILDTOOLS_PATH=`pwd`/buildtools
 On Windows:
 
 ```sh
+# cmd
 $ cd src
 $ set CHROMIUM_BUILDTOOLS_PATH=%cd%\buildtools
+
+# PowerShell
+$ cd src
+$ $env:CHROMIUM_BUILDTOOLS_PATH = "$(Get-Location)\buildtools"
 ```
 
 **To generate Testing build config of Electron:**
 
+On Linux & MacOS
+
 ```sh
 $ gn gen out/Testing --args="import(\"//electron/build/args/testing.gn\")"
 ```
 
+On Windows:
+
+```sh
+# cmd
+$ gn gen out/Testing --args="import(\"//electron/build/args/testing.gn\")"
+
+# PowerShell
+gn gen out/Testing --args="import(\`"//electron/build/args/testing.gn\`")"
+```
+
 **To generate Release build config of Electron:**
 
+On Linux & MacOS
+
 ```sh
 $ gn gen out/Release --args="import(\"//electron/build/args/release.gn\")"
 ```
 
+On Windows:
+
+```sh
+# cmd
+$ gn gen out/Release --args="import(\"//electron/build/args/release.gn\")"
+
+# PowerShell
+$ gn gen out/Release --args="import(\`"//electron/build/args/release.gn\`")"
+```
+
 **Note:** This will generate a `out/Testing` or `out/Release` build directory under `src/` with the testing or release build depending upon the configuration passed above. You can replace `Testing|Release` with another names, but it should be a subdirectory of `out`.
 
 Also you shouldn't have to run `gn gen` again—if you want to change the build arguments, you can run `gn args out/Testing` to bring up an editor. To see the list of available build configuration options, run `gn args out/Testing --list`.

docs/tutorial/asar-integrity.md

@@ -5,57 +5,50 @@ slug: asar-integrity
 hide_title: false
 ---
 
-## Platform Support
+ASAR integrity is an experimental feature that validates the contents of your app's
+[ASAR archives](./asar-archives.md) at runtime.
 
-Currently ASAR integrity checking is supported on:
-* macOS as of Electron `>=16.0.0`
-* Windows as of Electron `>=30.0.0`
+## Version support
 
-## Requirements
+Currently, ASAR integrity checking is supported on:
 
-### Electron Forge / Electron Packager
+* macOS as of `electron>=16.0.0`
+* Windows as of `electron>=30.0.0`
 
-If you are using `>= electron-packager@18.3.1` or `>= @electron-forge/core@7.4.0` then all these requirements are met for you automatically and you can skip to [Toggling the Fuse](#toggling-the-fuse).
+In order to enable ASAR integrity checking, you also need to ensure that your `app.asar` file
+was generated by a version of the `@electron/asar` npm package that supports ASAR integrity.
 
-### Other build systems
+Support was introduced in `asar@3.1.0`. Note that this package has since migrated over to `@electron/asar`.
+All versions of `@electron/asar` support ASAR integrity.
 
-In order to enable ASAR integrity checking you need to ensure that your `app.asar` file was generated by a version of the `asar` npm package that supports asar integrity.  Support was introduced in version `3.1.0`.
+## How it works
 
-### macOS
-
-When packaging for macOS you must populate a valid `ElectronAsarIntegrity` dictionary block in your packaged apps `Info.plist`.  An example is included below.
-
-```plist
-<key>ElectronAsarIntegrity</key>
-<dict>
-  <key>Resources/app.asar</key>
-  <dict>
-    <key>algorithm</key>
-    <string>SHA256</string>
-    <key>hash</key>
-    <string>9d1f61ea03c4bb62b4416387a521101b81151da0cfbe18c9f8c8b818c5cebfac</string>
-  </dict>
-</dict>
-```
-
-Valid `algorithm` values are currently `SHA256` only.  The `hash` is a hash of the ASAR header using the given algorithm.  The `asar` package exposes a `getRawHeader` method whose result can then be hashed to generate this value.
-
-### Windows
-
-When packaging for Windows you must populate a valid resource entry of type `Integrity` and name `ElectronAsar`. The value of this resource should be a JSON encoded dictionary in the form included below:
+Each ASAR archive contains a JSON string header. The header format includes an `integrity` object
+that contain a hex encoded hash of the entire archive as well as an array of hex encoded hashes for each
+block of `blockSize` bytes.
 
 ```json
 {
-  "resources/app.asar": {
-    "algorithm": "SHA256",
-    "hash": "9d1f61ea03c4bb62b4416387a521101b81151da0cfbe18c9f8c8b818c5cebfac"
-  }
+  "algorithm": "SHA256",
+  "hash": "...",
+  "blockSize": 1024,
+  "blocks": ["...", "..."]
 }
 ```
 
-## Toggling the Fuse
+Separately, you need to define a hex encoded hash of the entire ASAR header when packaging your Electron app.
 
-ASAR integrity checking is currently disabled by default and can be enabled by toggling a fuse. See [Electron Fuses](fuses.md) for more information on what Electron Fuses are and how they work.  When enabling this fuse you typically also want to enable the `onlyLoadAppFromAsar` fuse otherwise the validity checking can be bypassed via the Electron app code search path.
+When ASAR integrity is enabled, your Electron app will verify the header hash of the ASAR archive on runtime.
+If no hash is present or if there is a mismatch in the hashes, the app will forcefully terminate.
+
+## Enabling ASAR integrity in the binary
+
+ASAR integrity checking is currently disabled by default in Electron and can
+be enabled on build time by toggling the `EnableEmbeddedAsarIntegrityValidation`
+[Electron fuse](fuses.md).
+
+When enabling this fuse, you typically also want to enable the `onlyLoadAppFromAsar` fuse.
+Otherwise, the validity checking can be bypassed via the Electron app code search path.
 
 ```js @ts-nocheck
 const { flipFuses, FuseVersion, FuseV1Options } = require('@electron/fuses')
@@ -70,3 +63,71 @@ flipFuses(
   }
 )
 ```
+
+:::tip Fuses in Electron Forge
+
+With Electron Forge, you can configure your app's fuses with
+[@electron-forge/plugin-fuses](https://www.electronforge.io/config/plugins/fuses)
+in your Forge configuration file.
+
+:::
+
+## Providing the header hash
+
+ASAR integrity validates the contents of the ASAR archive against the header hash that you provide
+on package time. The process of providing this packaged hash is different for macOS and Windows.
+
+### Using Electron tooling
+
+Electron Forge and Electron Packager do this setup automatically for you with no additional
+configuration. The minimum required versions for ASAR integrity are:
+
+* `@electron/packager@18.3.1`
+* `@electron/forge@7.4.0`
+
+### Using other build systems
+
+#### macOS
+
+When packaging for macOS, you must populate a valid `ElectronAsarIntegrity` dictionary block
+in your packaged app's `Info.plist`. An example is included below.
+
+```xml title='Info.plist'
+<key>ElectronAsarIntegrity</key>
+<dict>
+  <key>Resources/app.asar</key>
+  <dict>
+    <key>algorithm</key>
+    <string>SHA256</string>
+    <key>hash</key>
+    <string>9d1f61ea03c4bb62b4416387a521101b81151da0cfbe18c9f8c8b818c5cebfac</string>
+  </dict>
+</dict>
+```
+
+Valid `algorithm` values are currently `SHA256` only. The `hash` is a hash of the ASAR header using the given algorithm.
+The `@electron/asar` package exposes a `getRawHeader` method whose result can then be hashed to generate this value
+(e.g. using the [`node:crypto`](https://nodejs.org/api/crypto.html) module).
+
+### Windows
+
+When packaging for Windows, you must populate a valid [resource](https://learn.microsoft.com/en-us/windows/win32/menurc/resources)
+entry of type `Integrity` and name `ElectronAsar`. The value of this resource should be a JSON encoded dictionary
+in the form included below:
+
+```json
+[
+  {
+    "file": "resources\\app.asar",
+    "alg": "sha256",
+    "value": "9d1f61ea03c4bb62b4416387a521101b81151da0cfbe18c9f8c8b818c5cebfac"
+  }
+]
+```
+
+::: info
+
+For an implementation example, see [`src/resedit.ts`](https://github.com/electron/packager/blob/main/src/resedit.ts)
+in the Electron Packager code.
+
+:::

docs/tutorial/electron-timelines.md

@@ -9,10 +9,11 @@ check out our [Electron Versioning](./electron-versioning.md) doc.
 
 | Electron | Alpha | Beta | Stable | EOL | Chrome | Node | Supported |
 | ------- | ----- | ------- | ------ | ------ | ---- | ---- | ---- |
-| 30.0.0 |  2024-Feb-22 | 2024-Mar-20 | 2024-Apr-16 | 2024-Oct-15 | M124 | v20.9+ | ✅ |
+| 31.0.0 |  2024-Apr-18 | 2024-May-15 | 2024-Jun-11 | 2025-Jan-07 | M126 | TBD | ✅ |
+| 30.0.0 |  2024-Feb-22 | 2024-Mar-20 | 2024-Apr-16 | 2024-Oct-15 | M124 | v20.11 | ✅ |
 | 29.0.0 |  2023-Dec-07 | 2024-Jan-24 | 2024-Feb-20 | 2024-Aug-20 | M122 | v20.9 | ✅ |
 | 28.0.0 |  2023-Oct-11 | 2023-Nov-06 | 2023-Dec-05 | 2024-Jun-11 | M120 | v18.18 | ✅ |
-| 27.0.0 |  2023-Aug-17 | 2023-Sep-13 | 2023-Oct-10 | 2024-Apr-16 | M118 | v18.17 | ✅ |
+| 27.0.0 |  2023-Aug-17 | 2023-Sep-13 | 2023-Oct-10 | 2024-Apr-16 | M118 | v18.17 | 🚫 |
 | 26.0.0 | 2023-Jun-01 | 2023-Jun-27 | 2023-Aug-15 | 2024-Feb-20 | M116 | v18.16 | 🚫 |
 | 25.0.0 | 2023-Apr-10 | 2023-May-02 | 2023-May-30 | 2023-Dec-05 | M114 | v18.15 | 🚫 |
 | 24.0.0 | 2023-Feb-09 | 2023-Mar-07 | 2023-Apr-04 | 2023-Oct-10 | M112 | v18.14 | 🚫 |

docs/tutorial/fuses.md

@@ -29,7 +29,7 @@ The cookieEncryption fuse toggles whether the cookie store on disk is encrypted
 **Default:** Enabled
 **@electron/fuses:** `FuseV1Options.EnableNodeOptionsEnvironmentVariable`
 
-The nodeOptions fuse toggles whether the [`NODE_OPTIONS`](https://nodejs.org/api/cli.html#node_optionsoptions) environment variable is respected or not.  This environment variable can be used to pass all kinds of custom options to the Node.js runtime and isn't typically used by apps in production.  Most apps can safely disable this fuse.
+The nodeOptions fuse toggles whether the [`NODE_OPTIONS`](https://nodejs.org/api/cli.html#node_optionsoptions)  and [`NODE_EXTRA_CA_CERTS`](https://github.com/nodejs/node/blob/main/doc/api/cli.md#node_extra_ca_certsfile) environment variables are respected.  The `NODE_OPTIONS` environment variable can be used to pass all kinds of custom options to the Node.js runtime and isn't typically used by apps in production.  Most apps can safely disable this fuse.
 
 ### `nodeCliInspect`
 

docs/tutorial/tutorial-2-first-app.md

@@ -234,7 +234,7 @@ Notification) whereas camelCase modules are not instantiable (e.g. app, ipcRende
 <details><summary>Typed import aliases</summary>
 
 For better type checking when writing TypeScript code, you can choose to import
-main process modules from <code>electron/main</code>.
+main process modules from `electron/main`.
 
 ```js
 const { app, BrowserWindow } = require('electron/main')

docs/tutorial/tutorial-6-publishing-updating.md

@@ -152,7 +152,7 @@ command that can handle the version bumping and tagging for you.
 #### Bonus: Publishing in GitHub Actions
 
 Publishing locally can be painful, especially because you can only create distributables
-for your host operating system (i.e. you can't publish a Window `.exe` file from macOS).
+for your host operating system (i.e. you can't publish a Windows `.exe` file from macOS).
 
 A solution for this would be to publish your app via automation workflows
 such as [GitHub Actions][], which can run tasks in the

docs/tutorial/web-embeds.md

@@ -4,7 +4,7 @@
 
 If you want to embed (third-party) web content in an Electron `BrowserWindow`,
 there are three options available to you: `<iframe>` tags, `<webview>` tags,
-and `BrowserViews`. Each one offers slightly different functionality and is
+and `WebContentsView`. Each one offers slightly different functionality and is
 useful in different situations. To help you choose between these, this guide
 explains the differences and capabilities of each option.
 

filenames.auto.gni

@@ -89,6 +89,7 @@ auto_filenames = {
     "docs/api/structures/extension.md",
     "docs/api/structures/file-filter.md",
     "docs/api/structures/file-path-with-headers.md",
+    "docs/api/structures/filesystem-permission-request.md",
     "docs/api/structures/gpu-feature-status.md",
     "docs/api/structures/hid-device.md",
     "docs/api/structures/input-event.md",
@@ -99,6 +100,7 @@ auto_filenames = {
     "docs/api/structures/jump-list-item.md",
     "docs/api/structures/keyboard-event.md",
     "docs/api/structures/keyboard-input-event.md",
+    "docs/api/structures/media-access-permission-request.md",
     "docs/api/structures/memory-info.md",
     "docs/api/structures/memory-usage-details.md",
     "docs/api/structures/mime-typed-buffer.md",
@@ -106,7 +108,9 @@ auto_filenames = {
     "docs/api/structures/mouse-wheel-input-event.md",
     "docs/api/structures/notification-action.md",
     "docs/api/structures/notification-response.md",
+    "docs/api/structures/open-external-permission-request.md",
     "docs/api/structures/payment-discount.md",
+    "docs/api/structures/permission-request.md",
     "docs/api/structures/point.md",
     "docs/api/structures/post-body.md",
     "docs/api/structures/printer-info.md",
@@ -145,7 +149,6 @@ auto_filenames = {
     "docs/api/structures/web-preferences.md",
     "docs/api/structures/web-request-filter.md",
     "docs/api/structures/web-source.md",
-    "docs/api/structures/window-open-handler-response.md",
   ]
 
   sandbox_bundle_deps = [

filenames.gni

@@ -155,8 +155,12 @@ filenames = {
     "shell/browser/osr/osr_web_contents_view_mac.mm",
     "shell/browser/relauncher_mac.cc",
     "shell/browser/ui/certificate_trust_mac.mm",
+    "shell/browser/ui/cocoa/delayed_native_view_host.h",
+    "shell/browser/ui/cocoa/delayed_native_view_host.mm",
     "shell/browser/ui/cocoa/electron_bundle_mover.h",
     "shell/browser/ui/cocoa/electron_bundle_mover.mm",
+    "shell/browser/ui/cocoa/electron_inspectable_web_contents_view.h",
+    "shell/browser/ui/cocoa/electron_inspectable_web_contents_view.mm",
     "shell/browser/ui/cocoa/electron_menu_controller.h",
     "shell/browser/ui/cocoa/electron_menu_controller.mm",
     "shell/browser/ui/cocoa/electron_native_widget_mac.h",
@@ -183,6 +187,8 @@ filenames = {
     "shell/browser/ui/cocoa/window_buttons_proxy.mm",
     "shell/browser/ui/drag_util_mac.mm",
     "shell/browser/ui/file_dialog_mac.mm",
+    "shell/browser/ui/inspectable_web_contents_view_mac.h",
+    "shell/browser/ui/inspectable_web_contents_view_mac.mm",
     "shell/browser/ui/message_box_mac.mm",
     "shell/browser/ui/tray_icon_cocoa.h",
     "shell/browser/ui/tray_icon_cocoa.mm",
@@ -198,7 +204,6 @@ filenames = {
     "shell/common/node_bindings_mac.cc",
     "shell/common/node_bindings_mac.h",
     "shell/common/platform_util_mac.mm",
-    "shell/browser/ui/views/inspectable_web_contents_view_mac.mm",
   ]
 
   lib_sources_views = [
@@ -213,6 +218,8 @@ filenames = {
     "shell/browser/ui/views/electron_views_delegate.h",
     "shell/browser/ui/views/frameless_view.cc",
     "shell/browser/ui/views/frameless_view.h",
+    "shell/browser/ui/views/inspectable_web_contents_view_views.cc",
+    "shell/browser/ui/views/inspectable_web_contents_view_views.h",
     "shell/browser/ui/views/menu_bar.cc",
     "shell/browser/ui/views/menu_bar.h",
     "shell/browser/ui/views/menu_delegate.cc",
@@ -380,6 +387,10 @@ filenames = {
     "shell/browser/file_select_helper.cc",
     "shell/browser/file_select_helper.h",
     "shell/browser/file_select_helper_mac.mm",
+    "shell/browser/file_system_access/file_system_access_permission_context.cc",
+    "shell/browser/file_system_access/file_system_access_permission_context.h",
+    "shell/browser/file_system_access/file_system_access_permission_context_factory.cc",
+    "shell/browser/file_system_access/file_system_access_permission_context_factory.h",
     "shell/browser/font_defaults.cc",
     "shell/browser/font_defaults.h",
     "shell/browser/hid/electron_hid_delegate.cc",

lib/browser/api/protocol.ts

@@ -18,7 +18,7 @@ function makeStreamFromPipe (pipe: any): ReadableStream {
       try {
         const rv = await pipe.read(buf);
         if (rv > 0) {
-          controller.enqueue(buf.subarray(0, rv));
+          controller.enqueue(buf.slice(0, rv));
         } else {
           controller.close();
         }

lib/browser/api/web-contents.ts

@@ -433,15 +433,14 @@ WebContents.prototype.loadURL = function (url, options) {
   return p;
 };
 
-WebContents.prototype.setWindowOpenHandler = function (handler: (details: Electron.HandlerDetails) => Electron.WindowOpenHandlerResponse) {
+WebContents.prototype.setWindowOpenHandler = function (handler: (details: Electron.HandlerDetails) => ({action: 'deny'} | {action: 'allow', overrideBrowserWindowOptions?: BrowserWindowConstructorOptions, outlivesOpener?: boolean})) {
   this._windowOpenHandler = handler;
 };
 
-WebContents.prototype._callWindowOpenHandler = function (event: Electron.Event, details: Electron.HandlerDetails): {browserWindowConstructorOptions: BrowserWindowConstructorOptions | null, outlivesOpener: boolean, createWindow?: Electron.CreateWindowFunction} {
+WebContents.prototype._callWindowOpenHandler = function (event: Electron.Event, details: Electron.HandlerDetails): {browserWindowConstructorOptions: BrowserWindowConstructorOptions | null, outlivesOpener: boolean} {
   const defaultResponse = {
     browserWindowConstructorOptions: null,
-    outlivesOpener: false,
-    createWindow: undefined
+    outlivesOpener: false
   };
   if (!this._windowOpenHandler) {
     return defaultResponse;
@@ -467,8 +466,7 @@ WebContents.prototype._callWindowOpenHandler = function (event: Electron.Event,
   } else if (response.action === 'allow') {
     return {
       browserWindowConstructorOptions: typeof response.overrideBrowserWindowOptions === 'object' ? response.overrideBrowserWindowOptions : null,
-      outlivesOpener: typeof response.outlivesOpener === 'boolean' ? response.outlivesOpener : false,
-      createWindow: typeof response.createWindow === 'function' ? response.createWindow : undefined
+      outlivesOpener: typeof response.outlivesOpener === 'boolean' ? response.outlivesOpener : false
     };
   } else {
     event.preventDefault();
@@ -666,16 +664,13 @@ WebContents.prototype._init = function () {
           postData,
           overrideBrowserWindowOptions: options || {},
           windowOpenArgs: details,
-          outlivesOpener: result.outlivesOpener,
-          createWindow: result.createWindow
+          outlivesOpener: result.outlivesOpener
         });
       }
     });
 
     let windowOpenOverriddenOptions: BrowserWindowConstructorOptions | null = null;
     let windowOpenOutlivesOpenerOption: boolean = false;
-    let createWindow: Electron.CreateWindowFunction | undefined;
-
     this.on('-will-add-new-contents' as any, (event: Electron.Event, url: string, frameName: string, rawFeatures: string, disposition: Electron.HandlerDetails['disposition'], referrer: Electron.Referrer, postData: PostData) => {
       const postBody = postData ? {
         data: postData,
@@ -700,7 +695,6 @@ WebContents.prototype._init = function () {
 
       windowOpenOutlivesOpenerOption = result.outlivesOpener;
       windowOpenOverriddenOptions = result.browserWindowConstructorOptions;
-      createWindow = result.createWindow;
       if (!event.defaultPrevented) {
         const secureOverrideWebPreferences = windowOpenOverriddenOptions ? {
           // Allow setting of backgroundColor as a webPreference even though
@@ -730,9 +724,6 @@ WebContents.prototype._init = function () {
       referrer: Electron.Referrer, rawFeatures: string, postData: PostData) => {
       const overriddenOptions = windowOpenOverriddenOptions || undefined;
       const outlivesOpener = windowOpenOutlivesOpenerOption;
-      const windowOpenFunction = createWindow;
-
-      createWindow = undefined;
       windowOpenOverriddenOptions = null;
       // false is the default
       windowOpenOutlivesOpenerOption = false;
@@ -755,8 +746,7 @@ WebContents.prototype._init = function () {
           frameName,
           features: rawFeatures
         },
-        outlivesOpener,
-        createWindow: windowOpenFunction
+        outlivesOpener
       });
     });
   }

lib/browser/guest-window-manager.ts

@@ -16,16 +16,16 @@ export type WindowOpenArgs = {
   features: string,
 }
 
-const frameNamesToWindow = new Map<string, WebContents>();
-const registerFrameNameToGuestWindow = (name: string, webContents: WebContents) => frameNamesToWindow.set(name, webContents);
+const frameNamesToWindow = new Map<string, BrowserWindow>();
+const registerFrameNameToGuestWindow = (name: string, win: BrowserWindow) => frameNamesToWindow.set(name, win);
 const unregisterFrameName = (name: string) => frameNamesToWindow.delete(name);
-const getGuestWebContentsByFrameName = (name: string) => frameNamesToWindow.get(name);
+const getGuestWindowByFrameName = (name: string) => frameNamesToWindow.get(name);
 
 /**
  * `openGuestWindow` is called to create and setup event handling for the new
  * window.
  */
-export function openGuestWindow ({ embedder, guest, referrer, disposition, postData, overrideBrowserWindowOptions, windowOpenArgs, outlivesOpener, createWindow }: {
+export function openGuestWindow ({ embedder, guest, referrer, disposition, postData, overrideBrowserWindowOptions, windowOpenArgs, outlivesOpener }: {
   embedder: WebContents,
   guest?: WebContents,
   referrer: Referrer,
@@ -34,8 +34,7 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
   overrideBrowserWindowOptions?: BrowserWindowConstructorOptions,
   windowOpenArgs: WindowOpenArgs,
   outlivesOpener: boolean,
-  createWindow?: Electron.CreateWindowFunction
-}): void {
+}): BrowserWindow | undefined {
   const { url, frameName, features } = windowOpenArgs;
   const { options: parsedOptions } = parseFeatures(features);
   const browserWindowOptions = {
@@ -49,42 +48,17 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
   // To spec, subsequent window.open calls with the same frame name (`target` in
   // spec parlance) will reuse the previous window.
   // https://html.spec.whatwg.org/multipage/window-object.html#apis-for-creating-and-navigating-browsing-contexts-by-name
-  const existingWebContents = getGuestWebContentsByFrameName(frameName);
-  if (existingWebContents) {
-    if (existingWebContents.isDestroyed()) {
+  const existingWindow = getGuestWindowByFrameName(frameName);
+  if (existingWindow) {
+    if (existingWindow.isDestroyed() || existingWindow.webContents.isDestroyed()) {
       // FIXME(t57ser): The webContents is destroyed for some reason, unregister the frame name
       unregisterFrameName(frameName);
     } else {
-      existingWebContents.loadURL(url);
-      return;
+      existingWindow.loadURL(url);
+      return existingWindow;
     }
   }
 
-  if (createWindow) {
-    const webContents = createWindow({
-      webContents: guest,
-      ...browserWindowOptions
-    });
-
-    if (guest != null) {
-      if (webContents !== guest) {
-        throw new Error('Invalid webContents. Created window should be connected to webContents passed with options object.');
-      }
-
-      webContents.loadURL(url, {
-        httpReferrer: referrer,
-        ...(postData && {
-          postData,
-          extraHeaders: formatPostDataHeaders(postData as Electron.UploadRawData[])
-        })
-      });
-
-      handleWindowLifecycleEvents({ embedder, frameName, guest, outlivesOpener });
-    }
-
-    return;
-  }
-
   const window = new BrowserWindow({
     webContents: guest,
     ...browserWindowOptions
@@ -103,9 +77,11 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
     });
   }
 
-  handleWindowLifecycleEvents({ embedder, frameName, guest: window.webContents, outlivesOpener });
+  handleWindowLifecycleEvents({ embedder, frameName, guest: window, outlivesOpener });
 
   embedder.emit('did-create-window', window, { url, frameName, options: browserWindowOptions, disposition, referrer, postData });
+
+  return window;
 }
 
 /**
@@ -116,12 +92,12 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
  */
 const handleWindowLifecycleEvents = function ({ embedder, guest, frameName, outlivesOpener }: {
   embedder: WebContents,
-  guest: WebContents,
+  guest: BrowserWindow,
   frameName: string,
   outlivesOpener: boolean
 }) {
   const closedByEmbedder = function () {
-    guest.removeListener('destroyed', closedByUser);
+    guest.removeListener('closed', closedByUser);
     guest.destroy();
   };
 
@@ -134,11 +110,11 @@ const handleWindowLifecycleEvents = function ({ embedder, guest, frameName, outl
   if (!outlivesOpener) {
     embedder.once('current-render-view-deleted' as any, closedByEmbedder);
   }
-  guest.once('destroyed', closedByUser);
+  guest.once('closed', closedByUser);
 
   if (frameName) {
     registerFrameNameToGuestWindow(frameName, guest);
-    guest.once('destroyed', function () {
+    guest.once('closed', function () {
       unregisterFrameName(frameName);
     });
   }

lib/common/api/net-client-request.ts

@@ -209,22 +209,6 @@ type ExtraURLLoaderOptions = {
    headers: Record<string, { name: string, value: string | string[] }>;
    allowNonHttpProtocols: boolean;
 }
-
-function validateHeader (name: any, value: any): void {
-  if (typeof name !== 'string') {
-    throw new TypeError('`name` should be a string in setHeader(name, value)');
-  }
-  if (value == null) {
-    throw new Error('`value` required in setHeader("' + name + '", value)');
-  }
-  if (!isValidHeaderName(name)) {
-    throw new Error(`Invalid header name: '${name}'`);
-  }
-  if (!isValidHeaderValue(value.toString())) {
-    throw new Error(`Invalid value for header '${name}': '${value}'`);
-  }
-}
-
 function parseOptions (optionsIn: ClientRequestConstructorOptions | string): NodeJS.CreateURLLoaderOptions & ExtraURLLoaderOptions {
   // eslint-disable-next-line node/no-deprecated-api
   const options: any = typeof optionsIn === 'string' ? url.parse(optionsIn) : { ...optionsIn };
@@ -291,7 +275,12 @@ function parseOptions (optionsIn: ClientRequestConstructorOptions | string): Nod
   };
   const headers: Record<string, string | string[]> = options.headers || {};
   for (const [name, value] of Object.entries(headers)) {
-    validateHeader(name, value);
+    if (!isValidHeaderName(name)) {
+      throw new Error(`Invalid header name: '${name}'`);
+    }
+    if (!isValidHeaderValue(value.toString())) {
+      throw new Error(`Invalid value for header '${name}': '${value}'`);
+    }
     const key = name.toLowerCase();
     urlLoaderOptions.headers[key] = { name, value };
   }
@@ -362,10 +351,21 @@ export class ClientRequest extends Writable implements Electron.ClientRequest {
   }
 
   setHeader (name: string, value: string) {
+    if (typeof name !== 'string') {
+      throw new TypeError('`name` should be a string in setHeader(name, value)');
+    }
+    if (value == null) {
+      throw new Error('`value` required in setHeader("' + name + '", value)');
+    }
     if (this._started || this._firstWrite) {
       throw new Error('Can\'t set headers after they are sent');
     }
-    validateHeader(name, value);
+    if (!isValidHeaderName(name)) {
+      throw new Error(`Invalid header name: '${name}'`);
+    }
+    if (!isValidHeaderValue(value.toString())) {
+      throw new Error(`Invalid value for header '${name}': '${value}'`);
+    }
 
     const key = name.toLowerCase();
     this._urlLoaderOptions.headers[key] = { name, value };

lib/node/asar-fs-wrapper.ts

@@ -1,5 +1,5 @@
 import { Buffer } from 'buffer';
-import { Dirent, constants } from 'fs';
+import { constants } from 'fs';
 import * as path from 'path';
 import * as util from 'util';
 
@@ -46,17 +46,7 @@ process._getOrCreateArchive = getOrCreateArchive;
 
 const asarRe = /\.asar/i;
 
-const {
-  getValidatedPath,
-  getOptions,
-  getDirent
-} = __non_webpack_require__('internal/fs/utils');
-
-const {
-  validateBoolean,
-  validateFunction
-} = __non_webpack_require__('internal/validators');
-
+const { getValidatedPath } = __non_webpack_require__('internal/fs/utils');
 // In the renderer node internals use the node global URL but we do not set that to be
 // the global URL instance.  We need to do instanceof checks against the internal URL impl
 const { URL: NodeURL } = __non_webpack_require__('internal/url');
@@ -88,23 +78,6 @@ const gid = process.getgid?.() ?? 0;
 
 const fakeTime = new Date();
 
-function getDirents (p: string, { 0: names, 1: types }: any[][]): Dirent[] {
-  for (let i = 0; i < names.length; i++) {
-    let type = types[i];
-    const info = splitPath(path.join(p, names[i]));
-    if (info.isAsar) {
-      const archive = getOrCreateArchive(info.asarPath);
-      if (!archive) continue;
-      const stats = archive.stat(info.filePath);
-      if (!stats) continue;
-      type = stats.type;
-    }
-    names[i] = getDirent(p, names[i], type);
-  }
-
-  return names;
-}
-
 enum AsarFileType {
   kFile = (constants as any).UV_DIRENT_FILE,
   kDirectory = (constants as any).UV_DIRENT_DIR,
@@ -689,27 +662,13 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     return (encoding) ? buffer.toString(encoding) : buffer;
   };
 
-  type ReaddirOptions = { encoding: BufferEncoding | null; withFileTypes?: false, recursive?: false } | undefined | null;
-  type ReaddirCallback = (err: NodeJS.ErrnoException | null, files: string[]) => void;
-
   const { readdir } = fs;
-  fs.readdir = function (pathArgument: string, options: ReaddirOptions, callback: ReaddirCallback) {
-    callback = typeof options === 'function' ? options : callback;
-    validateFunction(callback, 'callback');
-
-    options = getOptions(options);
-    pathArgument = getValidatedPath(pathArgument);
-
-    if (options?.recursive != null) {
-      validateBoolean(options?.recursive, 'options.recursive');
-    }
-
-    if (options?.recursive) {
-      nextTick(callback!, [null, readdirSyncRecursive(pathArgument, options)]);
-      return;
-    }
-
+  fs.readdir = function (pathArgument: string, options?: { encoding?: string | null; withFileTypes?: boolean } | null, callback?: Function) {
     const pathInfo = splitPath(pathArgument);
+    if (typeof options === 'function') {
+      callback = options;
+      options = undefined;
+    }
     if (!pathInfo.isAsar) return readdir.apply(this, arguments);
     const { asarPath, filePath } = pathInfo;
 
@@ -746,62 +705,12 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     nextTick(callback!, [null, files]);
   };
 
-  const { readdir: readdirPromise } = require('fs').promises;
-  fs.promises.readdir = async function (pathArgument: string, options: ReaddirOptions) {
-    options = getOptions(options);
-    pathArgument = getValidatedPath(pathArgument);
+  fs.promises.readdir = util.promisify(fs.readdir);
 
-    if (options?.recursive != null) {
-      validateBoolean(options?.recursive, 'options.recursive');
-    }
-
-    if (options?.recursive) {
-      return readdirRecursive(pathArgument, options);
-    }
-
-    const pathInfo = splitPath(pathArgument);
-    if (!pathInfo.isAsar) return readdirPromise(pathArgument, options);
-    const { asarPath, filePath } = pathInfo;
-
-    const archive = getOrCreateArchive(asarPath);
-    if (!archive) {
-      return Promise.reject(createError(AsarError.INVALID_ARCHIVE, { asarPath }));
-    }
-
-    const files = archive.readdir(filePath);
-    if (!files) {
-      return Promise.reject(createError(AsarError.NOT_FOUND, { asarPath, filePath }));
-    }
-
-    if (options?.withFileTypes) {
-      const dirents = [];
-      for (const file of files) {
-        const childPath = path.join(filePath, file);
-        const stats = archive.stat(childPath);
-        if (!stats) {
-          throw createError(AsarError.NOT_FOUND, { asarPath, filePath: childPath });
-        }
-        dirents.push(new fs.Dirent(file, stats.type));
-      }
-      return Promise.resolve(dirents);
-    }
-
-    return Promise.resolve(files);
-  };
+  type ReaddirSyncOptions = { encoding: BufferEncoding | null; withFileTypes?: false };
 
   const { readdirSync } = fs;
-  fs.readdirSync = function (pathArgument: string, options: ReaddirOptions) {
-    options = getOptions(options);
-    pathArgument = getValidatedPath(pathArgument);
-
-    if (options?.recursive != null) {
-      validateBoolean(options?.recursive, 'options.recursive');
-    }
-
-    if (options?.recursive) {
-      return readdirSyncRecursive(pathArgument, options);
-    }
-
+  fs.readdirSync = function (pathArgument: string, options: ReaddirSyncOptions | BufferEncoding | null) {
     const pathInfo = splitPath(pathArgument);
     if (!pathInfo.isAsar) return readdirSync.apply(this, arguments);
     const { asarPath, filePath } = pathInfo;
@@ -816,7 +725,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
       throw createError(AsarError.NOT_FOUND, { asarPath, filePath });
     }
 
-    if (options?.withFileTypes) {
+    if (options && (options as ReaddirSyncOptions).withFileTypes) {
       const dirents = [];
       for (const file of files) {
         const childPath = path.join(filePath, file);
@@ -832,8 +741,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     return files;
   };
 
-  const binding = internalBinding('fs');
-  const { internalModuleReadJSON, kUsePromises } = binding;
+  const { internalModuleReadJSON } = internalBinding('fs');
   internalBinding('fs').internalModuleReadJSON = (pathArgument: string) => {
     const pathInfo = splitPath(pathArgument);
     if (!pathInfo.isAsar) return internalModuleReadJSON(pathArgument);
@@ -879,187 +787,6 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     return (stats.type === AsarFileType.kDirectory) ? 1 : 0;
   };
 
-  async function readdirRecursive (originalPath: string, options: ReaddirOptions) {
-    const result: any[] = [];
-
-    const pathInfo = splitPath(originalPath);
-    let queue: [string, string[]][] = [];
-    const withFileTypes = Boolean(options?.withFileTypes);
-
-    let initialItem = [];
-    if (pathInfo.isAsar) {
-      const archive = getOrCreateArchive(pathInfo.asarPath);
-      if (!archive) return result;
-      const files = archive.readdir(pathInfo.filePath);
-      if (!files) return result;
-
-      // If we're in an asar dir, we need to ensure the result is in the same format as the
-      // native call to readdir withFileTypes i.e. an array of arrays.
-      initialItem = files;
-      if (withFileTypes) {
-        initialItem = [
-          [...initialItem], initialItem.map((p: string) => {
-            return internalBinding('fs').internalModuleStat(path.join(originalPath, p));
-          })
-        ];
-      }
-    } else {
-      initialItem = await binding.readdir(
-        path.toNamespacedPath(originalPath),
-        options!.encoding,
-        withFileTypes,
-        kUsePromises
-      );
-    }
-
-    queue = [[originalPath, initialItem]];
-
-    if (withFileTypes) {
-      while (queue.length > 0) {
-        // @ts-expect-error this is a valid array destructure assignment.
-        const { 0: pathArg, 1: readDir } = queue.pop();
-        for (const dirent of getDirents(pathArg, readDir)) {
-          result.push(dirent);
-          if (dirent.isDirectory()) {
-            const direntPath = path.join(pathArg, dirent.name);
-            const info = splitPath(direntPath);
-            let readdirResult;
-            if (info.isAsar) {
-              const archive = getOrCreateArchive(info.asarPath);
-              if (!archive) continue;
-              const files = archive.readdir(info.filePath);
-              if (!files) continue;
-
-              readdirResult = [
-                [...files], files.map((p: string) => {
-                  return internalBinding('fs').internalModuleStat(path.join(direntPath, p));
-                })
-              ];
-            } else {
-              readdirResult = await binding.readdir(
-                direntPath,
-                options!.encoding,
-                true,
-                kUsePromises
-              );
-            }
-            queue.push([direntPath, readdirResult]);
-          }
-        }
-      }
-    } else {
-      while (queue.length > 0) {
-        // @ts-expect-error this is a valid array destructure assignment.
-        const { 0: pathArg, 1: readDir } = queue.pop();
-        for (const ent of readDir) {
-          const direntPath = path.join(pathArg, ent);
-          const stat = internalBinding('fs').internalModuleStat(direntPath);
-          result.push(path.relative(originalPath, direntPath));
-
-          if (stat === 1) {
-            const subPathInfo = splitPath(direntPath);
-            let item = [];
-            if (subPathInfo.isAsar) {
-              const archive = getOrCreateArchive(subPathInfo.asarPath);
-              if (!archive) return;
-              const files = archive.readdir(subPathInfo.filePath);
-              if (!files) return result;
-              item = files;
-            } else {
-              item = await binding.readdir(
-                path.toNamespacedPath(direntPath),
-                options!.encoding,
-                false,
-                kUsePromises
-              );
-            }
-            queue.push([direntPath, item]);
-          }
-        }
-      }
-    }
-
-    return result;
-  }
-
-  function readdirSyncRecursive (basePath: string, options: ReaddirOptions) {
-    const withFileTypes = Boolean(options!.withFileTypes);
-    const encoding = options!.encoding;
-
-    const readdirResults: string[] = [];
-    const pathsQueue = [basePath];
-
-    function read (pathArg: string) {
-      let readdirResult;
-
-      const pathInfo = splitPath(pathArg);
-      if (pathInfo.isAsar) {
-        const { asarPath, filePath } = pathInfo;
-        const archive = getOrCreateArchive(asarPath);
-        if (!archive) return;
-
-        readdirResult = archive.readdir(filePath);
-        if (!readdirResult) return;
-        // If we're in an asar dir, we need to ensure the result is in the same format as the
-        // native call to readdir withFileTypes i.e. an array of arrays.
-        if (withFileTypes) {
-          readdirResult = [
-            [...readdirResult], readdirResult.map((p: string) => {
-              return internalBinding('fs').internalModuleStat(path.join(pathArg, p));
-            })
-          ];
-        }
-      } else {
-        readdirResult = binding.readdir(
-          path.toNamespacedPath(pathArg),
-          encoding,
-          withFileTypes
-        );
-      }
-
-      if (readdirResult === undefined) return;
-
-      if (withFileTypes) {
-        const length = readdirResult[0].length;
-        for (let i = 0; i < length; i++) {
-          const resultPath = path.join(pathArg, readdirResult[0][i]);
-          const info = splitPath(resultPath);
-
-          let type = readdirResult[1][i];
-          if (info.isAsar) {
-            const archive = getOrCreateArchive(info.asarPath);
-            if (!archive) return;
-            const stats = archive.stat(info.filePath);
-            if (!stats) continue;
-            type = stats.type;
-          }
-
-          const dirent = getDirent(pathArg, readdirResult[0][i], type);
-
-          readdirResults.push(dirent);
-          if (dirent.isDirectory()) {
-            pathsQueue.push(path.join(dirent.path, dirent.name));
-          }
-        }
-      } else {
-        for (let i = 0; i < readdirResult.length; i++) {
-          const resultPath = path.join(pathArg, readdirResult[i]);
-          const relativeResultPath = path.relative(basePath, resultPath);
-          const stat = internalBinding('fs').internalModuleStat(resultPath);
-
-          readdirResults.push(relativeResultPath);
-          if (stat === 1) pathsQueue.push(resultPath);
-        }
-      }
-    }
-
-    for (let i = 0; i < pathsQueue.length; i++) {
-      read(pathsQueue[i]);
-    }
-
-    return readdirResults;
-  }
-
   // Calling mkdir for directory inside asar archive should throw ENOTDIR
   // error, but on Windows it throws ENOENT.
   if (process.platform === 'win32') {

package.json

@@ -9,7 +9,7 @@
     "@electron/docs-parser": "^1.2.0",
     "@electron/fiddle-core": "^1.0.4",
     "@electron/github-app-auth": "^2.0.0",
-    "@electron/lint-roller": "^1.9.0",
+    "@electron/lint-roller": "^1.12.1",
     "@electron/typescript-definitions": "^8.15.2",
     "@octokit/rest": "^19.0.7",
     "@primer/octicons": "^10.0.0",

patches/chromium/.patches

@@ -129,3 +129,6 @@ build_run_reclient_cfg_generator_after_chrome.patch
 fix_suppress_clang_-wimplicit-const-int-float-conversion_in.patch
 fix_getcursorscreenpoint_wrongly_returns_0_0.patch
 fix_add_support_for_skipping_first_2_no-op_refreshes_in_thumb_cap.patch
+refactor_expose_file_system_access_blocklist.patch
+cherry-pick-013961609785.patch
+cherry-pick-b2cc7b7ac538.patch

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -23,10 +23,10 @@ index 289a8c25f14cad42b9178ce94b11f67870be7434..5b91eadb698eeb5a87c9d0b2edf7e5cc
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 0eed4c5645d4e119393e9e0fbd770847eaf01030..95eb5224b90268937c1d24190c1234a5f42cb235 100644
+index 0ac529a0b19d0d88b57bbab89f60b888c480051e..07e7daef4c2c2cdeb09ac1522046bcf5a59b5130 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4684,6 +4684,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4687,6 +4687,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  
@@ -40,10 +40,10 @@ index 0eed4c5645d4e119393e9e0fbd770847eaf01030..95eb5224b90268937c1d24190c1234a5
                                                 int world_id) {
    for (auto& observer : observers_)
 diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
-index e3350ff445fcffca7efb2b11eba66f4c84e05f14..46f2142ac5bb840f20f244d96384024431ea11c6 100644
+index b32fbb5887cb2719594a85a3177b5872208c1034..6f742235d7d67cc14624debb7378d873ce5ae798 100644
 --- a/content/renderer/render_frame_impl.h
 +++ b/content/renderer/render_frame_impl.h
-@@ -640,6 +640,8 @@ class CONTENT_EXPORT RenderFrameImpl
+@@ -642,6 +642,8 @@ class CONTENT_EXPORT RenderFrameImpl
    void DidObserveLayoutShift(double score, bool after_input_or_scroll) override;
    void DidCreateScriptContext(v8::Local<v8::Context> context,
                                int world_id) override;

patches/chromium/add_electron_deps_to_license_credits_file.patch

@@ -7,7 +7,7 @@ Ensure that licenses for the dependencies introduced by Electron
 are included in `LICENSES.chromium.html`
 
 diff --git a/tools/licenses/licenses.py b/tools/licenses/licenses.py
-index cc7b17e13c4c8b9e483df9a097b23935ab2e56bc..b89810659dab27dd8150c0b7185ea2b679ab98a4 100755
+index f3a8ba3756a19beb286a3f7bba52399705bf59bf..7cf72db56d3bc71cf6fb2b3f88a80e7866db1598 100755
 --- a/tools/licenses/licenses.py
 +++ b/tools/licenses/licenses.py
 @@ -336,6 +336,31 @@ SPECIAL_CASES = {

patches/chromium/add_ui_scopedcliboardwriter_writeunsaferawdata.patch

@@ -8,10 +8,10 @@ was removed as part of the Raw Clipboard API scrubbing.
 https://bugs.chromium.org/p/chromium/issues/detail?id=1217643
 
 diff --git a/ui/base/clipboard/scoped_clipboard_writer.cc b/ui/base/clipboard/scoped_clipboard_writer.cc
-index 6095ece239ae3b3ef6795d54e5c8bc4d1bb730ff..43c39f61e7d040c9923dac60ddc50fce2e3ee038 100644
+index 6022a0af4241fe65bd03d7cbf95785e8879dc78e..ec9e4c6ece9014b66e7d65e99cda2b956a9a5d80 100644
 --- a/ui/base/clipboard/scoped_clipboard_writer.cc
 +++ b/ui/base/clipboard/scoped_clipboard_writer.cc
-@@ -227,6 +227,16 @@ void ScopedClipboardWriter::WriteEncodedDataTransferEndpointForTesting(
+@@ -229,6 +229,16 @@ void ScopedClipboardWriter::WriteEncodedDataTransferEndpointForTesting(
  }
  #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
  
@@ -29,7 +29,7 @@ index 6095ece239ae3b3ef6795d54e5c8bc4d1bb730ff..43c39f61e7d040c9923dac60ddc50fce
    objects_.clear();
    platform_representations_.clear();
 diff --git a/ui/base/clipboard/scoped_clipboard_writer.h b/ui/base/clipboard/scoped_clipboard_writer.h
-index 6328d90cd1aca85c481b96bf859f0e9acb9de055..9aad0ae0134387fb2821d098a7d015ddd445de78 100644
+index 08fce03a51ded80c8dfe59f17a438ace21f8daa7..ffbd0cbff14ae7af2d00d5949f6b608e998e0429 100644
 --- a/ui/base/clipboard/scoped_clipboard_writer.h
 +++ b/ui/base/clipboard/scoped_clipboard_writer.h
 @@ -89,6 +89,10 @@ class COMPONENT_EXPORT(UI_BASE_CLIPBOARD) ScopedClipboardWriter {

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -51,7 +51,7 @@ index a94977d7a76ae9952bbba0efe59a7cb5021a1c84..11c4f890eaeae1329ca5a6634a698aef
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index 4c78692adb777b8e0a8fa2e2350775b7e2ef676a..fa18900586854c5d6b936d6b9e6fac1c9e571bce 100644
+index cb9b21a3d3e99558e6892e00e73e550f68571daf..f18a3d6b4287d986c31db3385541cd20db68ecd5 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
 @@ -553,8 +553,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
@@ -116,7 +116,7 @@ index c4348be90db209a757f21cbc518e1244fe0954d5..1ee953ad860291cdc1095880f6646d1d
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 735b6ae3eefaeb9c558a1cf63371f533685cc5db..986b4c9f35431ed14989d5f69fc09d17a2c3fda9 100644
+index fb042e637c831e3de72d7ed6fd33db9df5976c18..689010902c8508b85208618cc11b922adf10c08e 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
 @@ -2431,6 +2431,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
@@ -130,7 +130,7 @@ index 735b6ae3eefaeb9c558a1cf63371f533685cc5db..986b4c9f35431ed14989d5f69fc09d17
    bool storing_in_bfcache = new_state->is_in_back_forward_cache &&
                              !old_state->is_in_back_forward_cache;
    bool restoring_from_bfcache = !new_state->is_in_back_forward_cache &&
-@@ -3932,10 +3936,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -3937,10 +3941,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  

patches/chromium/blink_local_frame.patch

@@ -49,7 +49,7 @@ index 0a742bbbd5e8e1eb3610cc32f785f779e8907e75..26967019244d409dadf4533405d4d5d2
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 81e90b80d4ff25c7003e4e98f071848be98280d6..92cfe0001933cd18ecb7384ead1dda26f563e62b 100644
+index b89cc3f1dc53bc04793ebd2b4075df6e60193a73..0ba08a946155ee4d04a693cf26840a95f315b9a3 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
 @@ -684,10 +684,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {

patches/chromium/boringssl_build_gn.patch

@@ -6,7 +6,7 @@ Subject: boringssl BUILD.gn
 Build BoringSSL with some extra functions that nodejs needs.
 
 diff --git a/third_party/boringssl/BUILD.gn b/third_party/boringssl/BUILD.gn
-index 6a0e44685b3208663e89287894c55be8e1285a1a..084d29bf0a38f73aeeceb9a6649ae347a7ba9c9a 100644
+index feaef4bfd7f8c04c32f555ab2c61ec838844e355..ed49c4a14a0cd8c3ff0f7ed9c5dd78b385c623ea 100644
 --- a/third_party/boringssl/BUILD.gn
 +++ b/third_party/boringssl/BUILD.gn
 @@ -56,6 +56,21 @@ config("no_asm_config") {
@@ -28,6 +28,6 @@ index 6a0e44685b3208663e89287894c55be8e1285a1a..084d29bf0a38f73aeeceb9a6649ae347
 +  ]
 +}
 +
- if (enable_rust_boringssl) {
+ if (enable_rust) {
    rust_bindgen("raw_bssl_sys_bindings") {
      header = "src/rust/bssl-sys/wrapper.h"

patches/chromium/build_allow_electron_to_use_exec_script.patch

@@ -6,10 +6,10 @@ Subject: build: allow electron to use exec_script
 This is similar to the //build usecase so we're OK adding ourselves here
 
 diff --git a/.gn b/.gn
-index 6abe8e52e11154d5f3cb7c80d57754b1a3819e46..22adbcc359a53405b0c1b4dbc170a5c896eb2b5c 100644
+index afe0b3e90fafb9413cc49198cf3ad5d66d433b54..6b83b22994998ba98895144ec81b4cdff1b0e0db 100644
 --- a/.gn
 +++ b/.gn
-@@ -173,4 +173,8 @@ exec_script_whitelist =
+@@ -167,4 +167,8 @@ exec_script_whitelist =
  
        "//tools/grit/grit_rule.gni",
        "//tools/gritsettings/BUILD.gn",

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -33,10 +33,10 @@ index 4af5b8d5da1c0ae4c5603f49e3a1dbfec422f55e..d21e450d1ee387a72bbe601412856260
            "//base",
            "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 34cdca093a7fb4cf849c2964e6542558966bf3b1..e0ac5b6c7412a017077c342ef2f3d13cc0123008 100644
+index 0386b3db3ce09295e4a0b9490c19e85d1e03eb2d..f6d60cc17135dcb7a0125f7c3cc0286307671dff 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4793,7 +4793,7 @@ static_library("browser") {
+@@ -4800,7 +4800,7 @@ static_library("browser") {
  
      # On Windows, the hashes are embedded in //chrome:chrome_initial rather
      # than here in :chrome_dll.
@@ -46,10 +46,10 @@ index 34cdca093a7fb4cf849c2964e6542558966bf3b1..e0ac5b6c7412a017077c342ef2f3d13c
        sources += [ "certificate_viewer_stub.cc" ]
      }
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index bfb0033d1536941b52592a834b0c64d15cc1ed2c..2313065706e3c4531dfa8179a8b0ff26266aa7d9 100644
+index d058dee3b853d66ccc5727667382b4821d75577b..3dbbbed08ca3221cf4d949a0c536ea104f6b98d2 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -7195,9 +7195,12 @@ test("unit_tests") {
+@@ -7203,9 +7203,12 @@ test("unit_tests") {
        "//chrome/browser/safe_browsing/incident_reporting/verifier_test:verifier_test_dll_2",
      ]
  
@@ -63,7 +63,7 @@ index bfb0033d1536941b52592a834b0c64d15cc1ed2c..2313065706e3c4531dfa8179a8b0ff26
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -8176,6 +8179,10 @@ test("unit_tests") {
+@@ -8186,6 +8189,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -74,7 +74,7 @@ index bfb0033d1536941b52592a834b0c64d15cc1ed2c..2313065706e3c4531dfa8179a8b0ff26
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -8245,7 +8252,6 @@ test("unit_tests") {
+@@ -8255,7 +8262,6 @@ test("unit_tests") {
      }
  
      deps += [

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 06360bebe3baaa7571c412c7182ccd1fd1078fda..c36367b28a627f7e6e77bcf3fc10f907b131523b 100644
+index 2c985367d1c6268994b9973d3db2e065a80922eb..812708f24cf9e389d5f0a813c406fec082a795b4 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -8389,6 +8389,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -8391,6 +8391,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index 06360bebe3baaa7571c412c7182ccd1fd1078fda..c36367b28a627f7e6e77bcf3fc10f907
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index bfb696d17099ce153366f031a56b6ac74ce28d38..6475b9fd000fb83c4562f7d91a30c80e5dddf35e 100644
+index a3074afab886754b4d6a7e9a5f7f6eca6e5d3aa9..45ac0c129cff1187aa14d989470235de4f0419f1 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -4585,6 +4585,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -4586,6 +4586,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
  
    auto* new_contents_impl = new_contents.get();
  
@@ -37,7 +37,7 @@ index bfb696d17099ce153366f031a56b6ac74ce28d38..6475b9fd000fb83c4562f7d91a30c80e
    // If the new frame has a name, make sure any SiteInstances that can find
    // this named frame have proxies for it.  Must be called after
    // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
-@@ -4626,12 +4632,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -4627,12 +4633,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -66,10 +66,10 @@ index 268f150c1cc987ea020192a86ab886ed206a0064..05856b853112072a18ec16589f2b442f
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index 05d036b9262689f2103a3df1ee30b7ec16c96a34..952356fa426c6cb7df85b837ccdff3661fa90531 100644
+index 465de2f945f3afff3107ce750a320696c4db920f..6635f7d3932a8cfa133d830860b69915690b91ad 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -725,6 +725,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -718,6 +718,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -79,7 +79,7 @@ index 05d036b9262689f2103a3df1ee30b7ec16c96a34..952356fa426c6cb7df85b837ccdff366
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 48e6a6c74004650b5b07ce24f6476d7c9a306236..b777041ec1111444d690d1d188dd622ce4677d4c 100644
+index 9e1cf142f77d221aad87cdbc17054f06ce7f28cf..1d5e065aa06bc3175f9abdce25e31864aa06f78d 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
 @@ -183,6 +183,7 @@ class NetworkService;
@@ -90,7 +90,7 @@ index 48e6a6c74004650b5b07ce24f6476d7c9a306236..b777041ec1111444d690d1d188dd622c
  }  // namespace network
  
  namespace sandbox {
-@@ -1221,6 +1222,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1210,6 +1211,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -148,10 +148,10 @@ index c44ef9991cbb07ab2895a28a890466ce1bc8235f..1384a322617b4be4b4ffbda5c44b41ac
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index e131d7d256bad0ce6080e9817f196e60ca6c883c..0eed4c5645d4e119393e9e0fbd770847eaf01030 100644
+index f362ee7c232419eba8f00422fa5379e6af96eae7..0ac529a0b19d0d88b57bbab89f60b888c480051e 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -6686,6 +6686,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
+@@ -6691,6 +6691,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
            request.HasUserGesture(), GetWebFrame()->IsAdFrame(),
            GetWebFrame()->IsAdScriptInStack());
  

patches/chromium/cherry-pick-013961609785.patch

@@ -0,0 +1,139 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: John Stiles <johnstiles@google.com>
+Date: Thu, 28 Mar 2024 00:51:13 +0000
+Subject: Detect overflow in JPEG image size calculations.
+
+Bug: 330756841
+Change-Id: Ib30493152e08fd2347f76de276c5805d6fef9a7d
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5402199
+Commit-Queue: John Stiles <johnstiles@google.com>
+Reviewed-by: Daniel Cheng <dcheng@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1279376}
+
+diff --git a/ui/gfx/codec/jpeg_codec.cc b/ui/gfx/codec/jpeg_codec.cc
+index a4de17094e69b36bb2c34b3b4f70eece9c088cc3..595966d724146df33701b1225e659ec085ca115b 100644
+--- a/ui/gfx/codec/jpeg_codec.cc
++++ b/ui/gfx/codec/jpeg_codec.cc
+@@ -6,10 +6,12 @@
+ 
+ #include <setjmp.h>
+ 
++#include <climits>
+ #include <memory>
+ #include <ostream>
+ 
+ #include "base/notreached.h"
++#include "base/numerics/checked_math.h"
+ #include "third_party/skia/include/core/SkBitmap.h"
+ #include "third_party/skia/include/core/SkColorPriv.h"
+ #include "ui/gfx/codec/vector_wstream.h"
+@@ -244,16 +246,27 @@ bool JPEGCodec::Decode(const unsigned char* input, size_t input_size,
+ 
+   jpeg_start_decompress(cinfo.get());
+ 
+-  // FIXME(brettw) we may want to allow the capability for callers to request
+-  // how to align row lengths as we do for the compressor.
+-  int row_read_stride = cinfo->output_width * cinfo->output_components;
++  // Confirm that the image width * height * component-size fits within an int.
++  // Note that image width and height are unsigned ints (JDIMENSION) in memory,
++  // but the file format only holds a uint16.
++  base::CheckedNumeric<size_t> checked_output_size = cinfo->output_width;
++  checked_output_size *= cinfo->output_components;
+ 
+-  // Create memory for a decoded image and write decoded lines to the memory
+-  // without conversions same as JPEGCodec::Encode().
+-  int row_write_stride = row_read_stride;
+-  output->resize(row_write_stride * cinfo->output_height);
++  // This shouldn't ever overflow a `size_t`; it's multiplying a uint16 by four.
++  size_t row_write_stride = checked_output_size.ValueOrDie();
+ 
+-  for (int row = 0; row < static_cast<int>(cinfo->output_height); row++) {
++  // Extremely large JPEGs could overflow here if `size_t` is 32 bits.
++  checked_output_size *= cinfo->output_height;
++  size_t output_size = checked_output_size.ValueOrDefault(INT_MAX);
++  if (output_size >= INT_MAX) {
++    return false;
++  }
++
++  // Create memory for a decoded image.
++  output->resize(output_size);
++
++  // Write decoded lines to the memory.
++  for (unsigned int row = 0; row < cinfo->output_height; row++) {
+     unsigned char* rowptr = &(*output)[row * row_write_stride];
+     if (!jpeg_read_scanlines(cinfo.get(), &rowptr, 1))
+       return false;
+diff --git a/ui/gfx/codec/jpeg_codec_unittest.cc b/ui/gfx/codec/jpeg_codec_unittest.cc
+index 9f1bee95e0e476b34382aceffbf6df3bdde095ea..b446fe77896e254820db77afe7ed4e48b8525c79 100644
+--- a/ui/gfx/codec/jpeg_codec_unittest.cc
++++ b/ui/gfx/codec/jpeg_codec_unittest.cc
+@@ -61,6 +61,53 @@ const uint8_t kTopSitesMigrationTestImage[] =
+     "\xfa\xff\xda\x00\x0c\x03\x01\x00\x02\x11\x03\x11\x00\x3f\x00\xf9"
+     "\xd2\x8a\x28\xaf\xc3\x0f\xf5\x4c\xff\xd9";
+ 
++// This is a copy of the above JPEG, with the Start-of-Frame header manually
++// rewritten to indicate an image size of 25000x25000. An image this large would
++// require more than 2GB of RAM to decode, so the decoder will reject the image
++// as soon as the header is parsed.
++const uint8_t kExtremelyLargeTestImage[] =
++    "\xff\xd8\xff\xe0\x00\x10\x4a\x46\x49\x46\x00\x01\x01\x00\x00\x01"
++    "\x00\x01\x00\x00\xff\xdb\x00\x43\x00\x03\x02\x02\x03\x02\x02\x03"
++    "\x03\x03\x03\x04\x03\x03\x04\x05\x08\x05\x05\x04\x04\x05\x0a\x07"
++    "\x07\x06\x08\x0c\x0a\x0c\x0c\x0b\x0a\x0b\x0b\x0d\x0e\x12\x10\x0d"
++    "\x0e\x11\x0e\x0b\x0b\x10\x16\x10\x11\x13\x14\x15\x15\x15\x0c\x0f"
++    "\x17\x18\x16\x14\x18\x12\x14\x15\x14\xff\xdb\x00\x43\x01\x03\x04"
++    "\x04\x05\x04\x05\x09\x05\x05\x09\x14\x0d\x0b\x0d\x14\x14\x14\x14"
++    "\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14"
++    "\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14"
++    "\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\xff\xc0"
++    "\x00\x11\x08\x61\xa8\x61\xa8\x03\x01\x22\x00\x02\x11\x01\x03\x11"
++    //             ^^  ^^  ^^  ^^   image size forced to 25000x25000
++    "\x01\xff\xc4\x00\x1f\x00\x00\x01\x05\x01\x01\x01\x01\x01\x01\x00"
++    "\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09"
++    "\x0a\x0b\xff\xc4\x00\xb5\x10\x00\x02\x01\x03\x03\x02\x04\x03\x05"
++    "\x05\x04\x04\x00\x00\x01\x7d\x01\x02\x03\x00\x04\x11\x05\x12\x21"
++    "\x31\x41\x06\x13\x51\x61\x07\x22\x71\x14\x32\x81\x91\xa1\x08\x23"
++    "\x42\xb1\xc1\x15\x52\xd1\xf0\x24\x33\x62\x72\x82\x09\x0a\x16\x17"
++    "\x18\x19\x1a\x25\x26\x27\x28\x29\x2a\x34\x35\x36\x37\x38\x39\x3a"
++    "\x43\x44\x45\x46\x47\x48\x49\x4a\x53\x54\x55\x56\x57\x58\x59\x5a"
++    "\x63\x64\x65\x66\x67\x68\x69\x6a\x73\x74\x75\x76\x77\x78\x79\x7a"
++    "\x83\x84\x85\x86\x87\x88\x89\x8a\x92\x93\x94\x95\x96\x97\x98\x99"
++    "\x9a\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xb2\xb3\xb4\xb5\xb6\xb7"
++    "\xb8\xb9\xba\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xd2\xd3\xd4\xd5"
++    "\xd6\xd7\xd8\xd9\xda\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xf1"
++    "\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xff\xc4\x00\x1f\x01\x00\x03"
++    "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x01"
++    "\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\xff\xc4\x00\xb5\x11\x00"
++    "\x02\x01\x02\x04\x04\x03\x04\x07\x05\x04\x04\x00\x01\x02\x77\x00"
++    "\x01\x02\x03\x11\x04\x05\x21\x31\x06\x12\x41\x51\x07\x61\x71\x13"
++    "\x22\x32\x81\x08\x14\x42\x91\xa1\xb1\xc1\x09\x23\x33\x52\xf0\x15"
++    "\x62\x72\xd1\x0a\x16\x24\x34\xe1\x25\xf1\x17\x18\x19\x1a\x26\x27"
++    "\x28\x29\x2a\x35\x36\x37\x38\x39\x3a\x43\x44\x45\x46\x47\x48\x49"
++    "\x4a\x53\x54\x55\x56\x57\x58\x59\x5a\x63\x64\x65\x66\x67\x68\x69"
++    "\x6a\x73\x74\x75\x76\x77\x78\x79\x7a\x82\x83\x84\x85\x86\x87\x88"
++    "\x89\x8a\x92\x93\x94\x95\x96\x97\x98\x99\x9a\xa2\xa3\xa4\xa5\xa6"
++    "\xa7\xa8\xa9\xaa\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xc2\xc3\xc4"
++    "\xc5\xc6\xc7\xc8\xc9\xca\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xe2"
++    "\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9"
++    "\xfa\xff\xda\x00\x0c\x03\x01\x00\x02\x11\x03\x11\x00\x3f\x00\xf9"
++    "\xd2\x8a\x28\xaf\xc3\x0f\xf5\x4c\xff\xd9";
++
+ }  // namespace
+ 
+ namespace gfx {
+@@ -211,4 +258,15 @@ TEST(JPEGCodec, ParallelEncoding) {
+   encode_loop.Run();
+ }
+ 
++TEST(JPEGCodec, ExtremelyLargeImage) {
++  std::vector<unsigned char> output;
++  int outw, outh;
++  bool ok = JPEGCodec::Decode(kExtremelyLargeTestImage,
++                              std::size(kExtremelyLargeTestImage),
++                              JPEGCodec::FORMAT_RGBA, &output, &outw, &outh);
++  EXPECT_FALSE(ok);
++  EXPECT_EQ(outw, 25000);
++  EXPECT_EQ(outh, 25000);
++}
++
+ }  // namespace gfx

patches/chromium/cherry-pick-b2cc7b7ac538.patch

@@ -0,0 +1,99 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ken Rockot <rockot@google.com>
+Date: Wed, 8 May 2024 15:32:48 +0000
+Subject: Viz: Tolerate SinkGroup destruction during submit
+
+Fixed: 339266700
+Change-Id: I8c0ea8c540948016346b00db64fe33260d2446f0
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5523748
+Reviewed-by: Kyle Charbonneau <kylechar@chromium.org>
+Reviewed-by: Jonathan Ross <jonross@chromium.org>
+Commit-Queue: Ken Rockot <rockot@google.com>
+Cr-Commit-Position: refs/heads/main@{#1298119}
+
+diff --git a/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc b/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc
+index a43e274a920a7cc189652c29eb2fe4a09ab66ded..9fefc2446d9c95964db512e4c98654c3fcc4e8b4 100644
+--- a/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc
++++ b/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc
+@@ -4,12 +4,15 @@
+ 
+ #include "components/viz/service/frame_sinks/frame_sink_bundle_impl.h"
+ 
++#include <map>
+ #include <utility>
+ #include <vector>
+ 
+ #include "base/check.h"
+ #include "base/functional/bind.h"
++#include "base/memory/raw_ptr.h"
+ #include "base/memory/raw_ref.h"
++#include "base/memory/weak_ptr.h"
+ #include "build/build_config.h"
+ #include "components/viz/service/frame_sinks/compositor_frame_sink_impl.h"
+ #include "components/viz/service/frame_sinks/frame_sink_manager_impl.h"
+@@ -45,6 +48,10 @@ class FrameSinkBundleImpl::SinkGroup : public BeginFrameObserver {
+ 
+   bool IsEmpty() const { return frame_sinks_.empty(); }
+ 
++  base::WeakPtr<SinkGroup> GetWeakPtr() {
++    return weak_ptr_factory_.GetWeakPtr();
++  }
++
+   void AddFrameSink(uint32_t sink_id) {
+     frame_sinks_.insert(sink_id);
+ 
+@@ -206,6 +213,8 @@ class FrameSinkBundleImpl::SinkGroup : public BeginFrameObserver {
+   std::set<uint32_t> unacked_submissions_;
+ 
+   BeginFrameArgs last_used_begin_frame_args_;
++
++  base::WeakPtrFactory<SinkGroup> weak_ptr_factory_{this};
+ };
+ 
+ FrameSinkBundleImpl::FrameSinkBundleImpl(
+@@ -282,8 +291,9 @@ void FrameSinkBundleImpl::SetWantsBeginFrameAcks(uint32_t sink_id) {
+ 
+ void FrameSinkBundleImpl::Submit(
+     std::vector<mojom::BundledFrameSubmissionPtr> submissions) {
+-  std::set<SinkGroup*> groups;
+-  std::set<SinkGroup*> affected_groups;
++  std::map<raw_ptr<SinkGroup>, base::WeakPtr<SinkGroup>> groups;
++  std::map<raw_ptr<SinkGroup>, base::WeakPtr<SinkGroup>> affected_groups;
++
+   // Count the frame submissions before processing anything. This ensures that
+   // any frames submitted here will be acked together in a batch, and not acked
+   // individually in case they happen to ack synchronously within
+@@ -294,10 +304,10 @@ void FrameSinkBundleImpl::Submit(
+   // through to the client without batching.
+   for (auto& submission : submissions) {
+     if (auto* group = GetSinkGroup(submission->sink_id)) {
+-      groups.insert(group);
++      groups.emplace(group, group->GetWeakPtr());
+       if (submission->data->is_frame()) {
+         group->WillSubmitFrame(submission->sink_id);
+-        affected_groups.insert(group);
++        affected_groups.emplace(group, group->GetWeakPtr());
+       }
+     }
+   }
+@@ -327,12 +337,16 @@ void FrameSinkBundleImpl::Submit(
+     }
+   }
+ 
+-  for (auto* group : groups) {
+-    group->DidFinishFrame();
++  for (const auto& [unsafe_group, weak_group] : groups) {
++    if (weak_group) {
++      weak_group->DidFinishFrame();
++    }
+   }
+ 
+-  for (auto* group : affected_groups) {
+-    group->FlushMessages();
++  for (const auto& [unsafe_group, weak_group] : affected_groups) {
++    if (weak_group) {
++      weak_group->FlushMessages();
++    }
+   }
+ }
+ 

patches/chromium/chore_add_electron_deps_to_gitignores.patch

@@ -18,7 +18,7 @@ index a55c4c5bbbb298bce97fe7c1072e5bca4c032c73..e6ffcfcefd2aa29a0d761051e6169950
  /googleurl
  /gpu/gles2_conform_test
 diff --git a/third_party/.gitignore b/third_party/.gitignore
-index 71ff59deb05168f0090e1887c954f60de337ad44..18c70eec5ecc1900a70e4b8c20c657588e0566e4 100644
+index 1a18347e45e1e82834efde9718d9bb33531dd234..b0007c4b305dc681dc9cb951c499e7bcbe54d717 100644
 --- a/third_party/.gitignore
 +++ b/third_party/.gitignore
 @@ -51,7 +51,9 @@
@@ -39,7 +39,7 @@ index 71ff59deb05168f0090e1887c954f60de337ad44..18c70eec5ecc1900a70e4b8c20c65758
  /ninja/ninja*
  /node/*.tar.gz
  /node/linux/
-@@ -148,6 +151,7 @@
+@@ -149,6 +152,7 @@
  /soda-win64
  /speex
  /sqlite4java/lib/

patches/chromium/chore_allow_chromium_to_handle_synthetic_mouse_events_for_touch.patch

@@ -7,10 +7,10 @@ With WCO, allow chromium to handle synthetic mouse events generated for touch
 actions in the non-client caption area.
 
 diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-index 8c009b8e50049d49e47802395d1499b49475ee7a..618db09558e9bebd844fef465ab7298651c15abf 100644
+index 90c37ebd4549c825bc0f03945d88828dbadf1559..c3ab16a0923f38080ef753f137a315151194ba30 100644
 --- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
 +++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-@@ -1215,6 +1215,10 @@ void DesktopWindowTreeHostWin::HandleHeadlessWindowBoundsChanged(
+@@ -1220,6 +1220,10 @@ void DesktopWindowTreeHostWin::HandleHeadlessWindowBoundsChanged(
    window()->SetProperty(aura::client::kHeadlessBoundsKey, bounds);
  }
  
@@ -34,10 +34,10 @@ index 8d5b01098915dd8e27ed047fa3a250169157a382..797670a6d0a34f25ee5d6f266bb2a1f5
    Widget* GetWidget();
    const Widget* GetWidget() const;
 diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 259dc1a97511864256085bf9cb5806f17fddad8c..9e750772739b966647ae4effe625edc11ecf6c04 100644
+index ceb278617bd3621aa70671ac620d0c9969d56a38..577aa886b1ea3d942ae7b2bbca85ea6ae93fea7a 100644
 --- a/ui/views/win/hwnd_message_handler.cc
 +++ b/ui/views/win/hwnd_message_handler.cc
-@@ -3118,15 +3118,19 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
+@@ -3128,15 +3128,19 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
        SetMsgHandled(FALSE);
      // We must let Windows handle the caption buttons if it's drawing them, or
      // they won't work.

patches/chromium/chore_provide_iswebcontentscreationoverridden_with_full_params.patch

@@ -218,10 +218,10 @@ index c5b0d3b23b8da318ae55fcac2515a1187f261469..16ed1f46c9afde0ff25750128b4fcff6
    void AddNewContents(content::WebContents* source,
                        std::unique_ptr<content::WebContents> new_contents,
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 94cdebc2ae552106bdeb7d3619dc9281c4fb4063..257b9f8ae014f577a9e2de35a3b251efda451fbe 100644
+index 3066a882b9bb09cc15f6bf30e52362317bd03297..1b3b1b0b3f2b7956b750f559d461e2a41f343448 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -4491,8 +4491,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -4492,8 +4492,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
  
    if (delegate_ && delegate_->IsWebContentsCreationOverridden(
                         source_site_instance, params.window_container_type,

patches/chromium/create_browser_v8_snapshot_file_name_fuse.patch

@@ -102,10 +102,10 @@ index 2b0919b9a56bd37a398109777dfd199d777a9f74..823f44ab0303ccd6c7502ec65560ddb5
    friend class ContentClientCreator;
    friend class ContentClientInitializer;
 diff --git a/gin/v8_initializer.cc b/gin/v8_initializer.cc
-index bf101d76e22d80fe909d0eebe1f5c2c399cb09b9..3f8ca1e015e88a5d50d80903ecd0526778af0d58 100644
+index d069889816cbc50a922bed055c78d6779c49e03d..158a96fd3a14fe975554a0d0c40c80f090eb6490 100644
 --- a/gin/v8_initializer.cc
 +++ b/gin/v8_initializer.cc
-@@ -575,8 +575,7 @@ void V8Initializer::GetV8ExternalSnapshotData(const char** snapshot_data_out,
+@@ -577,8 +577,7 @@ void V8Initializer::GetV8ExternalSnapshotData(const char** snapshot_data_out,
  
  #if defined(V8_USE_EXTERNAL_STARTUP_DATA)
  
@@ -115,7 +115,7 @@ index bf101d76e22d80fe909d0eebe1f5c2c399cb09b9..3f8ca1e015e88a5d50d80903ecd05267
    if (g_mapped_snapshot) {
      // TODO(crbug.com/802962): Confirm not loading different type of snapshot
      // files in a process.
-@@ -585,10 +584,17 @@ void V8Initializer::LoadV8Snapshot(V8SnapshotFileType snapshot_file_type) {
+@@ -587,10 +586,17 @@ void V8Initializer::LoadV8Snapshot(V8SnapshotFileType snapshot_file_type) {
  
    base::MemoryMappedFile::Region file_region;
    base::File file =

patches/chromium/custom_protocols_plzserviceworker.patch

@@ -8,10 +8,10 @@ Allow registering custom protocols to handle service worker main script fetching
 Refs https://bugs.chromium.org/p/chromium/issues/detail?id=996511
 
 diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
-index 0019c6a54eb8c509597cad4b6727a23dec2926ed..b37cb96cb5d6a55671942cc4315100f81e23d7ba 100644
+index d8f2a9bee7f2b7a7e9cf3582f707da36c00099b0..a060087b655218864425500e8bd4dfe2359ec4ec 100644
 --- a/content/browser/service_worker/service_worker_context_wrapper.cc
 +++ b/content/browser/service_worker/service_worker_context_wrapper.cc
-@@ -1947,6 +1947,26 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+@@ -1966,6 +1966,26 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
        loader_factory_bundle_info =
            context()->loader_factory_bundle_for_update_check()->Clone();
  
@@ -38,7 +38,7 @@ index 0019c6a54eb8c509597cad4b6727a23dec2926ed..b37cb96cb5d6a55671942cc4315100f8
    if (auto* config = content::WebUIConfigMap::GetInstance().GetConfig(
            browser_context(), scope)) {
      // If this is a Service Worker for a WebUI, the WebUI's URLDataSource
-@@ -1966,9 +1986,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+@@ -1985,9 +2005,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
              features::kEnableServiceWorkersForChromeScheme) &&
          scope.scheme_piece() == kChromeUIScheme) {
        config->RegisterURLDataSource(browser_context());
@@ -49,7 +49,7 @@ index 0019c6a54eb8c509597cad4b6727a23dec2926ed..b37cb96cb5d6a55671942cc4315100f8
            .emplace(kChromeUIScheme, CreateWebUIServiceWorkerLoaderFactory(
                                          browser_context(), kChromeUIScheme,
                                          base::flat_set<std::string>()));
-@@ -1976,9 +1994,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+@@ -1995,9 +2013,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
                     features::kEnableServiceWorkersForChromeUntrusted) &&
                 scope.scheme_piece() == kChromeUIUntrustedScheme) {
        config->RegisterURLDataSource(browser_context());

patches/chromium/desktop_media_list.patch

@@ -82,10 +82,10 @@ index afc2cf89299315cca68b50196c2377a7d474883d..52bfd487d501ef895915800b9ee83a5b
    const Source& GetSource(int index) const override;
    DesktopMediaList::Type GetMediaListType() const override;
 diff --git a/chrome/browser/media/webrtc/native_desktop_media_list.cc b/chrome/browser/media/webrtc/native_desktop_media_list.cc
-index 2b736f68d112aa3780548f10ce5f461374356ef9..2529b53a4815c619ba75c61cf1d44f9433022a8c 100644
+index 335792a98ee6db5dd742b532fbf29efb142da26e..764535ed5855296de2139ca2405a43e146300104 100644
 --- a/chrome/browser/media/webrtc/native_desktop_media_list.cc
 +++ b/chrome/browser/media/webrtc/native_desktop_media_list.cc
-@@ -160,7 +160,7 @@ BOOL CALLBACK AllHwndCollector(HWND hwnd, LPARAM param) {
+@@ -170,7 +170,7 @@ BOOL CALLBACK AllHwndCollector(HWND hwnd, LPARAM param) {
  #if BUILDFLAG(IS_MAC)
  BASE_FEATURE(kWindowCaptureMacV2,
               "WindowCaptureMacV2",
@@ -94,7 +94,7 @@ index 2b736f68d112aa3780548f10ce5f461374356ef9..2529b53a4815c619ba75c61cf1d44f94
  #endif
  
  content::DesktopMediaID::Type ConvertToDesktopMediaIDType(
-@@ -345,7 +345,7 @@ class NativeDesktopMediaList::Worker
+@@ -355,7 +355,7 @@ class NativeDesktopMediaList::Worker
    base::WeakPtr<NativeDesktopMediaList> media_list_;
  
    DesktopMediaID::Type source_type_;
@@ -103,7 +103,7 @@ index 2b736f68d112aa3780548f10ce5f461374356ef9..2529b53a4815c619ba75c61cf1d44f94
    const ThumbnailCapturer::FrameDeliveryMethod frame_delivery_method_;
    const bool add_current_process_windows_;
  
-@@ -633,6 +633,12 @@ void NativeDesktopMediaList::Worker::RefreshNextThumbnail() {
+@@ -643,6 +643,12 @@ void NativeDesktopMediaList::Worker::RefreshNextThumbnail() {
        FROM_HERE,
        base::BindOnce(&NativeDesktopMediaList::UpdateNativeThumbnailsFinished,
                       media_list_));
@@ -116,7 +116,7 @@ index 2b736f68d112aa3780548f10ce5f461374356ef9..2529b53a4815c619ba75c61cf1d44f94
  }
  
  void NativeDesktopMediaList::Worker::OnCaptureResult(
-@@ -1017,6 +1023,11 @@ void NativeDesktopMediaList::RefreshForVizFrameSinkWindows(
+@@ -1027,6 +1033,11 @@ void NativeDesktopMediaList::RefreshForVizFrameSinkWindows(
          FROM_HERE, base::BindOnce(&Worker::RefreshThumbnails,
                                    base::Unretained(worker_.get()),
                                    std::move(native_ids), thumbnail_size_));

patches/chromium/disable_compositor_recycling.patch

@@ -6,7 +6,7 @@ Subject: fix: disabling compositor recycling
 Compositor recycling is useful for Chrome because there can be many tabs and spinning up a compositor for each one would be costly. In practice, Chrome uses the parent compositor code path of browser_compositor_view_mac.mm; the NSView of each tab is detached when it's hidden and attached when it's shown. For Electron, there is no parent compositor, so we're forced into the "own compositor" code path, which seems to be non-optimal and pretty ruthless in terms of the release of resources. Electron has no real concept of multiple tabs per window, so it should be okay to disable this ruthless recycling altogether in Electron.
 
 diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
-index 39e03b029c4ebf03020f6cc8b67922f73652772a..3ca1d0e229a5c0892fe431c606acbe43bcc0707b 100644
+index 96283a4f72b32eb45357eb6ec1f5b807593d5f07..ef9a5d3b4b99b40a8785c59c4e7ab495c6aa811c 100644
 --- a/content/browser/renderer_host/render_widget_host_view_mac.mm
 +++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
 @@ -557,7 +557,11 @@

patches/chromium/disable_hidden.patch

@@ -33,10 +33,10 @@ index fb89c4500eeae064c6c8f3d4c0ad7b5b4deecb5a..52868268ba4843e0743284afc684e549
    void StartDragging(blink::mojom::DragDataPtr drag_data,
                       const url::Origin& source_origin,
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index 094686284afc96d9719ca1821092863d1e160e0c..4c78692adb777b8e0a8fa2e2350775b7e2ef676a 100644
+index 58310ec382696f0f59c36771f8bf205016981ccb..cb9b21a3d3e99558e6892e00e73e550f68571daf 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -614,7 +614,7 @@ void RenderWidgetHostViewAura::HideImpl() {
+@@ -613,7 +613,7 @@ void RenderWidgetHostViewAura::HideImpl() {
    DCHECK(visibility_ == Visibility::HIDDEN ||
           visibility_ == Visibility::OCCLUDED);
  

patches/chromium/enable_reset_aspect_ratio.patch

@@ -6,10 +6,10 @@ Subject: feat: enable setting aspect ratio to 0
 Make SetAspectRatio accept 0 as valid input, which would reset to null.
 
 diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-index f63948de2c5bfa589ea3ada817bb0820697e4bb2..8c009b8e50049d49e47802395d1499b49475ee7a 100644
+index 3ff20acdff374d183a3c5b862767e64671443a6a..90c37ebd4549c825bc0f03945d88828dbadf1559 100644
 --- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
 +++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-@@ -572,7 +572,7 @@ void DesktopWindowTreeHostWin::SetOpacity(float opacity) {
+@@ -577,7 +577,7 @@ void DesktopWindowTreeHostWin::SetOpacity(float opacity) {
  void DesktopWindowTreeHostWin::SetAspectRatio(
      const gfx::SizeF& aspect_ratio,
      const gfx::Size& excluded_margin) {
@@ -19,10 +19,10 @@ index f63948de2c5bfa589ea3ada817bb0820697e4bb2..8c009b8e50049d49e47802395d1499b4
                                     excluded_margin);
  }
 diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 7516856fb93141302a4cfa92c2d14d4bdd2f8018..e209fa1848263e52d87cac8aa61e5c219e54a2e1 100644
+index b1f7412f7a8e7d3264545e2854c57c4f58541bae..871ec001eea168aaa47dcaf225342bbcf7106ee4 100644
 --- a/ui/views/win/hwnd_message_handler.cc
 +++ b/ui/views/win/hwnd_message_handler.cc
-@@ -963,8 +963,11 @@ void HWNDMessageHandler::SetFullscreen(bool fullscreen,
+@@ -964,8 +964,11 @@ void HWNDMessageHandler::SetFullscreen(bool fullscreen,
  
  void HWNDMessageHandler::SetAspectRatio(float aspect_ratio,
                                          const gfx::Size& excluded_margin) {

patches/chromium/expose_setuseragent_on_networkcontext.patch

@@ -33,7 +33,7 @@ index 0ab8187b0db8ae6db46d81738f653a2bc4c566f6..de3d55e85c22317f7f9375eb94d0d5d4
  
  }  // namespace net
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index 851280c5c26cb93a6a80977b0b3a9815ce2d5d11..df7c34715576f27f20fb1850c8adb8c74bc88ff9 100644
+index a68c23c049078ce0e1d893dd1921c1e55ebe1019..9fa71011ed7c7ec9e1d3191cab34b7b741280004 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
 @@ -1614,6 +1614,13 @@ void NetworkContext::SetNetworkConditions(
@@ -51,7 +51,7 @@ index 851280c5c26cb93a6a80977b0b3a9815ce2d5d11..df7c34715576f27f20fb1850c8adb8c7
    // This may only be called on NetworkContexts created with the constructor
    // that calls MakeURLRequestContext().
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index 7cb0642b4661c5415b4f8f4a934ef32f27b9eb28..382ee5ff8352fb0c4623fdb12b5673479231e8ea 100644
+index 5db4f275fb5b619f0dba5526202fec6e8a69399a..37db9e43d950010bec8048ddd76068c340431b0d 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
 @@ -315,6 +315,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
@@ -63,7 +63,7 @@ index 7cb0642b4661c5415b4f8f4a934ef32f27b9eb28..382ee5ff8352fb0c4623fdb12b567347
    void SetEnableReferrers(bool enable_referrers) override;
  #if BUILDFLAG(IS_CT_SUPPORTED)
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
-index 567d6f230e33b2e7d9ff8e3f768fc4c94704eaac..7a4e4b3a60a868bb8848f701b77fea5229212506 100644
+index 01e438f5060f8e249a599712248586d26f3b7b47..48d75aeed63b046659512b642ea4d2c964d8d408 100644
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
 @@ -1252,6 +1252,9 @@ interface NetworkContext {
@@ -77,7 +77,7 @@ index 567d6f230e33b2e7d9ff8e3f768fc4c94704eaac..7a4e4b3a60a868bb8848f701b77fea52
    SetAcceptLanguage(string new_accept_language);
  
 diff --git a/services/network/test/test_network_context.h b/services/network/test/test_network_context.h
-index 3061938ac5af0f2f1dbe0e0c70457b21ab1cd6c2..e8b682d80e4ea30c12a71402a130751e0f093bdf 100644
+index 981fc599cee08d36387ef4265a6c7c5816c174ac..d17290e52fcc1e27d44fe77e4f6d4c713edf0683 100644
 --- a/services/network/test/test_network_context.h
 +++ b/services/network/test/test_network_context.h
 @@ -147,6 +147,7 @@ class TestNetworkContext : public mojom::NetworkContext {

patches/chromium/extend_apply_webpreferences.patch

@@ -12,7 +12,7 @@ Ideally we could add an embedder observer pattern here but that can be
 done in future work.
 
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 986b4c9f35431ed14989d5f69fc09d17a2c3fda9..b88f27942cbefb1c3ae819a3fc4135d8a3a819fa 100644
+index 689010902c8508b85208618cc11b922adf10c08e..291b943982fcda859cd55e8dd2be57bb9e7b1bfa 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
 @@ -167,6 +167,7 @@

patches/chromium/feat_add_set_theme_source_to_allow_apps_to.patch

@@ -13,10 +13,10 @@ uses internally for things like menus and devtools.
 We can remove this patch once it has in some shape been upstreamed.
 
 diff --git a/ui/native_theme/native_theme.cc b/ui/native_theme/native_theme.cc
-index c5bcbe62463a418cf78c4813678d7a1e39c4dd9d..f51e2e70bb249f5113ee592f121e53d61bc334fc 100644
+index d466e72df7e2c7094ed80d6b70b78eab7a93ba4c..a9a10f2c91a473c41d5e2a0ce7ce2608894f55a8 100644
 --- a/ui/native_theme/native_theme.cc
 +++ b/ui/native_theme/native_theme.cc
-@@ -191,6 +191,8 @@ NativeTheme::NativeTheme(bool should_use_dark_colors,
+@@ -209,6 +209,8 @@ NativeTheme::NativeTheme(bool should_use_dark_colors,
  NativeTheme::~NativeTheme() = default;
  
  bool NativeTheme::ShouldUseDarkColors() const {
@@ -26,7 +26,7 @@ index c5bcbe62463a418cf78c4813678d7a1e39c4dd9d..f51e2e70bb249f5113ee592f121e53d6
  }
  
 diff --git a/ui/native_theme/native_theme.h b/ui/native_theme/native_theme.h
-index e1c2037c320efc78bc9df701960af57aa0ef180c..3a74da489cfbe6457aa9a206364a977bb3052d80 100644
+index 3385e9e9d5690d746d4935f3ddc74bc09746c017..278663682017393b1cd52475d8fffb601d0cbe25 100644
 --- a/ui/native_theme/native_theme.h
 +++ b/ui/native_theme/native_theme.h
 @@ -443,6 +443,23 @@ class NATIVE_THEME_EXPORT NativeTheme {
@@ -53,19 +53,19 @@ index e1c2037c320efc78bc9df701960af57aa0ef180c..3a74da489cfbe6457aa9a206364a977b
    // Returns a shared instance of the native theme that should be used for web
    // rendering. Do not use it in a normal application context (i.e. browser).
    // The returned object should not be deleted by the caller. This function is
-@@ -658,6 +675,7 @@ class NATIVE_THEME_EXPORT NativeTheme {
-   bool inverted_colors_ = false;
+@@ -672,6 +689,7 @@ class NATIVE_THEME_EXPORT NativeTheme {
    PreferredColorScheme preferred_color_scheme_ = PreferredColorScheme::kLight;
    PreferredContrast preferred_contrast_ = PreferredContrast::kNoPreference;
+   std::optional<base::TimeDelta> caret_blink_interval_;
 +  ThemeSource theme_source_ = ThemeSource::kSystem;
  
    SEQUENCE_CHECKER(sequence_checker_);
  };
 diff --git a/ui/native_theme/native_theme_win.cc b/ui/native_theme/native_theme_win.cc
-index 9830931142e76fe117266e64444d50f83eefa842..a9313c3bac674ca3e785adfe10ec4a03d74245c8 100644
+index 566230f830edec321ec3032b81e3478f155912c6..65d4d09c1e9e50197244a3e0f79ace8498463774 100644
 --- a/ui/native_theme/native_theme_win.cc
 +++ b/ui/native_theme/native_theme_win.cc
-@@ -661,6 +661,8 @@ bool NativeThemeWin::ShouldUseDarkColors() const {
+@@ -673,6 +673,8 @@ bool NativeThemeWin::ShouldUseDarkColors() const {
    // ...unless --force-dark-mode was specified in which case caveat emptor.
    if (InForcedColorsMode() && !IsForcedDarkMode())
      return false;

patches/chromium/feat_allow_code_cache_in_custom_schemes.patch

@@ -140,7 +140,7 @@ index f5c5ff2c89489257003dfe3284ee9de9f517c99b..fdd2e2483171c4d43963590200817dac
  
      // JavaScript from chrome and chrome-untrusted pages. The resource URLs are
 diff --git a/content/browser/code_cache/generated_code_cache_browsertest.cc b/content/browser/code_cache/generated_code_cache_browsertest.cc
-index 50e0966199b18f88f85443016f57e8e217d7cf9c..fca44ad6a96981349a52dc2eeff4626e4dcb8bcd 100644
+index 6f86563fe6c80ecd3db75b9480e1ed13399ccc18..31ef1e43db6ea4a51333d1ae4f84c3c274e26b53 100644
 --- a/content/browser/code_cache/generated_code_cache_browsertest.cc
 +++ b/content/browser/code_cache/generated_code_cache_browsertest.cc
 @@ -8,13 +8,18 @@
@@ -171,7 +171,7 @@ index 50e0966199b18f88f85443016f57e8e217d7cf9c..fca44ad6a96981349a52dc2eeff4626e
  bool SupportsSharedWorker() {
  #if BUILDFLAG(IS_ANDROID)
    // SharedWorkers are not enabled on Android. https://crbug.com/154571
-@@ -710,4 +717,82 @@ IN_PROC_BROWSER_TEST_F(LocalCompileHintsBrowserTest, LocalCompileHints) {
+@@ -714,4 +721,82 @@ IN_PROC_BROWSER_TEST_F(LocalCompileHintsBrowserTest, LocalCompileHints) {
    }
  }
  

patches/chromium/feat_configure_launch_options_for_service_process.patch

@@ -110,19 +110,19 @@ index 8736af0021dccba915e3d2303191ae3ec80f6e75..56f8384c3ff4959272363cb71e4c380e
  }
  
 diff --git a/content/browser/child_process_launcher_helper_win.cc b/content/browser/child_process_launcher_helper_win.cc
-index 1d6bc6590720cda38983203455cc20638710148f..8f965150db13d3f4fe1757a021b9a2f6446529d6 100644
+index 220eab3370bb2632150f845d29ab7babf44472f5..6f055560ecfe480de1c7c8f4f2c22a5977043b9c 100644
 --- a/content/browser/child_process_launcher_helper_win.cc
 +++ b/content/browser/child_process_launcher_helper_win.cc
-@@ -21,6 +21,8 @@
- #include "sandbox/policy/win/sandbox_win.h"
+@@ -25,6 +25,8 @@
+ #include "mojo/public/cpp/platform/platform_channel.h"
  #include "sandbox/win/src/sandbox_types.h"
  
 +#include <windows.h>
 +
  namespace {
  
- // /prefetch:# arguments to use when launching various process types. It has
-@@ -189,6 +191,30 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
+ // Helper to avoid marking the log file as non-executable every time we launch a
+@@ -259,6 +261,30 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
      mojo_channel_->PrepareToPassRemoteEndpoint(&options->handles_to_inherit,
                                                 command_line());
    }
@@ -153,7 +153,7 @@ index 1d6bc6590720cda38983203455cc20638710148f..8f965150db13d3f4fe1757a021b9a2f6
    return true;
  }
  
-@@ -216,7 +242,7 @@ ChildProcessLauncherHelper::LaunchProcessOnLauncherThread(
+@@ -286,7 +312,7 @@ ChildProcessLauncherHelper::LaunchProcessOnLauncherThread(
    ChildProcessLauncherHelper::Process process;
    *launch_result =
        StartSandboxedProcess(delegate_.get(), *command_line(),

patches/chromium/feat_enable_offscreen_rendering_with_viz_compositor.patch

@@ -562,10 +562,10 @@ index febb2718cb34ea4d9f411f068d8c01a89c7db888..be8bd51cb61c20ef3df8552972a0ac2f
    gpu::SyncPointManager* GetSyncPointManager() override;
  };
 diff --git a/content/browser/compositor/viz_process_transport_factory.cc b/content/browser/compositor/viz_process_transport_factory.cc
-index 65401cc3644945cba21c8ca2f6ac0919f1321d80..86a9f37f7d5ab6dfd8d3c8a6e079706b2fc6a3f3 100644
+index 3634618a687b375c2b0af7922c2f70347fdc0309..cdbb787d219578e9371333f699cfd25859c483fb 100644
 --- a/content/browser/compositor/viz_process_transport_factory.cc
 +++ b/content/browser/compositor/viz_process_transport_factory.cc
-@@ -383,8 +383,14 @@ void VizProcessTransportFactory::OnEstablishedGpuChannel(
+@@ -385,8 +385,14 @@ void VizProcessTransportFactory::OnEstablishedGpuChannel(
    mojo::AssociatedRemote<viz::mojom::DisplayPrivate> display_private;
    root_params->display_private =
        display_private.BindNewEndpointAndPassReceiver();

patches/chromium/feat_expose_documentloader_setdefersloading_on_webdocumentloader.patch

@@ -28,10 +28,10 @@ index f9d3219990dcf4f4a829567d567072df59a70ada..ca8281faaff601bf591cf5a2b185e4ba
  
    // Returns the http referrer of original request which initited this load.
 diff --git a/third_party/blink/renderer/core/loader/document_loader.h b/third_party/blink/renderer/core/loader/document_loader.h
-index ca693ac2874e4eec530bd511d2e3bb26f4ed6100..c2ca513b5062cf48b232c8129e6eda216c9d9a63 100644
+index 4b0cc3793ecb9c35405d2e106e3779debc97a433..07b05d3d90a729135b5d5ef1e87be0db90b71940 100644
 --- a/third_party/blink/renderer/core/loader/document_loader.h
 +++ b/third_party/blink/renderer/core/loader/document_loader.h
-@@ -311,7 +311,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
+@@ -312,7 +312,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
        std::optional<scheduler::TaskAttributionId>
            soft_navigation_heuristics_task_id);
  

patches/chromium/fix_activate_background_material_on_windows.patch

@@ -14,10 +14,10 @@ This patch likely can't be upstreamed as-is, as Chromium doesn't have
 this use case in mind currently.
 
 diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 5b5583740d5ea67e4d68447ceca675b83cb0acee..d9cbb47b71946a12ca493dd1c766bf18d3de76f6 100644
+index 5c4a1aed2e63aa16b0011375502532d85d543887..6f638b2003ff86bc06bd82402ab358dfb61c58b7 100644
 --- a/ui/views/win/hwnd_message_handler.cc
 +++ b/ui/views/win/hwnd_message_handler.cc
-@@ -905,13 +905,13 @@ void HWNDMessageHandler::FrameTypeChanged() {
+@@ -906,13 +906,13 @@ void HWNDMessageHandler::FrameTypeChanged() {
  
  void HWNDMessageHandler::PaintAsActiveChanged() {
    if (!delegate_->HasNonClientView() || !delegate_->CanActivate() ||
@@ -33,7 +33,7 @@ index 5b5583740d5ea67e4d68447ceca675b83cb0acee..d9cbb47b71946a12ca493dd1c766bf18
  }
  
  void HWNDMessageHandler::SetWindowIcons(const gfx::ImageSkia& window_icon,
-@@ -2258,17 +2258,18 @@ LRESULT HWNDMessageHandler::OnNCActivate(UINT message,
+@@ -2268,17 +2268,18 @@ LRESULT HWNDMessageHandler::OnNCActivate(UINT message,
    if (IsVisible())
      delegate_->SchedulePaint();
  

patches/chromium/fix_adapt_exclusive_access_for_electron_needs.patch

@@ -16,7 +16,7 @@ Linux or Windows to un-fullscreen in some circumstances without this
 change.
 
 diff --git a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
-index 243af5d34d99577d1e0b7205cf059962035b26f7..81a164a0fc8ff304814e0cc5990c544a7c0c7519 100644
+index f80cafcb32bb84070e451e4e5a3ede4d25a40aeb..b181478f43f4f42acb327e65dd8345b9fded029a 100644
 --- a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
 +++ b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
 @@ -16,12 +16,16 @@
@@ -77,7 +77,7 @@ index 243af5d34d99577d1e0b7205cf059962035b26f7..81a164a0fc8ff304814e0cc5990c544a
  }
  
  void FullscreenController::RunOrDeferUntilTransitionIsComplete(
-@@ -486,18 +496,17 @@ void FullscreenController::EnterFullscreenModeInternal(
+@@ -498,18 +508,17 @@ void FullscreenController::EnterFullscreenModeInternal(
    // Do not enter fullscreen mode if disallowed by pref. This prevents the user
    // from manually entering fullscreen mode and also disables kiosk mode on
    // desktop platforms.
@@ -101,7 +101,7 @@ index 243af5d34d99577d1e0b7205cf059962035b26f7..81a164a0fc8ff304814e0cc5990c544a
    if (option == TAB) {
      url = GetRequestingOrigin();
      tab_fullscreen_ = true;
-@@ -530,6 +539,7 @@ void FullscreenController::EnterFullscreenModeInternal(
+@@ -542,6 +551,7 @@ void FullscreenController::EnterFullscreenModeInternal(
      if (!extension_caused_fullscreen_.is_empty())
        url = extension_caused_fullscreen_;
    }
@@ -109,7 +109,7 @@ index 243af5d34d99577d1e0b7205cf059962035b26f7..81a164a0fc8ff304814e0cc5990c544a
  
    fullscreen_start_time_ = base::TimeTicks::Now();
    if (option == BROWSER)
-@@ -549,6 +559,7 @@ void FullscreenController::ExitFullscreenModeInternal() {
+@@ -561,6 +571,7 @@ void FullscreenController::ExitFullscreenModeInternal() {
    if (chrome::IsRunningInAppMode())
      return;
  
@@ -117,7 +117,7 @@ index 243af5d34d99577d1e0b7205cf059962035b26f7..81a164a0fc8ff304814e0cc5990c544a
    // `fullscreen_start_time_` is null if a fullscreen tab moves to a new window.
    if (fullscreen_start_time_ && exclusive_access_tab()) {
      ukm::SourceId source_id =
-@@ -560,15 +571,16 @@ void FullscreenController::ExitFullscreenModeInternal() {
+@@ -572,15 +583,16 @@ void FullscreenController::ExitFullscreenModeInternal() {
          .Record(ukm::UkmRecorder::Get());
      fullscreen_start_time_.reset();
    }
@@ -138,10 +138,10 @@ index 243af5d34d99577d1e0b7205cf059962035b26f7..81a164a0fc8ff304814e0cc5990c544a
    extension_caused_fullscreen_ = GURL();
  
 diff --git a/chrome/browser/ui/exclusive_access/fullscreen_controller.h b/chrome/browser/ui/exclusive_access/fullscreen_controller.h
-index 439f0aaceb443e650c82951bd1dffc937d58f2a2..781e02163bf11ac40bd82081465d08f5bb4be448 100644
+index 94a4cae3185365f492b902e5c0e9cc19ed7733ff..83ff0bd57e63571e2c157de2ec7586d46d6ff87f 100644
 --- a/chrome/browser/ui/exclusive_access/fullscreen_controller.h
 +++ b/chrome/browser/ui/exclusive_access/fullscreen_controller.h
-@@ -248,10 +248,12 @@ class FullscreenController : public ExclusiveAccessControllerBase {
+@@ -251,10 +251,12 @@ class FullscreenController : public ExclusiveAccessControllerBase {
    // Used in testing to set the state to tab fullscreen.
    bool is_tab_fullscreen_for_testing_ = false;
  

patches/chromium/fix_aspect_ratio_with_max_size.patch

@@ -11,10 +11,10 @@ enlarge window above dimensions set during creation of the
 BrowserWindow.
 
 diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index e209fa1848263e52d87cac8aa61e5c219e54a2e1..259dc1a97511864256085bf9cb5806f17fddad8c 100644
+index 871ec001eea168aaa47dcaf225342bbcf7106ee4..ceb278617bd3621aa70671ac620d0c9969d56a38 100644
 --- a/ui/views/win/hwnd_message_handler.cc
 +++ b/ui/views/win/hwnd_message_handler.cc
-@@ -3665,14 +3665,29 @@ void HWNDMessageHandler::SizeWindowToAspectRatio(UINT param,
+@@ -3675,14 +3675,29 @@ void HWNDMessageHandler::SizeWindowToAspectRatio(UINT param,
    delegate_->GetMinMaxSize(&min_window_size, &max_window_size);
    min_window_size = delegate_->DIPToScreenSize(min_window_size);
    max_window_size = delegate_->DIPToScreenSize(max_window_size);

patches/chromium/fix_crash_loading_non-standard_schemes_in_iframes.patch

@@ -23,10 +23,10 @@ Upstream bug https://bugs.chromium.org/p/chromium/issues/detail?id=1081397.
 Upstreamed at https://chromium-review.googlesource.com/c/chromium/src/+/3856266.
 
 diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
-index 1ca5ce3110edea41fde30db79b384489d0297977..072d02f2130294d59176e510caafade29feca96f 100644
+index 5d4f3ab1c8328bce254ede9c3c8dfe9a8c84b8d3..8a9beaf3bfb9fe5eca8ca6675c7c45b4b880db03 100644
 --- a/content/browser/renderer_host/navigation_request.cc
 +++ b/content/browser/renderer_host/navigation_request.cc
-@@ -10420,6 +10420,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo() {
+@@ -10396,6 +10396,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo() {
      return std::make_pair(parent->GetLastCommittedOrigin(), "about_srcdoc");
    }
  
@@ -40,10 +40,10 @@ index 1ca5ce3110edea41fde30db79b384489d0297977..072d02f2130294d59176e510caafade2
    // origin of |common_params.url| and/or |common_params.initiator_origin|.
    url::Origin resolved_origin = url::Origin::Resolve(
 diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
-index 1e94b973f4486e11ae05528b4a97c9fae74fe7f2..43ffe048aea73bd2fae57fb87ad1346296189d64 100644
+index 15c696731f42b6095e6fff66c3619d5301f807ca..d74a940cdaee0576135e2ceeffa3bdba1583f6be 100644
 --- a/third_party/blink/renderer/core/loader/document_loader.cc
 +++ b/third_party/blink/renderer/core/loader/document_loader.cc
-@@ -2165,6 +2165,10 @@ Frame* DocumentLoader::CalculateOwnerFrame() {
+@@ -2169,6 +2169,10 @@ Frame* DocumentLoader::CalculateOwnerFrame() {
  scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
      Document* owner_document) {
    scoped_refptr<SecurityOrigin> origin;
@@ -54,7 +54,7 @@ index 1e94b973f4486e11ae05528b4a97c9fae74fe7f2..43ffe048aea73bd2fae57fb87ad13462
    StringBuilder debug_info_builder;
    if (origin_to_commit_) {
      // Origin to commit is specified by the browser process, it must be taken
-@@ -2212,6 +2216,10 @@ scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
+@@ -2216,6 +2220,10 @@ scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
      debug_info_builder.Append(", url=");
      debug_info_builder.Append(owner_document->Url().BaseAsString());
      debug_info_builder.Append(")");

patches/chromium/fix_disabling_background_throttling_in_compositor.patch

@@ -12,7 +12,7 @@ invisible state of the `viz::DisplayScheduler` owned
 by the `ui::Compositor`.
 
 diff --git a/ui/compositor/compositor.cc b/ui/compositor/compositor.cc
-index 58c898eae10ecca9741d89e5a211b7c25c6d5a0b..ddd00f284e3e1efb810bf0202eb3b7838ac4d7e6 100644
+index d2c2b79216a496f7eea037bde312e3dc90d8ef9f..d50f310c435d17ede2718400e379aa28e58129f0 100644
 --- a/ui/compositor/compositor.cc
 +++ b/ui/compositor/compositor.cc
 @@ -339,7 +339,8 @@ void Compositor::SetLayerTreeFrameSink(
@@ -25,21 +25,18 @@ index 58c898eae10ecca9741d89e5a211b7c25c6d5a0b..ddd00f284e3e1efb810bf0202eb3b783
      display_private_->SetDisplayColorSpaces(display_color_spaces_);
      display_private_->SetDisplayColorMatrix(
          gfx::SkM44ToTransform(display_color_matrix_));
-@@ -531,8 +532,11 @@ void Compositor::SetVisible(bool visible) {
-   host_->SetVisible(visible);
-   // Visibility is reset when the output surface is lost, so this must also be
-   // updated then.
--  if (display_private_)
+@@ -540,7 +541,9 @@ void Compositor::SetVisible(bool visible) {
+   // updated then. We need to call this even if the visibility hasn't changed,
+   // for the same reason.
+   if (display_private_)
 -    display_private_->SetDisplayVisible(visible);
-+  if (display_private_) {
 +    // Invisible display is throttling itself.
 +    display_private_->SetDisplayVisible(
 +        background_throttling_ ? visible : true);
-+  }
- }
  
- bool Compositor::IsVisible() {
-@@ -959,4 +963,13 @@ const cc::LayerTreeSettings& Compositor::GetLayerTreeSettings() const {
+   if (changed) {
+     for (auto& observer : observer_list_) {
+@@ -973,4 +976,13 @@ const cc::LayerTreeSettings& Compositor::GetLayerTreeSettings() const {
    return host_->GetSettings();
  }
  

patches/chromium/fix_on-screen-keyboard_hides_on_input_blur_in_webview.patch

@@ -9,10 +9,10 @@ focus node change via TextInputManager.
 chromium-bug: https://crbug.com/1369605
 
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index fa18900586854c5d6b936d6b9e6fac1c9e571bce..6df34cc1c58d5722d6b6832abb47d2376a7818d8 100644
+index f18a3d6b4287d986c31db3385541cd20db68ecd5..a68019420d1a30c276a048bf770158a55f7dbe1b 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -2916,6 +2916,12 @@ void RenderWidgetHostViewAura::OnTextSelectionChanged(
+@@ -2920,6 +2920,12 @@ void RenderWidgetHostViewAura::OnTextSelectionChanged(
    }
  }
  
@@ -26,10 +26,10 @@ index fa18900586854c5d6b936d6b9e6fac1c9e571bce..6df34cc1c58d5722d6b6832abb47d237
      RenderWidgetHostViewAura* popup_child_host_view) {
    popup_child_host_view_ = popup_child_host_view;
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.h b/content/browser/renderer_host/render_widget_host_view_aura.h
-index e44b23e055f985fea140a41a87f10a5423f7c77d..d1e09b159746ad13de9f3fea6b189bb9db041434 100644
+index bb83b675c67b88b2826a550b77909e614c4edb1b..8aef94cf0b1d05c5c6dc5ed7dadc73fae5b0cb3e 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.h
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.h
-@@ -628,6 +628,8 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
+@@ -625,6 +625,8 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
        RenderWidgetHostViewBase* updated_view) override;
    void OnTextSelectionChanged(TextInputManager* text_input_mangager,
                                RenderWidgetHostViewBase* updated_view) override;
@@ -87,10 +87,10 @@ index 0c7d5b2c1d3e97420913bd643bb2a524a76fc286..653793fa480f035ce11e079b370bf5ed
    // The view with active text input state, i.e., a focused <input> element.
    // It will be nullptr if no such view exists. Note that the active view
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index d9646348e5b21618e013e04c5ec43868163c1d5b..9614ffb57e2d9b9d70f8affcefbed03f05c30f1f 100644
+index a916cc8491ccf00deae90f1a490df54f334f10d1..b0b1d0aea5bf251411d0cab06562fd77d8d7c549 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -8870,7 +8870,7 @@ void WebContentsImpl::OnFocusedElementChangedInFrame(
+@@ -8871,7 +8871,7 @@ void WebContentsImpl::OnFocusedElementChangedInFrame(
                          "WebContentsImpl::OnFocusedElementChangedInFrame",
                          "render_frame_host", frame);
    RenderWidgetHostViewBase* root_view =

patches/chromium/fix_remove_caption-removing_style_call.patch

@@ -18,10 +18,10 @@ or resizing, but Electron does not seem to run into that issue
 for opaque frameless windows even with that block commented out.
 
 diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 9e750772739b966647ae4effe625edc11ecf6c04..5b5583740d5ea67e4d68447ceca675b83cb0acee 100644
+index 577aa886b1ea3d942ae7b2bbca85ea6ae93fea7a..5c4a1aed2e63aa16b0011375502532d85d543887 100644
 --- a/ui/views/win/hwnd_message_handler.cc
 +++ b/ui/views/win/hwnd_message_handler.cc
-@@ -1738,7 +1738,23 @@ LRESULT HWNDMessageHandler::OnCreate(CREATESTRUCT* create_struct) {
+@@ -1739,7 +1739,23 @@ LRESULT HWNDMessageHandler::OnCreate(CREATESTRUCT* create_struct) {
    SendMessage(hwnd(), WM_CHANGEUISTATE, MAKELPARAM(UIS_CLEAR, UISF_HIDEFOCUS),
                0);
  

patches/chromium/fix_return_v8_value_from_localframe_requestexecutescript.patch

@@ -64,10 +64,10 @@ index cba373664bec3a32abad6fe0396bd67b53b7e67f..7a985067b1371604644d48159f2f5aa7
  
  #endif  // THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_SCRIPT_EXECUTION_CALLBACK_H_
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 92cfe0001933cd18ecb7384ead1dda26f563e62b..0e90800b13e3d0fd18e4c8c32f0a90d64bcff4b9 100644
+index 0ba08a946155ee4d04a693cf26840a95f315b9a3..2c6203cf838b6c988e49ffffe147264919d312c9 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -2982,6 +2982,7 @@ void LocalFrame::RequestExecuteScript(
+@@ -2991,6 +2991,7 @@ void LocalFrame::RequestExecuteScript(
      mojom::blink::EvaluationTiming evaluation_timing,
      mojom::blink::LoadEventBlockingOption blocking_option,
      WebScriptExecutionCallback callback,
@@ -75,7 +75,7 @@ index 92cfe0001933cd18ecb7384ead1dda26f563e62b..0e90800b13e3d0fd18e4c8c32f0a90d6
      BackForwardCacheAware back_forward_cache_aware,
      mojom::blink::WantResultOption want_result_option,
      mojom::blink::PromiseResultOption promise_behavior) {
-@@ -3015,7 +3016,7 @@ void LocalFrame::RequestExecuteScript(
+@@ -3024,7 +3025,7 @@ void LocalFrame::RequestExecuteScript(
    PausableScriptExecutor::CreateAndRun(
        script_state, std::move(script_sources), execute_script_policy,
        user_gesture, evaluation_timing, blocking_option, want_result_option,
@@ -85,7 +85,7 @@ index 92cfe0001933cd18ecb7384ead1dda26f563e62b..0e90800b13e3d0fd18e4c8c32f0a90d6
  
  void LocalFrame::SetEvictCachedSessionStorageOnFreezeOrUnload() {
 diff --git a/third_party/blink/renderer/core/frame/local_frame.h b/third_party/blink/renderer/core/frame/local_frame.h
-index b05cbf16c6917c646684774829493ad6c908d465..38c9e6c423144fa1f15dc8bc0d76109428b888cb 100644
+index fe3a87df88b5959cdc388123738d836625ccfaad..328cd42b4c7595181f6477a9d6b3a63af8939e7b 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.h
 +++ b/third_party/blink/renderer/core/frame/local_frame.h
 @@ -825,6 +825,7 @@ class CORE_EXPORT LocalFrame final

patches/chromium/frame_host_manager.patch

@@ -6,10 +6,10 @@ Subject: frame_host_manager.patch
 Allows embedder to intercept site instances created by chromium.
 
 diff --git a/content/browser/renderer_host/render_frame_host_manager.cc b/content/browser/renderer_host/render_frame_host_manager.cc
-index 91521d844841ba42cc98b98ec646e0a36f2cc393..62a069836bc680bd82559eaa1eb5a7f14d3597c1 100644
+index d9493f3d7503bcb34d18408a60540afe52bbe8e4..3f3e33c4f6dfa9b10f59622435c5da1ef6b01e4e 100644
 --- a/content/browser/renderer_host/render_frame_host_manager.cc
 +++ b/content/browser/renderer_host/render_frame_host_manager.cc
-@@ -4290,6 +4290,9 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
+@@ -4338,6 +4338,9 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
      request->ResetStateForSiteInstanceChange();
    }
  
@@ -20,7 +20,7 @@ index 91521d844841ba42cc98b98ec646e0a36f2cc393..62a069836bc680bd82559eaa1eb5a7f1
  }
  
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index b777041ec1111444d690d1d188dd622ce4677d4c..7541c01f350b41e5b69a6d91f6ab10409615f2a8 100644
+index 1d5e065aa06bc3175f9abdce25e31864aa06f78d..3e5f1307494ffe344118372a10a5fd0cfd439bb3 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
 @@ -308,6 +308,11 @@ class CONTENT_EXPORT ContentBrowserClient {

patches/chromium/gin_enable_disable_v8_platform.patch

@@ -38,10 +38,10 @@ index c19eb72e8d37fe8145b813d07875addf793e12dc..a5db8841773618814ac90f740201d4d7
    // Returns whether `Initialize` has already been invoked in the process.
    // Initialization is a one-way operation (i.e., this method cannot return
 diff --git a/gin/v8_initializer.cc b/gin/v8_initializer.cc
-index 87a32462a37a1226dfc14b47bf73b9f21f9eb898..bf101d76e22d80fe909d0eebe1f5c2c399cb09b9 100644
+index c8a18ab7ed686111c31147920604dc005abf5829..d069889816cbc50a922bed055c78d6779c49e03d 100644
 --- a/gin/v8_initializer.cc
 +++ b/gin/v8_initializer.cc
-@@ -463,7 +463,8 @@ void SetFlags(IsolateHolder::ScriptMode mode,
+@@ -465,7 +465,8 @@ void SetFlags(IsolateHolder::ScriptMode mode,
  // static
  void V8Initializer::Initialize(IsolateHolder::ScriptMode mode,
                                 const std::string js_command_line_flags,
@@ -51,7 +51,7 @@ index 87a32462a37a1226dfc14b47bf73b9f21f9eb898..bf101d76e22d80fe909d0eebe1f5c2c3
    static bool v8_is_initialized = false;
    if (v8_is_initialized)
      return;
-@@ -473,7 +474,8 @@ void V8Initializer::Initialize(IsolateHolder::ScriptMode mode,
+@@ -475,7 +476,8 @@ void V8Initializer::Initialize(IsolateHolder::ScriptMode mode,
    // See https://crbug.com/v8/11043
    SetFlags(mode, js_command_line_flags);
  

patches/chromium/gritsettings_resource_ids.patch

@@ -6,7 +6,7 @@ Subject: gritsettings_resource_ids.patch
 Add electron resources file to the list of resource ids generation.
 
 diff --git a/tools/gritsettings/resource_ids.spec b/tools/gritsettings/resource_ids.spec
-index af3d2926f558788796ba09b3adc0960c24096a2a..2b4b2e54ef1a7424bb675ff6d2f98b976a747fea 100644
+index 3b6a1acc7deefa79f90d3413a6862bd5b94ed416..abdbcaceab717ec10e045870d3522da1e6131164 100644
 --- a/tools/gritsettings/resource_ids.spec
 +++ b/tools/gritsettings/resource_ids.spec
 @@ -1283,6 +1283,11 @@

patches/chromium/hack_to_allow_gclient_sync_with_host_os_mac_on_linux_in_ci.patch

@@ -11,7 +11,7 @@ If removing this patch causes no sync failures, it's safe to delete :+1:
 Ref https://chromium-review.googlesource.com/c/chromium/src/+/2953903
 
 diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
-index 677ce05277c770d901829b6b6bc5242a448ed0c9..b8fc1ec916848f8fc301e043e7e28c4303209087 100755
+index 1c9c6fcc4dda9b38e71b5fc0d6feca4c75c350f4..299d765be8856c01a31af477f2c2e22012802dfe 100755
 --- a/tools/clang/scripts/update.py
 +++ b/tools/clang/scripts/update.py
 @@ -306,6 +306,8 @@ def GetDefaultHostOs():

patches/chromium/logging_win32_only_create_a_console_if_logging_to_stderr.patch

@@ -9,21 +9,21 @@ be created for each child process, despite logs being redirected to a
 file.
 
 diff --git a/content/app/content_main.cc b/content/app/content_main.cc
-index ffbb5986ca997135bd44b5a4aa02066cfce5f394..520825bc2d7d7006544e9d88a8c196f03903ff60 100644
+index fe6ffe9a1b9b39e077e6bdb60e4802e040a2f078..9c25426fa65ecf0b931972cf814329a0a416324c 100644
 --- a/content/app/content_main.cc
 +++ b/content/app/content_main.cc
-@@ -308,14 +308,13 @@ RunContentProcess(ContentMainParams params,
+@@ -307,14 +307,13 @@ RunContentProcess(ContentMainParams params,
+     }
  
  #if BUILDFLAG(IS_WIN)
-     // Route stdio to parent console (if any) or create one.
--    if (base::CommandLine::ForCurrentProcess()->HasSwitch(
--            switches::kEnableLogging)) {
--      base::RouteStdioToConsole(/*create_console_if_not_found*/ true);
--    } else if (base::CommandLine::ForCurrentProcess()->HasSwitch(
--                   switches::kHeadless)) {
+-    base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
+-    if (command_line->HasSwitch(switches::kHeadless)) {
 -      // When running in headless mode we want stdio routed however if
 -      // console does not exist we should not create one.
 -      base::RouteStdioToConsole(/*create_console_if_not_found*/ false);
+-    } else if (command_line->HasSwitch(switches::kEnableLogging)) {
+-      // Route stdio to parent console (if any) or create one.
+-      base::RouteStdioToConsole(/*create_console_if_not_found*/ true);
 +    auto const* cmd_line = base::CommandLine::ForCurrentProcess();
 +    bool const log_to_stderr =
 +        cmd_line->HasSwitch(switches::kEnableLogging) &&

patches/chromium/mas_avoid_private_macos_api_usage.patch.patch

@@ -35,10 +35,10 @@ system font by checking if it's kCTFontPriorityAttribute is set to
 system priority.
 
 diff --git a/base/BUILD.gn b/base/BUILD.gn
-index 353b3e7c6a519570af5a4842135388a8cc01e130..a836d7380a396813ec0a7a294c91ae0d09cc889f 100644
+index 25356ec40cdbf63c89ccc4b05245b00d65e0739a..0c347ca1a75a9c894a0dc067ef87c34ae5a5b495 100644
 --- a/base/BUILD.gn
 +++ b/base/BUILD.gn
-@@ -1050,6 +1050,7 @@ component("base") {
+@@ -1058,6 +1058,7 @@ component("base") {
      "//build/config/compiler:prevent_unsafe_narrowing",
      "//build/config/compiler:wexit_time_destructors",
      "//build/config/compiler:wglobal_constructors",
@@ -471,7 +471,7 @@ index 7c53d9b2015c6c57f19c23c52c1aab3ffeea15ea..f6b7ba2f3512dcd2528323bb6853452c
    libs = []
    frameworks = []
 diff --git a/content/browser/accessibility/browser_accessibility_manager_mac.mm b/content/browser/accessibility/browser_accessibility_manager_mac.mm
-index abdf8a8d28639dc3735d3dc5bd309c237917f087..c08c84c3b243a6bafd358a34cbb391a6d6a9262a 100644
+index e9e46e9c3ccfc08032cbeffdd6342236bbc6406c..c6836ccf3fc6089144bb31a248aea7a6f6af06f1 100644
 --- a/content/browser/accessibility/browser_accessibility_manager_mac.mm
 +++ b/content/browser/accessibility/browser_accessibility_manager_mac.mm
 @@ -21,7 +21,9 @@
@@ -500,7 +500,7 @@ index abdf8a8d28639dc3735d3dc5bd309c237917f087..c08c84c3b243a6bafd358a34cbb391a6
  
        // Use native VoiceOver support for live regions.
        BrowserAccessibilityCocoa* retained_node = native_node;
-@@ -621,6 +625,7 @@ void PostAnnouncementNotification(NSString* announcement,
+@@ -619,6 +623,7 @@ void PostAnnouncementNotification(NSString* announcement,
      return window == [NSApp accessibilityFocusedWindow];
    }
  
@@ -508,7 +508,7 @@ index abdf8a8d28639dc3735d3dc5bd309c237917f087..c08c84c3b243a6bafd358a34cbb391a6
    // TODO(accessibility): We need a solution to the problem described below.
    // If the window is NSAccessibilityRemoteUIElement, there are some challenges:
    // 1. NSApp is the browser which spawned the PWA, and what it considers the
-@@ -649,6 +654,7 @@ void PostAnnouncementNotification(NSString* announcement,
+@@ -647,6 +652,7 @@ void PostAnnouncementNotification(NSString* announcement,
    if ([window isKindOfClass:[NSAccessibilityRemoteUIElement class]]) {
      return true;
    }
@@ -517,7 +517,7 @@ index abdf8a8d28639dc3735d3dc5bd309c237917f087..c08c84c3b243a6bafd358a34cbb391a6
    return false;
  }
 diff --git a/content/browser/renderer_host/render_widget_host_view_mac.h b/content/browser/renderer_host/render_widget_host_view_mac.h
-index d4e154d08dc61e7240fbb564d942732d3eef7a1a..7b30649c6656107a9401475c745467dd525358ca 100644
+index 5497f4e3faa66cc0a78d449e92d54c1da0cb041c..a768ff0ad1fd0aebc14f0432b9f4b88b8a42e34a 100644
 --- a/content/browser/renderer_host/render_widget_host_view_mac.h
 +++ b/content/browser/renderer_host/render_widget_host_view_mac.h
 @@ -49,7 +49,9 @@ class ScopedPasswordInputEnabler;
@@ -530,7 +530,7 @@ index d4e154d08dc61e7240fbb564d942732d3eef7a1a..7b30649c6656107a9401475c745467dd
  @class RenderWidgetHostViewCocoa;
  @class CursorAccessibilityScaleFactorObserver;
  
-@@ -681,9 +683,11 @@ class CONTENT_EXPORT RenderWidgetHostViewMac
+@@ -682,9 +684,11 @@ class CONTENT_EXPORT RenderWidgetHostViewMac
    // EnsureSurfaceSynchronizedForWebTest().
    uint32_t latest_capture_sequence_number_ = 0u;
  
@@ -543,7 +543,7 @@ index d4e154d08dc61e7240fbb564d942732d3eef7a1a..7b30649c6656107a9401475c745467dd
    // Used to force the NSApplication's focused accessibility element to be the
    // content::BrowserAccessibilityCocoa accessibility tree when the NSView for
 diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
-index 72b957cd89704085ad44d040e0826148d56881fb..39e03b029c4ebf03020f6cc8b67922f73652772a 100644
+index a2c2c78947c5e3e64632fd0f128745a80ce45fa8..96283a4f72b32eb45357eb6ec1f5b807593d5f07 100644
 --- a/content/browser/renderer_host/render_widget_host_view_mac.mm
 +++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
 @@ -272,8 +272,10 @@
@@ -557,7 +557,7 @@ index 72b957cd89704085ad44d040e0826148d56881fb..39e03b029c4ebf03020f6cc8b67922f7
  
    // Reset `ns_view_` before resetting `remote_ns_view_` to avoid dangling
    // pointers. `ns_view_` gets reinitialized later in this method.
-@@ -1649,8 +1651,10 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
+@@ -1654,8 +1656,10 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
  
  gfx::NativeViewAccessible
  RenderWidgetHostViewMac::AccessibilityGetNativeViewAccessibleForWindow() {
@@ -568,7 +568,7 @@ index 72b957cd89704085ad44d040e0826148d56881fb..39e03b029c4ebf03020f6cc8b67922f7
    return [GetInProcessNSView() window];
  }
  
-@@ -1699,9 +1703,11 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
+@@ -1704,9 +1708,11 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
  }
  
  void RenderWidgetHostViewMac::SetAccessibilityWindow(NSWindow* window) {
@@ -580,7 +580,7 @@ index 72b957cd89704085ad44d040e0826148d56881fb..39e03b029c4ebf03020f6cc8b67922f7
  }
  
  bool RenderWidgetHostViewMac::SyncIsWidgetForMainFrame(
-@@ -2209,20 +2215,26 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
+@@ -2214,20 +2220,26 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
  void RenderWidgetHostViewMac::GetRenderWidgetAccessibilityToken(
      GetRenderWidgetAccessibilityTokenCallback callback) {
    base::ProcessId pid = getpid();
@@ -700,7 +700,7 @@ index a119b4439bfb9218c7aaf09dca8e78527da7f20d..faa813b003940280c6eeb87e70173019
  
  }  // namespace content
 diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
-index f8b1c7ebd90d032411b1885a183403162ec3ff0c..ec30a59330641562d0e3597a4fe12368408dadde 100644
+index 4d747913c7c3904f5e3f463580523907f758dcbe..d3b6b24ee7ca6ccc6e45b492735b21836b715102 100644
 --- a/content/test/BUILD.gn
 +++ b/content/test/BUILD.gn
 @@ -488,6 +488,7 @@ static_library("test_support") {
@@ -719,7 +719,7 @@ index f8b1c7ebd90d032411b1885a183403162ec3ff0c..ec30a59330641562d0e3597a4fe12368
  }
  
  mojom("content_test_mojo_bindings") {
-@@ -1703,6 +1705,7 @@ test("content_browsertests") {
+@@ -1702,6 +1704,7 @@ test("content_browsertests") {
    defines = [ "HAS_OUT_OF_PROC_TEST_RUNNER" ]
  
    configs += [ "//build/config:precompiled_headers" ]
@@ -727,7 +727,7 @@ index f8b1c7ebd90d032411b1885a183403162ec3ff0c..ec30a59330641562d0e3597a4fe12368
  
    public_deps = [
      ":test_interfaces",
-@@ -2930,6 +2933,7 @@ test("content_unittests") {
+@@ -2929,6 +2932,7 @@ test("content_unittests") {
    }
  
    configs += [ "//build/config:precompiled_headers" ]
@@ -805,10 +805,10 @@ index 3033b23a07041d375d5733bad1901f9a61bdf3b6..9dd6cb1aa49d03c167d1a92100d4ba5f
  
  base::WeakPtr<BluetoothLowEnergyAdapterApple>
 diff --git a/gpu/ipc/service/BUILD.gn b/gpu/ipc/service/BUILD.gn
-index ea3578a727bdccfff74a4112529af9ac052165f2..a0f8573a4401922e4bc9de9b0faf11951efef741 100644
+index 6716bd24f4bed27a57777e12846056cbd3d4ea03..b8c268ce7b04d48867d5f4b7becc70c93b0440fd 100644
 --- a/gpu/ipc/service/BUILD.gn
 +++ b/gpu/ipc/service/BUILD.gn
-@@ -135,6 +135,7 @@ component("service") {
+@@ -134,6 +134,7 @@ component("service") {
        "QuartzCore.framework",
      ]
      defines += [ "GL_SILENCE_DEPRECATION" ]
@@ -842,10 +842,10 @@ index 88bac8b417b0618fdb3c14ec4eb3c5006edd58d9..16106d3122cfc18f32285e4f475b01a5
  
    gfx::Size pixel_size_;
 diff --git a/gpu/ipc/service/image_transport_surface_overlay_mac.mm b/gpu/ipc/service/image_transport_surface_overlay_mac.mm
-index 9599d5f3351942d9d71d4c019ecefa35370e8327..268e05efbf68fc556763d18d54934ee711fa1d45 100644
+index 6b4b723f40c67b4ca465dfdb113ef9f3d495719a..16cdb97882e90a6a8d3bac494c745b7d3891a04e 100644
 --- a/gpu/ipc/service/image_transport_surface_overlay_mac.mm
 +++ b/gpu/ipc/service/image_transport_surface_overlay_mac.mm
-@@ -75,12 +75,16 @@
+@@ -74,12 +74,16 @@
  }  // namespace
  
  ImageTransportSurfaceOverlayMacEGL::ImageTransportSurfaceOverlayMacEGL()
@@ -863,7 +863,7 @@ index 9599d5f3351942d9d71d4c019ecefa35370e8327..268e05efbf68fc556763d18d54934ee7
    ca_layer_tree_coordinator_ = std::make_unique<ui::CALayerTreeCoordinator>(
        use_remote_layer_api_, !av_disabled_at_command_line);
  
-@@ -101,6 +105,10 @@
+@@ -100,6 +104,10 @@
  #endif
      ca_context_.layer = ca_layer_tree_coordinator_->GetCALayerForDisplay();
    }
@@ -874,7 +874,7 @@ index 9599d5f3351942d9d71d4c019ecefa35370e8327..268e05efbf68fc556763d18d54934ee7
  }
  
  ImageTransportSurfaceOverlayMacEGL::~ImageTransportSurfaceOverlayMacEGL() {
-@@ -233,9 +241,13 @@
+@@ -232,9 +240,13 @@
      TRACE_EVENT_INSTANT2("test_gpu", "SwapBuffers", TRACE_EVENT_SCOPE_THREAD,
                           "GLImpl", static_cast<int>(gl::GetGLImplementation()),
                           "width", pixel_size_.width());
@@ -929,10 +929,10 @@ index 25dfcca1ba390548599a4a3667a2ed6943834392..23a0960c13448aa6c9f413f00c833753
  }  // namespace
  #endif
 diff --git a/media/audio/mac/audio_manager_mac.cc b/media/audio/mac/audio_manager_mac.cc
-index 0c0243c2bb9e72c6eba6f9af554b99e2d5514a5d..f5f0e0ec951ccc8278b773c852134e4e29f53e8a 100644
+index bfe8aa58c527aad9135256c7fde4d46d4c906c33..e6ce3886d0992fea2aac2783e833da911e0e2275 100644
 --- a/media/audio/mac/audio_manager_mac.cc
 +++ b/media/audio/mac/audio_manager_mac.cc
-@@ -959,7 +959,7 @@ AudioParameters AudioManagerMac::GetPreferredOutputStreamParameters(
+@@ -969,7 +969,7 @@ AudioParameters AudioManagerMac::GetPreferredOutputStreamParameters(
  
  void AudioManagerMac::InitializeOnAudioThread() {
    DCHECK(GetTaskRunner()->BelongsToCurrentThread());
@@ -1596,10 +1596,10 @@ index 0ab5fbd2a81d8860c73f29c08896f6755b5ca5fa..9400c6c7698258ff2834c550fb8901b4
      // enough.
      return PlatformFontMac::SystemFontType::kGeneral;
 diff --git a/ui/views/BUILD.gn b/ui/views/BUILD.gn
-index d2a918d304afa5e540ab07a5d80887fe9ea6b60e..0fa6cc4314e7d2f16289b7bd7ab38d45cf5bed42 100644
+index ebc3920648cd0c02ad53ec97884a8906dc2d7321..43844bb1d2fb2daa4a8e9fd18e10fc0e8a3fb817 100644
 --- a/ui/views/BUILD.gn
 +++ b/ui/views/BUILD.gn
-@@ -712,6 +712,7 @@ component("views") {
+@@ -714,6 +714,7 @@ component("views") {
        "IOSurface.framework",
        "QuartzCore.framework",
      ]
@@ -1607,7 +1607,7 @@ index d2a918d304afa5e540ab07a5d80887fe9ea6b60e..0fa6cc4314e7d2f16289b7bd7ab38d45
    }
  
    if (is_win) {
-@@ -1143,6 +1144,8 @@ source_set("test_support") {
+@@ -1147,6 +1148,8 @@ source_set("test_support") {
      "//testing/gtest",
    ]
  
@@ -1644,7 +1644,7 @@ index 06cb52062e66fc27c00941e703b909cf42cfa322..309f7a351b8a2aa2ccc42a084a5af086
    // Used to force the NSApplication's focused accessibility element to be the
    // views::Views accessibility tree when the NSView for this is focused.
 diff --git a/ui/views/cocoa/native_widget_mac_ns_window_host.mm b/ui/views/cocoa/native_widget_mac_ns_window_host.mm
-index 800e715ad7a7051743ce3b1da1b2f9a2c07a4b7e..57169b5f44e6a457c2747f407b8e2b5a26785297 100644
+index 7201c4c13c1b225b921eeca073e8f0514de2c6af..a88c37536e54628b06f26c3405f6df2d34a7daaa 100644
 --- a/ui/views/cocoa/native_widget_mac_ns_window_host.mm
 +++ b/ui/views/cocoa/native_widget_mac_ns_window_host.mm
 @@ -345,7 +345,11 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
@@ -1671,7 +1671,19 @@ index 800e715ad7a7051743ce3b1da1b2f9a2c07a4b7e..57169b5f44e6a457c2747f407b8e2b5a
  }
  
  remote_cocoa::mojom::NativeWidgetNSWindow*
-@@ -1410,6 +1418,7 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
+@@ -1263,9 +1271,11 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
+   // for PWAs. However this breaks accessibility on in-process windows,
+   // so set it back to NO when a local window gains focus. See
+   // https://crbug.com/41485830.
++#if !IS_MAS_BUILD()
+   if (is_key && features::IsAccessibilityRemoteUIAppEnabled()) {
+     [NSAccessibilityRemoteUIElement setRemoteUIApp:!!application_host_];
+   }
++#endif
+   // Explicitly set the keyboard accessibility state on regaining key
+   // window status.
+   if (is_key && is_content_first_responder)
+@@ -1418,17 +1428,20 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
  void NativeWidgetMacNSWindowHost::SetRemoteAccessibilityTokens(
      const std::vector<uint8_t>& window_token,
      const std::vector<uint8_t>& view_token) {
@@ -1679,10 +1691,9 @@ index 800e715ad7a7051743ce3b1da1b2f9a2c07a4b7e..57169b5f44e6a457c2747f407b8e2b5a
    remote_window_accessible_ =
        ui::RemoteAccessibility::GetRemoteElementFromToken(window_token);
    remote_view_accessible_ =
-@@ -1421,11 +1430,13 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
-       ![NSAccessibilityRemoteUIElement isRemoteUIApp]) {
-     [NSAccessibilityRemoteUIElement setRemoteUIApp:YES];
-   }
+       ui::RemoteAccessibility::GetRemoteElementFromToken(view_token);
+   [remote_view_accessible_ setWindowUIElement:remote_window_accessible_];
+   [remote_view_accessible_ setTopLevelUIElement:remote_window_accessible_];
 +#endif
  }
  
@@ -1693,7 +1704,7 @@ index 800e715ad7a7051743ce3b1da1b2f9a2c07a4b7e..57169b5f44e6a457c2747f407b8e2b5a
    *pid = getpid();
    id element_id = GetNativeViewAccessible();
  
-@@ -1438,6 +1449,7 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
+@@ -1441,6 +1454,7 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
    }
  
    *token = ui::RemoteAccessibility::GetTokenForLocalElement(element_id);

patches/chromium/network_service_allow_remote_certificate_verification_logic.patch

@@ -7,7 +7,7 @@ This adds a callback from the network service that's used to implement
 session.setCertificateVerifyCallback.
 
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index ecefb420b45e9729fa97cb81362de36ccec4ae64..851280c5c26cb93a6a80977b0b3a9815ce2d5d11 100644
+index 16e8cf435e4b07240064afc13432512a920acf7f..a68c23c049078ce0e1d893dd1921c1e55ebe1019 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
 @@ -151,6 +151,11 @@
@@ -147,7 +147,7 @@ index ecefb420b45e9729fa97cb81362de36ccec4ae64..851280c5c26cb93a6a80977b0b3a9815
  
    builder.SetCertVerifier(IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index bf94d00d748c6b703081f49f9b1df8c7f906930a..7cb0642b4661c5415b4f8f4a934ef32f27b9eb28 100644
+index a3ba05cb98fdb566a3b2287e5920f32039c49087..5db4f275fb5b619f0dba5526202fec6e8a69399a 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
 @@ -113,6 +113,7 @@ class URLMatcher;
@@ -167,7 +167,7 @@ index bf94d00d748c6b703081f49f9b1df8c7f906930a..7cb0642b4661c5415b4f8f4a934ef32f
    void ResetURLLoaderFactories() override;
    void GetViaObliviousHttp(
        mojom::ObliviousHttpRequestPtr request,
-@@ -875,6 +878,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+@@ -887,6 +890,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
    std::vector<base::OnceClosure> dismount_closures_;
  #endif  // BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  
@@ -177,7 +177,7 @@ index bf94d00d748c6b703081f49f9b1df8c7f906930a..7cb0642b4661c5415b4f8f4a934ef32f
    std::unique_ptr<HostResolver> internal_host_resolver_;
    std::set<std::unique_ptr<HostResolver>, base::UniquePtrComparator>
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
-index e6b9d328b94d229dcb5a6267d3e5f3f7d42d1baf..567d6f230e33b2e7d9ff8e3f768fc4c94704eaac 100644
+index c774dfca15ae18c80084b9f46f0a9cf571ee42f4..01e438f5060f8e249a599712248586d26f3b7b47 100644
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
 @@ -298,6 +298,16 @@ struct SocketBrokerRemotes {
@@ -208,7 +208,7 @@ index e6b9d328b94d229dcb5a6267d3e5f3f7d42d1baf..567d6f230e33b2e7d9ff8e3f768fc4c9
    CreateURLLoaderFactory(pending_receiver<URLLoaderFactory> url_loader_factory,
                           URLLoaderFactoryParams params);
 diff --git a/services/network/test/test_network_context.h b/services/network/test/test_network_context.h
-index 73cfd546a0c5b5119aac6df910be9d925b48ade7..3061938ac5af0f2f1dbe0e0c70457b21ab1cd6c2 100644
+index 5868a904e53b2df6ea2cf6864ac1300bdc9bd967..981fc599cee08d36387ef4265a6c7c5816c174ac 100644
 --- a/services/network/test/test_network_context.h
 +++ b/services/network/test/test_network_context.h
 @@ -62,6 +62,8 @@ class TestNetworkContext : public mojom::NetworkContext {

patches/chromium/printing.patch

@@ -11,7 +11,7 @@ majority of changes originally come from these PRs:
 This patch also fixes callback for manual user cancellation and success.
 
 diff --git a/BUILD.gn b/BUILD.gn
-index 69e759c3b34692beac06ceeddf4b3f1637fb7788..42d0da7f936626aa8bb90057723deeaafce8744d 100644
+index 4b37258f1bbba1d37e414ea7ec9a93cbd7a1efc4..4667f496f093cb7df71c5e5756fc61bb06053a8b 100644
 --- a/BUILD.gn
 +++ b/BUILD.gn
 @@ -973,7 +973,6 @@ if (is_win) {
@@ -640,7 +640,7 @@ index 4ecdb28904fac480cf102fffdff24ae008ac88cf..e8150c95fafd83d7e2fe1f472a35acec
    PrintingFailed(int32 cookie, PrintFailureReason reason);
  
 diff --git a/components/printing/renderer/print_render_frame_helper.cc b/components/printing/renderer/print_render_frame_helper.cc
-index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a95306c72e2d 100644
+index 410dc5e8a46946e0a0293bdefa85b5dbb13821c9..c07c6a91caa137b15402efcb455ff919e0c4fd48 100644
 --- a/components/printing/renderer/print_render_frame_helper.cc
 +++ b/components/printing/renderer/print_render_frame_helper.cc
 @@ -47,6 +47,7 @@
@@ -651,7 +651,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
  #include "printing/units.h"
  #include "services/metrics/public/cpp/ukm_source_id.h"
  #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
-@@ -1229,14 +1230,14 @@ void PrintRenderFrameHelper::ScriptedPrint(bool user_initiated) {
+@@ -1232,14 +1233,14 @@ void PrintRenderFrameHelper::ScriptedPrint(bool user_initiated) {
    }
  
    print_in_progress_ = true;
@@ -668,7 +668,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
    if (!weak_this) {
      return;
    }
-@@ -1267,7 +1268,7 @@ void PrintRenderFrameHelper::BindPrintRenderFrameReceiver(
+@@ -1270,7 +1271,7 @@ void PrintRenderFrameHelper::BindPrintRenderFrameReceiver(
    receivers_.Add(this, std::move(receiver));
  }
  
@@ -677,7 +677,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
    ScopedIPC scoped_ipc(weak_ptr_factory_.GetWeakPtr());
    if (ipc_nesting_level_ > kAllowedIpcDepthForPrint)
      return;
-@@ -1282,7 +1283,7 @@ void PrintRenderFrameHelper::PrintRequestedPages() {
+@@ -1285,7 +1286,7 @@ void PrintRenderFrameHelper::PrintRequestedPages() {
    // plugin node and print that instead.
    auto plugin = delegate_->GetPdfElement(frame);
  
@@ -686,7 +686,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
  
    if (render_frame_gone_) {
      return;
-@@ -1371,7 +1372,8 @@ void PrintRenderFrameHelper::PrintForSystemDialog() {
+@@ -1374,7 +1375,8 @@ void PrintRenderFrameHelper::PrintForSystemDialog() {
    }
  
    Print(frame, print_preview_context_.source_node(),
@@ -696,7 +696,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
    if (render_frame_gone_) {
      return;
    }
-@@ -1434,6 +1436,8 @@ void PrintRenderFrameHelper::PrintPreview(base::Value::Dict settings) {
+@@ -1437,6 +1439,8 @@ void PrintRenderFrameHelper::PrintPreview(base::Value::Dict settings) {
    if (ipc_nesting_level_ > kAllowedIpcDepthForPrint)
      return;
  
@@ -705,7 +705,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
    print_preview_context_.OnPrintPreview();
  
  #if BUILDFLAG(IS_CHROMEOS_ASH)
-@@ -2011,7 +2015,8 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
+@@ -2014,7 +2018,8 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
    }
  
    Print(duplicate_node.GetDocument().GetFrame(), duplicate_node,
@@ -715,7 +715,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
    // Check if `this` is still valid.
    if (!weak_this) {
      return;
-@@ -2027,17 +2032,19 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
+@@ -2030,17 +2035,19 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
  
  void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
                                     const blink::WebNode& node,
@@ -738,7 +738,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
      DidFinishPrinting(PrintingResult::kFailPrintInit);
      return;
    }
-@@ -2058,8 +2065,15 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
+@@ -2061,8 +2068,15 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
          print_pages_params_->params->print_scaling_option;
  
      auto self = weak_ptr_factory_.GetWeakPtr();
@@ -755,7 +755,7 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
      // Check if `this` is still valid.
      if (!self)
        return;
-@@ -2317,25 +2331,33 @@ void PrintRenderFrameHelper::IPCProcessed() {
+@@ -2320,25 +2334,33 @@ void PrintRenderFrameHelper::IPCProcessed() {
  }
  
  bool PrintRenderFrameHelper::InitPrintSettings(blink::WebLocalFrame* frame,
@@ -785,11 +785,11 @@ index a0ec654b13f82d9c5ff4eb838585485a59c45924..e24f2e209e547685daf18570c0a8a953
      return false;
    }
  
-   bool fit_to_paper_size = !IsPrintingPdfFrame(frame, node);
+   bool center_on_paper = !IsPrintingPdfFrame(frame, node);
 -  settings.params->print_scaling_option =
 +  settings->params->print_scaling_option =
-       fit_to_paper_size ? mojom::PrintScalingOption::kFitToPrintableArea
-                         : mojom::PrintScalingOption::kSourceSize;
+       center_on_paper ? mojom::PrintScalingOption::kCenterShrinkToFitPaper
+                       : mojom::PrintScalingOption::kSourceSize;
 -  SetPrintPagesParams(settings);
 +  SetPrintPagesParams(*settings);
    return true;

patches/chromium/refactor_expose_cursor_changes_to_the_webcontentsobserver.patch

@@ -44,10 +44,10 @@ index df4a7d191281af4602517ecc7300235ceb4e6799..8718ad62ca50b8426814af3a41553263
  
  void RenderWidgetHostImpl::ShowContextMenuAtPoint(
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 6475b9fd000fb83c4562f7d91a30c80e5dddf35e..94cdebc2ae552106bdeb7d3619dc9281c4fb4063 100644
+index 45ac0c129cff1187aa14d989470235de4f0419f1..3066a882b9bb09cc15f6bf30e52362317bd03297 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5268,6 +5268,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {
+@@ -5269,6 +5269,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {
    return text_input_manager_.get();
  }
  
@@ -72,7 +72,7 @@ index 4cb27cbd808dafde72c82f3e907c6b45654813e7..6612ecd6d98dc071cf598dffc64d5593
        RenderWidgetHostImpl* render_widget_host) override;
    bool IsShowingContextMenuOnPage() const override;
 diff --git a/content/public/browser/web_contents_observer.h b/content/public/browser/web_contents_observer.h
-index ede7dc05810649698b30efe7b0889420225a0f2b..e9cd2da6c1343aa03ef97a0c42d3393a8c74dc20 100644
+index 2176bcc3adc34cad4b9f95a139ded422bf3adfb7..a579f764777a221d05e81d028755597e1d1c5754 100644
 --- a/content/public/browser/web_contents_observer.h
 +++ b/content/public/browser/web_contents_observer.h
 @@ -33,6 +33,7 @@

patches/chromium/refactor_expose_file_system_access_blocklist.patch

@@ -0,0 +1,303 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shelley Vohr <shelley.vohr@gmail.com>
+Date: Wed, 27 Mar 2024 10:47:48 +0100
+Subject: refactor: expose file system access blocklist
+
+This CL exposes the file system access blocklist publicly so that we can leverage
+it in Electron and prevent drift from Chrome's blocklist. We should look for a way
+to upstream this change to Chrome.
+
+diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
+index 9c644d678d6d811ae5679594c0574fc0d8607f62..792cd62da17239ca6933930880af23754e4ab3d3 100644
+--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
++++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
+@@ -38,7 +38,6 @@
+ #include "chrome/browser/profiles/profile_manager.h"
+ #include "chrome/browser/safe_browsing/download_protection/download_protection_util.h"
+ #include "chrome/browser/ui/file_system_access_dialogs.h"
+-#include "chrome/common/chrome_paths.h"
+ #include "chrome/common/pdf_util.h"
+ #include "chrome/grit/generated_resources.h"
+ #include "components/content_settings/core/browser/host_content_settings_map.h"
+@@ -222,121 +221,6 @@ bool MaybeIsLocalUNCPath(const base::FilePath& path) {
+ }
+ #endif
+ 
+-// Sentinel used to indicate that no PathService key is specified for a path in
+-// the struct below.
+-constexpr const int kNoBasePathKey = -1;
+-
+-enum BlockType {
+-  kBlockAllChildren,
+-  kBlockNestedDirectories,
+-  kDontBlockChildren
+-};
+-
+-const struct {
+-  // base::BasePathKey value (or one of the platform specific extensions to it)
+-  // for a path that should be blocked. Specify kNoBasePathKey if |path| should
+-  // be used instead.
+-  int base_path_key;
+-
+-  // Explicit path to block instead of using |base_path_key|. Set to nullptr to
+-  // use |base_path_key| on its own. If both |base_path_key| and |path| are set,
+-  // |path| is treated relative to the path |base_path_key| resolves to.
+-  const base::FilePath::CharType* path;
+-
+-  // If this is set to kDontBlockChildren, only the given path and its parents
+-  // are blocked. If this is set to kBlockAllChildren, all children of the given
+-  // path are blocked as well. Finally if this is set to kBlockNestedDirectories
+-  // access is allowed to individual files in the directory, but nested
+-  // directories are still blocked.
+-  // The BlockType of the nearest ancestor of a path to check is what ultimately
+-  // determines if a path is blocked or not. If a blocked path is a descendent
+-  // of another blocked path, then it may override the child-blocking policy of
+-  // its ancestor. For example, if /home blocks all children, but
+-  // /home/downloads does not, then /home/downloads/file.ext will *not* be
+-  // blocked.
+-  BlockType type;
+-} kBlockedPaths[] = {
+-    // Don't allow users to share their entire home directory, entire desktop or
+-    // entire documents folder, but do allow sharing anything inside those
+-    // directories not otherwise blocked.
+-    {base::DIR_HOME, nullptr, kDontBlockChildren},
+-    {base::DIR_USER_DESKTOP, nullptr, kDontBlockChildren},
+-    {chrome::DIR_USER_DOCUMENTS, nullptr, kDontBlockChildren},
+-    // Similar restrictions for the downloads directory.
+-    {chrome::DIR_DEFAULT_DOWNLOADS, nullptr, kDontBlockChildren},
+-    {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr, kDontBlockChildren},
+-    // The Chrome installation itself should not be modified by the web.
+-    {base::DIR_EXE, nullptr, kBlockAllChildren},
+-#if !BUILDFLAG(IS_FUCHSIA)
+-    {base::DIR_MODULE, nullptr, kBlockAllChildren},
+-#endif
+-    {base::DIR_ASSETS, nullptr, kBlockAllChildren},
+-    // And neither should the configuration of at least the currently running
+-    // Chrome instance (note that this does not take --user-data-dir command
+-    // line overrides into account).
+-    {chrome::DIR_USER_DATA, nullptr, kBlockAllChildren},
+-    // ~/.ssh is pretty sensitive on all platforms, so block access to that.
+-    {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), kBlockAllChildren},
+-    // And limit access to ~/.gnupg as well.
+-    {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"), kBlockAllChildren},
+-#if BUILDFLAG(IS_WIN)
+-    // Some Windows specific directories to block, basically all apps, the
+-    // operating system itself, as well as configuration data for apps.
+-    {base::DIR_PROGRAM_FILES, nullptr, kBlockAllChildren},
+-    {base::DIR_PROGRAM_FILESX86, nullptr, kBlockAllChildren},
+-    {base::DIR_PROGRAM_FILES6432, nullptr, kBlockAllChildren},
+-    {base::DIR_WINDOWS, nullptr, kBlockAllChildren},
+-    {base::DIR_ROAMING_APP_DATA, nullptr, kBlockAllChildren},
+-    {base::DIR_LOCAL_APP_DATA, nullptr, kBlockAllChildren},
+-    {base::DIR_COMMON_APP_DATA, nullptr, kBlockAllChildren},
+-    // Opening a file from an MTP device, such as a smartphone or a camera, is
+-    // implemented by Windows as opening a file in the temporary internet files
+-    // directory. To support that, allow opening files in that directory, but
+-    // not whole directories.
+-    {base::DIR_IE_INTERNET_CACHE, nullptr, kBlockNestedDirectories},
+-#endif
+-#if BUILDFLAG(IS_MAC)
+-    // Similar Mac specific blocks.
+-    {base::DIR_APP_DATA, nullptr, kBlockAllChildren},
+-    {base::DIR_HOME, FILE_PATH_LITERAL("Library"), kBlockAllChildren},
+-    // Allow access to other cloud files, such as Google Drive.
+-    {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
+-     kDontBlockChildren},
+-    // Allow the site to interact with data from its corresponding natively
+-    // installed (sandboxed) application. It would be nice to limit a site to
+-    // access only _its_ corresponding natively installed application,
+-    // but unfortunately there's no straightforward way to do that. See
+-    // https://crbug.com/984641#c22.
+-    {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
+-     kDontBlockChildren},
+-    // Allow access to iCloud files...
+-    {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
+-     kDontBlockChildren},
+-    // ... which may also appear at this directory.
+-    {base::DIR_HOME,
+-     FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
+-     kDontBlockChildren},
+-#endif
+-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+-    // On Linux also block access to devices via /dev.
+-    {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), kBlockAllChildren},
+-    // And security sensitive data in /proc and /sys.
+-    {kNoBasePathKey, FILE_PATH_LITERAL("/proc"), kBlockAllChildren},
+-    {kNoBasePathKey, FILE_PATH_LITERAL("/sys"), kBlockAllChildren},
+-    // And system files in /boot and /etc.
+-    {kNoBasePathKey, FILE_PATH_LITERAL("/boot"), kBlockAllChildren},
+-    {kNoBasePathKey, FILE_PATH_LITERAL("/etc"), kBlockAllChildren},
+-    // And block all of ~/.config, matching the similar restrictions on mac
+-    // and windows.
+-    {base::DIR_HOME, FILE_PATH_LITERAL(".config"), kBlockAllChildren},
+-    // Block ~/.dbus as well, just in case, although there probably isn't much a
+-    // website can do with access to that directory and its contents.
+-    {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"), kBlockAllChildren},
+-#endif
+-    // TODO(https://crbug.com/984641): Refine this list, for example add
+-    // XDG_CONFIG_HOME when it is not set ~/.config?
+-};
+-
+ // Describes a rule for blocking a directory, which can be constructed
+ // dynamically (based on state) or statically (from kBlockedPaths).
+ struct BlockPathRule {
+diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
+index 8bc8257b603a88e56f77dcf7d72aa9dad45880db..484f98c68b0dc860a6482e923df2379133c57749 100644
+--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
++++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
+@@ -17,12 +17,13 @@
+ #include "base/time/default_clock.h"
+ #include "chrome/browser/file_system_access/file_system_access_features.h"
+ #include "chrome/browser/file_system_access/file_system_access_permission_request_manager.h"
+-#include "components/enterprise/buildflags/buildflags.h"
++#include "chrome/common/chrome_paths.h"
+ #include "components/permissions/features.h"
+ #include "components/permissions/object_permission_context_base.h"
+ #include "content/public/browser/file_system_access_permission_context.h"
+ #include "third_party/blink/public/mojom/file_system_access/file_system_access_manager.mojom-forward.h"
+ 
++
+ #if !BUILDFLAG(IS_ANDROID)
+ #include "chrome/browser/permissions/one_time_permissions_tracker.h"
+ #include "chrome/browser/permissions/one_time_permissions_tracker_observer.h"
+@@ -30,7 +31,8 @@
+ #include "chrome/browser/web_applications/web_app_install_manager_observer.h"
+ #endif
+ 
+-#if BUILDFLAG(ENTERPRISE_CLOUD_CONTENT_ANALYSIS)
++#if 0
++#include "components/enterprise/buildflags/buildflags.h"
+ #include "chrome/browser/enterprise/connectors/analysis/content_analysis_delegate.h"
+ #include "components/enterprise/common/files_scan_data.h"
+ #endif
+@@ -331,6 +333,121 @@ class ChromeFileSystemAccessPermissionContext
+   // chrome://settings/content/filesystem UI.
+   static constexpr char kPermissionPathKey[] = "path";
+ 
++  // Sentinel used to indicate that no PathService key is specified for a path in
++  // the struct below.
++  static constexpr int kNoBasePathKey = -1;
++
++  enum BlockType {
++    kBlockAllChildren,
++    kBlockNestedDirectories,
++    kDontBlockChildren
++  };
++
++  static constexpr struct {
++    // base::BasePathKey value (or one of the platform specific extensions to it)
++    // for a path that should be blocked. Specify kNoBasePathKey if |path| should
++    // be used instead.
++    int base_path_key;
++
++    // Explicit path to block instead of using |base_path_key|. Set to nullptr to
++    // use |base_path_key| on its own. If both |base_path_key| and |path| are set,
++    // |path| is treated relative to the path |base_path_key| resolves to.
++    const base::FilePath::CharType* path;
++
++    // If this is set to kDontBlockChildren, only the given path and its parents
++    // are blocked. If this is set to kBlockAllChildren, all children of the given
++    // path are blocked as well. Finally if this is set to kBlockNestedDirectories
++    // access is allowed to individual files in the directory, but nested
++    // directories are still blocked.
++    // The BlockType of the nearest ancestor of a path to check is what ultimately
++    // determines if a path is blocked or not. If a blocked path is a descendent
++    // of another blocked path, then it may override the child-blocking policy of
++    // its ancestor. For example, if /home blocks all children, but
++    // /home/downloads does not, then /home/downloads/file.ext will *not* be
++    // blocked.
++    BlockType type;
++  } kBlockedPaths[] = {
++      // Don't allow users to share their entire home directory, entire desktop or
++      // entire documents folder, but do allow sharing anything inside those
++      // directories not otherwise blocked.
++      {base::DIR_HOME, nullptr, kDontBlockChildren},
++      {base::DIR_USER_DESKTOP, nullptr, kDontBlockChildren},
++      {chrome::DIR_USER_DOCUMENTS, nullptr, kDontBlockChildren},
++      // Similar restrictions for the downloads directory.
++      {chrome::DIR_DEFAULT_DOWNLOADS, nullptr, kDontBlockChildren},
++      {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr, kDontBlockChildren},
++      // The Chrome installation itself should not be modified by the web.
++      {base::DIR_EXE, nullptr, kBlockAllChildren},
++  #if !BUILDFLAG(IS_FUCHSIA)
++      {base::DIR_MODULE, nullptr, kBlockAllChildren},
++  #endif
++      {base::DIR_ASSETS, nullptr, kBlockAllChildren},
++      // And neither should the configuration of at least the currently running
++      // Chrome instance (note that this does not take --user-data-dir command
++      // line overrides into account).
++      {chrome::DIR_USER_DATA, nullptr, kBlockAllChildren},
++      // ~/.ssh is pretty sensitive on all platforms, so block access to that.
++      {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), kBlockAllChildren},
++      // And limit access to ~/.gnupg as well.
++      {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"), kBlockAllChildren},
++  #if BUILDFLAG(IS_WIN)
++      // Some Windows specific directories to block, basically all apps, the
++      // operating system itself, as well as configuration data for apps.
++      {base::DIR_PROGRAM_FILES, nullptr, kBlockAllChildren},
++      {base::DIR_PROGRAM_FILESX86, nullptr, kBlockAllChildren},
++      {base::DIR_PROGRAM_FILES6432, nullptr, kBlockAllChildren},
++      {base::DIR_WINDOWS, nullptr, kBlockAllChildren},
++      {base::DIR_ROAMING_APP_DATA, nullptr, kBlockAllChildren},
++      {base::DIR_LOCAL_APP_DATA, nullptr, kBlockAllChildren},
++      {base::DIR_COMMON_APP_DATA, nullptr, kBlockAllChildren},
++      // Opening a file from an MTP device, such as a smartphone or a camera, is
++      // implemented by Windows as opening a file in the temporary internet files
++      // directory. To support that, allow opening files in that directory, but
++      // not whole directories.
++      {base::DIR_IE_INTERNET_CACHE, nullptr, kBlockNestedDirectories},
++  #endif
++  #if BUILDFLAG(IS_MAC)
++      // Similar Mac specific blocks.
++      {base::DIR_APP_DATA, nullptr, kBlockAllChildren},
++      {base::DIR_HOME, FILE_PATH_LITERAL("Library"), kBlockAllChildren},
++      // Allow access to other cloud files, such as Google Drive.
++      {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
++      kDontBlockChildren},
++      // Allow the site to interact with data from its corresponding natively
++      // installed (sandboxed) application. It would be nice to limit a site to
++      // access only _its_ corresponding natively installed application,
++      // but unfortunately there's no straightforward way to do that. See
++      // https://crbug.com/984641#c22.
++      {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
++      kDontBlockChildren},
++      // Allow access to iCloud files...
++      {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
++      kDontBlockChildren},
++      // ... which may also appear at this directory.
++      {base::DIR_HOME,
++      FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
++      kDontBlockChildren},
++  #endif
++  #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
++      // On Linux also block access to devices via /dev.
++      {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), kBlockAllChildren},
++      // And security sensitive data in /proc and /sys.
++      {kNoBasePathKey, FILE_PATH_LITERAL("/proc"), kBlockAllChildren},
++      {kNoBasePathKey, FILE_PATH_LITERAL("/sys"), kBlockAllChildren},
++      // And system files in /boot and /etc.
++      {kNoBasePathKey, FILE_PATH_LITERAL("/boot"), kBlockAllChildren},
++      {kNoBasePathKey, FILE_PATH_LITERAL("/etc"), kBlockAllChildren},
++      // And block all of ~/.config, matching the similar restrictions on mac
++      // and windows.
++      {base::DIR_HOME, FILE_PATH_LITERAL(".config"), kBlockAllChildren},
++      // Block ~/.dbus as well, just in case, although there probably isn't much a
++      // website can do with access to that directory and its contents.
++      {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"), kBlockAllChildren},
++  #endif
++      // TODO(https://crbug.com/984641): Refine this list, for example add
++      // XDG_CONFIG_HOME when it is not set ~/.config?
++  };
++
+  protected:
+   SEQUENCE_CHECKER(sequence_checker_);
+ 
+@@ -350,7 +467,7 @@ class ChromeFileSystemAccessPermissionContext
+ 
+   void PermissionGrantDestroyed(PermissionGrantImpl* grant);
+ 
+-#if BUILDFLAG(ENTERPRISE_CLOUD_CONTENT_ANALYSIS)
++#if 0
+   void OnContentAnalysisComplete(
+       std::vector<PathInfo> entries,
+       EntriesAllowedByEnterprisePolicyCallback callback,

patches/chromium/render_widget_host_view_base.patch

@@ -6,10 +6,10 @@ Subject: render_widget_host_view_base.patch
 ... something to do with OSR? and maybe <webview> as well? terrifying.
 
 diff --git a/content/browser/renderer_host/render_widget_host_view_base.cc b/content/browser/renderer_host/render_widget_host_view_base.cc
-index 577d2ad516dc748ff067f1bdcae35317bff602d1..252c754aa1f0145879d95a971af486512fc14fa0 100644
+index f67fa6e039aed0321fab980eb39c7f9981be8366..390a8b4870326083d33a37c8f6cd3e13ff57b4ed 100644
 --- a/content/browser/renderer_host/render_widget_host_view_base.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_base.cc
-@@ -718,6 +718,13 @@ bool RenderWidgetHostViewBase::ScreenRectIsUnstableForIOv2For(
+@@ -724,6 +724,13 @@ bool RenderWidgetHostViewBase::ScreenRectIsUnstableForIOv2For(
    return false;
  }
  
@@ -24,7 +24,7 @@ index 577d2ad516dc748ff067f1bdcae35317bff602d1..252c754aa1f0145879d95a971af48651
      const blink::WebMouseEvent& event,
      const ui::LatencyInfo& latency) {
 diff --git a/content/browser/renderer_host/render_widget_host_view_base.h b/content/browser/renderer_host/render_widget_host_view_base.h
-index 6f246e3c59620d2c4f98c73ca1833817938fb86f..547d7108a1e984d71eb8f1e74b875d391bd42725 100644
+index 116046b24a3e03984913d0bccb3697bd4b9c6b9a..a4635a52ffe5caa72745ad66b089b9ca895bdf05 100644
 --- a/content/browser/renderer_host/render_widget_host_view_base.h
 +++ b/content/browser/renderer_host/render_widget_host_view_base.h
 @@ -25,10 +25,13 @@

patches/chromium/scroll_bounce_flag.patch

@@ -6,7 +6,7 @@ Subject: scroll_bounce_flag.patch
 Patch to make scrollBounce option work.
 
 diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
-index 1952b5018f8e5bed87b7dc9d8012c8f2fac00c96..ecef0e83520cbf1015ba1d639be39791ec0cfbb5 100644
+index 3594bc7a25c95dd348495b42a27aa0e1f54323dc..1c1fb1609b75b865f0cd9e81794ebb186fdeafba 100644
 --- a/content/renderer/render_thread_impl.cc
 +++ b/content/renderer/render_thread_impl.cc
 @@ -1263,7 +1263,7 @@ bool RenderThreadImpl::IsLcdTextEnabled() {

patches/chromium/web_contents.patch

@@ -9,7 +9,7 @@ is needed for OSR.
 Originally landed in https://github.com/electron/libchromiumcontent/pull/226.
 
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 257b9f8ae014f577a9e2de35a3b251efda451fbe..74b8b5bd0d22555f9e11bf326dc212634078f441 100644
+index 1b3b1b0b3f2b7956b750f559d461e2a41f343448..a716f751687d4b6bb218ae89a8d1e8d761136100 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -3521,6 +3521,13 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,

patches/chromium/webview_fullscreen.patch

@@ -15,10 +15,10 @@ Note that we also need to manually update embedder's
 `api::WebContents::IsFullscreenForTabOrPending` value.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index c36367b28a627f7e6e77bcf3fc10f907b131523b..ed7e48a9b2313eedae4a733e15286a2c28a42a74 100644
+index 812708f24cf9e389d5f0a813c406fec082a795b4..22789f1f1ebbbf76575c3d07e1c9381af73a590a 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -7548,6 +7548,17 @@ void RenderFrameHostImpl::EnterFullscreen(
+@@ -7550,6 +7550,17 @@ void RenderFrameHostImpl::EnterFullscreen(
      }
    }
  
@@ -37,7 +37,7 @@ index c36367b28a627f7e6e77bcf3fc10f907b131523b..ed7e48a9b2313eedae4a733e15286a2c
    if (had_fullscreen_token && !GetView()->HasFocus())
      GetView()->Focus();
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 74b8b5bd0d22555f9e11bf326dc212634078f441..d9646348e5b21618e013e04c5ec43868163c1d5b 100644
+index a716f751687d4b6bb218ae89a8d1e8d761136100..a916cc8491ccf00deae90f1a490df54f334f10d1 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -3775,21 +3775,25 @@ KeyboardEventProcessingResult WebContentsImpl::PreHandleKeyboardEvent(

patches/chromium/worker_context_will_destroy.patch

@@ -26,10 +26,10 @@ index 4399fe2564a03527f5172519d0542967803c8635..1b0e7abf7db8cb2c4df4955f6f5547c6
    // An empty URL is returned if the URL is not overriden.
    virtual GURL OverrideFlashEmbedWithHTML(const GURL& url);
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
-index 033169bbdd94d4767ff90306d8768e87d2c5ccab..49a3f95667a5ae24d32c0f986a98bdd7dd557974 100644
+index 81b4ff933b5d906dc63c6a0d08e3cb20b634d49e..164a4b24b529dd989d6b03a016dbd50242b85e9a 100644
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
-@@ -854,6 +854,12 @@ void RendererBlinkPlatformImpl::WillStopWorkerThread() {
+@@ -846,6 +846,12 @@ void RendererBlinkPlatformImpl::WillStopWorkerThread() {
    WorkerThreadRegistry::Instance()->WillStopCurrentWorkerThread();
  }
  
@@ -43,10 +43,10 @@ index 033169bbdd94d4767ff90306d8768e87d2c5ccab..49a3f95667a5ae24d32c0f986a98bdd7
      const v8::Local<v8::Context>& worker) {
    GetContentClient()->renderer()->DidInitializeWorkerContextOnWorkerThread(
 diff --git a/content/renderer/renderer_blink_platform_impl.h b/content/renderer/renderer_blink_platform_impl.h
-index 89fd49fe34afaef4e36a2b0ac13e01fa98517f7d..f1af544c524680939847a4eca70e4d5aff1a91bf 100644
+index d5ab3967f21ccfc65171366580ba6bbd7532e5eb..00be5a58e202cf4830397f3386384f7dc8b8e19a 100644
 --- a/content/renderer/renderer_blink_platform_impl.h
 +++ b/content/renderer/renderer_blink_platform_impl.h
-@@ -187,6 +187,7 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
+@@ -186,6 +186,7 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
    void DidStartWorkerThread() override;
    void WillStopWorkerThread() override;
    void WorkerContextCreated(const v8::Local<v8::Context>& worker) override;
@@ -55,10 +55,10 @@ index 89fd49fe34afaef4e36a2b0ac13e01fa98517f7d..f1af544c524680939847a4eca70e4d5a
        const blink::WebSecurityOrigin& script_origin) override;
    blink::ProtocolHandlerSecurityLevel GetProtocolHandlerSecurityLevel(
 diff --git a/third_party/blink/public/platform/platform.h b/third_party/blink/public/platform/platform.h
-index 165bd4eae9e1b3509379af1697991469d53c76ae..c953d63fe7252a570347b79ae436bccaebe979c1 100644
+index 38c079e1f9c371854922afccdd73dac65a75240d..f5f0b31af8c18a6e290bcc3605bf43f5fd522b66 100644
 --- a/third_party/blink/public/platform/platform.h
 +++ b/third_party/blink/public/platform/platform.h
-@@ -636,6 +636,7 @@ class BLINK_PLATFORM_EXPORT Platform {
+@@ -632,6 +632,7 @@ class BLINK_PLATFORM_EXPORT Platform {
    virtual void DidStartWorkerThread() {}
    virtual void WillStopWorkerThread() {}
    virtual void WorkerContextCreated(const v8::Local<v8::Context>& worker) {}

patches/chromium/worker_feat_add_hook_to_notify_script_ready.patch

@@ -35,10 +35,10 @@ index 1b0e7abf7db8cb2c4df4955f6f5547c63902f14e..ee60a9cbc78858528f3d77e035e0bc11
    // from the worker thread.
    virtual void WillDestroyWorkerContextOnWorkerThread(
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
-index 49a3f95667a5ae24d32c0f986a98bdd7dd557974..00ca3094599e6ba3bb17582d2bf13dd06e455ffc 100644
+index 164a4b24b529dd989d6b03a016dbd50242b85e9a..abcad188a5cb4ac543ae8b9908dd8a212330d748 100644
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
-@@ -866,6 +866,12 @@ void RendererBlinkPlatformImpl::WorkerContextCreated(
+@@ -858,6 +858,12 @@ void RendererBlinkPlatformImpl::WorkerContextCreated(
        worker);
  }
  
@@ -52,10 +52,10 @@ index 49a3f95667a5ae24d32c0f986a98bdd7dd557974..00ca3094599e6ba3bb17582d2bf13dd0
      const blink::WebSecurityOrigin& script_origin) {
    return GetContentClient()->renderer()->AllowScriptExtensionForServiceWorker(
 diff --git a/content/renderer/renderer_blink_platform_impl.h b/content/renderer/renderer_blink_platform_impl.h
-index f1af544c524680939847a4eca70e4d5aff1a91bf..2c557fc2f50b5181e1e57caab6ed4b21e9dcdd62 100644
+index 00be5a58e202cf4830397f3386384f7dc8b8e19a..f8cdff26b78a0049414ab369185bd331e488efc3 100644
 --- a/content/renderer/renderer_blink_platform_impl.h
 +++ b/content/renderer/renderer_blink_platform_impl.h
-@@ -187,6 +187,8 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
+@@ -186,6 +186,8 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
    void DidStartWorkerThread() override;
    void WillStopWorkerThread() override;
    void WorkerContextCreated(const v8::Local<v8::Context>& worker) override;
@@ -65,10 +65,10 @@ index f1af544c524680939847a4eca70e4d5aff1a91bf..2c557fc2f50b5181e1e57caab6ed4b21
    bool AllowScriptExtensionForServiceWorker(
        const blink::WebSecurityOrigin& script_origin) override;
 diff --git a/third_party/blink/public/platform/platform.h b/third_party/blink/public/platform/platform.h
-index c953d63fe7252a570347b79ae436bccaebe979c1..5013b5affb24eca6cf177590bbc033071488676b 100644
+index f5f0b31af8c18a6e290bcc3605bf43f5fd522b66..72cc5b0ab5a846d1ffa068fa3fa831e221254ce8 100644
 --- a/third_party/blink/public/platform/platform.h
 +++ b/third_party/blink/public/platform/platform.h
-@@ -636,6 +636,8 @@ class BLINK_PLATFORM_EXPORT Platform {
+@@ -632,6 +632,8 @@ class BLINK_PLATFORM_EXPORT Platform {
    virtual void DidStartWorkerThread() {}
    virtual void WillStopWorkerThread() {}
    virtual void WorkerContextCreated(const v8::Local<v8::Context>& worker) {}

patches/devtools_frontend/chore_expose_ui_to_allow_electron_to_set_dock_side.patch

@@ -10,10 +10,10 @@ to handle this without patching, but this is fairly clean for now and no longer
 patching legacy devtools code.
 
 diff --git a/front_end/entrypoints/main/MainImpl.ts b/front_end/entrypoints/main/MainImpl.ts
-index be3b1dd1fe8950d7b4fd276e44f5e0552988e8ad..31daf42856d62bfd05a55aab3244605b9d8073f3 100644
+index aadf24f6663f8824891a76ec3808bad10e8cb069..35472a101fa6e3f8870739a493abf3299a41200b 100644
 --- a/front_end/entrypoints/main/MainImpl.ts
 +++ b/front_end/entrypoints/main/MainImpl.ts
-@@ -734,6 +734,8 @@ export class MainImpl {
+@@ -732,6 +732,8 @@ export class MainImpl {
  globalThis.Main = globalThis.Main || {};
  // @ts-ignore Exported for Tests.js
  globalThis.Main.Main = MainImpl;

patches/node/.patches

@@ -33,7 +33,6 @@ fix_assert_module_in_the_renderer_process.patch
 fix_add_trusted_space_and_trusted_lo_space_to_the_v8_heap.patch
 win_process_avoid_assert_after_spawning_store_app_4152.patch
 chore_remove_use_of_deprecated_kmaxlength.patch
-fix_missing_include_for_node_extern.patch
 feat_optionally_prevent_calling_v8_enablewebassemblytraphandler.patch
 build_only_create_cppgc_heap_on_non-32_bit_platforms.patch
 fix_-wshadow_error_in_uvwasi_c.patch
@@ -48,3 +47,4 @@ fix_revert_src_lb_reducing_c_calls_of_esm_legacy_main_resolve.patch
 src_preload_function_for_environment.patch
 deprecate_vector_v8_local_in_v8.patch
 fs_fix_wtf-8_decoding_issue.patch
+stream_do_not_defer_construction_by_one_microtick.patch

patches/node/chore_expose_importmoduledynamically_and.patch

@@ -87,10 +87,18 @@ index 895ff3a5948add3513700ecc2f32fce4c2fbe4eb..3182a5e4aad2ba0be2b6769edb696b81
  
  MaybeLocal<Value> ModuleWrap::SyntheticModuleEvaluationStepsCallback(
 diff --git a/src/module_wrap.h b/src/module_wrap.h
-index e17048357feca2419087621ed280de30882a90bc..061117dc3182d63e35d7e99ffd95801f96356322 100644
+index e17048357feca2419087621ed280de30882a90bc..63682be31ce00a3bf7b9be909cac4b7f9ec02a8e 100644
 --- a/src/module_wrap.h
 +++ b/src/module_wrap.h
-@@ -31,7 +31,14 @@ enum HostDefinedOptions : int {
+@@ -7,6 +7,7 @@
+ #include <string>
+ #include <vector>
+ #include "base_object.h"
++#include "node.h"
+ 
+ namespace node {
+ 
+@@ -31,7 +32,14 @@ enum HostDefinedOptions : int {
    kLength = 9,
  };
  
@@ -106,7 +114,7 @@ index e17048357feca2419087621ed280de30882a90bc..061117dc3182d63e35d7e99ffd95801f
   public:
    enum InternalFields {
      kModuleSlot = BaseObject::kInternalFieldCount,
-@@ -68,6 +75,8 @@ class ModuleWrap : public BaseObject {
+@@ -68,6 +76,8 @@ class ModuleWrap : public BaseObject {
      return true;
    }
  
@@ -115,7 +123,7 @@ index e17048357feca2419087621ed280de30882a90bc..061117dc3182d63e35d7e99ffd95801f
   private:
    ModuleWrap(Realm* realm,
               v8::Local<v8::Object> object,
-@@ -102,7 +111,6 @@ class ModuleWrap : public BaseObject {
+@@ -102,7 +112,6 @@ class ModuleWrap : public BaseObject {
        v8::Local<v8::String> specifier,
        v8::Local<v8::FixedArray> import_attributes,
        v8::Local<v8::Module> referrer);

patches/node/feat_optionally_prevent_calling_v8_enablewebassemblytraphandler.patch

@@ -10,7 +10,7 @@ already been called.
 This should be upstreamed.
 
 diff --git a/src/node.cc b/src/node.cc
-index 524f80ee69ee5248e045a2b61faf5610c9ba4285..971668792eabe5be299849b5a3fd8a2790a2210a 100644
+index 1d77a8b31cb0bfbeeeac594b6e1ac7dd303c902d..dadddf33527beebfcde12214da4084badbd27af1 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -605,6 +605,7 @@ static void PlatformInit(ProcessInitializationFlags::Flags flags) {

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -373,6 +373,36 @@ index 5734d8fdc5505e1586f571c19b840bd56e9c9f1f..3034b114e081e2b32dd5b71653927a41
  }
  }  // namespace
  
+diff --git a/src/node.cc b/src/node.cc
+index 524f80ee69ee5248e045a2b61faf5610c9ba4285..1d77a8b31cb0bfbeeeac594b6e1ac7dd303c902d 100644
+--- a/src/node.cc
++++ b/src/node.cc
+@@ -1027,7 +1027,8 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+   }
+ 
+   if (!(flags & ProcessInitializationFlags::kNoInitOpenSSL)) {
+-#if HAVE_OPENSSL && !defined(OPENSSL_IS_BORINGSSL)
++#if HAVE_OPENSSL
++#if !defined(OPENSSL_IS_BORINGSSL)
+     auto GetOpenSSLErrorString = []() -> std::string {
+       std::string ret;
+       ERR_print_errors_cb(
+@@ -1127,13 +1128,13 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+       CHECK(crypto::CSPRNG(buffer, length).is_ok());
+       return true;
+     });
+-
++#endif // !defined(OPENSSL_IS_BORINGSSL)
+     {
+       std::string extra_ca_certs;
+       if (credentials::SafeGetenv("NODE_EXTRA_CA_CERTS", &extra_ca_certs))
+         crypto::UseExtraCaCerts(extra_ca_certs);
+     }
+-#endif  // HAVE_OPENSSL && !defined(OPENSSL_IS_BORINGSSL)
++#endif  // HAVE_OPENSSL
+   }
+ 
+   if (!(flags & ProcessInitializationFlags::kNoInitializeNodeV8Platform)) {
 diff --git a/src/node_metadata.cc b/src/node_metadata.cc
 index b88cfb98e75aca426224e19376b3ff4c23b92e53..b66f4e2b5cbd8f36af42f82a8921207302360e39 100644
 --- a/src/node_metadata.cc

patches/node/fix_missing_include_for_node_extern.patch

@@ -1,26 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Wed, 15 Nov 2023 12:25:39 +0100
-Subject: fix: missing include for NODE_EXTERN
-
-At some point it seems that node.h was removed from the include chain,
-causing the following error:
-
-../../third_party/electron_node/src/module_wrap.h:33:1: error: unknown type name 'NODE_EXTERN'
-   33 | NODE_EXTERN v8::MaybeLocal<v8::Promise> ImportModuleDynamically(
-      | ^
-
-This should be upstreamed.
-
-diff --git a/src/module_wrap.h b/src/module_wrap.h
-index 061117dc3182d63e35d7e99ffd95801f96356322..63682be31ce00a3bf7b9be909cac4b7f9ec02a8e 100644
---- a/src/module_wrap.h
-+++ b/src/module_wrap.h
-@@ -7,6 +7,7 @@
- #include <string>
- #include <vector>
- #include "base_object.h"
-+#include "node.h"
- 
- namespace node {
-