refactor: split IPCRenderer implementation

* perf: cache whether or not ELECTRON_DEBUG_NOTIFICATIONS env var is set

* chore: remove unused #include

.gitattributes

@@ -1,6 +1,9 @@
 # `git apply` and friends don't understand CRLF, even on windows. Force those
 # files to be checked out with LF endings even if core.autocrlf is true.
 *.patch text eol=lf
+DEPS text eol=lf
+yarn.lock text eol=lf
+script/zip_manifests/*.manifest text eol=lf
 patches/**/.patches merge=union
 
 # Source code and markdown files should always use LF as line ending.

.github/actions/build-electron/action.yml

@@ -5,10 +5,10 @@ inputs:
     description: 'Target arch'
     required: true
   target-platform:
-    description: 'Target platform'
+    description: 'Target platform, should be linux, win, macos'
     required: true
   artifact-platform:
-    description: 'Artifact platform, should be linux, darwin or mas'
+    description: 'Artifact platform, should be linux, win, darwin or mas'
     required: true
   step-suffix:
     description: 'Suffix for build steps'
@@ -69,9 +69,9 @@ runs:
       shell: bash
       run: |
         cd src
-        e build --target electron:electron_dist_zip -j $NUMBER_OF_NINJA_PROCESSES
+        e build --target electron:electron_dist_zip -j $NUMBER_OF_NINJA_PROCESSES -d explain
         if [ "${{ inputs.is-asan }}" != "true" ]; then
-          target_os=${{ inputs.target-platform == 'linux' && 'linux' || 'mac'}}
+          target_os=${{ inputs.target-platform == 'macos' && 'mac' || inputs.target-platform }}
           if [ "${{ inputs.artifact-platform }}" = "mas" ]; then
             target_os="${target_os}_mas"
           fi
@@ -82,7 +82,7 @@ runs:
       run: |
         cd src
         e build --target electron:electron_mksnapshot -j $NUMBER_OF_NINJA_PROCESSES
-        gn desc out/Default v8:run_mksnapshot_default args > out/Default/mksnapshot_args
+        ELECTRON_DEPOT_TOOLS_DISABLE_LOG=1 e d gn desc out/Default v8:run_mksnapshot_default args > out/Default/mksnapshot_args
         # Remove unused args from mksnapshot_args
         SEDOPTION="-i"
         if [ "`uname`" = "Darwin" ]; then
@@ -91,7 +91,7 @@ runs:
         sed $SEDOPTION '/.*builtins-pgo/d' out/Default/mksnapshot_args
         sed $SEDOPTION '/--turbo-profiling-input/d' out/Default/mksnapshot_args
 
-        if [ "`uname`" = "Linux" ]; then
+        if [ "${{ inputs.target-platform }}" = "linux" ]; then
           if [ "${{ inputs.target-arch }}" = "arm" ]; then
             electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/mksnapshot
             electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/v8_context_snapshot_generator
@@ -105,7 +105,13 @@ runs:
         fi
 
         e build --target electron:electron_mksnapshot_zip -j $NUMBER_OF_NINJA_PROCESSES
-        (cd out/Default; zip mksnapshot.zip mksnapshot_args gen/v8/embedded.S)
+        if [ "${{ inputs.target-platform }}" = "win" ]; then
+          cd out/Default
+          powershell Compress-Archive -update mksnapshot_args mksnapshot.zip
+          powershell Compress-Archive -update gen/v8/embedded.S mksnapshot.zip
+        else
+          (cd out/Default; zip mksnapshot.zip mksnapshot_args gen/v8/embedded.S)
+        fi
     - name: Generate Cross-Arch Snapshot (arm/arm64)  ${{ inputs.step-suffix }}
       shell: bash
       if: ${{ (inputs.target-arch == 'arm' || inputs.target-arch == 'arm64') && inputs.target-platform == 'linux' }}

.github/actions/checkout/action.yml

@@ -5,6 +5,10 @@ inputs:
     description: 'Whether to generate and persist a SAS token for the item in the cache'
     required: false
     default: 'false'
+  use-cache:
+    description: 'Whether to persist the cache to the shared drive'
+    required: false
+    default: 'true'
 runs:
   using: "composite"
   steps:
@@ -13,31 +17,27 @@ runs:
     run: |
       echo "GIT_CACHE_PATH=$(pwd)/git-cache" >> $GITHUB_ENV
   - name: Install Dependencies
-    shell: bash
-    run: |
-      cd src/electron
-      node script/yarn install --frozen-lockfile
+    uses: ./src/electron/.github/actions/install-dependencies
+  - name: Install Build Tools
+    uses: ./src/electron/.github/actions/install-build-tools
   - name: Get Depot Tools
     shell: bash
     run: |
-      git clone --depth=1 https://chromium.googlesource.com/chromium/tools/depot_tools.git
+      if [[ ! -d depot_tools ]]; then
+        git clone --depth=1 https://chromium.googlesource.com/chromium/tools/depot_tools.git
 
-      sed -i '/ninjalog_uploader_wrapper.py/d' ./depot_tools/autoninja
-      # Remove swift-format dep from cipd on macOS until we send a patch upstream.
-      cd depot_tools
-      git apply --3way ../src/electron/.github/workflows/config/gclient.diff
-
-      # Ensure depot_tools does not update.
-      test -d depot_tools && cd depot_tools
-      touch .disable_auto_update
+        # Ensure depot_tools does not update.
+        test -d depot_tools && cd depot_tools
+        touch .disable_auto_update
+      fi
   - name: Add Depot Tools to PATH
     shell: bash
     run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
   - name: Generate DEPS Hash
     shell: bash
     run: |
-      node src/electron/script/generate-deps-hash.js && cat src/electron/.depshash-target
-      echo "DEPSHASH=v1-src-cache-$(shasum src/electron/.depshash | cut -f1 -d' ')" >> $GITHUB_ENV
+      node src/electron/script/generate-deps-hash.js
+      echo "DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)" >> $GITHUB_ENV
   - name: Generate SAS Key
     if: ${{ inputs.generate-sas-token == 'true' }}
     shell: bash
@@ -54,18 +54,23 @@ runs:
     id: check-cache
     shell: bash
     run: |
-      cache_path=/mnt/cross-instance-cache/$DEPSHASH.tar
-      echo "Using cache key: $DEPSHASH"
-      echo "Checking for cache in: $cache_path"
-      if [ ! -f "$cache_path" ] || [ `du $cache_path | cut -f1` = "0" ]; then
+      if [[ "${{ inputs.use-cache }}" == "false" ]]; then
+        echo "Not using cache this time..."
         echo "cache_exists=false" >> $GITHUB_OUTPUT
-        echo "Cache Does Not Exist for $DEPSHASH"
       else
-        echo "cache_exists=true" >> $GITHUB_OUTPUT
-        echo "Cache Already Exists for $DEPSHASH, Skipping.."
+        cache_path=/mnt/cross-instance-cache/$DEPSHASH.tar
+        echo "Using cache key: $DEPSHASH"
+        echo "Checking for cache in: $cache_path"
+        if [ ! -f "$cache_path" ] || [ `du $cache_path | cut -f1` = "0" ]; then
+          echo "cache_exists=false" >> $GITHUB_OUTPUT
+          echo "Cache Does Not Exist for $DEPSHASH"
+        else
+          echo "cache_exists=true" >> $GITHUB_OUTPUT
+          echo "Cache Already Exists for $DEPSHASH, Skipping.."
+        fi
       fi
   - name: Check cross instance cache disk space
-    if: steps.check-cache.outputs.cache_exists == 'false'
+    if: steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache  == 'true'
     shell: bash
     run: |    
       # if there is less than 20 GB free space then creating the cache might fail so exit early
@@ -81,13 +86,17 @@ runs:
     if: steps.check-cache.outputs.cache_exists == 'false'
     shell: bash
     run: |
-      gclient config \
+      e d gclient config \
         --name "src/electron" \
         --unmanaged \
         ${GCLIENT_EXTRA_ARGS} \
         "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
 
-      ELECTRON_USE_THREE_WAY_MERGE_FOR_PATCHES=1 gclient sync --with_branch_heads --with_tags -vvvvv
+      if [ "$TARGET_OS" != "" ]; then
+        echo "target_os=['$TARGET_OS']" >> ./.gclient
+      fi
+
+      ELECTRON_USE_THREE_WAY_MERGE_FOR_PATCHES=1 e d gclient sync --with_branch_heads --with_tags -vv
       if [ "${{ inputs.is-release }}" != "true" && -n "${{ env.PATCH_UP_APP_CREDS }}" ]; then
         # Re-export all the patches to check if there were changes.
         python3 src/electron/script/export_all_patches.py src/electron/patches/config.json
@@ -128,13 +137,13 @@ runs:
   # https://dawn-review.googlesource.com/c/dawn/+/83901
   # TODO: maybe better to always leave out */.git/HEAD file for all targets ?
   - name: Delete .git directories under src to free space
-    if: steps.check-cache.outputs.cache_exists == 'false'
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
     shell: bash
     run: |
       cd src
       ( find . -type d -name ".git" -not -path "./third_party/angle/*" -not -path "./third_party/dawn/*" -not -path "./electron/*" ) | xargs rm -rf
   - name: Minimize Cache Size for Upload
-    if: steps.check-cache.outputs.cache_exists == 'false'
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
     shell: bash
     run: |
       rm -rf src/android_webview
@@ -145,9 +154,12 @@ runs:
       rm -rf src/third_party/angle/third_party/VK-GL-CTS/src
       rm -rf src/third_party/swift-toolchain
       rm -rf src/third_party/swiftshader/tests/regres/testlists
+      cp src/electron/.github/actions/checkout/action.yml ./
       rm -rf src/electron
+      mkdir -p src/electron/.github/actions/checkout
+      mv action.yml src/electron/.github/actions/checkout
   - name: Compress Src Directory
-    if: steps.check-cache.outputs.cache_exists == 'false'
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
     shell: bash
     run: |
       echo "Uncompressed src size: $(du -sh src | cut -f1 -d' ')"
@@ -155,7 +167,7 @@ runs:
       echo "Compressed src to $(du -sh $DEPSHASH.tar | cut -f1 -d' ')"
       cp ./$DEPSHASH.tar /mnt/cross-instance-cache/
   - name: Persist Src Cache
-    if: steps.check-cache.outputs.cache_exists == 'false'
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
     shell: bash
     run: |
       final_cache_path=/mnt/cross-instance-cache/$DEPSHASH.tar

.github/actions/install-build-tools/action.yml

@@ -6,6 +6,15 @@ runs:
   - name: Install Build Tools
     shell: bash
     run: |
-      export BUILD_TOOLS_SHA=eeb1a11392e4cec08fd926c93b31ab556dc0c23b
+      if [ "$(expr substr $(uname -s) 1 10)" == "MSYS_NT-10" ]; then
+        git config --global core.filemode false
+        git config --global core.autocrlf false
+        git config --global branch.autosetuprebase always
+      fi
+      export BUILD_TOOLS_SHA=8246e57791b0af4ae5975eb96f09855f9269b1cd
       npm i -g @electron/build-tools
       e auto-update disable
+      if [ "$(expr substr $(uname -s) 1 10)" == "MSYS_NT-10" ]; then
+        e d cipd.bat --version
+        cp "C:\Python37\python.exe" "C:\Python37\python3.exe"
+      fi

.github/actions/install-dependencies/action.yml

@@ -0,0 +1,21 @@
+name: 'Install Dependencies'
+description: 'Installs yarn depdencies using cache when available'
+runs:
+  using: "composite"
+  steps:
+  - name: Get yarn cache directory path
+    shell: bash
+    id: yarn-cache-dir-path
+    run: echo "dir=$(node src/electron/script/yarn cache dir)" >> $GITHUB_OUTPUT
+  - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9
+    id: yarn-cache
+    with:
+      path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+      key: ${{ runner.os }}-yarn-${{ hashFiles('src/electron/yarn.lock') }}
+      restore-keys: |
+        ${{ runner.os }}-yarn-
+  - name: Install Dependencies
+    shell: bash
+    run: |
+      cd src/electron
+      node script/yarn install --frozen-lockfile --prefer-offline

.github/workflows/archaeologist-dig.yml

@@ -41,7 +41,7 @@ jobs:
           sha-file: .dig-old
           filename: electron.old.d.ts
       - name: Upload artifacts
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 #v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0
         with:
           name: artifacts
           path: electron/artifacts

.github/workflows/build.yml

@@ -18,6 +18,11 @@ on:
         description: 'Skip Linux builds'
         default: false
         required: false
+      skip-windows:
+        type: boolean
+        description: 'Skip Windows builds'
+        default: false
+        required: false
       skip-lint:
         type: boolean
         description: 'Skip lint check'
@@ -28,7 +33,11 @@ on:
       - main
       - '[1-9][0-9]-x-y'
   pull_request:
-      
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   setup:
     runs-on: ubuntu-latest
@@ -41,6 +50,8 @@ jobs:
         docs-only: ${{ steps.set-output.outputs.docs-only }}
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.0.2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
     - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
       id: filter
       with:
@@ -98,6 +109,7 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Checkout & Sync & Save
       uses: ./src/electron/.github/actions/checkout
       with:
@@ -124,9 +136,68 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Checkout & Sync & Save
       uses: ./src/electron/.github/actions/checkout
 
+  checkout-windows:
+    needs: setup
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    runs-on: electron-arc-linux-amd64-32core
+    container:
+      image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
+      options: --user root --device /dev/fuse --cap-add SYS_ADMIN
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+    env:
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_win=True'
+      TARGET_OS: 'win'
+      ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN: '1'
+    outputs:
+      build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+
+  # GN Check Jobs
+  macos-gn-check:
+    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    needs: checkout-macos
+    with:
+      target-platform: macos
+      target-archs: x64 arm64
+      check-runs-on: macos-14
+      gn-build-type: testing
+    secrets: inherit
+
+  linux-gn-check:
+    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    needs: checkout-linux
+    with:
+      target-platform: linux
+      target-archs: x64 arm arm64
+      check-runs-on: electron-arc-linux-amd64-8core
+      check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      gn-build-type: testing
+    secrets: inherit
+
+  windows-gn-check:
+    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    needs: checkout-windows
+    with:
+      target-platform: win
+      target-archs: x64 x86 arm64
+      check-runs-on: electron-arc-linux-amd64-8core
+      check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      gn-build-type: testing
+    secrets: inherit
+
   # Build Jobs - These cascade into testing jobs
   macos-x64:
     permissions:
@@ -137,7 +208,6 @@ jobs:
     needs: checkout-macos
     with:
       build-runs-on: macos-14-xlarge
-      check-runs-on: macos-14
       test-runs-on: macos-13
       target-platform: macos
       target-arch: x64
@@ -156,7 +226,6 @@ jobs:
     needs: checkout-macos
     with:
       build-runs-on: macos-14-xlarge
-      check-runs-on: macos-14
       test-runs-on: macos-14
       target-platform: macos
       target-arch: arm64
@@ -175,7 +244,6 @@ jobs:
     needs: checkout-linux
     with:
       build-runs-on: electron-arc-linux-amd64-32core
-      check-runs-on: electron-arc-linux-amd64-8core
       test-runs-on: electron-arc-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
@@ -196,7 +264,6 @@ jobs:
     needs: checkout-linux
     with:
       build-runs-on: electron-arc-linux-amd64-32core
-      check-runs-on: electron-arc-linux-amd64-8core
       test-runs-on: electron-arc-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
@@ -218,7 +285,6 @@ jobs:
     needs: checkout-linux
     with:
       build-runs-on: electron-arc-linux-amd64-32core
-      check-runs-on: electron-arc-linux-amd64-8core
       test-runs-on: electron-arc-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
@@ -239,7 +305,6 @@ jobs:
     needs: checkout-linux
     with:
       build-runs-on: electron-arc-linux-amd64-32core
-      check-runs-on: electron-arc-linux-amd64-8core
       test-runs-on: electron-arc-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm64v8-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
@@ -251,10 +316,67 @@ jobs:
       upload-to-storage: '0'
     secrets: inherit
 
+  windows-x64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: setup
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    with:
+      build-runs-on: electron-arc-windows-amd64-16core
+      test-runs-on: windows-latest
+      target-platform: win
+      target-arch: x64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
+  windows-x86:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: setup
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    with:
+      build-runs-on: electron-arc-windows-amd64-16core
+      test-runs-on: windows-latest
+      target-platform: win
+      target-arch: x86
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
+  windows-arm64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: setup
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    with:
+      build-runs-on: electron-arc-windows-amd64-16core
+      test-runs-on: electron-hosted-windows-arm64-4core
+      target-platform: win
+      target-arch: arm64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
   gha-done:
     name: GitHub Actions Completed
     runs-on: ubuntu-latest
-    needs: [docs-only, macos-x64, macos-arm64, linux-x64, linux-x64-asan, linux-arm, linux-arm64]
+    needs: [docs-only, macos-x64, macos-arm64, linux-x64, linux-x64-asan, linux-arm, linux-arm64, windows-x64, windows-x86, windows-arm64]
     if: always() && !contains(needs.*.result, 'failure')
     steps: 
     - name: GitHub Actions Jobs Done

.github/workflows/config/gclient.diff

@@ -1,14 +0,0 @@
-diff --git a/gclient.py b/gclient.py
-index 59e2b4c5197928bdba1ef69bdbe637d7dfe471c1..b4bae5e48c83c84bd867187afaf40eed16e69851 100755
---- a/gclient.py
-+++ b/gclient.py
-@@ -783,7 +783,8 @@ class Dependency(gclient_utils.WorkItem, DependencySettings):
-                         not condition or "non_git_source" not in condition):
-                     continue
-                 cipd_root = self.GetCipdRoot()
--                for package in dep_value.get('packages', []):
-+                packages = dep_value.get('packages', [])
-+                for package in (x for x in packages if "infra/3pp/tools/swift-format" not in x.get('package')):
-                     deps_to_add.append(
-                         CipdDependency(parent=self,
-                                        name=name,

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       target-platform:
         type: string
-        description: 'Platform to run on, can be macos or linux'
+        description: 'Platform to run on, can be macos, win or linux.'
         required: true
       target-arch:
         type: string
@@ -15,10 +15,6 @@ on:
         type: string
         description: 'What host to run the build'
         required: true
-      check-runs-on:
-        type: string
-        description: 'What host to run the gn-check'
-        required: true
       test-runs-on:
         type: string
         description: 'What host to run the tests on'
@@ -76,16 +72,6 @@ jobs:
       generate-symbols: ${{ inputs.generate-symbols }}
       upload-to-storage: ${{ inputs.upload-to-storage }}
     secrets: inherit
-  gn-check:
-    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
-    with:
-      target-platform: ${{ inputs.target-platform }}
-      target-arch: ${{ inputs.target-arch }}
-      check-runs-on: ${{ inputs.check-runs-on }}
-      check-container: ${{ inputs.build-container }}
-      gn-build-type: ${{ inputs.gn-build-type }}
-      is-asan: ${{ inputs.is-asan }}
-    secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
     needs: build

.github/workflows/pipeline-electron-build-and-test.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       target-platform:
         type: string
-        description: 'Platform to run on, can be macos or linux'
+        description: 'Platform to run on, can be macos, win or linux'
         required: true
       target-arch:
         type: string
@@ -15,10 +15,6 @@ on:
         type: string
         description: 'What host to run the build'
         required: true
-      check-runs-on:
-        type: string
-        description: 'What host to run the gn-check'
-        required: true
       test-runs-on:
         type: string
         description: 'What host to run the tests on'
@@ -82,16 +78,6 @@ jobs:
       upload-to-storage: ${{ inputs.upload-to-storage }}
       is-asan: ${{ inputs.is-asan}}
     secrets: inherit
-  gn-check:
-    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
-    with:
-      target-platform: ${{ inputs.target-platform }}
-      target-arch: ${{ inputs.target-arch }}
-      check-runs-on: ${{ inputs.check-runs-on }}
-      check-container: ${{ inputs.build-container }}
-      gn-build-type: ${{ inputs.gn-build-type }}
-      is-asan: ${{ inputs.is-asan }}
-    secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
     needs: build

.github/workflows/pipeline-electron-docs-only.yml

@@ -24,10 +24,9 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Dependencies
-      run: |
-        cd src/electron
-        node script/yarn install --frozen-lockfile
+      uses: ./src/electron/.github/actions/install-dependencies
     - name: Run TS/JS compile
       shell: bash
       run: |

.github/workflows/pipeline-electron-lint.yml

@@ -24,10 +24,9 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Dependencies
-      run: |
-        cd src/electron
-        node script/yarn install --frozen-lockfile
+      uses: ./src/electron/.github/actions/install-dependencies
     - name: Setup third_party Depot Tools
       shell: bash
       run: |

.github/workflows/pipeline-segment-electron-build.yml

@@ -9,7 +9,7 @@ on:
         type: string
       target-platform:
         type: string
-        description: 'Platform to run on, can be macos or linux'
+        description: 'Platform to run on, can be macos, win or linux'
         required: true
       target-arch:
         type: string
@@ -69,11 +69,14 @@ env:
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
   SUDOWOODO_EXCHANGE_URL: ${{ secrets.SUDOWOODO_EXCHANGE_URL }}
   SUDOWOODO_EXCHANGE_TOKEN: ${{ secrets.SUDOWOODO_EXCHANGE_TOKEN }}
-  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
+  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || inputs.target-platform == 'win' && '--custom-var=checkout_win=True' || '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
   ELECTRON_OUT_DIR: Default
 
 jobs:
   build:
+    defaults:
+      run:
+        shell: bash
     runs-on: ${{ inputs.build-runs-on }}
     container: ${{ fromJSON(inputs.build-container) }}
     environment: ${{ inputs.environment }}
@@ -81,12 +84,14 @@ jobs:
       TARGET_ARCH: ${{ inputs.target-arch }}
     steps:
     - name: Create src dir
-      run: mkdir src
+      run: |
+        mkdir src
     - name: Checkout Electron
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos
@@ -101,9 +106,7 @@ jobs:
         cache: yarn
         cache-dependency-path: src/electron/yarn.lock
     - name: Install Dependencies
-      run: |
-        cd src/electron
-        node script/yarn install --frozen-lockfile
+      uses: ./src/electron/.github/actions/install-dependencies
     - name: Install AZCopy
       if: ${{ inputs.target-platform == 'macos' }}
       run: brew install azcopy
@@ -137,16 +140,13 @@ jobs:
 
         # Ensure depot_tools does not update.
         test -d depot_tools && cd depot_tools
-        if [ "`uname`" = "Linux" ]; then
-          git apply --3way ../src/electron/.github/workflows/config/gclient.diff
-        fi
         touch .disable_auto_update
     - name: Add Depot Tools to PATH
       run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
     - name: Generate DEPS Hash
       run: |
-        node src/electron/script/generate-deps-hash.js && cat src/electron/.depshash-target
-        DEPSHASH=v1-src-cache-$(shasum src/electron/.depshash | cut -f1 -d' ')
+        node src/electron/script/generate-deps-hash.js
+        DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
         echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
         echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
     - name: Restore src cache via AZCopy
@@ -155,11 +155,17 @@ jobs:
     - name: Restore src cache via AKS
       if: ${{ inputs.target-platform == 'linux' }}
       uses: ./src/electron/.github/actions/restore-cache-aks
+    - name: Checkout src via gclient sync
+      if: ${{ inputs.target-platform == 'win' }}
+      uses: ./src/electron/.github/actions/checkout
+      with:
+        use-cache: 'false'
     - name: Checkout Electron
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Build Tools
       uses: ./src/electron/.github/actions/install-build-tools
     - name: Init Build Tools
@@ -167,11 +173,11 @@ jobs:
         e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }}
     - name: Run Electron Only Hooks
       run: |
-        gclient runhooks --spec="solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]"
+        e d gclient runhooks --spec="solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]"
     - name: Regenerate DEPS Hash
       run: |
-        (cd src/electron && git checkout .) && node src/electron/script/generate-deps-hash.js && cat src/electron/.depshash-target
-        echo "DEPSHASH=$(shasum src/electron/.depshash | cut -f1 -d' ')" >> $GITHUB_ENV
+        (cd src/electron && git checkout .) && node src/electron/script/generate-deps-hash.js
+        echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
     - name: Fix Sync (macOS)
@@ -179,7 +185,7 @@ jobs:
       uses: ./src/electron/.github/actions/fix-sync-macos
     - name: Setup Number of Ninja Processes
       run: |
-        echo "NUMBER_OF_NINJA_PROCESSES=${{ inputs.target-platform == 'linux' && '300' || '200' }}" >> $GITHUB_ENV
+        echo "NUMBER_OF_NINJA_PROCESSES=${{ inputs.target-platform != 'macos' && '300' || '200' }}" >> $GITHUB_ENV
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos
@@ -189,7 +195,7 @@ jobs:
       with:
         target-arch: ${{ inputs.target-arch }}
         target-platform: ${{ inputs.target-platform }}
-        artifact-platform: ${{ inputs.target-platform == 'linux' && 'linux' || 'darwin' }}
+        artifact-platform: ${{ inputs.target-platform == 'macos' && 'darwin' || inputs.target-platform }}
         is-release: '${{ inputs.is-release }}'
         generate-symbols: '${{ inputs.generate-symbols }}'
         strip-binaries: '${{ inputs.strip-binaries }}'

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -5,11 +5,11 @@ on:
     inputs:
       target-platform:
         type: string
-        description: 'Platform to run on, can be macos or linux'
+        description: 'Platform to run on, can be macos, win or linux'
         required: true
-      target-arch:
+      target-archs:
         type: string
-        description: 'Arch to build for, can be x64, arm64 or arm'
+        description: 'Archs to check for, can be x64, x86, arm64 or arm space separated'
         required: true
       check-runs-on:
         type: string
@@ -25,35 +25,30 @@ on:
         required: true
         type: string
         default: testing
-      is-asan: 
-        description: 'Building the Address Sanitizer (ASan) Linux build'
-        required: false
-        type: boolean
-        default: false
 
 concurrency:
-  group: electron-gn-check-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref }}
+  group: electron-gn-check-${{ inputs.target-platform }}-${{ github.ref }}
   cancel-in-progress: true
 
 env:
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
-  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
+  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || (inputs.target-platform == 'linux' && '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' || '--custom-var=checkout_win=True') }}
   ELECTRON_OUT_DIR: Default
-  TARGET_ARCH: ${{ inputs.target-arch }}
 
 jobs:
   gn-check:
-    # TODO(codebytere): Change this to medium VM
+    defaults:
+      run:
+        shell: bash
     runs-on: ${{ inputs.check-runs-on }}
     container: ${{ fromJSON(inputs.check-container) }}
-    env:
-      TARGET_ARCH: ${{ inputs.target-arch }}
     steps:
     - name: Checkout Electron
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Cleanup disk space on macOS
       if: ${{ inputs.target-platform == 'macos' }}
       shell: bash
@@ -73,58 +68,40 @@ jobs:
       run: df -h        
     - name: Install Build Tools
       uses: ./src/electron/.github/actions/install-build-tools
-    - name: Init Build Tools
+    - name: Enable windows toolchain
+      if: ${{ inputs.target-platform == 'win' }}
       run: |
-        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }}
-    - name: Get Depot Tools
-      timeout-minutes: 5
-      run: |
-        git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
-
-        SEDOPTION="-i"
-        if [ "`uname`" = "Darwin" ]; then
-          SEDOPTION="-i ''"
-        fi
-
-        # remove ninjalog_uploader_wrapper.py from autoninja since we don't use it and it causes problems
-        sed $SEDOPTION '/ninjalog_uploader_wrapper.py/d' ./depot_tools/autoninja
-
-        # Ensure depot_tools does not update.
-        test -d depot_tools && cd depot_tools
-        if [ "`uname`" = "Linux" ]; then
-          git apply --3way ../src/electron/.github/workflows/config/gclient.diff
-        fi
-        touch .disable_auto_update
-    - name: Add Depot Tools to PATH
-      run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
-    - name: Set GN_EXTRA_ARGS for Linux
-      if: ${{ inputs.target-platform == 'linux' }}
-      run: |
-        if [ "${{ inputs.target-arch  }}" = "arm" ]; then
-          GN_EXTRA_ARGS='build_tflite_with_xnnpack=false'
-        elif [ "${{ inputs.target-arch }}" = "arm64" ]; then
-          GN_EXTRA_ARGS='fatal_linker_warnings=false enable_linux_installer=false'
-        fi
-        echo "GN_EXTRA_ARGS=$GN_EXTRA_ARGS" >> $GITHUB_ENV
+        echo "ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN=1" >> $GITHUB_ENV
     - name: Generate DEPS Hash
       run: |
-        node src/electron/script/generate-deps-hash.js && cat src/electron/.depshash-target
-        DEPSHASH=v1-src-cache-$(shasum src/electron/.depshash | cut -f1 -d' ')
+        node src/electron/script/generate-deps-hash.js
+        DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
         echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
         echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
     - name: Restore src cache via AZCopy
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/restore-cache-azcopy
     - name: Restore src cache via AKS
-      if: ${{ inputs.target-platform == 'linux' }}
+      if: ${{ inputs.target-platform == 'linux' || inputs.target-platform == 'win' }}
       uses: ./src/electron/.github/actions/restore-cache-aks
     - name: Run Electron Only Hooks
       run: |
-        gclient runhooks --spec="solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]"
+        echo "solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]" > tmpgclient
+        if [ "${{ inputs.target-platform }}" = "win" ]; then
+          echo "solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False,'install_sysroot':False,'checkout_win':True},'managed':False}]" > tmpgclient
+          echo "target_os=['win']" >> tmpgclient
+        fi
+        e d gclient runhooks --gclientfile=tmpgclient
+
+        # Fix VS Toolchain
+        if [ "${{ inputs.target-platform }}" = "win" ]; then
+          rm -rf src/third_party/depot_tools/win_toolchain/vs_files
+          e d python3 src/build/vs_toolchain.py update --force
+        fi
     - name: Regenerate DEPS Hash
       run: |
-        (cd src/electron && git checkout .) && node src/electron/script/generate-deps-hash.js && cat src/electron/.depshash-target
-        echo "DEPSHASH=$(shasum src/electron/.depshash | cut -f1 -d' ')" >> $GITHUB_ENV
+        (cd src/electron && git checkout .) && node src/electron/script/generate-deps-hash.js
+        echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
     - name: Checkout Electron
@@ -132,30 +109,46 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Dependencies
-      run: |
-        cd src/electron
-        node script/yarn install --frozen-lockfile
+      uses: ./src/electron/.github/actions/install-dependencies
     - name: Default GN gen
       run: |
         cd src/electron
         git pack-refs
-        cd ..
-
-        e build --only-gen
-    - name: Run GN Check
+    - name: Run GN Check for ${{ inputs.target-archs }}
       run: |
-        cd src
-        gn check out/Default //electron:electron_lib
-        gn check out/Default //electron:electron_app
-        gn check out/Default //electron/shell/common:mojo
-        gn check out/Default //electron/shell/common:plugin
+        for target_cpu in ${{ inputs.target-archs }}
+        do
+          e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu $target_cpu
+          cd src
+          export GN_EXTRA_ARGS="target_cpu=\"$target_cpu\""
+          if [ "${{ inputs.target-platform }}" = "linux" ]; then
+            if [ "$target_cpu" = "arm" ]; then
+              export GN_EXTRA_ARGS="$GN_EXTRA_ARGS build_tflite_with_xnnpack=false"
+            elif [ "$target_cpu" = "arm64" ]; then
+              export GN_EXTRA_ARGS="$GN_EXTRA_ARGS fatal_linker_warnings=false enable_linux_installer=false"
+            fi
+          fi
+          if [ "${{ inputs.target-platform }}" = "win" ]; then
+            export GN_EXTRA_ARGS="$GN_EXTRA_ARGS use_v8_context_snapshot=true target_os=\"win\""
+          fi
 
-        # Check the hunspell filenames
-        node electron/script/gen-hunspell-filenames.js --check
-        node electron/script/gen-libc++-filenames.js --check
+          e build --only-gen
+
+          e d gn check out/Default //electron:electron_lib
+          e d gn check out/Default //electron:electron_app
+          e d gn check out/Default //electron/shell/common:mojo
+          e d gn check out/Default //electron/shell/common:plugin
+
+          # Check the hunspell filenames
+          node electron/script/gen-hunspell-filenames.js --check
+          node electron/script/gen-libc++-filenames.js --check
+          cd ..
+        done
     - name: Wait for active SSH sessions
       if: always() && !cancelled()
+      shell: bash
       run: |
         while [ -f /var/.ssh-lock ]
         do

.github/workflows/pipeline-segment-electron-test.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       target-platform:
         type: string
-        description: 'Platform to run on, can be macos or linux'
+        description: 'Platform to run on, can be macos, win or linux'
         required: true
       target-arch:
         type: string
@@ -41,22 +41,44 @@ env:
 
 jobs:
   test:
+    defaults:
+      run:
+        shell: bash
     runs-on: ${{ inputs.test-runs-on }}
     container: ${{ fromJSON(inputs.test-container) }}
     strategy:
       fail-fast: false
       matrix:
-        build-type: ${{ inputs.target-platform == 'macos' && fromJSON('["darwin","mas"]') || fromJSON('["linux"]') }}
-        shard: ${{ inputs.target-platform == 'macos' && fromJSON('[1, 2]') || fromJSON('[1, 2, 3]') }}
+        build-type: ${{ inputs.target-platform == 'macos' && fromJSON('["darwin","mas"]') || (inputs.target-platform == 'win' && fromJSON('["win"]') || fromJSON('["linux"]')) }}
+        shard: ${{ inputs.target-platform == 'linux' && fromJSON('[1, 2, 3]') || fromJSON('[1, 2]') }}
     env:
       BUILD_TYPE: ${{ matrix.build-type }}
       TARGET_ARCH: ${{ inputs.target-arch }}
       ARTIFACT_KEY: ${{ matrix.build-type }}_${{ inputs.target-arch }}
     steps:
     - name: Fix node20 on arm32 runners
-      if: ${{ inputs.target-arch == 'arm' }}
+      if: ${{ inputs.target-arch == 'arm' && inputs.target-platform == 'linux' }}
       run: |
         cp $(which node) /mnt/runner-externals/node20/bin/
+    - name: Install Git on Windows arm64 runners
+      if: ${{ inputs.target-arch == 'arm64' && inputs.target-platform == 'win' }}
+      shell: powershell
+      run: |
+        Set-ExecutionPolicy Bypass -Scope Process -Force
+        [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
+        iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
+        choco install -y --no-progress git.install --params "'/GitAndUnixToolsOnPath'"
+        choco install -y --no-progress git
+        choco install -y --no-progress python --version 3.11.9
+        choco install -y --no-progress visualstudio2022-workload-vctools --package-parameters "--add Microsoft.VisualStudio.Component.VC.Tools.ARM64"
+        echo "C:\Program Files\Git\cmd" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        echo "C:\Program Files\Git\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        echo "C:\Python311" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+    - name: Setup Node.js/npm
+      if: ${{ inputs.target-platform == 'win' }}
+      uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6
+      with:
+        node-version: 20.11.x
     - name: Add TCC permissions on macOS
       if: ${{ inputs.target-platform == 'macos' }}
       run: |
@@ -95,24 +117,18 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Dependencies
-      run: |
-        cd src/electron
-        node script/yarn install --frozen-lockfile
+      uses: ./src/electron/.github/actions/install-dependencies
     - name: Get Depot Tools
       timeout-minutes: 5
       run: |
+        git config --global core.filemode false
+        git config --global core.autocrlf false
+        git config --global branch.autosetuprebase always
         git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
         # Ensure depot_tools does not update.
         test -d depot_tools && cd depot_tools
-        if [ "`uname`" = "Darwin" ]; then
-          # remove ninjalog_uploader_wrapper.py from autoninja since we don't use it and it causes problems
-          sed -i '' '/ninjalog_uploader_wrapper.py/d' ./autoninja
-        else
-          sed -i '/ninjalog_uploader_wrapper.py/d' ./autoninja
-          # Remove swift-format dep from cipd on macOS until we send a patch upstream.
-          git apply --3way ../src/electron/.github/workflows/config/gclient.diff
-        fi
         touch .disable_auto_update
     - name: Add Depot Tools to PATH
       run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
@@ -134,7 +150,17 @@ jobs:
         path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Restore Generated Artifacts
       run: ./src/electron/script/actions/restore-artifacts.sh
-    - name: Unzip Dist, Mksnapshot & Chromedriver
+    - name: Unzip Dist, Mksnapshot & Chromedriver (win)
+      if: ${{ inputs.target-platform == 'win' }}
+      shell: powershell
+      run: |
+        Set-ExecutionPolicy Bypass -Scope Process -Force
+        cd src/out/Default
+        Expand-Archive -Force dist.zip -DestinationPath ./
+        Expand-Archive -Force chromedriver.zip -DestinationPath ./
+        Expand-Archive -Force mksnapshot.zip -DestinationPath ./
+    - name: Unzip Dist, Mksnapshot & Chromedriver (unix)
+      if: ${{ inputs.target-platform != 'win' }}
       run: |
         cd src/out/Default
         unzip -:o dist.zip
@@ -158,15 +184,24 @@ jobs:
         ELECTRON_DISABLE_SECURITY_WARNINGS: 1
         ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
         DISPLAY: ':99.0'
+        NPM_CONFIG_MSVS_VERSION: '2022'
       run: |
         cd src/electron
         export ELECTRON_TEST_RESULTS_DIR=`pwd`/junit
         # Get which tests are on this shard
-        tests_files=$(node script/split-tests ${{ matrix.shard }} ${{ inputs.target-platform == 'macos' && 2 || 3 }})
+        tests_files=$(node script/split-tests ${{ matrix.shard }} ${{ inputs.target-platform == 'linux' && 3 || 2 }})
 
         # Run tests
-        if [ "`uname`" = "Darwin" ]; then
+        if [ "${{ inputs.target-platform }}" != "linux" ]; then
           echo "About to start tests"
+          if [ "${{ inputs.target-platform }}" = "win" ]; then
+            if [ "${{ inputs.target-arch }}" = "x86" ]; then
+              export npm_config_arch="ia32"
+            fi
+            if [ "${{ inputs.target-arch }}" = "arm64" ]; then
+              export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
+            fi
+          fi
           node script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
         else
           chown :builduser .. && chmod g+w ..
@@ -197,19 +232,21 @@ jobs:
         DD_CIVISIBILITY_LOGS_ENABLED: true
         DD_TAGS: "os.architecture:${{ inputs.target-arch }},os.family:${{ inputs.target-platform }},os.platform:${{ inputs.target-platform }},asan:${{ inputs.is-asan }}"
       run: |
-        if ! [ -z $DD_API_KEY ]; then
-          datadog-ci junit upload src/electron/junit/test-results-main.xml
+        if ! [ -z $DD_API_KEY ] && [ -f src/electron/junit/test-results-main.xml ]; then
+          export DATADOG_PATH=`node src/electron/script/yarn global bin`
+          $DATADOG_PATH/datadog-ci junit upload src/electron/junit/test-results-main.xml
         fi          
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always() && !cancelled()
-      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b
       with:
-        name: test_artifacts_${{ env.ARTIFACT_KEY }}
+        name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
         path: src/electron/spec/artifacts
         if-no-files-found: ignore
     - name: Wait for active SSH sessions
       if: always() && !cancelled()
+      shell: bash
       run: |
         while [ -f /var/.ssh-lock ]
         do

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       target-platform:
         type: string
-        description: 'Platform to run on, can be macos or linux'
+        description: 'Platform to run on, can be macos, win or linux'
         required: true
       target-arch:
         type: string
@@ -49,23 +49,20 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Build Tools
       uses: ./src/electron/.github/actions/install-build-tools
     - name: Init Build Tools
       run: |
         e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }}
     - name: Install Dependencies
-      run: |
-        cd src/electron
-        node script/yarn install --frozen-lockfile
+      uses: ./src/electron/.github/actions/install-dependencies
     - name: Get Depot Tools
       timeout-minutes: 5
       run: |
         git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
-        sed -i '/ninjalog_uploader_wrapper.py/d' ./depot_tools/autoninja
         # Ensure depot_tools does not update.
         test -d depot_tools && cd depot_tools
-        git apply --3way ../src/electron/.github/workflows/config/gclient.diff
         touch .disable_auto_update
     - name: Add Depot Tools to PATH
       run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
@@ -93,6 +90,7 @@ jobs:
         node electron/script/node-spec-runner.js --default --jUnitDir=junit
     - name: Wait for active SSH sessions
       if: always() && !cancelled()
+      shell: bash
       run: |
         while [ -f /var/.ssh-lock ]
         do
@@ -112,23 +110,20 @@ jobs:
       with:
         path: src/electron
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Build Tools
       uses: ./src/electron/.github/actions/install-build-tools
     - name: Init Build Tools
       run: |
         e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }}
     - name: Install Dependencies
-      run: |
-        cd src/electron
-        node script/yarn install --frozen-lockfile
+      uses: ./src/electron/.github/actions/install-dependencies
     - name: Get Depot Tools
       timeout-minutes: 5
       run: |
         git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
-        sed -i '/ninjalog_uploader_wrapper.py/d' ./depot_tools/autoninja
         # Ensure depot_tools does not update.
         test -d depot_tools && cd depot_tools
-        git apply --3way ../src/electron/.github/workflows/config/gclient.diff
         touch .disable_auto_update
     - name: Add Depot Tools to PATH
       run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
@@ -155,6 +150,7 @@ jobs:
         cd src
         node electron/script/nan-spec-runner.js
     - name: Wait for active SSH sessions
+      shell: bash
       if: always() && !cancelled()
       run: |
         while [ -f /var/.ssh-lock ]

.github/workflows/scorecards.yml

@@ -42,7 +42,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: SARIF file
           path: results.sarif
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
+        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
         with:
           sarif_file: results.sarif

.github/workflows/update_appveyor_image.yml

@@ -23,6 +23,7 @@ jobs:
       with:
         fetch-depth: 0
         token: ${{ steps.generate-token.outputs.token }}
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Setup Node.js
       uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
       with:

.gitignore

@@ -48,7 +48,6 @@ ts-gen
 
 # Used to accelerate CI builds
 .depshash
-.depshash-target
 
 # Used to accelerate builds after sync
 patches/mtime-cache.json

BUILD.gn

@@ -224,11 +224,21 @@ webpack_build("electron_utility_bundle") {
   out_file = "$target_gen_dir/js2c/utility_init.js"
 }
 
+webpack_build("electron_preload_realm_bundle") {
+  deps = [ ":build_electron_definitions" ]
+
+  inputs = auto_filenames.preload_realm_bundle_deps
+
+  config_file = "//electron/build/webpack/webpack.config.preload_realm.js"
+  out_file = "$target_gen_dir/js2c/preload_realm_bundle.js"
+}
+
 action("electron_js2c") {
   deps = [
     ":electron_browser_bundle",
     ":electron_isolated_renderer_bundle",
     ":electron_node_bundle",
+    ":electron_preload_realm_bundle",
     ":electron_renderer_bundle",
     ":electron_sandboxed_renderer_bundle",
     ":electron_utility_bundle",
@@ -240,6 +250,7 @@ action("electron_js2c") {
     "$target_gen_dir/js2c/browser_init.js",
     "$target_gen_dir/js2c/isolated_bundle.js",
     "$target_gen_dir/js2c/node_init.js",
+    "$target_gen_dir/js2c/preload_realm_bundle.js",
     "$target_gen_dir/js2c/renderer_init.js",
     "$target_gen_dir/js2c/sandbox_bundle.js",
     "$target_gen_dir/js2c/utility_init.js",

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '133.0.6878.0',
+    '133.0.6887.0',
   'node_version':
     'v22.9.0',
   'nan_version':

appveyor.yml

@@ -187,7 +187,12 @@ for:
             7z a pdb.zip out\Default\*.pdb
           }
       - ps: |
-          $manifest_file = "electron/script/zip_manifests/dist_zip.win.$env:TARGET_ARCH.manifest"
+          if ($env:TARGET_ARCH -eq 'ia32') {
+            $env:MANIFEST_ARCH = "x86"
+          } else {
+            $env:MANIFEST_ARCH = $env:TARGET_ARCH
+          }
+          $manifest_file = "electron/script/zip_manifests/dist_zip.win.$env:MANIFEST_ARCH.manifest"
           python3 electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip $manifest_file
           if ($LASTEXITCODE -ne 0) {
             throw "Zip contains files not listed in the manifest $manifest_file"

build/webpack/webpack.config.preload_realm.js

@@ -0,0 +1,6 @@
+module.exports = require('./webpack.config.base')({
+  target: 'preload_realm',
+  alwaysHasNode: false,
+  wrapInitWithProfilingTimeout: true,
+  wrapInitWithTryCatch: true
+});

build/zip.py

@@ -59,7 +59,7 @@ def skip_path(dep, dist_zip, target_cpu):
       and dep == "snapshot_blob.bin"
     )
   )
-  if should_skip:
+  if should_skip and os.environ.get('ELECTRON_DEBUG_ZIP_SKIP') == '1':
     print("Skipping {}".format(dep))
   return should_skip
 

docs/README.md

@@ -128,6 +128,7 @@ These individual tutorials expand on topics discussed in the guide above.
 * [pushNotifications](api/push-notifications.md)
 * [safeStorage](api/safe-storage.md)
 * [screen](api/screen.md)
+* [ServiceWorkerMain](api/service-worker-main.md)
 * [session](api/session.md)
 * [ShareMenu](api/share-menu.md)
 * [systemPreferences](api/system-preferences.md)

docs/api/context-bridge.md

@@ -61,6 +61,20 @@ The `contextBridge` module has the following methods:
 * `apiKey` string - The key to inject the API onto `window` with.  The API will be accessible on `window[apiKey]`.
 * `api` any - Your API, more information on what this API can be and how it works is available below.
 
+### `contextBridge.executeInMainWorld(executionScript)` _Experimental_
+
+<!-- TODO(samuelmaddock): add generics to map the `args` types to the `func` params  -->
+
+* `executionScript` Object
+  * `func` (...args: any[]) => any - A JavaScript function to execute. This function will be serialized which means
+      that any bound parameters and execution context will be lost.
+  * `args` any[] (optional) - An array of arguments to pass to the provided function. These
+      arguments will be copied between worlds in accordance with
+      [the table of supported types.](#parameter--error--return-type-support)
+
+Returns `any` - A copy of the resulting value from executing the function in the main world.
+[Refer to the table](#parameter--error--return-type-support) on how values are copied between worlds.
+
 ## Usage
 
 ### API

docs/api/ipc-main-service-worker.md

@@ -0,0 +1,75 @@
+## Class: IpcMainServiceWorker
+
+> Communicate asynchronously from the main process to service workers.
+
+Process: [Main](../glossary.md#main-process)
+
+> [!NOTE]
+> This API is a subtle variation of [`IpcMain`](ipc-main.md)—targeted for
+> communicating with service workers. For communicating with web frames,
+> consult the `IpcMain` documentation.
+
+<!-- TODO(samuelmaddock): refactor doc gen to allow generics to reduce duplication -->
+
+### Instance Methods
+
+#### `ipcMainServiceWorker.on(channel, listener)`
+
+* `channel` string
+* `listener` Function
+  * `event` [IpcMainServiceWorkerEvent][ipc-main-service-worker-event]
+  * `...args` any[]
+
+Listens to `channel`, when a new message arrives `listener` would be called with
+`listener(event, args...)`.
+
+#### `ipcMainServiceWorker.once(channel, listener)`
+
+* `channel` string
+* `listener` Function
+  * `event` [IpcMainServiceWorkerEvent][ipc-main-service-worker-event]
+  * `...args` any[]
+
+Adds a one time `listener` function for the event. This `listener` is invoked
+only the next time a message is sent to `channel`, after which it is removed.
+
+#### `ipcMainServiceWorker.removeListener(channel, listener)`
+
+* `channel` string
+* `listener` Function
+  * `...args` any[]
+
+Removes the specified `listener` from the listener array for the specified
+`channel`.
+
+#### `ipcMainServiceWorker.removeAllListeners([channel])`
+
+* `channel` string (optional)
+
+Removes listeners of the specified `channel`.
+
+#### `ipcMainServiceWorker.handle(channel, listener)`
+
+* `channel` string
+* `listener` Function\<Promise\<any\> | any\>
+  * `event` [IpcMainServiceWorkerInvokeEvent][ipc-main-service-worker-invoke-event]
+  * `...args` any[]
+
+#### `ipcMainServiceWorker.handleOnce(channel, listener)`
+
+* `channel` string
+* `listener` Function\<Promise\<any\> | any\>
+  * `event` [IpcMainServiceWorkerInvokeEvent][ipc-main-service-worker-invoke-event]
+  * `...args` any[]
+
+Handles a single `invoke`able IPC message, then removes the listener. See
+`ipcMainServiceWorker.handle(channel, listener)`.
+
+#### `ipcMainServiceWorker.removeHandler(channel)`
+
+* `channel` string
+
+Removes any handler for `channel`, if present.
+
+[ipc-main-service-worker-event]:../api/structures/ipc-main-service-worker-event.md
+[ipc-main-service-worker-invoke-event]:../api/structures/ipc-main-service-worker-invoke-event.md

docs/api/process.md

@@ -114,6 +114,7 @@ A `string` representing the current process's type, can be:
 
 * `browser` - The main process
 * `renderer` - A renderer process
+* `service-worker` - In a service worker
 * `worker` - In a web worker
 * `utility` - In a node process launched as a service
 

docs/api/service-worker-main.md

@@ -0,0 +1,75 @@
+# ServiceWorkerMain
+
+> An instance of a Service Worker representing a version of a script for a given scope.
+
+Process: [Main](../glossary.md#main-process)
+
+## Class: ServiceWorkerMain
+
+Process: [Main](../glossary.md#main-process)<br />
+_This class is not exported from the `'electron'` module. It is only available as a return value of other methods in the Electron API._
+
+### Instance Methods
+
+#### `serviceWorker.isDestroyed()` _Experimental_
+
+Returns `boolean` - Whether the service worker has been destroyed.
+
+#### `serviceWorker.send(channel, ...args)` _Experimental_
+
+- `channel` string
+- `...args` any[]
+
+Send an asynchronous message to the service worker process via `channel`, along with
+arguments. Arguments will be serialized with the [Structured Clone Algorithm][SCA],
+just like [`postMessage`][], so prototype chains will not be included.
+Sending Functions, Promises, Symbols, WeakMaps, or WeakSets will throw an exception.
+
+The service worker process can handle the message by listening to `channel` with the
+[`ipcRenderer`](ipc-renderer.md) module.
+
+#### `serviceWorker.startTask()` _Experimental_
+
+Returns `Object`:
+
+- `end` Function - Method to call when the task has ended. If never called, the service won't terminate while otherwise idle.
+
+Initiate a task to keep the service worker alive until ended.
+
+```js
+const { session } = require('electron')
+const { serviceWorkers } = session.defaultSession
+
+async function fetchData () {}
+
+const versionId = 0
+const serviceWorker = serviceWorkers.getWorkerFromVersionID(versionId)
+
+serviceWorker?.ipc.handle('request-data', async () => {
+  // Keep service worker alive while fetching data
+  const task = serviceWorker.startTask()
+  try {
+    return await fetchData()
+  } finally {
+    // Mark task as ended to allow service worker to terminate when idle.
+    task.end()
+  }
+})
+```
+
+### Instance Properties
+
+#### `serviceWorker.ipc` _Readonly_ _Experimental_
+
+An [`IpcMainServiceWorker`](ipc-main-service-worker.md) instance scoped to the service worker.
+
+#### `serviceWorker.scope` _Readonly_ _Experimental_
+
+A `string` representing the scope URL of the service worker.
+
+#### `serviceWorker.versionId` _Readonly_ _Experimental_
+
+A `number` representing the ID of the specific version of the service worker script in its scope.
+
+[SCA]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm
+[`postMessage`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage

docs/api/service-workers.md

@@ -56,6 +56,17 @@ Returns:
 
 Emitted when a service worker has been registered. Can occur after a call to [`navigator.serviceWorker.register('/sw.js')`](https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorkerContainer/register) successfully resolves or when a Chrome extension is loaded.
 
+#### Event: 'running-status-changed' _Experimental_
+
+Returns:
+
+* `details` Event\<\>
+  * `versionId` number - ID of the updated service worker version
+  * `runningStatus` string - Running status.
+    Possible values include `starting`, `running`, `stopping`, or `stopped`.
+
+Emitted when a service worker's running status has changed.
+
 ### Instance Methods
 
 The following methods are available on instances of `ServiceWorkers`:
@@ -64,10 +75,55 @@ The following methods are available on instances of `ServiceWorkers`:
 
 Returns `Record<number, ServiceWorkerInfo>` - A [ServiceWorkerInfo](structures/service-worker-info.md) object where the keys are the service worker version ID and the values are the information about that service worker.
 
-#### `serviceWorkers.getFromVersionID(versionId)`
+#### `serviceWorkers.getInfoFromVersionID(versionId)`
 
-* `versionId` number
+* `versionId` number - ID of the service worker version
 
 Returns [`ServiceWorkerInfo`](structures/service-worker-info.md) - Information about this service worker
 
 If the service worker does not exist or is not running this method will throw an exception.
+
+#### `serviceWorkers.getFromVersionID(versionId)` _Deprecated_
+
+* `versionId` number - ID of the service worker version
+
+Returns [`ServiceWorkerInfo`](structures/service-worker-info.md) - Information about this service worker
+
+If the service worker does not exist or is not running this method will throw an exception.
+
+**Deprecated:** Use the new `serviceWorkers.getInfoFromVersionID` API.
+
+#### `serviceWorkers.getWorkerFromVersionID(versionId)` _Experimental_
+
+* `versionId` number - ID of the service worker version
+
+Returns [`ServiceWorkerMain | undefined`](service-worker-main.md) - Instance of the service worker associated with the given version ID.
+
+#### `serviceWorkers.startWorkerForScope(scope)` _Experimental_
+
+* `scope` string - The scope of the service worker to start.
+
+Returns `Promise<ServiceWorkerMain>` - Resolves with the service worker when it's started.
+
+Starts the service worker or does nothing if already running.
+
+```js
+const { app, session } = require('electron')
+const { serviceWorkers } = session.defaultSession
+
+// Collect service workers scopes
+const workerScopes = Object.values(serviceWorkers.getAllRunning()).map((info) => info.scope)
+
+app.on('browser-window-created', async (event, window) => {
+  for (const scope of workerScopes) {
+    try {
+      // Ensure worker is started and send message
+      const serviceWorker = await serviceWorkers.startWorkerForScope(scope)
+      serviceWorker.send('window-created', { windowId: window.id })
+    } catch (error) {
+      console.error(`Failed to start service worker for ${scope}`)
+      console.error(error)
+    }
+  }
+})
+```

docs/api/session.md

@@ -1330,18 +1330,44 @@ the initial state will be `interrupted`. The download will start only when the
 
 Returns `Promise<void>` - resolves when the session’s HTTP authentication cache has been cleared.
 
-#### `ses.setPreloads(preloads)`
+#### `ses.setPreloads(preloads)` _Deprecated_
 
 * `preloads` string[] - An array of absolute path to preload scripts
 
 Adds scripts that will be executed on ALL web contents that are associated with
 this session just before normal `preload` scripts run.
 
-#### `ses.getPreloads()`
+**Deprecated:** Use the new `ses.registerPreloadScript` API. This will overwrite any preload scripts
+registered for `service-worker` context types.
+
+#### `ses.getPreloads()` _Deprecated_
 
 Returns `string[]` an array of paths to preload scripts that have been
 registered.
 
+**Deprecated:** Use the new `ses.getPreloadScripts` API. This will only return preload script paths
+for `frame` context types.
+
+#### `ses.registerPreloadScript(script)`
+
+* `script` [PreloadScriptRegistration](structures/preload-script-registration.md) - Preload script
+
+Registers preload script that will be executed in its associated context type in this session. For
+`frame` contexts, this will run prior to any preload defined in the web preferences of a
+WebContents.
+
+Returns `string` - The ID of the registered preload script.
+
+#### `ses.unregisterPreloadScript(id)`
+
+* `id` string - Preload script ID
+
+Unregisters script.
+
+#### `ses.getPreloadScripts()`
+
+Returns [`PreloadScript[]`](structures/preload-script.md): An array of paths to preload scripts that have been registered.
+
 #### `ses.setCodeCachePath(path)`
 
 * `path` String - Absolute path to store the v8 generated JS code cache from the renderer.

docs/api/structures/ipc-main-event.md

@@ -1,5 +1,6 @@
 # IpcMainEvent Object extends `Event`
 
+* `type` String - Possible values include `frame`
 * `processId` Integer - The internal ID of the renderer process that sent this message
 * `frameId` Integer - The ID of the renderer frame that sent this message
 * `returnValue` any - Set this to the value to be returned in a synchronous message

docs/api/structures/ipc-main-invoke-event.md

@@ -1,5 +1,6 @@
 # IpcMainInvokeEvent Object extends `Event`
 
+* `type` String - Possible values include `frame`
 * `processId` Integer - The internal ID of the renderer process that sent this message
 * `frameId` Integer - The ID of the renderer frame that sent this message
 * `sender` [WebContents](../web-contents.md) - Returns the `webContents` that sent the message

docs/api/structures/ipc-main-service-worker-event.md

@@ -0,0 +1,11 @@
+# IpcMainServiceWorkerEvent Object extends `Event`
+
+* `type` String - Possible values include `service-worker`.
+* `serviceWorker` [ServiceWorkerMain](../service-worker-main.md) _Readonly_ - The service worker that sent this message
+* `versionId` Number - The service worker version ID.
+* `session` Session - The [`Session`](../session.md) instance with which the event is associated.
+* `returnValue` any - Set this to the value to be returned in a synchronous message
+* `ports` [MessagePortMain](../message-port-main.md)[] - A list of MessagePorts that were transferred with this message
+* `reply` Function - A function that will send an IPC message to the renderer frame that sent the original message that you are currently handling.  You should use this method to "reply" to the sent message in order to guarantee the reply will go to the correct process and frame.
+  * `channel` string
+  * `...args` any[]

docs/api/structures/ipc-main-service-worker-invoke-event.md

@@ -0,0 +1,6 @@
+# IpcMainServiceWorkerInvokeEvent Object extends `Event`
+
+* `type` String - Possible values include `service-worker`.
+* `serviceWorker` [ServiceWorkerMain](../service-worker-main.md) _Readonly_ - The service worker that sent this message
+* `versionId` Number - The service worker version ID.
+* `session` Session - The [`Session`](../session.md) instance with which the event is associated.

docs/api/structures/preload-script-registration.md

@@ -0,0 +1,6 @@
+# PreloadScriptRegistration Object
+
+* `type` string - Context type where the preload script will be executed.
+  Possible values include `frame` or `service-worker`.
+* `id` string (optional) - Unique ID of preload script. Defaults to a random UUID.
+* `filePath` string - Path of the script file. Must be an absolute path.

docs/api/structures/preload-script.md

@@ -0,0 +1,6 @@
+# PreloadScript Object
+
+* `type` string - Context type where the preload script will be executed.
+  Possible values include `frame` or `service-worker`.
+* `id` string - Unique ID of preload script.
+* `filePath` string - Path of the script file. Must be an absolute path.

docs/api/structures/service-worker-info.md

@@ -3,3 +3,4 @@
 * `scriptUrl` string - The full URL to the script that this service worker runs
 * `scope` string - The base URL that this service worker is active for.
 * `renderProcessId` number - The virtual ID of the process that this service worker is running in.  This is not an OS level PID.  This aligns with the ID set used for `webContents.getProcessId()`.
+* `versionId` number - ID of the service worker version

docs/breaking-changes.md

@@ -12,6 +12,42 @@ This document uses the following convention to categorize breaking changes:
 * **Deprecated:** An API was marked as deprecated. The API will continue to function, but will emit a deprecation warning, and will be removed in a future release.
 * **Removed:** An API or feature was removed, and is no longer supported by Electron.
 
+## Planned Breaking API Changes (35.0)
+
+### Deprecated: `setPreloads`, `getPreloads` on `Session`
+
+`registerPreloadScript`, `unregisterPreloadScript`, and `getPreloadScripts` are introduced as a
+replacement for the deprecated methods. These new APIs allow third-party libraries to register
+preload scripts without replacing existing scripts. Also, the new `type` option allows for
+additional preload targets such as `service-worker`.
+
+```ts
+// Deprecated
+session.setPreloads([path.join(__dirname, 'preload.js')])
+
+// Replace with:
+session.registerPreloadScript({
+  type: 'frame',
+  id: 'app-preload',
+  filePath: path.join(__dirname, 'preload.js')
+})
+```
+
+### Deprecated: `getFromVersionID` on `session.serviceWorkers`
+
+The `session.serviceWorkers.fromVersionID(versionId)` API has been deprecated
+in favor of `session.serviceWorkers.getInfoFromVersionID(versionId)`. This was
+changed to make it more clear which object is returned with the introduction
+of the `session.serviceWorkers.getWorkerFromVersionID(versionId)` API.
+
+```js
+// Deprecated
+session.serviceWorkers.fromVersionID(versionId)
+
+// Replace with
+session.serviceWorkers.getInfoFromVersionID(versionId)
+```
+
 ## Planned Breaking API Changes (34.0)
 
 ### Deprecated: `level`, `message`, `line`, and `sourceId` arguments in `console-message` event on `WebContents`

docs/fiddles/features/web-bluetooth/index.html

@@ -11,7 +11,7 @@
     <button id="clickme">Test Bluetooth</button>
     <button id="cancel">Cancel Bluetooth Request</button>
 
-    <p>Currently selected bluetooth device: <strong id="device-name""></strong></p>
+    <p>Currently selected bluetooth device: <strong id="device-name"></strong></p>
 
     <script src="./renderer.js"></script>
   </body>

filenames.auto.gni

@@ -25,6 +25,7 @@ auto_filenames = {
     "docs/api/global-shortcut.md",
     "docs/api/in-app-purchase.md",
     "docs/api/incoming-message.md",
+    "docs/api/ipc-main-service-worker.md",
     "docs/api/ipc-main.md",
     "docs/api/ipc-renderer.md",
     "docs/api/menu-item.md",
@@ -45,6 +46,7 @@ auto_filenames = {
     "docs/api/push-notifications.md",
     "docs/api/safe-storage.md",
     "docs/api/screen.md",
+    "docs/api/service-worker-main.md",
     "docs/api/service-workers.md",
     "docs/api/session.md",
     "docs/api/share-menu.md",
@@ -94,6 +96,8 @@ auto_filenames = {
     "docs/api/structures/input-event.md",
     "docs/api/structures/ipc-main-event.md",
     "docs/api/structures/ipc-main-invoke-event.md",
+    "docs/api/structures/ipc-main-service-worker-event.md",
+    "docs/api/structures/ipc-main-service-worker-invoke-event.md",
     "docs/api/structures/ipc-renderer-event.md",
     "docs/api/structures/jump-list-category.md",
     "docs/api/structures/jump-list-item.md",
@@ -114,6 +118,8 @@ auto_filenames = {
     "docs/api/structures/permission-request.md",
     "docs/api/structures/point.md",
     "docs/api/structures/post-body.md",
+    "docs/api/structures/preload-script-registration.md",
+    "docs/api/structures/preload-script.md",
     "docs/api/structures/printer-info.md",
     "docs/api/structures/process-memory-info.md",
     "docs/api/structures/process-metric.md",
@@ -169,6 +175,8 @@ auto_filenames = {
     "lib/renderer/api/web-utils.ts",
     "lib/renderer/common-init.ts",
     "lib/renderer/inspector.ts",
+    "lib/renderer/ipc-native-setup.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
     "lib/renderer/security-warnings.ts",
@@ -183,6 +191,8 @@ auto_filenames = {
     "lib/sandboxed_renderer/api/exports/electron.ts",
     "lib/sandboxed_renderer/api/module-list.ts",
     "lib/sandboxed_renderer/init.ts",
+    "lib/sandboxed_renderer/pre-init.ts",
+    "lib/sandboxed_renderer/preload.ts",
     "package.json",
     "tsconfig.electron.json",
     "tsconfig.json",
@@ -239,6 +249,7 @@ auto_filenames = {
     "lib/browser/api/push-notifications.ts",
     "lib/browser/api/safe-storage.ts",
     "lib/browser/api/screen.ts",
+    "lib/browser/api/service-worker-main.ts",
     "lib/browser/api/session.ts",
     "lib/browser/api/share-menu.ts",
     "lib/browser/api/system-preferences.ts",
@@ -255,6 +266,7 @@ auto_filenames = {
     "lib/browser/guest-view-manager.ts",
     "lib/browser/guest-window-manager.ts",
     "lib/browser/init.ts",
+    "lib/browser/ipc-dispatch.ts",
     "lib/browser/ipc-main-impl.ts",
     "lib/browser/ipc-main-internal-utils.ts",
     "lib/browser/ipc-main-internal.ts",
@@ -299,6 +311,8 @@ auto_filenames = {
     "lib/renderer/common-init.ts",
     "lib/renderer/init.ts",
     "lib/renderer/inspector.ts",
+    "lib/renderer/ipc-native-setup.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
     "lib/renderer/security-warnings.ts",
@@ -333,6 +347,7 @@ auto_filenames = {
     "lib/renderer/api/module-list.ts",
     "lib/renderer/api/web-frame.ts",
     "lib/renderer/api/web-utils.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
     "lib/worker/init.ts",
@@ -373,4 +388,27 @@ auto_filenames = {
     "typings/internal-ambient.d.ts",
     "typings/internal-electron.d.ts",
   ]
+
+  preload_realm_bundle_deps = [
+    "lib/common/api/native-image.ts",
+    "lib/common/define-properties.ts",
+    "lib/common/ipc-messages.ts",
+    "lib/common/webpack-globals-provider.ts",
+    "lib/preload_realm/api/exports/electron.ts",
+    "lib/preload_realm/api/module-list.ts",
+    "lib/preload_realm/init.ts",
+    "lib/renderer/api/context-bridge.ts",
+    "lib/renderer/api/ipc-renderer.ts",
+    "lib/renderer/ipc-native-setup.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
+    "lib/renderer/ipc-renderer-internal-utils.ts",
+    "lib/renderer/ipc-renderer-internal.ts",
+    "lib/sandboxed_renderer/pre-init.ts",
+    "lib/sandboxed_renderer/preload.ts",
+    "package.json",
+    "tsconfig.electron.json",
+    "tsconfig.json",
+    "typings/internal-ambient.d.ts",
+    "typings/internal-electron.d.ts",
+  ]
 }

filenames.gni

@@ -304,6 +304,8 @@ filenames = {
     "shell/browser/api/electron_api_screen.h",
     "shell/browser/api/electron_api_service_worker_context.cc",
     "shell/browser/api/electron_api_service_worker_context.h",
+    "shell/browser/api/electron_api_service_worker_main.cc",
+    "shell/browser/api/electron_api_service_worker_main.h",
     "shell/browser/api/electron_api_session.cc",
     "shell/browser/api/electron_api_session.h",
     "shell/browser/api/electron_api_system_preferences.cc",
@@ -330,6 +332,7 @@ filenames = {
     "shell/browser/api/gpu_info_enumerator.h",
     "shell/browser/api/gpuinfo_manager.cc",
     "shell/browser/api/gpuinfo_manager.h",
+    "shell/browser/api/ipc_dispatcher.h",
     "shell/browser/api/message_port.cc",
     "shell/browser/api/message_port.h",
     "shell/browser/api/process_metric.cc",
@@ -361,6 +364,8 @@ filenames = {
     "shell/browser/draggable_region_provider.h",
     "shell/browser/electron_api_ipc_handler_impl.cc",
     "shell/browser/electron_api_ipc_handler_impl.h",
+    "shell/browser/electron_api_sw_ipc_handler_impl.cc",
+    "shell/browser/electron_api_sw_ipc_handler_impl.h",
     "shell/browser/electron_autofill_driver.cc",
     "shell/browser/electron_autofill_driver.h",
     "shell/browser/electron_autofill_driver_factory.cc",
@@ -482,6 +487,7 @@ filenames = {
     "shell/browser/osr/osr_web_contents_view.h",
     "shell/browser/plugins/plugin_utils.cc",
     "shell/browser/plugins/plugin_utils.h",
+    "shell/browser/preload_script.h",
     "shell/browser/protocol_registry.cc",
     "shell/browser/protocol_registry.h",
     "shell/browser/relauncher.cc",
@@ -621,6 +627,8 @@ filenames = {
     "shell/common/gin_converters/osr_converter.cc",
     "shell/common/gin_converters/osr_converter.h",
     "shell/common/gin_converters/serial_port_info_converter.h",
+    "shell/common/gin_converters/service_worker_converter.cc",
+    "shell/common/gin_converters/service_worker_converter.h",
     "shell/common/gin_converters/std_converter.h",
     "shell/common/gin_converters/time_converter.cc",
     "shell/common/gin_converters/time_converter.h",
@@ -661,6 +669,8 @@ filenames = {
     "shell/common/gin_helper/pinnable.h",
     "shell/common/gin_helper/promise.cc",
     "shell/common/gin_helper/promise.h",
+    "shell/common/gin_helper/reply_channel.cc",
+    "shell/common/gin_helper/reply_channel.h",
     "shell/common/gin_helper/trackable_object.cc",
     "shell/common/gin_helper/trackable_object.h",
     "shell/common/gin_helper/wrappable.cc",
@@ -710,14 +720,22 @@ filenames = {
     "shell/renderer/electron_api_service_impl.h",
     "shell/renderer/electron_autofill_agent.cc",
     "shell/renderer/electron_autofill_agent.h",
+    "shell/renderer/electron_ipc_native.cc",
+    "shell/renderer/electron_ipc_native.h",
     "shell/renderer/electron_render_frame_observer.cc",
     "shell/renderer/electron_render_frame_observer.h",
     "shell/renderer/electron_renderer_client.cc",
     "shell/renderer/electron_renderer_client.h",
     "shell/renderer/electron_sandboxed_renderer_client.cc",
     "shell/renderer/electron_sandboxed_renderer_client.h",
+    "shell/renderer/preload_realm_context.cc",
+    "shell/renderer/preload_realm_context.h",
+    "shell/renderer/preload_utils.cc",
+    "shell/renderer/preload_utils.h",
     "shell/renderer/renderer_client_base.cc",
     "shell/renderer/renderer_client_base.h",
+    "shell/renderer/service_worker_data.cc",
+    "shell/renderer/service_worker_data.h",
     "shell/renderer/web_worker_observer.cc",
     "shell/renderer/web_worker_observer.h",
     "shell/services/node/node_service.cc",

lib/browser/api/module-list.ts

@@ -29,6 +29,7 @@ export const browserModuleList: ElectronInternal.ModuleEntry[] = [
   { name: 'protocol', loader: () => require('./protocol') },
   { name: 'safeStorage', loader: () => require('./safe-storage') },
   { name: 'screen', loader: () => require('./screen') },
+  { name: 'ServiceWorkerMain', loader: () => require('./service-worker-main') },
   { name: 'session', loader: () => require('./session') },
   { name: 'ShareMenu', loader: () => require('./share-menu') },
   { name: 'systemPreferences', loader: () => require('./system-preferences') },

lib/browser/api/service-worker-main.ts

@@ -0,0 +1,39 @@
+import { IpcMainImpl } from '@electron/internal/browser/ipc-main-impl';
+
+const { ServiceWorkerMain } = process._linkedBinding('electron_browser_service_worker_main');
+
+Object.defineProperty(ServiceWorkerMain.prototype, 'ipc', {
+  get () {
+    const ipc = new IpcMainImpl();
+    Object.defineProperty(this, 'ipc', { value: ipc });
+    return ipc;
+  }
+});
+
+ServiceWorkerMain.prototype.send = function (channel, ...args) {
+  if (typeof channel !== 'string') {
+    throw new TypeError('Missing required channel argument');
+  }
+
+  try {
+    return this._send(false /* internal */, channel, args);
+  } catch (e) {
+    console.error('Error sending from ServiceWorkerMain: ', e);
+  }
+};
+
+ServiceWorkerMain.prototype.startTask = function () {
+  // TODO(samuelmaddock): maybe make timeout configurable in the future
+  const hasTimeout = false;
+  const { id, ok } = this._startExternalRequest(hasTimeout);
+
+  if (!ok) {
+    throw new Error('Unable to start service worker task.');
+  }
+
+  return {
+    end: () => this._finishExternalRequest(id)
+  };
+};
+
+module.exports = ServiceWorkerMain;

lib/browser/api/session.ts

@@ -1,4 +1,6 @@
 import { fetchWithSession } from '@electron/internal/browser/api/net-fetch';
+import { addIpcDispatchListeners } from '@electron/internal/browser/ipc-dispatch';
+import * as deprecate from '@electron/internal/common/deprecate';
 
 import { net } from 'electron/main';
 
@@ -20,6 +22,10 @@ Object.defineProperty(systemPickerVideoSource, 'id', {
 systemPickerVideoSource.name = '';
 Object.freeze(systemPickerVideoSource);
 
+Session.prototype._init = function () {
+  addIpcDispatchListeners(this, this.serviceWorkers);
+};
+
 Session.prototype.fetch = function (input: RequestInfo, init?: RequestInit) {
   return fetchWithSession(input, init, this, net.request);
 };
@@ -36,6 +42,31 @@ Session.prototype.setDisplayMediaRequestHandler = function (handler, opts) {
   }, opts);
 };
 
+const getPreloadsDeprecated = deprecate.warnOnce('session.getPreloads', 'session.getPreloadScripts');
+Session.prototype.getPreloads = function () {
+  getPreloadsDeprecated();
+  return this.getPreloadScripts()
+    .filter((script) => script.type === 'frame')
+    .map((script) => script.filePath);
+};
+
+const setPreloadsDeprecated = deprecate.warnOnce('session.setPreloads', 'session.registerPreloadScript');
+Session.prototype.setPreloads = function (preloads) {
+  setPreloadsDeprecated();
+  this.getPreloadScripts()
+    .filter((script) => script.type === 'frame')
+    .forEach((script) => {
+      this.unregisterPreloadScript(script.id);
+    });
+  preloads.map(filePath => ({
+    type: 'frame',
+    filePath,
+    _deprecated: true
+  }) as Electron.PreloadScriptRegistration).forEach(script => {
+    this.registerPreloadScript(script);
+  });
+};
+
 export default {
   fromPartition,
   fromPath,

lib/browser/api/web-contents.ts

@@ -514,9 +514,9 @@ WebContents.prototype.canGoForward = function () {
 };
 
 const canGoToOffsetDeprecated = deprecate.warnOnce('webContents.canGoToOffset', 'webContents.navigationHistory.canGoToOffset');
-WebContents.prototype.canGoToOffset = function () {
+WebContents.prototype.canGoToOffset = function (index: number) {
   canGoToOffsetDeprecated();
-  return this._canGoToOffset();
+  return this._canGoToOffset(index);
 };
 
 const clearHistoryDeprecated = deprecate.warnOnce('webContents.clearHistory', 'webContents.navigationHistory.clear');

lib/browser/devtools.ts

@@ -69,6 +69,7 @@ const assertChromeDevTools = function (contents: Electron.WebContents, api: stri
 
 ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_CONTEXT_MENU, function (event, items: ContextMenuItem[], isEditMenu: boolean) {
   return new Promise<number | void>(resolve => {
+    if (event.type !== 'frame') return;
     assertChromeDevTools(event.sender, 'window.InspectorFrontendHost.showContextMenuAtPoint()');
 
     const template = isEditMenu ? getEditMenuItems() : convertToMenuTemplate(items, resolve);
@@ -80,6 +81,7 @@ ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_CONTEXT_MENU, function (event, ite
 });
 
 ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_SELECT_FILE, async function (event) {
+  if (event.type !== 'frame') return [];
   assertChromeDevTools(event.sender, 'window.UI.createFileSelectorElement()');
 
   const result = await dialog.showOpenDialog({});
@@ -92,6 +94,7 @@ ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_SELECT_FILE, async function (event
 });
 
 ipcMainUtils.handleSync(IPC_MESSAGES.INSPECTOR_CONFIRM, async function (event, message: string = '', title: string = '') {
+  if (event.type !== 'frame') return;
   assertChromeDevTools(event.sender, 'window.confirm()');
 
   const options = {

lib/browser/guest-view-manager.ts

@@ -267,9 +267,10 @@ const isWebViewTagEnabled = function (contents: Electron.WebContents) {
 };
 
 const makeSafeHandler = function<Event extends { sender: Electron.WebContents }> (channel: string, handler: (event: Event, ...args: any[]) => any) {
-  return (event: Event, ...args: any[]) => {
+  return (event: Electron.IpcMainInvokeEvent | Electron.IpcMainServiceWorkerInvokeEvent, ...args: any[]) => {
+    if (event.type !== 'frame') return;
     if (isWebViewTagEnabled(event.sender)) {
-      return handler(event, ...args);
+      return handler(event as unknown as Event, ...args);
     } else {
       console.error(`<webview> IPC message ${channel} sent by WebContents with <webview> disabled (${event.sender.id})`);
       throw new Error('<webview> disabled');
@@ -281,7 +282,7 @@ const handleMessage = function (channel: string, handler: (event: Electron.IpcMa
   ipcMainInternal.handle(channel, makeSafeHandler(channel, handler));
 };
 
-const handleMessageSync = function (channel: string, handler: (event: ElectronInternal.IpcMainInternalEvent, ...args: any[]) => any) {
+const handleMessageSync = function (channel: string, handler: (event: { sender: Electron.WebContents }, ...args: any[]) => any) {
   ipcMainUtils.handleSync(channel, makeSafeHandler(channel, handler));
 };
 
@@ -294,8 +295,10 @@ handleMessageSync(IPC_MESSAGES.GUEST_VIEW_MANAGER_DETACH_GUEST, function (event,
 });
 
 // this message is sent by the actual <webview>
-ipcMainInternal.on(IPC_MESSAGES.GUEST_VIEW_MANAGER_FOCUS_CHANGE, function (event: ElectronInternal.IpcMainInternalEvent, focus: boolean) {
-  event.sender.emit('-focus-change', {}, focus);
+ipcMainInternal.on(IPC_MESSAGES.GUEST_VIEW_MANAGER_FOCUS_CHANGE, function (event, focus: boolean) {
+  if (event.type === 'frame') {
+    event.sender.emit('-focus-change', {}, focus);
+  }
 });
 
 handleMessage(IPC_MESSAGES.GUEST_VIEW_MANAGER_CALL, function (event, guestInstanceId: number, method: string, args: any[]) {

lib/browser/init.ts

@@ -146,6 +146,9 @@ require('@electron/internal/browser/devtools');
 // Load protocol module to ensure it is populated on app ready
 require('@electron/internal/browser/api/protocol');
 
+// Load service-worker-main module to ensure it is populated on app ready
+require('@electron/internal/browser/api/service-worker-main');
+
 // Load web-contents module to ensure it is populated on app ready
 require('@electron/internal/browser/api/web-contents');
 

lib/browser/ipc-dispatch.ts

@@ -0,0 +1,91 @@
+import { ipcMainInternal } from '@electron/internal/browser/ipc-main-internal';
+import { MessagePortMain } from '@electron/internal/browser/message-port-main';
+
+import type { ServiceWorkerMain } from 'electron/main';
+
+const v8Util = process._linkedBinding('electron_common_v8_util');
+
+const addReturnValueToEvent = (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent) => {
+  Object.defineProperty(event, 'returnValue', {
+    set: (value) => event._replyChannel.sendReply(value),
+    get: () => {}
+  });
+};
+
+/**
+ * Listens for IPC dispatch events on `api`.
+ *
+ * NOTE: Currently this only supports dispatching IPCs for ServiceWorkerMain.
+ */
+export function addIpcDispatchListeners (api: NodeJS.EventEmitter, serviceWorkers: Electron.ServiceWorkers) {
+  const getServiceWorkerFromEvent = (event: Electron.IpcMainServiceWorkerEvent | Electron.IpcMainServiceWorkerInvokeEvent): ServiceWorkerMain | undefined => {
+    return serviceWorkers._getWorkerFromVersionIDIfExists(event.versionId);
+  };
+  const addServiceWorkerPropertyToEvent = (event: Electron.IpcMainServiceWorkerEvent | Electron.IpcMainServiceWorkerInvokeEvent) => {
+    Object.defineProperty(event, 'serviceWorker', {
+      get: () => serviceWorkers.getWorkerFromVersionID(event.versionId)
+    });
+  };
+
+  api.on('-ipc-message' as any, function (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent, channel: string, args: any[]) {
+    const internal = v8Util.getHiddenValue<boolean>(event, 'internal');
+
+    if (internal) {
+      ipcMainInternal.emit(channel, event, ...args);
+    } else if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      getServiceWorkerFromEvent(event)?.ipc.emit(channel, event, ...args);
+    }
+  } as any);
+
+  api.on('-ipc-invoke' as any, async function (event: Electron.IpcMainInvokeEvent | Electron.IpcMainServiceWorkerInvokeEvent, channel: string, args: any[]) {
+    const internal = v8Util.getHiddenValue<boolean>(event, 'internal');
+
+    const replyWithResult = (result: any) => event._replyChannel.sendReply({ result });
+    const replyWithError = (error: Error) => {
+      console.error(`Error occurred in handler for '${channel}':`, error);
+      event._replyChannel.sendReply({ error: error.toString() });
+    };
+
+    const targets: (Electron.IpcMainServiceWorker | ElectronInternal.IpcMainInternal | undefined)[] = [];
+
+    if (internal) {
+      targets.push(ipcMainInternal);
+    } else if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      const workerIpc = getServiceWorkerFromEvent(event)?.ipc;
+      targets.push(workerIpc);
+    }
+
+    const target = targets.find(target => (target as any)?._invokeHandlers.has(channel));
+    if (target) {
+      const handler = (target as any)._invokeHandlers.get(channel);
+      try {
+        replyWithResult(await Promise.resolve(handler(event, ...args)));
+      } catch (err) {
+        replyWithError(err as Error);
+      }
+    } else {
+      replyWithError(new Error(`No handler registered for '${channel}'`));
+    }
+  } as any);
+
+  api.on('-ipc-message-sync' as any, function (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent, channel: string, args: any[]) {
+    const internal = v8Util.getHiddenValue<boolean>(event, 'internal');
+    addReturnValueToEvent(event);
+    if (internal) {
+      ipcMainInternal.emit(channel, event, ...args);
+    } else if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      getServiceWorkerFromEvent(event)?.ipc.emit(channel, event, ...args);
+    }
+  } as any);
+
+  api.on('-ipc-ports' as any, function (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent, channel: string, message: any, ports: any[]) {
+    event.ports = ports.map(p => new MessagePortMain(p));
+    if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      getServiceWorkerFromEvent(event)?.ipc.emit(channel, event, message);
+    }
+  } as any);
+}

lib/browser/ipc-main-internal-utils.ts

@@ -19,7 +19,7 @@ export function invokeInWebContents<T> (sender: Electron.WebContents, command: s
     const requestId = ++nextId;
     const channel = `${command}_RESPONSE_${requestId}`;
     ipcMainInternal.on(channel, function handler (event, error: Error, result: any) {
-      if (event.sender !== sender) {
+      if (event.type === 'frame' && event.sender !== sender) {
         console.error(`Reply to ${command} sent by unexpected WebContents (${event.sender.id})`);
         return;
       }

lib/browser/rpc-server.ts

@@ -5,9 +5,12 @@ import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 import { clipboard } from 'electron/common';
 
 import * as fs from 'fs';
+import * as path from 'path';
 
 // Implements window.close()
 ipcMainInternal.on(IPC_MESSAGES.BROWSER_WINDOW_CLOSE, function (event) {
+  if (event.type !== 'frame') return;
+
   const window = event.sender.getOwnerBrowserWindow();
   if (window) {
     window.close();
@@ -16,10 +19,12 @@ ipcMainInternal.on(IPC_MESSAGES.BROWSER_WINDOW_CLOSE, function (event) {
 });
 
 ipcMainInternal.handle(IPC_MESSAGES.BROWSER_GET_LAST_WEB_PREFERENCES, function (event) {
+  if (event.type !== 'frame') return;
   return event.sender.getLastWebPreferences();
 });
 
 ipcMainInternal.handle(IPC_MESSAGES.BROWSER_GET_PROCESS_MEMORY_INFO, function (event) {
+  if (event.type !== 'frame') return;
   return event.sender._getProcessMemoryInfo();
 });
 
@@ -43,22 +48,46 @@ ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_CLIPBOARD_SYNC, function (event, me
   return (clipboard as any)[method](...args);
 });
 
-const getPreloadScript = async function (preloadPath: string) {
-  let preloadSrc = null;
-  let preloadError = null;
-  try {
-    preloadSrc = await fs.promises.readFile(preloadPath, 'utf8');
-  } catch (error) {
-    preloadError = error;
+const getPreloadScriptsFromEvent = (event: ElectronInternal.IpcMainInternalEvent) => {
+  const session: Electron.Session = event.type === 'service-worker' ? event.session : event.sender.session;
+  let preloadScripts = session.getPreloadScripts();
+
+  if (event.type === 'frame') {
+    preloadScripts = preloadScripts.filter(script => script.type === 'frame');
+    const preload = event.sender._getPreloadScript();
+    if (preload) preloadScripts.push(preload);
+  } else if (event.type === 'service-worker') {
+    preloadScripts = preloadScripts.filter(script => script.type === 'service-worker');
+  } else {
+    throw new Error(`getPreloadScriptsFromEvent: event.type is invalid (${(event as any).type})`);
   }
-  return { preloadPath, preloadSrc, preloadError };
+
+  // TODO(samuelmaddock): Remove filter after Session.setPreloads is fully
+  // deprecated. The new API will prevent relative paths from being registered.
+  return preloadScripts.filter(script => path.isAbsolute(script.filePath));
+};
+
+const readPreloadScript = async function (script: Electron.PreloadScript): Promise<ElectronInternal.PreloadScript> {
+  let contents;
+  let error;
+  try {
+    contents = await fs.promises.readFile(script.filePath, 'utf8');
+  } catch (err) {
+    if (err instanceof Error) {
+      error = err;
+    }
+  }
+  return {
+    ...script,
+    contents,
+    error
+  };
 };
 
 ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_SANDBOX_LOAD, async function (event) {
-  const preloadPaths = event.sender._getPreloadPaths();
-
+  const preloadScripts = getPreloadScriptsFromEvent(event);
   return {
-    preloadScripts: await Promise.all(preloadPaths.map(path => getPreloadScript(path))),
+    preloadScripts: await Promise.all(preloadScripts.map(readPreloadScript)),
     process: {
       arch: process.arch,
       platform: process.platform,
@@ -71,9 +100,11 @@ ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_SANDBOX_LOAD, async function (event
 });
 
 ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_NONSANDBOX_LOAD, function (event) {
-  return { preloadPaths: event.sender._getPreloadPaths() };
+  const preloadScripts = getPreloadScriptsFromEvent(event);
+  return { preloadPaths: preloadScripts.map(script => script.filePath) };
 });
 
 ipcMainInternal.on(IPC_MESSAGES.BROWSER_PRELOAD_ERROR, function (event, preloadPath: string, error: Error) {
-  event.sender.emit('preload-error', event, preloadPath, error);
+  if (event.type !== 'frame') return;
+  event.sender?.emit('preload-error', event, preloadPath, error);
 });

lib/preload_realm/.eslintrc.json

@@ -0,0 +1,18 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          "electron",
+          "electron/main"
+        ],
+        "patterns": [
+          "./*",
+          "../*",
+          "@electron/internal/browser/*"
+        ]
+      }
+    ]
+  }
+}

lib/preload_realm/api/exports/electron.ts

@@ -0,0 +1,6 @@
+import { defineProperties } from '@electron/internal/common/define-properties';
+import { moduleList } from '@electron/internal/preload_realm/api/module-list';
+
+module.exports = {};
+
+defineProperties(module.exports, moduleList);

lib/preload_realm/api/module-list.ts

@@ -0,0 +1,14 @@
+export const moduleList: ElectronInternal.ModuleEntry[] = [
+  {
+    name: 'contextBridge',
+    loader: () => require('@electron/internal/renderer/api/context-bridge')
+  },
+  {
+    name: 'ipcRenderer',
+    loader: () => require('@electron/internal/renderer/api/ipc-renderer')
+  },
+  {
+    name: 'nativeImage',
+    loader: () => require('@electron/internal/common/api/native-image')
+  }
+];

lib/preload_realm/init.ts

@@ -0,0 +1,56 @@
+import '@electron/internal/sandboxed_renderer/pre-init';
+import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
+import type * as ipcRendererUtilsModule from '@electron/internal/renderer/ipc-renderer-internal-utils';
+import { createPreloadProcessObject, executeSandboxedPreloadScripts } from '@electron/internal/sandboxed_renderer/preload';
+
+import * as events from 'events';
+
+declare const binding: {
+  get: (name: string) => any;
+  process: NodeJS.Process;
+  createPreloadScript: (src: string) => Function
+};
+
+const ipcRendererUtils = require('@electron/internal/renderer/ipc-renderer-internal-utils') as typeof ipcRendererUtilsModule;
+
+const {
+  preloadScripts,
+  process: processProps
+} = ipcRendererUtils.invokeSync<{
+  preloadScripts: ElectronInternal.PreloadScript[];
+  process: NodeJS.Process;
+}>(IPC_MESSAGES.BROWSER_SANDBOX_LOAD);
+
+const electron = require('electron');
+
+const loadedModules = new Map<string, any>([
+  ['electron', electron],
+  ['electron/common', electron],
+  ['events', events],
+  ['node:events', events]
+]);
+
+const loadableModules = new Map<string, Function>([
+  ['url', () => require('url')],
+  ['node:url', () => require('url')]
+]);
+
+const preloadProcess = createPreloadProcessObject();
+
+Object.assign(preloadProcess, binding.process);
+Object.assign(preloadProcess, processProps);
+
+Object.assign(process, processProps);
+
+require('@electron/internal/renderer/ipc-native-setup');
+
+executeSandboxedPreloadScripts({
+  loadedModules: loadedModules,
+  loadableModules: loadableModules,
+  process: preloadProcess,
+  createPreloadScript: binding.createPreloadScript,
+  exposeGlobals: {
+    Buffer: Buffer,
+    global: global
+  }
+}, preloadScripts);

lib/renderer/api/context-bridge.ts

@@ -5,13 +5,17 @@ const checkContextIsolationEnabled = () => {
 };
 
 const contextBridge: Electron.ContextBridge = {
-  exposeInMainWorld: (key: string, api: any) => {
+  exposeInMainWorld: (key, api) => {
     checkContextIsolationEnabled();
     return binding.exposeAPIInWorld(0, key, api);
   },
-  exposeInIsolatedWorld: (worldId: number, key: string, api: any) => {
+  exposeInIsolatedWorld: (worldId, key, api) => {
     checkContextIsolationEnabled();
     return binding.exposeAPIInWorld(worldId, key, api);
+  },
+  executeInMainWorld: (script) => {
+    checkContextIsolationEnabled();
+    return binding.executeInWorld(0, script);
   }
 };
 
@@ -27,8 +31,7 @@ export const internalContextBridge = {
   },
   overrideGlobalPropertyFromIsolatedWorld: (keys: string[], getter: Function, setter?: Function) => {
     return binding._overrideGlobalPropertyFromIsolatedWorld(keys, getter, setter || null);
-  },
-  isInMainWorld: () => binding._isCalledFromMainWorld() as boolean
+  }
 };
 
 if (binding._isDebug) {

lib/renderer/api/ipc-renderer.ts

@@ -1,8 +1,10 @@
+import { getIPCRenderer } from '@electron/internal/renderer/ipc-renderer-bindings';
+
 import { EventEmitter } from 'events';
 
-const { ipc } = process._linkedBinding('electron_renderer_ipc');
-
+const ipc = getIPCRenderer();
 const internal = false;
+
 class IpcRenderer extends EventEmitter implements Electron.IpcRenderer {
   send (channel: string, ...args: any[]) {
     return ipc.send(internal, channel, args);

lib/renderer/common-init.ts

@@ -1,27 +1,16 @@
-import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
 import type * as securityWarningsModule from '@electron/internal/renderer/security-warnings';
 import type * as webFrameInitModule from '@electron/internal/renderer/web-frame-init';
 import type * as webViewInitModule from '@electron/internal/renderer/web-view/web-view-init';
 import type * as windowSetupModule from '@electron/internal/renderer/window-setup';
 
-import { ipcRenderer } from 'electron/renderer';
-
 const { mainFrame } = process._linkedBinding('electron_renderer_web_frame');
-const v8Util = process._linkedBinding('electron_common_v8_util');
 
 const nodeIntegration = mainFrame.getWebPreference('nodeIntegration');
 const webviewTag = mainFrame.getWebPreference('webviewTag');
 const isHiddenPage = mainFrame.getWebPreference('hiddenPage');
 const isWebView = mainFrame.getWebPreference('isWebView');
 
-// ElectronApiServiceImpl will look for the "ipcNative" hidden object when
-// invoking the 'onMessage' callback.
-v8Util.setHiddenValue(global, 'ipcNative', {
-  onMessage (internal: boolean, channel: string, ports: MessagePort[], args: any[]) {
-    const sender = internal ? ipcRendererInternal : ipcRenderer;
-    sender.emit(channel, { sender, ports }, ...args);
-  }
-});
+require('@electron/internal/renderer/ipc-native-setup');
 
 switch (window.location.protocol) {
   case 'devtools:': {

lib/renderer/init.ts

@@ -12,7 +12,7 @@ const Module = require('module') as NodeJS.ModuleInternal;
 const originalModuleLoad = Module._load;
 Module._load = function (request: string) {
   if (request === 'vm') {
-    console.warn('The vm module of Node.js is deprecated in the renderer process and will be removed.');
+    console.warn('The vm module of Node.js is unsupported in Electron\'s renderer process due to incompatibilities with the Blink rendering engine. Crashes are likely and avoiding the module is highly recommended. This module may be removed in a future release.');
   }
   return originalModuleLoad.apply(this, arguments as any);
 };

lib/renderer/ipc-native-setup.ts

@@ -0,0 +1,14 @@
+import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
+
+import { ipcRenderer } from 'electron/renderer';
+
+const v8Util = process._linkedBinding('electron_common_v8_util');
+
+// ElectronApiServiceImpl will look for the "ipcNative" hidden object when
+// invoking the 'onMessage' callback.
+v8Util.setHiddenValue(globalThis, 'ipcNative', {
+  onMessage (internal: boolean, channel: string, ports: MessagePort[], args: any[]) {
+    const sender = internal ? ipcRendererInternal : ipcRenderer;
+    sender.emit(channel, { sender, ports }, ...args);
+  }
+});

lib/renderer/ipc-renderer-bindings.ts

@@ -0,0 +1,17 @@
+let ipc: NodeJS.IpcRendererImpl | undefined;
+
+/**
+ * Get IPCRenderer implementation for the current process.
+ */
+export function getIPCRenderer () {
+  if (ipc) return ipc;
+  const ipcBinding = process._linkedBinding('electron_renderer_ipc');
+  switch (process.type) {
+    case 'renderer':
+      return (ipc = ipcBinding.createForRenderFrame());
+    case 'service-worker':
+      return (ipc = ipcBinding.createForServiceWorker());
+    default:
+      throw new Error(`Cannot create IPCRenderer for '${process.type}' process`);
+  }
+};

lib/renderer/ipc-renderer-internal.ts

@@ -1,7 +1,8 @@
+import { getIPCRenderer } from '@electron/internal/renderer/ipc-renderer-bindings';
+
 import { EventEmitter } from 'events';
 
-const { ipc } = process._linkedBinding('electron_renderer_ipc');
-
+const ipc = getIPCRenderer();
 const internal = true;
 
 class IpcRendererInternal extends EventEmitter implements ElectronInternal.IpcRendererInternal {

lib/renderer/window-setup.ts

@@ -15,7 +15,7 @@ export const windowSetup = (isWebView: boolean, isHiddenPage: boolean) => {
 
   // But we do not support prompt().
   window.prompt = function () {
-    throw new Error('prompt() is and will not be supported.');
+    throw new Error('prompt() is not supported.');
   };
   if (contextIsolationEnabled) internalContextBridge.overrideGlobalValueFromIsolatedWorld(['prompt'], window.prompt);
 

lib/sandboxed_renderer/init.ts

@@ -1,45 +1,23 @@
+import '@electron/internal/sandboxed_renderer/pre-init';
 import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
-import type * as ipcRendererInternalModule from '@electron/internal/renderer/ipc-renderer-internal';
 import type * as ipcRendererUtilsModule from '@electron/internal/renderer/ipc-renderer-internal-utils';
+import { createPreloadProcessObject, executeSandboxedPreloadScripts } from '@electron/internal/sandboxed_renderer/preload';
 
 import * as events from 'events';
 import { setImmediate, clearImmediate } from 'timers';
 
 declare const binding: {
-  get: (name: string) => any;
   process: NodeJS.Process;
   createPreloadScript: (src: string) => Function
 };
 
-const { EventEmitter } = events;
-
-process._linkedBinding = binding.get;
-
-const v8Util = process._linkedBinding('electron_common_v8_util');
-// Expose Buffer shim as a hidden value. This is used by C++ code to
-// deserialize Buffer instances sent from browser process.
-v8Util.setHiddenValue(global, 'Buffer', Buffer);
-// The process object created by webpack is not an event emitter, fix it so
-// the API is more compatible with non-sandboxed renderers.
-for (const prop of Object.keys(EventEmitter.prototype) as (keyof typeof process)[]) {
-  if (Object.hasOwn(process, prop)) {
-    delete process[prop];
-  }
-}
-Object.setPrototypeOf(process, EventEmitter.prototype);
-
-const { ipcRendererInternal } = require('@electron/internal/renderer/ipc-renderer-internal') as typeof ipcRendererInternalModule;
 const ipcRendererUtils = require('@electron/internal/renderer/ipc-renderer-internal-utils') as typeof ipcRendererUtilsModule;
 
 const {
   preloadScripts,
   process: processProps
 } = ipcRendererUtils.invokeSync<{
-  preloadScripts: {
-    preloadPath: string;
-    preloadSrc: string | null;
-    preloadError: null | Error;
-  }[];
+  preloadScripts: ElectronInternal.PreloadScript[];
   process: NodeJS.Process;
 }>(IPC_MESSAGES.BROWSER_SANDBOX_LOAD);
 
@@ -60,89 +38,32 @@ const loadableModules = new Map<string, Function>([
   ['node:url', () => require('url')]
 ]);
 
-// Pass different process object to the preload script.
-const preloadProcess: NodeJS.Process = new EventEmitter() as any;
+const preloadProcess = createPreloadProcessObject();
 
 // InvokeEmitProcessEvent in ElectronSandboxedRendererClient will look for this
+const v8Util = process._linkedBinding('electron_common_v8_util');
 v8Util.setHiddenValue(global, 'emit-process-event', (event: string) => {
   (process as events.EventEmitter).emit(event);
   (preloadProcess as events.EventEmitter).emit(event);
 });
 
-Object.assign(preloadProcess, binding.process);
-Object.assign(preloadProcess, processProps);
-
-Object.assign(process, binding.process);
 Object.assign(process, processProps);
 
-process.getProcessMemoryInfo = preloadProcess.getProcessMemoryInfo = () => {
-  return ipcRendererInternal.invoke<Electron.ProcessMemoryInfo>(IPC_MESSAGES.BROWSER_GET_PROCESS_MEMORY_INFO);
-};
-
-Object.defineProperty(preloadProcess, 'noDeprecation', {
-  get () {
-    return process.noDeprecation;
-  },
-  set (value) {
-    process.noDeprecation = value;
-  }
-});
-
-// This is the `require` function that will be visible to the preload script
-function preloadRequire (module: string) {
-  if (loadedModules.has(module)) {
-    return loadedModules.get(module);
-  }
-  if (loadableModules.has(module)) {
-    const loadedModule = loadableModules.get(module)!();
-    loadedModules.set(module, loadedModule);
-    return loadedModule;
-  }
-  throw new Error(`module not found: ${module}`);
-}
-
-// Process command line arguments.
-const { hasSwitch } = process._linkedBinding('electron_common_command_line');
-
-// Similar to nodes --expose-internals flag, this exposes _linkedBinding so
-// that tests can call it to get access to some test only bindings
-if (hasSwitch('unsafely-expose-electron-internals-for-testing')) {
-  preloadProcess._linkedBinding = process._linkedBinding;
-}
+Object.assign(preloadProcess, binding.process);
+Object.assign(preloadProcess, processProps);
 
 // Common renderer initialization
 require('@electron/internal/renderer/common-init');
 
-// Wrap the script into a function executed in global scope. It won't have
-// access to the current scope, so we'll expose a few objects as arguments:
-//
-// - `require`: The `preloadRequire` function
-// - `process`: The `preloadProcess` object
-// - `Buffer`: Shim of `Buffer` implementation
-// - `global`: The window object, which is aliased to `global` by webpack.
-function runPreloadScript (preloadSrc: string) {
-  const preloadWrapperSrc = `(function(require, process, Buffer, global, setImmediate, clearImmediate, exports, module) {
-  ${preloadSrc}
-  })`;
-
-  // eval in window scope
-  const preloadFn = binding.createPreloadScript(preloadWrapperSrc);
-  const exports = {};
-
-  preloadFn(preloadRequire, preloadProcess, Buffer, global, setImmediate, clearImmediate, exports, { exports });
-}
-
-for (const { preloadPath, preloadSrc, preloadError } of preloadScripts) {
-  try {
-    if (preloadSrc) {
-      runPreloadScript(preloadSrc);
-    } else if (preloadError) {
-      throw preloadError;
-    }
-  } catch (error) {
-    console.error(`Unable to load preload script: ${preloadPath}`);
-    console.error(error);
-
-    ipcRendererInternal.send(IPC_MESSAGES.BROWSER_PRELOAD_ERROR, preloadPath, error);
+executeSandboxedPreloadScripts({
+  loadedModules: loadedModules,
+  loadableModules: loadableModules,
+  process: preloadProcess,
+  createPreloadScript: binding.createPreloadScript,
+  exposeGlobals: {
+    Buffer: Buffer,
+    global: global,
+    setImmediate: setImmediate,
+    clearImmediate: clearImmediate
   }
-}
+}, preloadScripts);

lib/sandboxed_renderer/pre-init.ts

@@ -0,0 +1,30 @@
+// Pre-initialization code for sandboxed renderers.
+
+import * as events from 'events';
+
+declare const binding: {
+  get: (name: string) => any;
+  process: NodeJS.Process;
+};
+
+// Expose internal binding getter.
+process._linkedBinding = binding.get;
+
+const { EventEmitter } = events;
+const v8Util = process._linkedBinding('electron_common_v8_util');
+
+// Include properties from script 'binding' parameter.
+Object.assign(process, binding.process);
+
+// Expose Buffer shim as a hidden value. This is used by C++ code to
+// deserialize Buffer instances sent from browser process.
+v8Util.setHiddenValue(global, 'Buffer', Buffer);
+
+// The process object created by webpack is not an event emitter, fix it so
+// the API is more compatible with non-sandboxed renderers.
+for (const prop of Object.keys(EventEmitter.prototype) as (keyof typeof process)[]) {
+  if (Object.hasOwn(process, prop)) {
+    delete process[prop];
+  }
+}
+Object.setPrototypeOf(process, EventEmitter.prototype);

lib/sandboxed_renderer/preload.ts

@@ -0,0 +1,107 @@
+import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
+import type * as ipcRendererInternalModule from '@electron/internal/renderer/ipc-renderer-internal';
+
+import { EventEmitter } from 'events';
+
+// Delay loading for `process._linkedBinding` to be set.
+const getIpcRendererLazy = () => require('@electron/internal/renderer/ipc-renderer-internal') as typeof ipcRendererInternalModule;
+
+interface PreloadContext {
+  loadedModules: Map<string, any>;
+  loadableModules: Map<string, any>;
+
+  /** Process object to pass into preloads. */
+  process: NodeJS.Process;
+
+  createPreloadScript: (src: string) => Function
+
+  /** Globals to be exposed to preload context. */
+  exposeGlobals: any;
+}
+
+export function createPreloadProcessObject (): NodeJS.Process {
+  const preloadProcess: NodeJS.Process = new EventEmitter() as any;
+
+  preloadProcess.getProcessMemoryInfo = () => {
+    const { ipcRendererInternal } = getIpcRendererLazy();
+    return ipcRendererInternal.invoke<Electron.ProcessMemoryInfo>(IPC_MESSAGES.BROWSER_GET_PROCESS_MEMORY_INFO);
+  };
+
+  Object.defineProperty(preloadProcess, 'noDeprecation', {
+    get () {
+      return process.noDeprecation;
+    },
+    set (value) {
+      process.noDeprecation = value;
+    }
+  });
+
+  const { hasSwitch } = process._linkedBinding('electron_common_command_line');
+
+  // Similar to nodes --expose-internals flag, this exposes _linkedBinding so
+  // that tests can call it to get access to some test only bindings
+  if (hasSwitch('unsafely-expose-electron-internals-for-testing')) {
+    preloadProcess._linkedBinding = process._linkedBinding;
+  }
+
+  return preloadProcess;
+}
+
+// This is the `require` function that will be visible to the preload script
+function preloadRequire (context: PreloadContext, module: string) {
+  if (context.loadedModules.has(module)) {
+    return context.loadedModules.get(module);
+  }
+  if (context.loadableModules.has(module)) {
+    const loadedModule = context.loadableModules.get(module)!();
+    context.loadedModules.set(module, loadedModule);
+    return loadedModule;
+  }
+  throw new Error(`module not found: ${module}`);
+}
+
+// Wrap the script into a function executed in global scope. It won't have
+// access to the current scope, so we'll expose a few objects as arguments:
+//
+// - `require`: The `preloadRequire` function
+// - `process`: The `preloadProcess` object
+// - `Buffer`: Shim of `Buffer` implementation
+// - `global`: The window object, which is aliased to `global` by webpack.
+function runPreloadScript (context: PreloadContext, preloadSrc: string) {
+  const globalVariables = [];
+  const fnParameters = [];
+  for (const [key, value] of Object.entries(context.exposeGlobals)) {
+    globalVariables.push(key);
+    fnParameters.push(value);
+  }
+  const preloadWrapperSrc = `(function(require, process, exports, module, ${globalVariables.join(', ')}) {
+  ${preloadSrc}
+  })`;
+
+  // eval in window scope
+  const preloadFn = context.createPreloadScript(preloadWrapperSrc);
+  const exports = {};
+
+  preloadFn(preloadRequire.bind(null, context), context.process, exports, { exports }, ...fnParameters);
+}
+
+/**
+ * Execute preload scripts within a sandboxed process.
+ */
+export function executeSandboxedPreloadScripts (context: PreloadContext, preloadScripts: ElectronInternal.PreloadScript[]) {
+  for (const { filePath, contents, error } of preloadScripts) {
+    try {
+      if (contents) {
+        runPreloadScript(context, contents);
+      } else if (error) {
+        throw error;
+      }
+    } catch (error) {
+      console.error(`Unable to load preload script: ${filePath}`);
+      console.error(error);
+
+      const { ipcRendererInternal } = getIpcRendererLazy();
+      ipcRendererInternal.send(IPC_MESSAGES.BROWSER_PRELOAD_ERROR, filePath, error);
+    }
+  }
+}

patches/boringssl/revert_track_ssl_error_zero_return_explicitly.patch

@@ -20,10 +20,10 @@ index 7de8923518dbfb69fef62d7781f906b30cf62155..7a4310d6d8e85f07f0ae6c97726d909c
  
      case ssl_open_record_error:
 diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
-index 82870cda0593bdfa7434154bb7dfd5e1b00f6c4f..d3ad8a596b832af328d5e6bfeb5f36590574cc94 100644
+index d601695f51322f3ccecfd31b623eabf8440fceaa..0eb0e88c495d6934345e067298305041ee3d9a8b 100644
 --- a/ssl/ssl_lib.cc
 +++ b/ssl/ssl_lib.cc
-@@ -1319,7 +1319,7 @@ int SSL_get_error(const SSL *ssl, int ret_code) {
+@@ -1323,7 +1323,7 @@ int SSL_get_error(const SSL *ssl, int ret_code) {
    }
  
    if (ret_code == 0) {
@@ -32,7 +32,7 @@ index 82870cda0593bdfa7434154bb7dfd5e1b00f6c4f..d3ad8a596b832af328d5e6bfeb5f3659
        return SSL_ERROR_ZERO_RETURN;
      }
      // An EOF was observed which violates the protocol, and the underlying
-@@ -2686,13 +2686,7 @@ void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
+@@ -2690,13 +2690,7 @@ void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
    return CRYPTO_get_ex_data(&ctx->ex_data, idx);
  }
  

patches/chromium/.patches

@@ -136,3 +136,4 @@ fix_software_compositing_infinite_loop.patch
 refactor_unfilter_unresponsive_events.patch
 build_disable_thin_lto_mac.patch
 build_add_public_config_simdutf_config.patch
+reland_set_app_container_acls_reliably_on_out_directory.patch

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -23,7 +23,7 @@ index ad0092ef2e13853e4bb8b923481559a043b00ab7..1c2dfd23f18733e21312992877ae1499
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 1412679cc093a678f19c2f60a633d9650efc27bb..c5ea7eefbbd1a68a613971208d961940af77a3a0 100644
+index 4bf834dc836e4238a98c5f9db216b0054ed7add1..fd2505d9e0608b1c2258e6596b1817835c37b36e 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
 @@ -4793,6 +4793,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -116,7 +116,7 @@ index 083af135d890c2837e72c314e170e81931bd2a20..5245ea88441ef84c15b8052a9011ce70
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 27fd589b2ea53ba9c65ca87c9ca0eb4362d0c735..ff69256c5ac5323ce1b94533af4dec785bca78bd 100644
+index c1aebbc3db3e22e7e9391cb0eb2654a28a2052f4..77f2b8a03f92062fc9c07b04adb22d421127b73a 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
 @@ -2468,6 +2468,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
@@ -155,7 +155,7 @@ index 27fd589b2ea53ba9c65ca87c9ca0eb4362d0c735..ff69256c5ac5323ce1b94533af4dec78
    // Do not throttle if the page should be painting.
    bool is_visible =
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index c6059d2d02e295e8b4547a6fdaccf9381c7a77c2..738d51aa13e3a2cf2656a1bc613eda75c7ff1fca 100644
+index 4f77ef1379390973fa912640a33a5033dc8db68f..12d4932d82df824e459a8a90b6f24222172618df 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
 @@ -448,6 +448,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,

patches/chromium/blink_local_frame.patch

@@ -49,7 +49,7 @@ index 7e564e9970ef5abf51a212130a8cfb3ec590c5ff..af48a64ae405ffe7d89c8bc074f614ef
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 7050a0229f064b3ec116ddd9d801655b025ab911..18bd846599b09ce040de377b6ff5e80b249928e8 100644
+index 0b2043673b01c7b47d85895e6133d1b73d941cad..91d67a69cddcb7ae4425b893f625e40975e665cc 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
 @@ -746,10 +746,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -33,10 +33,10 @@ index 3ea31014540b5679880a00e1a3ae8674b8858348..d8b18d03446b6aecad22ab778f6b512c
            "//base",
            "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index b25189748cf13c05bfcffd1063a651de5334bf88..557ff484615283fb6a9e76e495501e58671a9cf5 100644
+index 0e22dc99e59133363b5d56dc6fba9f603a6d9c67..59162df964cf90225010591a722ed8bd0e8269c6 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4512,7 +4512,7 @@ static_library("browser") {
+@@ -4516,7 +4516,7 @@ static_library("browser") {
        ]
      }
  
@@ -46,10 +46,10 @@ index b25189748cf13c05bfcffd1063a651de5334bf88..557ff484615283fb6a9e76e495501e58
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 664601c3d14489d7b26090bba3c80d0b82e0372e..9299397d15a0af9c57a48d7dcf730d6b5851e8e0 100644
+index 50bbabb107314333070aabaf78ca79e5f8fa801f..4e2255f209d6523359cb626f361742e70285b2ae 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -6888,9 +6888,12 @@ test("unit_tests") {
+@@ -6887,9 +6887,12 @@ test("unit_tests") {
        "//chrome/notification_helper",
      ]
  
@@ -63,7 +63,7 @@ index 664601c3d14489d7b26090bba3c80d0b82e0372e..9299397d15a0af9c57a48d7dcf730d6b
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -7828,6 +7831,10 @@ test("unit_tests") {
+@@ -7823,6 +7826,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -74,7 +74,7 @@ index 664601c3d14489d7b26090bba3c80d0b82e0372e..9299397d15a0af9c57a48d7dcf730d6b
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -7880,7 +7887,6 @@ test("unit_tests") {
+@@ -7875,7 +7882,6 @@ test("unit_tests") {
      # Non-android deps for "unit_tests" target.
      deps += [
        "../browser/screen_ai:screen_ai_install_state",

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 2bbcfef90f53cc92e248eee2e3fa1cd9f479b5ee..cef9a8b5029ca357b9447f764864c6b77af538f0 100644
+index 62105d810472187a8ddb71e57873d5084e7921a7..7b91ba71aadbf44ba76dd38ea2ca69ef16e48dc8 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -9157,6 +9157,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -9137,6 +9137,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,7 +21,7 @@ index 2bbcfef90f53cc92e248eee2e3fa1cd9f479b5ee..cef9a8b5029ca357b9447f764864c6b7
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 4fe69ec3fa5507285dfd91619d65ca712383f4d2..e5e9771863573c0826111a724a1c38566ed3655e 100644
+index c87953ecbdbc1226134ae51bcb8acf3e627b6ca9..b056a3dad69316b919c058458ee9de3ad4a88147 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -4923,6 +4923,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
@@ -66,10 +66,10 @@ index 8e571dc1371cf2aa7c8354f0b4e492e0d030b485..c878169e7838849cbc23df2ed94ca65d
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index a2ceb54e4f39c1a28890f2b3593fe47608623910..b3d70e0201caa266a8e692d501e3977e39e2fb16 100644
+index ff59226e8f953cd7cc5e9c95250187836d64764b..5338c3a292ff3c34ab33a64341b17d0c9948f7e7 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -789,6 +789,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -794,6 +794,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -79,10 +79,10 @@ index a2ceb54e4f39c1a28890f2b3593fe47608623910..b3d70e0201caa266a8e692d501e3977e
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 715e05418b01cbed51248cec77901b885ab3df7d..9b0f873353c957842f42284250a21a635b11f3cc 100644
+index 800f3314ecbdb8fe9d5ef8320ef952a3bcdf05d1..f2f7571b76542bd4c0d44750639e36b191cd5bd7 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
-@@ -200,6 +200,7 @@ class NetworkService;
+@@ -202,6 +202,7 @@ class NetworkService;
  class TrustedURLLoaderHeaderClient;
  }  // namespace mojom
  struct ResourceRequest;
@@ -90,7 +90,7 @@ index 715e05418b01cbed51248cec77901b885ab3df7d..9b0f873353c957842f42284250a21a63
  }  // namespace network
  
  namespace sandbox {
-@@ -1354,6 +1355,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1356,6 +1357,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -148,10 +148,10 @@ index c0be779a4c1d89426c30261aff72ea55be900087..7413c1bef86f5e4633db7220c5de4de7
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index c9d6e7acd432682381a1131e05a3758589967f69..1412679cc093a678f19c2f60a633d9650efc27bb 100644
+index 5c4be625e42065c99e327ee6b60ee241eff75ac0..4bf834dc836e4238a98c5f9db216b0054ed7add1 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -6846,6 +6846,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
+@@ -6862,6 +6862,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
            request.HasUserGesture(), GetWebFrame()->IsAdFrame(),
            GetWebFrame()->IsAdScriptInStack());
  

patches/chromium/chore_partial_revert_of.patch

@@ -14,7 +14,7 @@ track down the source of this problem & figure out if we can fix it
 by changing something in Electron.
 
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 242054584563ad8d6a6117556998dc8b43cac1dd..7f42a4609ce1d1da017591f4f10eb1685e7ea67b 100644
+index e878d103eb79cbb67878e7c6da369d355b45ac40..e49fd4b3278b4a25af30ecc522794847440d4c50 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -4849,9 +4849,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(

patches/chromium/chore_provide_iswebcontentscreationoverridden_with_full_params.patch

@@ -218,7 +218,7 @@ index c6838c83ef971b88769b1f3fba8095025ae25464..2da6a4e08340e72ba7de5d03444c2f17
    content::WebContents* AddNewContents(
        content::WebContents* source,
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 70cb6b43f214c7f5210e99edc930428520f02b7c..9b9edea9eb076f29dd8349ee784e9b2c1ab5a71c 100644
+index 0b70b695a4d3990842f9c5909ef485b540d9be58..f0d92a18c0cdefd437086695e122c81ca9293ce5 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -4818,8 +4818,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(

patches/chromium/disable_hidden.patch

@@ -6,10 +6,10 @@ Subject: disable_hidden.patch
 Electron uses this to disable background throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index b1493e3a01b821fa4b9d803b24678728855df559..3191fc7cf201b59abfcf87cd796752423f9a3c00 100644
+index 74f2e51c7fa802e7afb30f4de8489efd7f081709..9af5efcacb38453d3f92a3c2d9a42ad8817ef6d5 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -789,6 +789,10 @@ void RenderWidgetHostImpl::WasHidden() {
+@@ -793,6 +793,10 @@ void RenderWidgetHostImpl::WasHidden() {
      return;
    }
  
@@ -21,10 +21,10 @@ index b1493e3a01b821fa4b9d803b24678728855df559..3191fc7cf201b59abfcf87cd79675242
    // Prompts should remain open and functional across tab switches.
    if (!delegate_->IsWaitingForPointerLockPrompt(this)) {
 diff --git a/content/browser/renderer_host/render_widget_host_impl.h b/content/browser/renderer_host/render_widget_host_impl.h
-index 882f245e04a3a45aaff54eac149eded07a892500..9388eb5a06b72cbd77f28c4212cbaf3c0e017e1f 100644
+index ddfae2b85cb8823eeba88050d5378bfbbe133ab3..fa0a2cfe2cfeceab692bfe9d94d80192115dd8f8 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.h
 +++ b/content/browser/renderer_host/render_widget_host_impl.h
-@@ -1023,6 +1023,9 @@ class CONTENT_EXPORT RenderWidgetHostImpl
+@@ -1024,6 +1024,9 @@ class CONTENT_EXPORT RenderWidgetHostImpl
    // Requests a commit and forced redraw in the renderer compositor.
    void ForceRedrawForTesting();
  

patches/chromium/disable_unload_metrics.patch

@@ -24,10 +24,10 @@ This patch temporarily disables the metrics so we can have green CI, and we
 should continue seeking for a real fix.
 
 diff --git a/content/browser/renderer_host/navigator.cc b/content/browser/renderer_host/navigator.cc
-index a0b2b43187e02321632a36fe9b388d903789603f..22962fe80da0550b2458289df3ad3eedb28e5709 100644
+index 1dc14ea5d899cc17756911820ede80a4fa22df1d..f6160979def6f553e0e601e14830c498f05e52b1 100644
 --- a/content/browser/renderer_host/navigator.cc
 +++ b/content/browser/renderer_host/navigator.cc
-@@ -1433,6 +1433,7 @@ void Navigator::RecordNavigationMetrics(
+@@ -1448,6 +1448,7 @@ void Navigator::RecordNavigationMetrics(
              .InMilliseconds());
    }
  
@@ -35,7 +35,7 @@ index a0b2b43187e02321632a36fe9b388d903789603f..22962fe80da0550b2458289df3ad3eed
    // If this is a same-process navigation and we have timestamps for unload
    // durations, fill those metrics out as well.
    if (params.unload_start && params.unload_end &&
-@@ -1482,6 +1483,7 @@ void Navigator::RecordNavigationMetrics(
+@@ -1497,6 +1498,7 @@ void Navigator::RecordNavigationMetrics(
           first_before_unload_start_time)
              .InMilliseconds());
    }

patches/chromium/extend_apply_webpreferences.patch

@@ -12,7 +12,7 @@ Ideally we could add an embedder observer pattern here but that can be
 done in future work.
 
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index ff69256c5ac5323ce1b94533af4dec785bca78bd..3b2e9a5946d7c4407d453ee8012291885592f6e9 100644
+index 77f2b8a03f92062fc9c07b04adb22d421127b73a..ed07b4cee033ced8eee6aca4472cd1e2599e1956 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
 @@ -169,6 +169,7 @@

patches/chromium/feat_configure_launch_options_for_service_process.patch

@@ -706,10 +706,10 @@ index b67f4f87d588386409a90cd49e8338272c6e0d51..c34a80ec8db1b868a7f387ea4a11d71d
  #if BUILDFLAG(IS_MAC)
    // Whether or not to disclaim TCC responsibility for the process, defaults to
 diff --git a/sandbox/policy/win/sandbox_win.cc b/sandbox/policy/win/sandbox_win.cc
-index 875cade81e6c0c33af043cea6ad0b93fd0e90cdb..20081605a724b52e89a03858b6b6e290c6ab34a1 100644
+index 617103850407d1affa2649a79f92aa26213f5496..8a029328e972262045f4069fb2edb67e20867d71 100644
 --- a/sandbox/policy/win/sandbox_win.cc
 +++ b/sandbox/policy/win/sandbox_win.cc
-@@ -608,11 +608,9 @@ base::win::ScopedHandle CreateUnsandboxedJob() {
+@@ -594,11 +594,9 @@ base::win::ScopedHandle CreateUnsandboxedJob() {
  // command line flag.
  ResultCode LaunchWithoutSandbox(
      const base::CommandLine& cmd_line,
@@ -722,7 +722,7 @@ index 875cade81e6c0c33af043cea6ad0b93fd0e90cdb..20081605a724b52e89a03858b6b6e290
    // Network process runs in a job even when unsandboxed. This is to ensure it
    // does not outlive the browser, which could happen if there is a lot of I/O
    // on process shutdown, in which case TerminateProcess can fail. See
-@@ -907,7 +905,7 @@ bool SandboxWin::InitTargetServices(TargetServices* target_services) {
+@@ -890,7 +888,7 @@ bool SandboxWin::InitTargetServices(TargetServices* target_services) {
  // static
  ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
      const base::CommandLine& cmd_line,
@@ -731,7 +731,7 @@ index 875cade81e6c0c33af043cea6ad0b93fd0e90cdb..20081605a724b52e89a03858b6b6e290
      SandboxDelegate* delegate,
      TargetPolicy* policy) {
    const base::CommandLine& launcher_process_command_line =
-@@ -921,7 +919,7 @@ ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
+@@ -904,7 +902,7 @@ ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
    }
  
    // Add any handles to be inherited to the policy.
@@ -740,7 +740,7 @@ index 875cade81e6c0c33af043cea6ad0b93fd0e90cdb..20081605a724b52e89a03858b6b6e290
      policy->AddHandleToShare(handle);
  
    if (!policy->GetConfig()->IsConfigured()) {
-@@ -936,6 +934,13 @@ ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
+@@ -919,6 +917,13 @@ ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
    // have no effect. These calls can fail with SBOX_ERROR_BAD_PARAMS.
    policy->SetStdoutHandle(GetStdHandle(STD_OUTPUT_HANDLE));
    policy->SetStderrHandle(GetStdHandle(STD_ERROR_HANDLE));
@@ -754,7 +754,7 @@ index 875cade81e6c0c33af043cea6ad0b93fd0e90cdb..20081605a724b52e89a03858b6b6e290
  #endif
  
    if (!delegate->PreSpawnTarget(policy))
-@@ -947,7 +952,7 @@ ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
+@@ -930,7 +935,7 @@ ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
  // static
  ResultCode SandboxWin::StartSandboxedProcess(
      const base::CommandLine& cmd_line,
@@ -763,7 +763,7 @@ index 875cade81e6c0c33af043cea6ad0b93fd0e90cdb..20081605a724b52e89a03858b6b6e290
      SandboxDelegate* delegate,
      StartSandboxedProcessCallback result_callback) {
    SandboxLaunchTimer timer;
-@@ -957,7 +962,7 @@ ResultCode SandboxWin::StartSandboxedProcess(
+@@ -940,7 +945,7 @@ ResultCode SandboxWin::StartSandboxedProcess(
                             *base::CommandLine::ForCurrentProcess())) {
      base::Process process;
      ResultCode result =
@@ -772,7 +772,7 @@ index 875cade81e6c0c33af043cea6ad0b93fd0e90cdb..20081605a724b52e89a03858b6b6e290
      DWORD last_error = GetLastError();
      std::move(result_callback).Run(std::move(process), last_error, result);
      return SBOX_ALL_OK;
-@@ -967,7 +972,7 @@ ResultCode SandboxWin::StartSandboxedProcess(
+@@ -950,7 +955,7 @@ ResultCode SandboxWin::StartSandboxedProcess(
    timer.OnPolicyCreated();
  
    ResultCode result = GeneratePolicyForSandboxedProcess(

patches/chromium/feat_enable_offscreen_rendering_with_viz_compositor.patch

@@ -521,10 +521,10 @@ index 796ae2688436eb07f19909641d1620dd02f10cdb..c9e0eee0b329caf46669b419b1cd10cf
    waiting_on_draw_ack_ = true;
  
 diff --git a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
-index 5e127e0652230081b60205691117c71ab56440d5..0b0449e21987e3d90b15b232eb1d26b45c4debfa 100644
+index 977161762c67e126e182c24c5e8e7a3e7523dacb..1773488b3b5fce5e1c99f484988620edd8da9034 100644
 --- a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
 +++ b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
-@@ -101,7 +101,8 @@ RootCompositorFrameSinkImpl::Create(
+@@ -111,7 +111,8 @@ RootCompositorFrameSinkImpl::Create(
        params->gpu_compositing, params->widget);
    auto output_surface = output_surface_provider->CreateOutputSurface(
        params->widget, params->gpu_compositing, display_client.get(),

patches/chromium/feat_expose_documentloader_setdefersloading_on_webdocumentloader.patch

@@ -28,10 +28,10 @@ index 23b29fe25bc463ff1d36aa502a27c4222595e7c5..c1ac6172c4cee72f64f42ca64d2db9c0
  
    // Returns the http referrer of original request which initited this load.
 diff --git a/third_party/blink/renderer/core/loader/document_loader.h b/third_party/blink/renderer/core/loader/document_loader.h
-index abe9239b5863c0cac7623d121580de1f61e83232..3cd9fe38ca4017064d2e17a7d083a8bebbfab34c 100644
+index 92ab7845b6e3f060de76fa023ec472c056e69d4b..aafd123ccd8faf630dffa304ec7825088155a15b 100644
 --- a/third_party/blink/renderer/core/loader/document_loader.h
 +++ b/third_party/blink/renderer/core/loader/document_loader.h
-@@ -325,7 +325,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
+@@ -326,7 +326,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
        std::optional<scheduler::TaskAttributionId>
            soft_navigation_heuristics_task_id);
  

patches/chromium/feat_expose_raw_response_headers_from_urlloader.patch

@@ -112,10 +112,10 @@ index 5c4b8a05034f8defacbc13671fe9bc92f76ade5a..e7390e01f113755613f42d592b36108b
    string mime_type;
  
 diff --git a/services/network/url_loader.cc b/services/network/url_loader.cc
-index c0be8ab2e57fbaf87e2761a290ec4179606d4aa9..e8ac75b21deb02c9b96aec8dda77d715394fcca8 100644
+index e73516e9f8716d2865ae6606a26fdd47f2aba00d..c6fa2051124fd3d11ab04fe5f2c35033fcf09f56 100644
 --- a/services/network/url_loader.cc
 +++ b/services/network/url_loader.cc
-@@ -613,6 +613,9 @@ URLLoader::URLLoader(
+@@ -634,6 +634,9 @@ URLLoader::URLLoader(
            mojo::SimpleWatcher::ArmingPolicy::MANUAL,
            base::SequencedTaskRunner::GetCurrentDefault()),
        per_factory_orb_state_(context.GetMutableOrbState()),
@@ -125,7 +125,7 @@ index c0be8ab2e57fbaf87e2761a290ec4179606d4aa9..e8ac75b21deb02c9b96aec8dda77d715
        devtools_request_id_(request.devtools_request_id),
        request_mode_(request.mode),
        request_credentials_mode_(request.credentials_mode),
-@@ -892,7 +895,7 @@ void URLLoader::ConfigureRequest(
+@@ -913,7 +916,7 @@ void URLLoader::ConfigureRequest(
          &URLLoader::IsSharedDictionaryReadAllowed, base::Unretained(this)));
    }
  
@@ -134,7 +134,7 @@ index c0be8ab2e57fbaf87e2761a290ec4179606d4aa9..e8ac75b21deb02c9b96aec8dda77d715
      url_request_->SetResponseHeadersCallback(base::BindRepeating(
          &URLLoader::SetRawResponseHeaders, base::Unretained(this)));
    }
-@@ -1887,6 +1890,19 @@ void URLLoader::OnResponseStarted(net::URLRequest* url_request, int net_error) {
+@@ -1923,6 +1926,19 @@ void URLLoader::OnResponseStarted(net::URLRequest* url_request, int net_error) {
    }
  
    response_ = BuildResponseHead();

patches/chromium/fix_adapt_exclusive_access_for_electron_needs.patch

@@ -16,7 +16,7 @@ Linux or Windows to un-fullscreen in some circumstances without this
 change.
 
 diff --git a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
-index e9c7ab23a1e9c3eda0f4fb94bf3ef44de7de7ad3..21367db92b195c3883729c3f599694295928f03f 100644
+index 9e6611a53f8430f86ba4e6439e9a21446ce3332e..7d85ea70870c5064f6c0a6abd3ef091a0da75dd0 100644
 --- a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
 +++ b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
 @@ -20,12 +20,16 @@
@@ -77,7 +77,7 @@ index e9c7ab23a1e9c3eda0f4fb94bf3ef44de7de7ad3..21367db92b195c3883729c3f59969429
  }
  
  void FullscreenController::RunOrDeferUntilTransitionIsComplete(
-@@ -585,18 +595,17 @@ void FullscreenController::EnterFullscreenModeInternal(
+@@ -590,18 +600,17 @@ void FullscreenController::EnterFullscreenModeInternal(
    // Do not enter fullscreen mode if disallowed by pref. This prevents the user
    // from manually entering fullscreen mode and also disables kiosk mode on
    // desktop platforms.
@@ -101,7 +101,7 @@ index e9c7ab23a1e9c3eda0f4fb94bf3ef44de7de7ad3..21367db92b195c3883729c3f59969429
    if (option == TAB) {
      url = GetRequestingOrigin();
      tab_fullscreen_ = true;
-@@ -629,6 +638,7 @@ void FullscreenController::EnterFullscreenModeInternal(
+@@ -634,6 +643,7 @@ void FullscreenController::EnterFullscreenModeInternal(
      if (!extension_caused_fullscreen_.is_empty())
        url = extension_caused_fullscreen_;
    }
@@ -109,7 +109,7 @@ index e9c7ab23a1e9c3eda0f4fb94bf3ef44de7de7ad3..21367db92b195c3883729c3f59969429
  
    fullscreen_start_time_ = base::TimeTicks::Now();
    if (option == BROWSER)
-@@ -649,6 +659,7 @@ void FullscreenController::ExitFullscreenModeInternal() {
+@@ -654,6 +664,7 @@ void FullscreenController::ExitFullscreenModeInternal() {
      return;
    }
  
@@ -117,7 +117,7 @@ index e9c7ab23a1e9c3eda0f4fb94bf3ef44de7de7ad3..21367db92b195c3883729c3f59969429
    // `fullscreen_start_time_` is null if a fullscreen tab moves to a new window.
    if (fullscreen_start_time_ && exclusive_access_tab()) {
      ukm::SourceId source_id =
-@@ -660,15 +671,16 @@ void FullscreenController::ExitFullscreenModeInternal() {
+@@ -665,15 +676,16 @@ void FullscreenController::ExitFullscreenModeInternal() {
          .Record(ukm::UkmRecorder::Get());
      fullscreen_start_time_.reset();
    }
@@ -137,7 +137,7 @@ index e9c7ab23a1e9c3eda0f4fb94bf3ef44de7de7ad3..21367db92b195c3883729c3f59969429
    exclusive_access_manager()->context()->ExitFullscreen();
    extension_caused_fullscreen_ = GURL();
    exclusive_access_manager()->UpdateBubble(base::NullCallback());
-@@ -730,8 +742,12 @@ GURL FullscreenController::GetEmbeddingOrigin() const {
+@@ -735,8 +747,12 @@ GURL FullscreenController::GetEmbeddingOrigin() const {
  void FullscreenController::RecordMetricsOnFullscreenApiRequested(
      content::RenderFrameHost* requesting_frame) {
    history::HistoryService* service =

patches/chromium/fix_crash_loading_non-standard_schemes_in_iframes.patch

@@ -9,7 +9,7 @@ ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin contains explicit
 exceptions to allow built-in non-standard schemes, but does not check
 for non-standard schemes registered by the embedder.
 
-This patch adjusts the origin calculation for non-standard schemes in
+This patch adjusts the origin calculation for subframe non-standard schemes in
  - browser process at `NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo`
  - render process at `DocumentLoader::CalculateOrigin`
 
@@ -18,19 +18,24 @@ as `null` without any derivation. It is only in cases where there is a `initiato
 then the origin is derived from it, which is usually the case for renderer initiated
 navigations and iframes are no exceptions from this rule.
 
+The patch should be removed in favor of either:
+  - Remove support for non-standard custom schemes
+  - Register non-standard custom schemes as websafe schemes and update
+  CPSPI::CanAccessDataForOrigin to allow them for any navigation.
+  - Update the callsite to use RFHI::CanCommitOriginAndUrl in upstream, previous
+  effort to do this can be found at https://chromium-review.googlesource.com/c/chromium/src/+/3856266.
+
 Upstream bug https://bugs.chromium.org/p/chromium/issues/detail?id=1081397.
 
-Upstreamed at https://chromium-review.googlesource.com/c/chromium/src/+/3856266.
-
 diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
-index 8153ca434b396423ee36af27e8600be43e095c0f..8c1c72d7f3d4abef48bd0d3e632f427dec3ed88d 100644
+index e919dcd7acf870e39709d7ac5afd356a8a2b94fa..ceed8afc60dd3d38ca722b79b93c6b1c1ee7fb76 100644
 --- a/content/browser/renderer_host/navigation_request.cc
 +++ b/content/browser/renderer_host/navigation_request.cc
-@@ -10830,6 +10830,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo() {
+@@ -10867,6 +10867,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo() {
          "blob");
    }
  
-+  if (!common_params().url.IsStandard()) {
++  if (!IsInMainFrame() && !common_params().url.IsStandard()) {
 +    return std::make_pair(url::Origin::Resolve(common_params().url,
 +                                               url::Origin()),
 +                          "url_non_standard");
@@ -40,10 +45,10 @@ index 8153ca434b396423ee36af27e8600be43e095c0f..8c1c72d7f3d4abef48bd0d3e632f427d
    // origin of |common_params.url| and/or |common_params.initiator_origin|.
    url::Origin resolved_origin = url::Origin::Resolve(
 diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
-index fb11dcea26684440b7b08fe5ca4da619ac4ccb5c..bd3591e3d6f1ee66c31897cdfd1994510a8ebe52 100644
+index ccc8243d90000c8da65486a00c4800ede3de66fe..8355f72ec1e2d3a50c21761e764ad6c0233a3b81 100644
 --- a/third_party/blink/renderer/core/loader/document_loader.cc
 +++ b/third_party/blink/renderer/core/loader/document_loader.cc
-@@ -2308,6 +2308,10 @@ Frame* DocumentLoader::CalculateOwnerFrame() {
+@@ -2309,6 +2309,10 @@ Frame* DocumentLoader::CalculateOwnerFrame() {
  scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
      Document* owner_document) {
    scoped_refptr<SecurityOrigin> origin;
@@ -54,7 +59,7 @@ index fb11dcea26684440b7b08fe5ca4da619ac4ccb5c..bd3591e3d6f1ee66c31897cdfd199451
    StringBuilder debug_info_builder;
    // Whether the origin is newly created within this call, instead of copied
    // from an existing document's origin or from `origin_to_commit_`. If this is
-@@ -2361,6 +2365,10 @@ scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
+@@ -2362,6 +2366,10 @@ scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
      // the end of this function.
      origin = origin_to_commit_;
      debug_info_builder.Append("use_origin_to_commit");

patches/chromium/fix_on-screen-keyboard_hides_on_input_blur_in_webview.patch

@@ -87,10 +87,10 @@ index 51522e60d6dc14f1113cc438558b6b393c3fe73a..153ed02f493a83ef9ca354cc18736f93
    // The view with active text input state, i.e., a focused <input> element.
    // It will be nullptr if no such view exists. Note that the active view
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 3b2cb5075d3596b0fd71e898aeeac3b9ef3d1e65..242054584563ad8d6a6117556998dc8b43cac1dd 100644
+index 750a5c74404d7d96e65fce1d91d1e38d8621c1f2..e878d103eb79cbb67878e7c6da369d355b45ac40 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -9508,7 +9508,7 @@ void WebContentsImpl::OnFocusedElementChangedInFrame(
+@@ -9501,7 +9501,7 @@ void WebContentsImpl::OnFocusedElementChangedInFrame(
                          "WebContentsImpl::OnFocusedElementChangedInFrame",
                          "render_frame_host", frame);
    RenderWidgetHostViewBase* root_view =

patches/chromium/fix_restore_original_resize_performance_on_macos.patch

@@ -11,10 +11,10 @@ This patch should be upstreamed as a conditional revert of the logic in desktop
 vs mobile runtimes.  i.e. restore the old logic only on desktop platforms
 
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 4d89c3bf11f453f72489bb9b2531b51493792dce..6a1b01713fc94f47695e9e1a2874ced08bdfef0b 100644
+index c877e1aff3216aaf881e35e704745be442c5ca69..9ac652e9b232fe2b2122da5db113bf67274c959b 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -2048,9 +2048,8 @@ RenderWidgetHostImpl::GetWidgetInputHandler() {
+@@ -2052,9 +2052,8 @@ RenderWidgetHostImpl::GetWidgetInputHandler() {
  void RenderWidgetHostImpl::NotifyScreenInfoChanged() {
    // The resize message (which may not happen immediately) will carry with it
    // the screen info as well as the new size (if the screen has changed scale

patches/chromium/fix_return_v8_value_from_localframe_requestexecutescript.patch

@@ -64,10 +64,10 @@ index cba373664bec3a32abad6fe0396bd67b53b7e67f..7a985067b1371604644d48159f2f5aa7
  
  #endif  // THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_SCRIPT_EXECUTION_CALLBACK_H_
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 18bd846599b09ce040de377b6ff5e80b249928e8..db003ba0be169e9db06e89c5166724343770305f 100644
+index 91d67a69cddcb7ae4425b893f625e40975e665cc..712f72bddbd7bae782b468659bc7e2b022f04281 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -3133,6 +3133,7 @@ void LocalFrame::RequestExecuteScript(
+@@ -3134,6 +3134,7 @@ void LocalFrame::RequestExecuteScript(
      mojom::blink::EvaluationTiming evaluation_timing,
      mojom::blink::LoadEventBlockingOption blocking_option,
      WebScriptExecutionCallback callback,
@@ -75,7 +75,7 @@ index 18bd846599b09ce040de377b6ff5e80b249928e8..db003ba0be169e9db06e89c516672434
      BackForwardCacheAware back_forward_cache_aware,
      mojom::blink::WantResultOption want_result_option,
      mojom::blink::PromiseResultOption promise_behavior) {
-@@ -3165,7 +3166,7 @@ void LocalFrame::RequestExecuteScript(
+@@ -3166,7 +3167,7 @@ void LocalFrame::RequestExecuteScript(
    PausableScriptExecutor::CreateAndRun(
        script_state, std::move(script_sources), execute_script_policy,
        user_gesture, evaluation_timing, blocking_option, want_result_option,

patches/chromium/frame_host_manager.patch

@@ -20,10 +20,10 @@ index a0da3098c6391a9b07f40275cb09fb351fde9f7f..d5846a800b9a9097a6fa7cd097646ef3
  }
  
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 9b0f873353c957842f42284250a21a635b11f3cc..2f469dc53342d2ad7ec57fd33b4c70854c820c73 100644
+index f2f7571b76542bd4c0d44750639e36b191cd5bd7..44309e7bad6a23a3ceb28e3acf974edcf1b1a51d 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
-@@ -341,6 +341,11 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -343,6 +343,11 @@ class CONTENT_EXPORT ContentBrowserClient {
  
    virtual ~ContentBrowserClient() = default;
  

patches/chromium/introduce_ozoneplatform_electron_can_call_x11_property.patch

@@ -9,10 +9,10 @@ at rutime. It would be best if eventually all usages of this property were
 replaced with clean ozone native implementations.
 
 diff --git a/ui/ozone/platform/x11/ozone_platform_x11.cc b/ui/ozone/platform/x11/ozone_platform_x11.cc
-index bc8ac7431f25d1fd6f026f8049d589cba01fa6fd..1bb0c95acf2df61975b1cc6423eb8514bb3488e4 100644
+index ec79b3c8e3e434987f2f08d95c8567982a0c4368..d5e5f81b8c6ccae1822e8192b107eeff2d3a6dd9 100644
 --- a/ui/ozone/platform/x11/ozone_platform_x11.cc
 +++ b/ui/ozone/platform/x11/ozone_platform_x11.cc
-@@ -192,6 +192,7 @@ class OzonePlatformX11 : public OzonePlatform,
+@@ -193,6 +193,7 @@ class OzonePlatformX11 : public OzonePlatform,
            base::MessagePumpType::UI;
        properties->supports_vulkan_swap_chain = true;
        properties->skia_can_fall_back_to_x11 = true;

patches/chromium/mas_avoid_private_macos_api_usage.patch.patch

@@ -35,7 +35,7 @@ system font by checking if it's kCTFontPriorityAttribute is set to
 system priority.
 
 diff --git a/base/BUILD.gn b/base/BUILD.gn
-index 4d2d2e88d37e95a2b8ac0c1e0d7d1b0c1e8ad417..58a4b86746a345eeeca66969aec39791fb2d1a8c 100644
+index 123b5d982c3bca4ebd22b5e0e17b9d903969d7e1..0cacd08e17f8ab8c0e4951bcc4645cd7a3d2fea8 100644
 --- a/base/BUILD.gn
 +++ b/base/BUILD.gn
 @@ -1027,6 +1027,7 @@ component("base") {
@@ -560,10 +560,10 @@ index faddee802d6538c092ba96914184663ee57751c8..49238975848d58cd30727ec818bbac52
    return kAttributes;
  }
 diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
-index 00ac46d858b7f83e53b1817028baba13719f04fe..31c9a53d5c7f09a7326ef57753b4a49f0239a7f8 100644
+index f22893989f09e40a8eb6a3df1d48d5438426c727..1212cd37acff7847ec4a7d3fb841426d5a77576d 100644
 --- a/content/browser/BUILD.gn
 +++ b/content/browser/BUILD.gn
-@@ -327,6 +327,7 @@ source_set("browser") {
+@@ -328,6 +328,7 @@ source_set("browser") {
      "//ui/strings:ax_strings",
      "//ui/touch_selection",
      "//v8:v8_version",
@@ -773,7 +773,7 @@ index a1068589ad844518038ee7bc15a3de9bc5cba525..1ff781c49f086ec8015c7d3c44567dbe
  
  }  // namespace content
 diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
-index 4f0153bf27764fce04a56d2bce8f8e7a012d78f5..17955a2806d741905bc9507ea6d39fd012162d12 100644
+index 817e8ecdc6b15177d4cfa5cf44ad5fb1a5346393..106977501728d3216ec6f0a47005bc86c156f605 100644
 --- a/content/test/BUILD.gn
 +++ b/content/test/BUILD.gn
 @@ -643,6 +643,7 @@ static_library("test_support") {
@@ -800,7 +800,7 @@ index 4f0153bf27764fce04a56d2bce8f8e7a012d78f5..17955a2806d741905bc9507ea6d39fd0
    ]
  
    if (!(is_chromeos_ash && target_cpu == "arm64" && current_cpu == "arm")) {
-@@ -3244,6 +3247,7 @@ test("content_unittests") {
+@@ -3245,6 +3248,7 @@ test("content_unittests") {
      "//ui/latency:test_support",
      "//ui/shell_dialogs:shell_dialogs",
      "//ui/webui:test_support",
@@ -1373,7 +1373,7 @@ index eb81a70e4d5d5cd3e6ae9b45f8cd1c795ea76c51..9921ccb10d3455600eddd85f77f10228
  
  }  // namespace sandbox
 diff --git a/third_party/blink/renderer/core/BUILD.gn b/third_party/blink/renderer/core/BUILD.gn
-index 679005c0d241207646a7aabad5ce896bc5c56558..39547524d6e77954c949d4ac05bec1f9596162fd 100644
+index 407169fd5aab525cb249890d49a23ac301ab61d8..19ca594bf376344bcf27a17dab276271379a30e5 100644
 --- a/third_party/blink/renderer/core/BUILD.gn
 +++ b/third_party/blink/renderer/core/BUILD.gn
 @@ -409,6 +409,7 @@ component("core") {

patches/chromium/notification_provenance.patch

@@ -133,10 +133,10 @@ index 05d3a12dd84c7005d46cc73b312f97ef418d96f5..4765de982802541b3efc7211d106acc7
        const GURL& document_url,
        const WeakDocumentPtr& weak_document_ptr,
 diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
-index 93fb45230ddedddf68bb879ab8dbddce2740ed22..302c4cbed8b158257b7dfde14f591ad6bc971641 100644
+index fa95a56e761c7c0a1bf400392579e1c3f01d48d1..167462f298cafe0400d8326881c61e95ad1769d5 100644
 --- a/content/browser/renderer_host/render_process_host_impl.cc
 +++ b/content/browser/renderer_host/render_process_host_impl.cc
-@@ -2113,7 +2113,7 @@ void RenderProcessHostImpl::CreateNotificationService(
+@@ -2116,7 +2116,7 @@ void RenderProcessHostImpl::CreateNotificationService(
      case RenderProcessHost::NotificationServiceCreatorType::kSharedWorker:
      case RenderProcessHost::NotificationServiceCreatorType::kDedicatedWorker: {
        storage_partition_impl_->GetPlatformNotificationContext()->CreateService(
@@ -145,7 +145,7 @@ index 93fb45230ddedddf68bb879ab8dbddce2740ed22..302c4cbed8b158257b7dfde14f591ad6
            creator_type, std::move(receiver));
        break;
      }
-@@ -2121,7 +2121,7 @@ void RenderProcessHostImpl::CreateNotificationService(
+@@ -2124,7 +2124,7 @@ void RenderProcessHostImpl::CreateNotificationService(
        CHECK(rfh);
  
        storage_partition_impl_->GetPlatformNotificationContext()->CreateService(

patches/chromium/osr_shared_texture_remove_keyed_mutex_on_win_dxgi.patch

@@ -36,7 +36,7 @@ index a7742298af440bf9f6bcfceb7a07a90f19ae8283..9d59397f2bed400e5131691778965ec1
    Microsoft::WRL::ComPtr<ID3D11Texture2D> d3d11_texture;
  
 diff --git a/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc b/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc
-index b27bcf13d3a5f7c8e85a677766718f4362467022..df1b2d697f7cce028d0d6d86190b3218b8f662a5 100644
+index 55756afa319d890d0776de40c0c747cccfcecf83..6291e6fad5dbcfebca4263147bed0cc85274d52f 100644
 --- a/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc
 +++ b/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc
 @@ -193,7 +193,7 @@ gfx::Size GetBufferSizeInPixelsForVideoPixelFormat(
@@ -75,9 +75,9 @@ index b27bcf13d3a5f7c8e85a677766718f4362467022..df1b2d697f7cce028d0d6d86190b3218
 @@ -231,7 +248,7 @@ bool FrameResources::Initialize() {
        viz::GetSharedImageFormat(buffer_format);
  
-   shared_image_ = context->CreateSharedImage(
--      buffer_size_in_pixels, kBufferUsage, si_format, color_space_,
-+      buffer_size_in_pixels, buffer_usage, si_format, color_space_,
-       kTopLeft_GrSurfaceOrigin, kPremul_SkAlphaType, kSharedImageUsage,
-       sync_token_);
+   shared_image_ =
+-      context->CreateSharedImage(buffer_size_in_pixels, kBufferUsage, si_format,
++      context->CreateSharedImage(buffer_size_in_pixels, buffer_usage, si_format,
+                                  color_space_, kSharedImageUsage, sync_token_);
    if (!shared_image_) {
+     DLOG(ERROR) << "Failed to allocate shared image for frame: coded_size="

patches/chromium/partially_revert_is_newly_created_to_allow_for_browser_initiated.patch

@@ -10,7 +10,7 @@ an about:blank check to this area.
 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/5403876
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 5394c89af750a7de2ec9b7762abbc43f6483d737..ffc85d4198cfb2427aaa699a9551fe29a335bb77 100644
+index 90ed344e4714ea2f98feab48824e8273ea51d048..e9d0fb7ee9a2dc0241926e6d82bae8d6c11fc4d3 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
 @@ -785,8 +785,8 @@ void VerifyThatBrowserAndRendererCalculatedOriginsToCommitMatch(

patches/chromium/printing.patch

@@ -860,10 +860,10 @@ index b8c803184f267d87696c4e72c3d993ff3b69d95b..7278dfae56305cc8669fc2240563450f
    ScriptingThrottler scripting_throttler_;
  
 diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
-index 31c9a53d5c7f09a7326ef57753b4a49f0239a7f8..7e913765d72087d57165efe59bca70584f43c836 100644
+index 1212cd37acff7847ec4a7d3fb841426d5a77576d..a6fbe92d06d373ff9794035de88553b36f837e30 100644
 --- a/content/browser/BUILD.gn
 +++ b/content/browser/BUILD.gn
-@@ -3041,8 +3041,9 @@ source_set("browser") {
+@@ -3044,8 +3044,9 @@ source_set("browser") {
        "//ppapi/shared_impl",
      ]
  

patches/chromium/refactor_expose_cursor_changes_to_the_webcontentsobserver.patch

@@ -30,10 +30,10 @@ index dea7ba2237cea261fe0b526753e1a9c4e355e484..9e3bf5eca5e9ad99112069a28b7fb8c1
    // RenderWidgetHost on the primary main frame, and false otherwise.
    virtual bool IsWidgetForPrimaryMainFrame(RenderWidgetHostImpl*);
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 3191fc7cf201b59abfcf87cd796752423f9a3c00..4d89c3bf11f453f72489bb9b2531b51493792dce 100644
+index 9af5efcacb38453d3f92a3c2d9a42ad8817ef6d5..c877e1aff3216aaf881e35e704745be442c5ca69 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -1982,6 +1982,9 @@ void RenderWidgetHostImpl::SetCursor(const ui::Cursor& cursor) {
+@@ -1986,6 +1986,9 @@ void RenderWidgetHostImpl::SetCursor(const ui::Cursor& cursor) {
    if (view_) {
      view_->UpdateCursor(cursor);
    }
@@ -44,7 +44,7 @@ index 3191fc7cf201b59abfcf87cd796752423f9a3c00..4d89c3bf11f453f72489bb9b2531b514
  
  void RenderWidgetHostImpl::ShowContextMenuAtPoint(
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index e5e9771863573c0826111a724a1c38566ed3655e..70cb6b43f214c7f5210e99edc930428520f02b7c 100644
+index b056a3dad69316b919c058458ee9de3ad4a88147..0b70b695a4d3990842f9c5909ef485b540d9be58 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -5647,6 +5647,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {

patches/chromium/refactor_expose_hostimportmoduledynamically_and.patch

@@ -7,10 +7,10 @@ Subject: refactor: expose HostImportModuleDynamically and
 This is so that Electron can blend Blink's and Node's implementations of these isolate handlers.
 
 diff --git a/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc b/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
-index 9b75260d27621f7174f8c47b108c175551319141..e4d63c2700d3079347279938e93eba4ba311a166 100644
+index 98da84ea08da05a486651d188c3eb8d14a2002cf..4ce1c044cf70525bd9ab4fee5a94e55017313910 100644
 --- a/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
 +++ b/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
-@@ -641,7 +641,9 @@ bool WasmJSPromiseIntegrationEnabledCallback(v8::Local<v8::Context> context) {
+@@ -637,7 +637,9 @@ bool WasmJSPromiseIntegrationEnabledCallback(v8::Local<v8::Context> context) {
        execution_context);
  }
  
@@ -21,7 +21,7 @@ index 9b75260d27621f7174f8c47b108c175551319141..e4d63c2700d3079347279938e93eba4b
      v8::Local<v8::Context> context,
      v8::Local<v8::Data> v8_host_defined_options,
      v8::Local<v8::Value> v8_referrer_resource_url,
-@@ -719,7 +721,7 @@ v8::MaybeLocal<v8::Promise> HostImportModuleDynamically(
+@@ -715,7 +717,7 @@ v8::MaybeLocal<v8::Promise> HostImportModuleDynamically(
  }
  
  // https://html.spec.whatwg.org/C/#hostgetimportmetaproperties
@@ -30,7 +30,7 @@ index 9b75260d27621f7174f8c47b108c175551319141..e4d63c2700d3079347279938e93eba4b
                                   v8::Local<v8::Module> module,
                                   v8::Local<v8::Object> meta) {
    v8::Isolate* isolate = context->GetIsolate();
-@@ -762,9 +764,6 @@ std::ostream& operator<<(std::ostream& os, const PrintV8OOM& oom_details) {
+@@ -758,9 +760,6 @@ std::ostream& operator<<(std::ostream& os, const PrintV8OOM& oom_details) {
    return os;
  }
  
@@ -40,7 +40,7 @@ index 9b75260d27621f7174f8c47b108c175551319141..e4d63c2700d3079347279938e93eba4b
  void V8Initializer::InitializeV8Common(v8::Isolate* isolate) {
    // Set up garbage collection before setting up anything else as V8 may trigger
    // GCs during Blink setup.
-@@ -784,9 +783,9 @@ void V8Initializer::InitializeV8Common(v8::Isolate* isolate) {
+@@ -780,9 +779,9 @@ void V8Initializer::InitializeV8Common(v8::Isolate* isolate) {
    isolate->SetWasmJSPIEnabledCallback(WasmJSPromiseIntegrationEnabledCallback);
    isolate->SetSharedArrayBufferConstructorEnabledCallback(
        SharedArrayBufferConstructorEnabledCallback);

patches/chromium/refactor_unfilter_unresponsive_events.patch

@@ -15,10 +15,10 @@ This CL removes these filters so the unresponsive event can still be
 accessed from our JS event. The filtering is moved into Electron's code.
 
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 7f42a4609ce1d1da017591f4f10eb1685e7ea67b..38d2200912410cbca6847387d637df505c2876aa 100644
+index e49fd4b3278b4a25af30ecc522794847440d4c50..6e38f593dfc53387e1bf12606314e0cd31918962 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -9642,25 +9642,13 @@ void WebContentsImpl::RendererUnresponsive(
+@@ -9635,25 +9635,13 @@ void WebContentsImpl::RendererUnresponsive(
      base::RepeatingClosure hang_monitor_restarter) {
    OPTIONAL_TRACE_EVENT1("content", "WebContentsImpl::RendererUnresponsive",
                          "render_widget_host", render_widget_host);

patches/chromium/reland_set_app_container_acls_reliably_on_out_directory.patch

@@ -0,0 +1,80 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Smolen <ssmole@microsoft.com>
+Date: Tue, 10 Dec 2024 19:38:18 +0000
+Subject: [reland] Set app container ACLs reliably on out directory
+
+This is a reland of:
+https://chromium-review.googlesource.com/c/chromium/src/+/6068009
+
+Reverted due to cross-compile failures. This cl adds host_os checks.
+
+Original description:
+> Sandbox on Windows relies on AppContainer sandbox for certain sandboxes.
+> The AppContainer sandbox requires that files loaded in those processes
+> have the right security attributes (ACLs), or they will not be allowed
+> to load. We can set the security attributes for a local build using the
+> icacls tool, which currently runs when //sandbox/win:sandbox target is
+> built, ensuring it happens as part of building chrome.dll.
+>
+> The APIs used for ACL-ing by icacls are subject to race conditions when
+> files are generated in the folder while it's running, as is the case
+> with a chromium build for binaries such as component build dlls and
+> chrome_elf.dll.
+>
+> This change resolves the race condition by ensuring the ACL-ing step
+> will happen via a DEPS of each executable target by default, which
+> should guarantee that icacls finishes running before we link any
+> binaries which require it.
+
+Bug: 379656387
+Change-Id: I45ee0d42934ab5cac4a24498f1f4ca9d0b3fb551
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6081378
+Reviewed-by: Dirk Pranke <dpranke@google.com>
+Commit-Queue: Stefan Smolen <ssmole@microsoft.com>
+Reviewed-by: Will Harris <wfh@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1394456}
+
+diff --git a/build/config/BUILD.gn b/build/config/BUILD.gn
+index 6f8cb29dbb18a144f572f4fb32633d7bec080eb7..d32152894f3483fe8e7cecc74e9b302f5649da2b 100644
+--- a/build/config/BUILD.gn
++++ b/build/config/BUILD.gn
+@@ -272,12 +272,14 @@ group("common_deps_without_libcxx") {
+     # debugging DLLs in all builds.
+     data_deps = [ "//build/win:runtime_libs" ]
+ 
+-    # In order to ensure the ACLing is applied to every binary loaded in an
+-    # app container sandbox, run the ACL step before any binary is built. We
+-    # do this because the tool is subject to race conditions if a binary is
+-    # placed in the out folder while it is running.
+-    public_deps +=
+-        [ "//build/config/win:maybe_set_appcontainer_acls($host_toolchain)" ]
++    if (host_os == "win") {
++      # In order to ensure the ACLing is applied to every binary loaded in an
++      # app container sandbox, run the ACL step before any binary is built. We
++      # do this because the tool is subject to race conditions if a binary is
++      # placed in the out folder while it is running.
++      public_deps +=
++          [ "//build/config/win:maybe_set_appcontainer_acls($host_toolchain)" ]
++    }
+   }
+ }
+ 
+diff --git a/build/config/win/BUILD.gn b/build/config/win/BUILD.gn
+index a75b2b09cf708ffb3d60a07cd31f78bc80075913..9928e76832cce20cead2531293d872b8af520336 100644
+--- a/build/config/win/BUILD.gn
++++ b/build/config/win/BUILD.gn
+@@ -483,12 +483,12 @@ config("delayloads_not_for_child_dll") {
+ # sandboxed processes in an app container when run from the out directory.
+ group("maybe_set_appcontainer_acls") {
+   # Exclude setting ACLs when build is not happening on chromium, or with a different toolchain.
+-  if (build_with_chromium && current_cpu == target_cpu) {
++  if (build_with_chromium && current_cpu == target_cpu && host_os == "win") {
+     deps = [ ":set_appcontainer_acls" ]
+   }
+ }
+ 
+-if (build_with_chromium && current_cpu == target_cpu) {
++if (build_with_chromium && current_cpu == target_cpu && host_os == "win") {
+   action("set_appcontainer_acls") {
+     script = "//build/win/set_appcontainer_acls.py"
+     stamp_file = "$target_out_dir/acls.stamp"

patches/chromium/render_widget_host_view_base.patch

@@ -6,7 +6,7 @@ Subject: render_widget_host_view_base.patch
 ... something to do with OSR? and maybe <webview> as well? terrifying.
 
 diff --git a/content/browser/renderer_host/render_widget_host_view_base.cc b/content/browser/renderer_host/render_widget_host_view_base.cc
-index 7684afb6afe8efb19cec45ee37a134fedeaa2ea1..7a7ac5c40da4c3e2d426fa517903e9a976146897 100644
+index 2fb637bba3e00058f3433ae2f6da799d59a75543..9365d9ebfd47e3054fa4ff9679c0ee06cfac3855 100644
 --- a/content/browser/renderer_host/render_widget_host_view_base.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_base.cc
 @@ -634,6 +634,13 @@ void RenderWidgetHostViewBase::OnFrameTokenChangedForView(
@@ -24,7 +24,7 @@ index 7684afb6afe8efb19cec45ee37a134fedeaa2ea1..7a7ac5c40da4c3e2d426fa517903e9a9
      const blink::WebMouseEvent& event,
      const ui::LatencyInfo& latency) {
 diff --git a/content/browser/renderer_host/render_widget_host_view_base.h b/content/browser/renderer_host/render_widget_host_view_base.h
-index bdd8712db25a50607999893fe78cd195023704cb..b9c57ea019cbf04c77116f12b9ae1e3abcb474d0 100644
+index 8377a897ff00c69e5b11e4775720d25465e6ec81..0b27be5b7d5824dbc5bbbfde813da263c453f20a 100644
 --- a/content/browser/renderer_host/render_widget_host_view_base.h
 +++ b/content/browser/renderer_host/render_widget_host_view_base.h
 @@ -29,8 +29,11 @@
@@ -39,7 +39,7 @@ index bdd8712db25a50607999893fe78cd195023704cb..b9c57ea019cbf04c77116f12b9ae1e3a
  #include "content/public/browser/render_widget_host_view.h"
  #include "content/public/common/page_visibility_state.h"
  #include "content/public/common/widget_type.h"
-@@ -70,9 +73,11 @@ namespace content {
+@@ -70,11 +73,13 @@ namespace content {
  class DevicePosturePlatformProvider;
  class MouseWheelPhaseHandler;
  class RenderWidgetHostImpl;
@@ -47,11 +47,13 @@ index bdd8712db25a50607999893fe78cd195023704cb..b9c57ea019cbf04c77116f12b9ae1e3a
  class ScopedViewTransitionResources;
  class TextInputManager;
  class TouchSelectionControllerClientManager;
-+class WebContentsView;
+ class TouchSelectionControllerInputObserver;
  class WebContentsAccessibility;
++class WebContentsView;
  class DelegatedFrameHost;
  class SyntheticGestureTarget;
-@@ -144,6 +149,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+ 
+@@ -145,6 +150,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    void ProcessGestureEvent(const blink::WebGestureEvent& event,
                             const ui::LatencyInfo& latency) override;
    RenderWidgetHostViewBase* GetRootView() override;
@@ -62,7 +64,7 @@ index bdd8712db25a50607999893fe78cd195023704cb..b9c57ea019cbf04c77116f12b9ae1e3a
    void OnAutoscrollStart() override;
    const viz::DisplayHitTestQueryMap& GetDisplayHitTestQuery() const override;
  
-@@ -181,6 +190,9 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -182,6 +191,9 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
        const gfx::Rect& keyboard_rect) override {}
    bool IsHTMLFormPopup() const override;