Bump v19.0.12

Fixes #35255

Co-authored-by: Samuel Attard <sam@electronjs.org>

.circleci/config.yml

@@ -14,7 +14,7 @@ parameters:
     type: boolean
     default: false
   
-  upload-to-s3:
+  upload-to-storage:
     type: string
     default: '1'
 

.circleci/config/base.yml

@@ -5,7 +5,7 @@ parameters:
     type: boolean
     default: false
   
-  upload-to-s3:
+  upload-to-storage:
     type: string
     default: '1'
 
@@ -41,9 +41,8 @@ executors:
     parameters:
       size:
         description: "Docker executor size"
-        default: 2xlarge+
         type: enum
-        enum: ["medium", "xlarge", "2xlarge+"]
+        enum: ["medium", "xlarge", "2xlarge"]
     docker:
       - image: ghcr.io/electron/build:e6bebd08a51a0d78ec23e5b3fd7e7c0846412328
     resource_class: << parameters.size >>
@@ -52,17 +51,10 @@ executors:
     parameters:
       size:
         description: "macOS executor size"
-        default: macos.x86.medium.gen2
         type: enum
         enum: ["macos.x86.medium.gen2", "large"]
-      xcode:
-        description: "xcode version"
-        default: "12.4.0"
-        type: enum
-        enum: ["12.4.0", "13.3.0"]
-
     macos:
-      xcode: << parameters.xcode >>
+      xcode: 13.3.0
     resource_class: << parameters.size >>
 
   # Electron Runners
@@ -127,6 +119,9 @@ env-apple-silicon: &env-apple-silicon
   USE_PREBUILT_V8_CONTEXT_SNAPSHOT: 1
   npm_config_arch: arm64
 
+env-runner: &env-runner
+  IS_ELECTRON_RUNNER: 1
+
 env-arm64: &env-arm64
   GN_EXTRA_ARGS: 'target_cpu = "arm64" fatal_linker_warnings = false enable_linux_installer = false'
   MKSNAPSHOT_TOOLCHAIN: //build/toolchain/linux:clang_arm64
@@ -339,6 +334,19 @@ step-setup-goma-for-build: &step-setup-goma-for-build
       echo 'export LOCAL_GOMA_DIR='`node -e "console.log(require('./src/utils/goma.js').dir)"` >> $BASH_ENV
       echo 'export GOMA_FALLBACK_ON_AUTH_FAILURE=true' >> $BASH_ENV
       cd ..
+      touch "${TMPDIR:=/tmp}"/.goma-ready
+    background: true
+
+step-wait-for-goma: &step-wait-for-goma
+  run:
+    name: Wait for Goma
+    command: |
+      until [ -f "${TMPDIR:=/tmp}"/.goma-ready ]
+      do
+          sleep 5
+      done
+      echo "Goma ready"
+    no_output_timeout: 5m
 
 step-restore-brew-cache: &step-restore-brew-cache
   restore_cache:
@@ -462,6 +470,13 @@ step-install-npm-deps-on-mac: &step-install-npm-deps-on-mac
         node script/yarn install
       fi
 
+step-install-npm-deps: &step-install-npm-deps
+  run:
+    name: Install node_modules
+    command: |
+      cd src/electron
+      node script/yarn install --frozen-lockfile
+
 # This step handles the differences between the linux "gclient sync"
 # and the expected state on macOS
 step-fix-sync: &step-fix-sync
@@ -493,6 +508,7 @@ step-install-signing-cert-on-mac: &step-install-signing-cert-on-mac
     name: Import and trust self-signed codesigning cert on MacOS
     command: |
       if  [ "$TARGET_ARCH" != "arm64" ] && [ "`uname`" == "Darwin" ]; then
+        sudo security authorizationdb write com.apple.trust-settings.admin allow
         cd src/electron
         ./script/codesign/generate-identity.sh
       fi
@@ -509,15 +525,6 @@ step-install-gnutar-on-mac: &step-install-gnutar-on-mac
         ln -fs /usr/local/bin/gtar /usr/local/bin/tar
       fi
 
-step-install-python2-on-mac: &step-install-python2-on-mac
-  run:
-    name: Install python2 on macos
-    command: |
-      if [ "`uname`" == "Darwin" ]; then
-        curl -O https://www.python.org/ftp/python/2.7.18/python-2.7.18-macosx10.9.pkg
-        sudo installer -pkg python-2.7.18-macosx10.9.pkg -target /
-      fi
-
 step-gn-gen-default: &step-gn-gen-default
   run:
     name: Default GN gen
@@ -540,7 +547,7 @@ step-gn-check: &step-gn-check
 step-electron-build: &step-electron-build
   run:
     name: Electron build
-    no_output_timeout: 30m
+    no_output_timeout: 60m
     command: |
       # On arm platforms we generate a cross-arch ffmpeg that ninja does not seem
       # to realize is not correct / should be rebuilt.  We delete it here so it is
@@ -574,14 +581,6 @@ step-electron-build: &step-electron-build
       cp out/Default/.ninja_log out/electron_ninja_log
       node electron/script/check-symlinks.js
 
-step-native-unittests-build: &step-native-unittests-build
-  run:
-    name: Build native test targets
-    no_output_timeout: 30m
-    command: |
-      cd src
-      ninja -C out/Default shell_browser_ui_unittests -j $NUMBER_OF_NINJA_PROCESSES
-
 step-maybe-electron-dist-strip: &step-maybe-electron-dist-strip
   run:
     name: Strip electron binaries
@@ -598,38 +597,6 @@ step-maybe-electron-dist-strip: &step-maybe-electron-dist-strip
         electron/script/add-debug-link.py --target-cpu="$target_cpu" --debug-dir=out/Default/debug
       fi
 
-step-electron-dist-build: &step-electron-dist-build
-  run:
-    name: Build dist.zip
-    command: |
-      cd src
-      if [ "$SKIP_DIST_ZIP" != "1" ]; then
-        ninja -C out/Default electron:electron_dist_zip
-        if [ "$CHECK_DIST_MANIFEST" == "1" ]; then
-          if [ "`uname`" == "Darwin" ]; then
-            target_os=mac
-            target_cpu=x64
-            if [ x"$MAS_BUILD" == x"true" ]; then
-              target_os=mac_mas
-            fi
-            if [ "$TARGET_ARCH" == "arm64" ]; then
-              target_cpu=arm64
-            fi
-          elif [ "`uname`" == "Linux" ]; then
-            target_os=linux
-            if [ x"$TARGET_ARCH" == x ]; then
-              target_cpu=x64
-            else
-              target_cpu="$TARGET_ARCH"
-            fi
-          else
-            echo "Unknown system: `uname`"
-            exit 1
-          fi
-          electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip electron/script/zip_manifests/dist_zip.$target_os.$target_cpu.manifest
-        fi
-      fi
-
 step-electron-chromedriver-build: &step-electron-chromedriver-build
   run:
     name: Build chromedriver.zip
@@ -666,9 +633,9 @@ step-electron-publish: &step-electron-publish
       fi
 
       cd src/electron
-      if [ "$UPLOAD_TO_S3" == "1" ]; then
-        echo 'Uploading Electron release distribution to S3'
-        script/release/uploaders/upload.py --verbose --upload_to_s3
+      if [ "$UPLOAD_TO_STORAGE" == "1" ]; then
+        echo 'Uploading Electron release distribution to Azure'
+        script/release/uploaders/upload.py --verbose --UPLOAD_TO_STORAGE
       else
         echo 'Uploading Electron release distribution to Github releases'
         script/release/uploaders/upload.py --verbose
@@ -682,7 +649,6 @@ step-persist-data-for-tests: &step-persist-data-for-tests
       - src/out/Default/dist.zip
       - src/out/Default/mksnapshot.zip
       - src/out/Default/chromedriver.zip
-      - src/out/Default/shell_browser_ui_unittests
       - src/out/Default/gen/node_headers
       - src/out/ffmpeg/ffmpeg.zip
       - src/electron
@@ -793,6 +759,7 @@ step-show-goma-stats: &step-show-goma-stats
       $LOCAL_GOMA_DIR/diagnose_goma_log.py
       true
     when: always
+    background: true
 
 step-mksnapshot-build: &step-mksnapshot-build
   run:
@@ -1029,19 +996,30 @@ step-ts-compile: &step-ts-compile
   run:
     name: Run TS/JS compile on doc only change
     command: |
-      cd src
-      ninja -C out/Default electron:default_app_js -j $NUMBER_OF_NINJA_PROCESSES
-      ninja -C out/Default electron:electron_js2c -j $NUMBER_OF_NINJA_PROCESSES
+      cd src/electron
+      node script/yarn create-typescript-definitions
+      node script/yarn tsc -p tsconfig.default_app.json --noEmit
+      for f in build/webpack/*.js
+      do
+        out="${f:29}"
+        if [ "$out" != "base.js" ]; then
+          node script/yarn webpack --config $f --output-filename=$out --output-path=./.tmp --env.mode=development
+        fi
+      done
 
 # List of all steps.
 steps-electron-gn-check: &steps-electron-gn-check
   steps:
-    - attach_workspace:
-        at: .
+    - *step-checkout-electron
+    - *step-depot-tools-get
     - *step-depot-tools-add-to-path
-    - *step-install-python2-on-mac
+    - install-python2-mac
     - *step-setup-env-for-build
     - *step-setup-goma-for-build
+    - *step-generate-deps-hash
+    - *step-touch-sync-done
+    - maybe-restore-portaled-src-cache
+    - *step-wait-for-goma
     - *step-gn-gen-default
     - *step-gn-check
 
@@ -1049,36 +1027,7 @@ steps-electron-ts-compile-for-doc-change: &steps-electron-ts-compile-for-doc-cha
   steps:
     # Checkout - Copied from steps-checkout
     - *step-checkout-electron
-    - *step-depot-tools-get
-    - *step-depot-tools-add-to-path
-    - *step-restore-brew-cache
-    - *step-install-gnutar-on-mac
-    - *step-install-python2-on-mac
-    - *step-get-more-space-on-mac
-    - *step-generate-deps-hash
-    - *step-touch-sync-done
-    - maybe-restore-portaled-src-cache
-    - *step-maybe-restore-git-cache
-    - *step-set-git-cache-path
-    # This sync call only runs if .circle-sync-done is an EMPTY file
-    - *step-gclient-sync
-    # These next few steps reset Electron to the correct commit regardless of which cache was restored
-    - run:
-        name: Wipe Electron
-        command: rm -rf src/electron
-    - *step-checkout-electron
-    - *step-run-electron-only-hooks
-    - *step-generate-deps-hash-cleanly
-    - *step-mark-sync-done
-    - *step-minimize-workspace-size-from-checkout
-
-    - *step-depot-tools-add-to-path
-    - *step-setup-env-for-build
-    - *step-setup-goma-for-build
-    - *step-get-more-space-on-mac
-    - *step-install-npm-deps-on-mac
-    - *step-fix-sync
-    - *step-gn-gen-default
+    - *step-install-npm-deps
 
     #Compile ts/js to verify doc change didn't break anything
     - *step-ts-compile
@@ -1088,9 +1037,10 @@ steps-native-tests: &steps-native-tests
     - attach_workspace:
         at: .
     - *step-depot-tools-add-to-path
-    - *step-install-python2-on-mac
+    - install-python2-mac
     - *step-setup-env-for-build
     - *step-setup-goma-for-build
+    - *step-wait-for-goma
     - *step-gn-gen-default
 
     - run:
@@ -1140,6 +1090,7 @@ steps-tests: &steps-tests
     - *step-setup-linux-for-headless-testing
     - *step-restore-brew-cache
     - *step-fix-known-hosts-linux
+    - install-python2-mac
     - *step-install-signing-cert-on-mac
 
     - run:
@@ -1229,6 +1180,31 @@ steps-test-node: &steps-test-node
 
 # Command Aliases
 commands:
+  install-python2-mac:
+    steps:
+      - restore_cache:
+          keys:
+            - v2.7.18-python-cache-{{ arch }}
+          name: Restore python cache
+      - run:
+          name: Install python2 on macos
+          command: |
+            if [ "`uname`" == "Darwin" ] && [ "$IS_ELECTRON_RUNNER" != "1" ]; then
+              if [ ! -f "python-downloads/python-2.7.18-macosx10.9.pkg" ]; then
+                mkdir python-downloads
+                echo 'Downloading Python 2.7.18'
+                curl -O https://dev-cdn.electronjs.org/python/python-2.7.18-macosx10.9.pkg
+                mv python-2.7.18-macosx10.9.pkg python-downloads
+              else
+                echo 'Using Python install from cache'
+              fi
+              sudo installer -pkg python-downloads/python-2.7.18-macosx10.9.pkg -target /        
+            fi
+      - save_cache:
+          paths:
+            - python-downloads
+          key: v2.7.18-python-cache-{{ arch }}
+          name: Persisting python cache
   maybe-restore-portaled-src-cache:
     parameters:
       halt-if-successful:
@@ -1276,7 +1252,6 @@ commands:
               fi
             }
             mv_if_exist src/out/Default/dist.zip
-            mv_if_exist src/out/Default/shell_browser_ui_unittests
             mv_if_exist src/out/Default/gen/node_headers.tar.gz
             mv_if_exist src/out/Default/symbols.zip
             mv_if_exist src/out/Default/mksnapshot.zip
@@ -1314,6 +1289,44 @@ commands:
       - *step-checkout-electron
       - *step-run-electron-only-hooks
       - *step-generate-deps-hash-cleanly
+
+  step-electron-dist-build:
+    parameters:
+      additional-targets:
+        type: string
+        default: ''
+    steps:
+      - run:
+          name: Build dist.zip
+          command: |
+            cd src
+            if [ "$SKIP_DIST_ZIP" != "1" ]; then
+              ninja -C out/Default electron:electron_dist_zip << parameters.additional-targets >>
+              if [ "$CHECK_DIST_MANIFEST" == "1" ]; then
+                if [ "`uname`" == "Darwin" ]; then
+                  target_os=mac
+                  target_cpu=x64
+                  if [ x"$MAS_BUILD" == x"true" ]; then
+                    target_os=mac_mas
+                  fi
+                  if [ "$TARGET_ARCH" == "arm64" ]; then
+                    target_cpu=arm64
+                  fi
+                elif [ "`uname`" == "Linux" ]; then
+                  target_os=linux
+                  if [ x"$TARGET_ARCH" == x ]; then
+                    target_cpu=x64
+                  else
+                    target_cpu="$TARGET_ARCH"
+                  fi
+                else
+                  echo "Unknown system: `uname`"
+                  exit 1
+                fi
+                electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip electron/script/zip_manifests/dist_zip.$target_os.$target_cpu.manifest
+              fi
+            fi
+
   electron-build:
     parameters:
       attach:
@@ -1358,8 +1371,12 @@ commands:
             - run: rm -rf src/electron
       - *step-restore-brew-cache
       - *step-install-gnutar-on-mac
-      - *step-install-python2-on-mac
+      - install-python2-mac
       - *step-save-brew-cache
+      - when:
+          condition: << parameters.build >>
+          steps:
+            - *step-setup-goma-for-build
       - when:
           condition: << parameters.checkout-and-assume-cache >>
           steps:
@@ -1455,7 +1472,7 @@ commands:
           steps:
             - *step-depot-tools-add-to-path
             - *step-setup-env-for-build
-            - *step-setup-goma-for-build
+            - *step-wait-for-goma
             - *step-get-more-space-on-mac
             - *step-fix-sync
             - *step-delete-git-directories
@@ -1468,13 +1485,8 @@ commands:
             - *step-gn-gen-default
             - *step-electron-build
             - *step-maybe-electron-dist-strip
-            - *step-electron-dist-build
-
-            # Native test targets
-            - *step-native-unittests-build
-
-            # Node.js headers
-            - *step-nodejs-headers-build
+            - step-electron-dist-build:
+                additional-targets: shell_browser_ui_unittests third_party/electron_node:headers electron:hunspell_dictionaries_zip
 
             - *step-show-goma-stats
 
@@ -1492,13 +1504,14 @@ commands:
                   - *step-ffmpeg-gn-gen
                   - *step-ffmpeg-build
 
-            # hunspell
-            - *step-hunspell-build
-
       # Save all data needed for a further tests run.
       - when:
           condition: << parameters.persist >>
           steps:
+            - *step-minimize-workspace-size-from-checkout
+            - run: |
+                rm -rf src/third_party/electron_node/deps/openssl
+                rm -rf src/third_party/electron_node/deps/v8
             - *step-persist-data-for-tests
 
       - when:
@@ -1550,7 +1563,7 @@ commands:
             - *step-depot-tools-get
       - *step-depot-tools-add-to-path
       - *step-restore-brew-cache
-      - *step-install-python2-on-mac
+      - install-python2-mac
       - *step-get-more-space-on-mac
       - when:
           condition: << parameters.checkout >>
@@ -1565,6 +1578,7 @@ commands:
       - *step-fix-sync
       - *step-setup-env-for-build
       - *step-setup-goma-for-build
+      - *step-wait-for-goma
       - *step-gn-gen-default
 
       # Electron app
@@ -1572,7 +1586,7 @@ commands:
       - *step-show-goma-stats
       - *step-maybe-generate-breakpad-symbols
       - *step-maybe-electron-dist-strip
-      - *step-electron-dist-build
+      - step-electron-dist-build
       - *step-maybe-zip-symbols
 
       # mksnapshot
@@ -1605,7 +1619,9 @@ commands:
 jobs:
   # Layer 0: Docs. Standalone.
   ts-compile-doc-change:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: medium
     environment:
       <<: *env-linux-2xlarge
       <<: *env-testing-build
@@ -1613,20 +1629,10 @@ jobs:
     <<: *steps-electron-ts-compile-for-doc-change
 
   # Layer 1: Checkout.
-  linux-checkout-for-workspace:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
-    steps:
-      - electron-build:
-          persist: false
-          build: false
-          checkout: true
-          persist-checkout: true
-
   linux-make-src-cache:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: xlarge
     environment:
       <<: *env-linux-2xlarge
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
@@ -1638,32 +1644,10 @@ jobs:
           save-git-cache: true
           checkout-to-create-src-cache: true
 
-  linux-checkout-for-native-tests:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_pyyaml=True'
-    steps:
-      - electron-build:
-          persist: false
-          build: false
-          checkout: true
-          persist-checkout: true
-
-  linux-checkout-for-native-tests-with-no-patches:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      GCLIENT_EXTRA_ARGS: '--custom-var=apply_patches=False --custom-var=checkout_pyyaml=True'
-    steps:
-      - electron-build:
-          persist: false
-          build: false
-          checkout: true
-          persist-checkout: true
-
   mac-checkout:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: xlarge
     environment:
       <<: *env-linux-2xlarge
       <<: *env-testing-build
@@ -1677,22 +1661,10 @@ jobs:
           persist-checkout: true
           restore-src-cache: false
 
-  mac-checkout-for-workspace:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      <<: *env-testing-build
-      <<: *env-macos-build
-      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
-    steps:
-      - electron-build:
-          persist: false
-          build: false
-          checkout: true
-          persist-checkout: true
-
   mac-make-src-cache:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: xlarge
     environment:
       <<: *env-linux-2xlarge
       <<: *env-testing-build
@@ -1708,7 +1680,9 @@ jobs:
 
   # Layer 2: Builds.
   linux-x64-testing:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: xlarge
     environment:
       <<: *env-global
       <<: *env-testing-build
@@ -1717,11 +1691,14 @@ jobs:
     steps:
       - electron-build:
           persist: true
-          checkout: true
+          checkout: false
+          checkout-and-assume-cache: true
           use-out-cache: false
 
   linux-x64-testing-asan:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: 2xlarge
     environment:
       <<: *env-global
       <<: *env-testing-build
@@ -1737,7 +1714,9 @@ jobs:
           build-nonproprietary-ffmpeg: false
 
   linux-x64-testing-no-run-as-node:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: xlarge
     environment:
       <<: *env-linux-2xlarge
       <<: *env-testing-build
@@ -1757,27 +1736,17 @@ jobs:
     environment:
       <<: *env-linux-medium
       <<: *env-testing-build
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     <<: *steps-electron-gn-check
 
-  linux-x64-release:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge-release
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-      <<: *env-ninja-status
-      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
-    steps:
-      - electron-build:
-          persist: true
-          checkout: true
-
   linux-x64-publish:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: 2xlarge
     environment:
       <<: *env-linux-2xlarge-release
       <<: *env-release-build
-      UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
       <<: *env-ninja-status
     steps:
       - run: echo running
@@ -1793,7 +1762,9 @@ jobs:
 
 
   linux-arm-testing:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: 2xlarge
     environment:
       <<: *env-global
       <<: *env-arm
@@ -1805,32 +1776,21 @@ jobs:
     steps:
       - electron-build:
           persist: true
-          checkout: true
+          checkout: false
+          checkout-and-assume-cache: true
           use-out-cache: false
 
-  linux-arm-release:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge-release
-      <<: *env-arm
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-      <<: *env-ninja-status
-      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
-    steps:
-      - electron-build:
-          persist: false
-          checkout: true
-
   linux-arm-publish:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: 2xlarge
     environment:
       <<: *env-linux-2xlarge-release
       <<: *env-arm
       <<: *env-release-build
       <<: *env-32bit-release
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True'
-      UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
       <<: *env-ninja-status
     steps:
       - run: echo running
@@ -1845,7 +1805,9 @@ jobs:
                 checkout: true
 
   linux-arm64-testing:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: 2xlarge
     environment:
       <<: *env-global
       <<: *env-arm64
@@ -1857,7 +1819,8 @@ jobs:
     steps:
       - electron-build:
           persist: true
-          checkout: true
+          checkout: false
+          checkout-and-assume-cache: true
           use-out-cache: false
 
   linux-arm64-testing-gn-check:
@@ -1868,30 +1831,19 @@ jobs:
       <<: *env-linux-medium
       <<: *env-arm64
       <<: *env-testing-build
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     <<: *steps-electron-gn-check
 
-  linux-arm64-release:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge-release
-      <<: *env-arm64
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-      <<: *env-ninja-status
-      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
-    steps:
-      - electron-build:
-          persist: false
-          checkout: true
-
   linux-arm64-publish:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: 2xlarge
     environment:
       <<: *env-linux-2xlarge-release
       <<: *env-arm64
       <<: *env-release-build
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm64=True'
-      UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
       <<: *env-ninja-status
     steps:
       - run: echo running
@@ -1908,7 +1860,7 @@ jobs:
   osx-testing-x64:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large
       <<: *env-testing-build
@@ -1925,20 +1877,21 @@ jobs:
   osx-testing-x64-gn-check:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-machine-mac
       <<: *env-testing-build
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     <<: *steps-electron-gn-check
 
   osx-publish-x64-skip-checkout:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large-release
       <<: *env-release-build
-      UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
       <<: *env-ninja-status
     steps:
       - run: echo running
@@ -1955,12 +1908,12 @@ jobs:
   osx-publish-arm64-skip-checkout:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large-release
       <<: *env-release-build
       <<: *env-apple-silicon
-      UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
       <<: *env-ninja-status
     steps:
       - run: echo running
@@ -1977,7 +1930,7 @@ jobs:
   osx-testing-arm64:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large
       <<: *env-testing-build
@@ -1996,7 +1949,7 @@ jobs:
   mas-testing-x64:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large
       <<: *env-mas
@@ -2014,22 +1967,23 @@ jobs:
   mas-testing-x64-gn-check:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-machine-mac
       <<: *env-mas
       <<: *env-testing-build
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     <<: *steps-electron-gn-check
 
   mas-publish-x64-skip-checkout:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large-release
       <<: *env-mas
       <<: *env-release-build
-      UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
     steps:
       - run: echo running
       - when:
@@ -2045,12 +1999,12 @@ jobs:
   mas-publish-arm64-skip-checkout:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large-release
       <<: *env-mas-apple-silicon
       <<: *env-release-build
-      UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
       <<: *env-ninja-status
     steps:
       - run: echo running
@@ -2067,7 +2021,7 @@ jobs:
   mas-testing-arm64:
     executor:
       name: macos
-      xcode: "13.3.0"
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large
       <<: *env-testing-build
@@ -2084,41 +2038,6 @@ jobs:
           attach: true
 
   # Layer 3: Tests.
-  linux-x64-unittests:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      <<: *env-unittests
-      <<: *env-headless-testing
-    <<: *steps-native-tests
-
-  linux-x64-disabled-unittests:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      <<: *env-unittests
-      <<: *env-headless-testing
-      TESTS_ARGS: '--only-disabled-tests'
-    <<: *steps-native-tests
-
-  linux-x64-chromium-unittests:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      <<: *env-unittests
-      <<: *env-headless-testing
-      TESTS_ARGS: '--include-disabled-tests'
-    <<: *steps-native-tests
-
-  linux-x64-browsertests:
-    executor: linux-docker
-    environment:
-      <<: *env-linux-2xlarge
-      <<: *env-browsertests
-      <<: *env-testing-build
-      <<: *env-headless-testing
-    <<: *steps-native-tests
-
   linux-x64-testing-tests:
     executor:
       name: linux-docker
@@ -2154,23 +2073,15 @@ jobs:
     <<: *steps-test-nan
 
   linux-x64-testing-node:
-    executor: linux-docker
+    executor:
+      name: linux-docker
+      size: xlarge
     environment:
       <<: *env-linux-medium
       <<: *env-headless-testing
       <<: *env-stack-dumping
     <<: *steps-test-node
 
-  linux-x64-release-tests:
-    executor:
-      name: linux-docker
-      size: medium
-    environment:
-      <<: *env-linux-medium
-      <<: *env-headless-testing
-      <<: *env-send-slack-notifications
-    <<: *steps-tests
-
   linux-x64-verify-ffmpeg:
     executor:
       name: linux-docker
@@ -2200,7 +2111,9 @@ jobs:
     <<: *steps-tests
 
   osx-testing-x64-tests:
-    executor: macos      
+    executor:
+      name: macos
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large
       <<: *env-stack-dumping
@@ -2213,10 +2126,13 @@ jobs:
       <<: *env-mac-large
       <<: *env-stack-dumping
       <<: *env-apple-silicon
+      <<: *env-runner
     <<: *steps-tests
 
   mas-testing-x64-tests:
-    executor: macos
+    executor:
+      name: macos
+      size: macos.x86.medium.gen2
     environment:
       <<: *env-mac-large
       <<: *env-stack-dumping
@@ -2229,6 +2145,7 @@ jobs:
       <<: *env-mac-large
       <<: *env-stack-dumping
       <<: *env-apple-silicon
+      <<: *env-runner
     <<: *steps-tests
 
   # Layer 4: Summary.
@@ -2291,14 +2208,19 @@ workflows:
         - equal: [false, << pipeline.parameters.run-linux-publish >>]
         - equal: [true, << pipeline.parameters.run-build-linux >>]
     jobs:
-      - linux-checkout-for-workspace
       - linux-make-src-cache
-      - linux-x64-testing
-      - linux-x64-testing-asan
-      - linux-x64-testing-no-run-as-node
+      - linux-x64-testing:
+          requires:
+            - linux-make-src-cache
+      - linux-x64-testing-asan:
+          requires:
+            - linux-make-src-cache
+      - linux-x64-testing-no-run-as-node:
+          requires:
+            - linux-make-src-cache
       - linux-x64-testing-gn-check:
           requires:
-            - linux-checkout-for-workspace
+            - linux-make-src-cache
       - linux-x64-testing-tests:
           requires:
             - linux-x64-testing
@@ -2311,7 +2233,9 @@ workflows:
       - linux-x64-testing-node:
           requires:
             - linux-x64-testing
-      - linux-arm-testing
+      - linux-arm-testing:
+          requires:
+            - linux-make-src-cache
       - linux-arm-testing-tests:
           filters:
             branches:
@@ -2319,7 +2243,9 @@ workflows:
               ignore: /pull\/[0-9]+/        
           requires:
             - linux-arm-testing      
-      - linux-arm64-testing
+      - linux-arm64-testing:
+          requires:
+            - linux-make-src-cache
       - linux-arm64-testing-tests:
           filters:
             branches:
@@ -2329,7 +2255,7 @@ workflows:
             - linux-arm64-testing
       - linux-arm64-testing-gn-check:
           requires:
-            - linux-checkout-for-workspace
+            - linux-make-src-cache
 
   build-mac:
     when:
@@ -2338,14 +2264,13 @@ workflows:
         - equal: [false, << pipeline.parameters.run-linux-publish >>]
         - equal: [true, << pipeline.parameters.run-build-mac >>]
     jobs:
-      - mac-checkout-for-workspace
       - mac-make-src-cache
       - osx-testing-x64:
           requires:
             - mac-make-src-cache
       - osx-testing-x64-gn-check:
           requires:
-            - mac-checkout-for-workspace
+            - mac-make-src-cache
       - osx-testing-x64-tests:
           requires:
             - osx-testing-x64
@@ -2364,7 +2289,7 @@ workflows:
             - mac-make-src-cache
       - mas-testing-x64-gn-check:
           requires:
-            - mac-checkout-for-workspace
+            - mac-make-src-cache
       - mas-testing-x64-tests:
           requires:
             - mas-testing-x64

.github/workflows/electron_woa_testing.yml

@@ -0,0 +1,178 @@
+name: Electron WOA Testing
+
+on:
+  push:    
+    branches: '**'
+  workflow_dispatch:
+    inputs:
+      appveyor_job_id:
+        description: 'Job Id of Appveyor WOA job to test'
+        type: text
+        required: true
+
+jobs:
+  electron-woa-init:
+    if: ${{ github.event_name == 'push' && github.repository == 'electron/electron' }}
+    runs-on: ubuntu-latest
+    steps:
+        - name: Dummy step for push event
+          run: |
+            echo "This job is a needed initialization step for Electron WOA testing.  Another test result will appear once the electron-woa-testing build is done."
+
+  electron-woa-testing:    
+    if: ${{ github.event_name == 'workflow_dispatch' && github.repository == 'electron/electron' }}    
+    runs-on: [self-hosted, woa]  
+    permissions:
+      checks: write
+      pull-requests: write
+    steps:
+    - uses: LouisBrunner/checks-action@v1.1.1
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        status: in_progress
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}    
+        output: |
+          {"summary":"Test In Progress","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}        
+    - name: Clean Workspace
+      run: |
+        Remove-Item * -Recurse -Force
+      shell: powershell
+    - name: Checkout
+      uses: actions/checkout@v3
+      with:
+        path: src\electron
+        fetch-depth: 0
+    - name: Yarn install
+      run: |
+        cd src\electron
+        node script/yarn.js install --frozen-lockfile
+    - name: Download and extract dist.zip for test
+      run: |
+        $localArtifactPath = "$pwd\dist.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/dist.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -osrc\out\Default -y $localArtifactPath
+      shell: powershell
+    - name: Download and extract native test executables for test
+      run: |
+        $localArtifactPath = "src\out\Default\shell_browser_ui_unittests.exe"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/shell_browser_ui_unittests.exe"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+      shell: powershell
+    - name: Download and extract ffmpeg.zip for test
+      run: |
+        $localArtifactPath = "$pwd\ffmpeg.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/ffmpeg.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -osrc\out\ffmpeg $localArtifactPath
+      shell: powershell
+    - name: Download node headers for test
+      run: |
+        $localArtifactPath = "src\node_headers.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/node_headers.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        cd src
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y node_headers.zip
+      shell: powershell
+    - name: Download electron.lib for test
+      run: |
+        $localArtifactPath = "src\out\Default\electron.lib"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/electron.lib"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+      shell: powershell
+    # Uncomment the following block if pdb files are needed to debug issues
+    # - name: Download pdb files for detailed stacktraces
+    #   if: ${{ github.event_name == 'workflow_dispatch' }}
+    #   run: |
+    #     try {
+    #       $localArtifactPath = "src\pdb.zip"
+    #       $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/pdb.zip"
+    #       Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+    #       cd src
+    #       & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y pdb.zip
+    #     } catch {
+    #       Write-Host "There was an exception encountered while downloading pdb files:" $_.Exception.Message
+    #     } finally {
+    #       $global:LASTEXITCODE = 0
+    #     }
+    #   shell: powershell
+    - name: Setup node headers
+      run: |
+        New-Item src\out\Default\gen\node_headers\Release -Type directory
+        Copy-Item -path src\out\Default\electron.lib -destination src\out\Default\gen\node_headers\Release\node.lib
+      shell: powershell
+    - name: Run Electron Main process tests
+      run: |
+        cd src
+        set npm_config_nodedir=%cd%\out\Default\gen\node_headers
+        set npm_config_arch=arm64
+        cd electron
+        node script/yarn test --runners=main --enable-logging --disable-features=CalculateNativeWinOcclusion  
+      env:
+        ELECTRON_ENABLE_STACK_DUMPING: true
+        ELECTRON_OUT_DIR: Default
+        IGNORE_YARN_INSTALL_ERROR: 1
+        ELECTRON_TEST_RESULTS_DIR: junit
+        MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
+        MOCHA_REPORTER: mocha-multi-reporters
+        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
+    - name: Run Electron Remote based tests
+      if: ${{ success() || failure() }}
+      run: |
+        cd src
+        set npm_config_nodedir=%cd%\out\Default\gen\node_headers
+        set npm_config_arch=arm64
+        cd electron
+        node script/yarn test --runners=remote --enable-logging --disable-features=CalculateNativeWinOcclusion
+      env:
+        ELECTRON_OUT_DIR: Default
+        IGNORE_YARN_INSTALL_ERROR: 1
+        ELECTRON_TEST_RESULTS_DIR: junit
+        MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
+        MOCHA_REPORTER: mocha-multi-reporters
+        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
+    - name: Verify ffmpeg
+      run: |
+        cd src
+        echo "Verifying non proprietary ffmpeg"
+        python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
+      shell: cmd
+    - name: Kill processes left running from last test run
+      if: ${{ always() }}
+      run: |
+        Get-Process | Where Name -Like "electron*" | Stop-Process
+        Get-Process | Where Name -Like "msedge*" | Stop-Process
+      shell: powershell
+    - name: Delete user app data directories
+      if: ${{ always() }}
+      run: |
+        Remove-Item -path $env:APPDATA/Electron* -Recurse -Force -ErrorAction Ignore
+      shell: powershell
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"${{ job.status }}","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"Job Succeeded","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}          
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ ! success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"Job Failed","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}                    

.markdownlint.json

@@ -23,7 +23,5 @@
     "br_spaces": 0
   },
   "single-h1": false,
-  "no-inline-html": {
-    "allowed_elements": ["br"]
-  }
+  "no-inline-html": false
 }

BUILD.gn

@@ -80,7 +80,10 @@ if (is_linux) {
   }
 
   generate_stubs("electron_gtk_stubs") {
-    sigs = [ "shell/browser/ui/electron_gtk.sigs" ]
+    sigs = [
+      "shell/browser/ui/electron_gdk_pixbuf.sigs",
+      "shell/browser/ui/electron_gtk.sigs",
+    ]
     extra_header = "shell/browser/ui/electron_gtk.fragment"
     output_name = "electron_gtk_stubs"
     public_deps = [ "//ui/gtk:gtk_config" ]
@@ -363,6 +366,7 @@ source_set("electron_lib") {
     "//chrome/app/resources:platform_locale_settings",
     "//components/autofill/core/common:features",
     "//components/certificate_transparency",
+    "//components/embedder_support:browser_util",
     "//components/language/core/browser",
     "//components/net_log",
     "//components/network_hints/browser",
@@ -1269,6 +1273,10 @@ if (is_mac) {
       if (!is_component_build && is_component_ffmpeg) {
         configs += [ "//build/config/gcc:rpath_for_built_shared_libraries" ]
       }
+
+      if (is_linux) {
+        deps += [ "//sandbox/linux:chrome_sandbox" ]
+      }
     }
   }
 

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '102.0.4999.0',
+    '102.0.5005.167',
   'node_version':
     'v16.14.2',
   'nan_version':

ELECTRON_VERSION

@@ -1 +1 @@
-19.0.0-beta.1
+19.0.12

appveyor.yml

@@ -11,7 +11,7 @@
 #  - "TARGET_ARCH" Choose from {'ia32', 'x64', 'arm', 'arm64', 'mips64el'}.
 #      Is used in some publishing scripts, but does NOT affect the Electron binary.
 #      Must match 'target_cpu' passed to "GN_EXTRA_ARGS" and "NPM_CONFIG_ARCH" value.
-#  - "UPLOAD_TO_S3" Set it to '1' upload a release to the S3 bucket.
+#  - "UPLOAD_TO_STORAGE" Set it to '1' upload a release to the Azure bucket.
 #      Otherwise the release will be uploaded to the Github Releases.
 #      (The value is only checked if "ELECTRON_RELEASE" is defined.)
 #
@@ -38,16 +38,6 @@ environment:
   MOCHA_REPORTER: mocha-multi-reporters
   MOCHA_MULTI_REPORTERS: mocha-appveyor-reporter, tap
   GOMA_FALLBACK_ON_AUTH_FAILURE: true
-notifications:
-  - provider: Webhook
-    url: https://electron-mission-control.herokuapp.com/rest/appveyor-hook
-    method: POST
-    headers:
-      x-mission-control-secret:
-        secure: 90BLVPcqhJPG7d24v0q/RRray6W3wDQ8uVQlQjOHaBWkw1i8FoA1lsjr2C/v1dVok+tS2Pi6KxDctPUkwIb4T27u4RhvmcPzQhVpfwVJAG9oNtq+yKN7vzHfg7k/pojEzVdJpQLzeJGcSrZu7VY39Q==
-    on_build_success: false
-    on_build_failure: true
-    on_build_status_changed: false
 build_script:
   - ps: >-
       if(($env:APPVEYOR_PULL_REQUEST_HEAD_REPO_NAME -split "/")[0] -eq ($env:APPVEYOR_REPO_NAME -split "/")[0]) {
@@ -183,34 +173,21 @@ build_script:
   - ninja -C out/Default third_party/electron_node:headers
   - python %LOCAL_GOMA_DIR%\goma_ctl.py stat
   - python3 electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
-  - appveyor PushArtifact out/Default/windows_toolchain_profile.json
-  - appveyor PushArtifact out/Default/dist.zip
-  - appveyor PushArtifact out/Default/shell_browser_ui_unittests.exe
-  - appveyor PushArtifact out/Default/chromedriver.zip
-  - appveyor PushArtifact out/ffmpeg/ffmpeg.zip
   - 7z a node_headers.zip out\Default\gen\node_headers
-  - appveyor PushArtifact node_headers.zip
-  - appveyor PushArtifact out/Default/mksnapshot.zip
-  - appveyor PushArtifact out/Default/hunspell_dictionaries.zip
-  - appveyor PushArtifact out/Default/electron.lib
-  # Temporarily disable symbol generation on 32-bit Windows due to failures  
   - ps: >-
-      if ($env:GN_CONFIG -eq 'release' -And $env:TARGET_ARCH -ne 'ia32') {
+      if ($env:GN_CONFIG -eq 'release') {
         # Needed for msdia140.dll on 64-bit windows
         $env:Path += ";$pwd\third_party\llvm-build\Release+Asserts\bin"
         ninja -C out/Default electron:electron_symbols
       }
   - ps: >-
       if ($env:GN_CONFIG -eq 'release') {
-        if ($env:TARGET_ARCH -ne 'ia32') {
-          python electron\script\zip-symbols.py
-          appveyor-retry appveyor PushArtifact out/Default/symbols.zip
-        }
+        python electron\script\zip-symbols.py
+        appveyor-retry appveyor PushArtifact out/Default/symbols.zip
       } else {
         # It's useful to have pdb files when debugging testing builds that are
         # built on CI.
         7z a pdb.zip out\Default\*.pdb
-        appveyor-retry appveyor PushArtifact pdb.zip
       }
   - python electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip electron/script/zip_manifests/dist_zip.win.%TARGET_ARCH%.manifest
 test_script:
@@ -239,20 +216,33 @@ test_script:
   - echo "Done verifying mksnapshot"
   - if "%RUN_TESTS%"=="true" ( echo Verifying chromedriver & python electron\script\verify-chromedriver.py --build-dir out\Default --source-root %cd% )
   - echo "Done verifying chromedriver"
-  - if exist %cd%\electron.log ( appveyor-retry appveyor PushArtifact %cd%\electron.log )
 deploy_script:
   - cd electron
   - ps: >-
       if (Test-Path Env:\ELECTRON_RELEASE) {
-        if (Test-Path Env:\UPLOAD_TO_S3) {
-          Write-Output "Uploading Electron release distribution to s3"
-          & python script\release\uploaders\upload.py --verbose --upload_to_s3
+        if (Test-Path Env:\UPLOAD_TO_STORAGE) {
+          Write-Output "Uploading Electron release distribution to azure"
+          & python script\release\uploaders\upload.py --verbose --upload_to_storage
         } else {
           Write-Output "Uploading Electron release distribution to github releases"
           & python script\release\uploaders\upload.py --verbose
         }
       } elseif (Test-Path Env:\TEST_WOA) {
-        node script/release/ci-release-build.js --job=electron-woa-testing --ci=VSTS --armTest --appveyorJobId=$env:APPVEYOR_JOB_ID $env:APPVEYOR_REPO_BRANCH
+        node script/release/ci-release-build.js --job=electron-woa-testing --ci=GHA --appveyorJobId=$env:APPVEYOR_JOB_ID $env:APPVEYOR_REPO_BRANCH
       }
 on_finish:
-  - if exist src\electron\electron.log ( appveyor-retry appveyor PushArtifact src\electron\electron.log )
+  - cd ..
+  - if exist out\Default\windows_toolchain_profile.json ( appveyor-retry appveyor PushArtifact out\Default\windows_toolchain_profile.json )
+  - if exist out\Default\dist.zip (appveyor-retry appveyor PushArtifact out\Default\dist.zip)
+  - if exist out\Default\shell_browser_ui_unittests.exe (appveyor-retry appveyor PushArtifact out\Default\shell_browser_ui_unittests.exe)
+  - if exist out\Default\chromedriver.zip (appveyor-retry appveyor PushArtifact out\Default\chromedriver.zip)
+  - if exist out\ffmpeg\ffmpeg.zip (appveyor-retry appveyor PushArtifact out\ffmpeg\ffmpeg.zip)
+  - if exist node_headers.zip (appveyor-retry appveyor PushArtifact node_headers.zip)
+  - if exist out\Default\mksnapshot.zip (appveyor-retry appveyor PushArtifact out\Default\mksnapshot.zip)
+  - if exist out\Default\hunspell_dictionaries.zip (appveyor-retry appveyor PushArtifact out\Default\hunspell_dictionaries.zip)
+  - if exist out\Default\electron.lib (appveyor-retry appveyor PushArtifact out\Default\electron.lib)
+  - ps: >-
+      if ((Test-Path "pdb.zip") -And ($env:GN_CONFIG -ne 'release')) {
+        appveyor-retry appveyor PushArtifact pdb.zip
+      }
+  - if exist electron\electron.log ( appveyor-retry appveyor PushArtifact electron\electron.log )

azure-pipelines-arm.yml

@@ -1,121 +0,0 @@
-steps:
-- task: CopyFiles@2
-  displayName: 'Copy Files to: src/electron'
-  inputs:
-    TargetFolder: src/electron
-
-- bash: |
-    cd src/electron
-    node script/yarn.js install --frozen-lockfile
-  displayName: 'Yarn install'
-
-- bash: |
-    export ZIP_DEST=$PWD/src/out/Default
-    echo "##vso[task.setvariable variable=ZIP_DEST]$ZIP_DEST"
-    mkdir -p $ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=dist.zip --dest=$ZIP_DEST
-    cd $ZIP_DEST
-    unzip -o dist.zip
-    xattr -cr Electron.app    
-  displayName: 'Download and unzip dist files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    export FFMPEG_ZIP_DEST=$PWD/src/out/ffmpeg
-    mkdir -p $FFMPEG_ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=ffmpeg.zip --dest=$FFMPEG_ZIP_DEST
-    cd $FFMPEG_ZIP_DEST
-    unzip -o ffmpeg.zip
-  displayName: 'Download and unzip ffmpeg for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export NODE_HEADERS_DEST=$PWD/src/out/Default/gen
-   mkdir -p $NODE_HEADERS_DEST
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=node_headers.tar.gz --dest=$NODE_HEADERS_DEST
-   cd $NODE_HEADERS_DEST
-   tar xzf node_headers.tar.gz
-  displayName: 'Download and untar node header files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export CROSS_ARCH_SNAPSHOTS=$PWD/src/out/Default/cross-arch-snapshots
-   mkdir -p $CROSS_ARCH_SNAPSHOTS
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/snapshot_blob.bin --dest=$CROSS_ARCH_SNAPSHOTS
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/v8_context_snapshot.arm64.bin --dest=$CROSS_ARCH_SNAPSHOTS
-  displayName: 'Download cross arch snapshot files'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    cd src
-    export ELECTRON_OUT_DIR=Default
-    export npm_config_arch=arm64
-    (cd electron && node script/yarn test --enable-logging --runners main)
-  displayName: 'Run Electron main tests'
-  timeoutInMinutes: 20
-  env:
-    ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-
-- bash: |
-    cd src
-    export ELECTRON_OUT_DIR=Default
-    export npm_config_arch=arm64
-    (cd electron && node script/yarn test --enable-logging --runners remote)
-  displayName: 'Run Electron remote tests'
-  timeoutInMinutes: 20
-  condition: succeededOrFailed()
-  env:
-    ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-
-- bash: |
-    cd src
-    python electron/script/verify-ffmpeg.py --source-root "$PWD" --build-dir out/Default --ffmpeg-path out/ffmpeg
-  displayName: Verify non proprietary ffmpeg
-  timeoutInMinutes: 5
-  condition: succeededOrFailed()
-  env:
-    TARGET_ARCH: arm64
-
-- bash: |
-    cd src
-    echo Verify cross arch snapshot
-    python electron/script/verify-mksnapshot.py --source-root "$PWD" --build-dir out/Default --snapshot-files-dir $PWD/out/Default/cross-arch-snapshots
-  displayName: Verify cross arch snapshot
-  timeoutInMinutes: 5
-  condition: succeededOrFailed()
-
-- task: PublishTestResults@2
-  displayName: 'Publish Test Results'
-  inputs:
-    testResultsFiles: '*.xml'
-
-    searchFolder: '$(System.DefaultWorkingDirectory)/src/junit/'
-
-  condition: succeededOrFailed()
-
-- bash: killall Electron || echo "No Electron processes left running"
-  displayName: 'Kill processes left running from last test run'
-  condition: always()
-
-- bash: |
-    rm -rf ~/Library/Application\ Support/Electron*
-    rm -rf ~/Library/Application\ Support/electron*
-  displayName: 'Delete user app data directories'
-  condition: always()
-
-- task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3
-  displayName: 'Clean Agent Directories'
-
-  condition: always()

azure-pipelines-woa.yml

@@ -1,130 +0,0 @@
-workspace:
-  clean: all
-
-steps:
-- checkout: self
-  path: src\electron
-
-- script: |
-    node script/yarn.js install --frozen-lockfile
-  displayName: 'Yarn install'
-
-- powershell: |
-    $localArtifactPath = "$pwd\dist.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/dist.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -o$(Pipeline.Workspace)\src\out\Default -y $localArtifactPath
-  displayName: 'Download and extract dist.zip for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\out\Default\shell_browser_ui_unittests.exe"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/shell_browser_ui_unittests.exe"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-  displayName: 'Download and extract native test executables for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$pwd\ffmpeg.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/ffmpeg.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -o$(Pipeline.Workspace)\src\out\ffmpeg $localArtifactPath
-  displayName: 'Download and extract ffmpeg.zip for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\node_headers.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/node_headers.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    cd $(Pipeline.Workspace)\src
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y node_headers.zip
-  displayName: 'Download node headers for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\out\Default\electron.lib"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/electron.lib"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-  displayName: 'Download electron.lib for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-# Uncomment the following block if pdb files are needed to debug issues
-# - powershell: |
-#     try {
-#       $localArtifactPath = "$(Pipeline.Workspace)\src\pdb.zip"
-#       $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/pdb.zip"
-#       Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-#       cd $(Pipeline.Workspace)\src
-#       & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y pdb.zip
-#     } catch {
-#       Write-Host "There was an exception encountered while downloading pdb files:" $_.Exception.Message
-#     } finally {
-#       $global:LASTEXITCODE = 0
-#     }
-#   displayName: 'Download pdb files for detailed stacktraces'
-#   env:
-#     APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    New-Item $(Pipeline.Workspace)\src\out\Default\gen\node_headers\Release -Type directory
-    Copy-Item -path $(Pipeline.Workspace)\src\out\Default\electron.lib -destination $(Pipeline.Workspace)\src\out\Default\gen\node_headers\Release\node.lib
-  displayName: 'Setup node headers'
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    set npm_config_nodedir=%cd%\out\Default\gen\node_headers
-    set npm_config_arch=arm64
-    cd electron
-    node script/yarn test --runners=main --enable-logging --disable-features=CalculateNativeWinOcclusion
-  displayName: 'Run Electron Main process tests'
-  env:
-    ELECTRON_ENABLE_STACK_DUMPING: true
-    ELECTRON_OUT_DIR: Default
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-    MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
-    MOCHA_REPORTER: mocha-multi-reporters
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    set npm_config_nodedir=%cd%\out\Default\gen\node_headers
-    set npm_config_arch=arm64
-    cd electron
-    node script/yarn test --runners=remote --enable-logging --disable-features=CalculateNativeWinOcclusion
-  displayName: 'Run Electron Remote based tests'
-  env:
-    ELECTRON_OUT_DIR: Default
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-    MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
-    MOCHA_REPORTER: mocha-multi-reporters
-  condition: succeededOrFailed()
-
-- task: PublishTestResults@2
-  displayName: 'Publish Test Results'
-  inputs:
-    testResultsFiles: '*.xml'
-    searchFolder: '$(Pipeline.Workspace)/src/junit/'
-  condition: always()
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    echo "Verifying non proprietary ffmpeg"
-    python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
-  displayName: 'Verify ffmpeg'
-
-- powershell: |
-    Get-Process | Where Name –Like "electron*" | Stop-Process
-    Get-Process | Where Name –Like "msedge*" | Stop-Process
-  displayName: 'Kill processes left running from last test run'
-  condition: always()
-
-- powershell: |
-    Remove-Item -path $env:APPDATA/Electron* -Recurse -Force -ErrorAction Ignore
-  displayName: 'Delete user app data directories'
-  condition: always()

build/args/all.gn

@@ -21,6 +21,9 @@ proprietary_codecs = true
 ffmpeg_branding = "Chrome"
 
 enable_basic_printing = true
+
+# Removes DLLs from the build, which are only meant to be used for Chromium development.
+# See https://github.com/electron/electron/pull/17985
 angle_enable_vulkan_validation_layers = false
 dawn_enable_vulkan_validation_layers = false
 

build/extract_symbols.gni

@@ -24,7 +24,11 @@ template("extract_symbols") {
     assert(defined(invoker.binary), "Need binary to dump")
     assert(defined(invoker.symbol_dir), "Need directory for symbol output")
 
-    dump_syms_label = "//third_party/breakpad:dump_syms($host_toolchain)"
+    if (host_os == "win" && target_cpu == "x86") {
+      dump_syms_label = "//third_party/breakpad:dump_syms(//build/toolchain/win:win_clang_x64)"
+    } else {
+      dump_syms_label = "//third_party/breakpad:dump_syms($host_toolchain)"
+    }
     dump_syms_binary = get_label_info(dump_syms_label, "root_out_dir") +
                        "/dump_syms$_host_executable_suffix"
 

docs/README.md

@@ -69,9 +69,6 @@ an issue:
   * [Windows Store](tutorial/windows-store-guide.md)
   * [Snapcraft](tutorial/snapcraft.md)
 * [Updates](tutorial/updates.md)
-  * [Deploying an Update Server](tutorial/updates.md#deploying-an-update-server)
-  * [Implementing Updates in Your App](tutorial/updates.md#implementing-updates-in-your-app)
-  * [Applying Updates](tutorial/updates.md#applying-updates)
 * [Getting Support](tutorial/support.md)
 
 ## Detailed Tutorials

docs/api/app.md

@@ -484,7 +484,6 @@ Returns:
 * `argv` string[] - An array of the second instance's command line arguments
 * `workingDirectory` string - The second instance's working directory
 * `additionalData` unknown - A JSON object of additional data passed from the second instance
-* `ackCallback` unknown - A function that can be used to send data back to the second instance
 
 This event will be emitted inside the primary instance of your application
 when a second instance has been executed and calls `app.requestSingleInstanceLock()`.
@@ -496,35 +495,12 @@ non-minimized.
 
 **Note:** If the second instance is started by a different user than the first, the `argv` array will not include the arguments.
 
-**Note:** `ackCallback` allows the user to send data back to the
-second instance during the `app.requestSingleInstanceLock()` flow.
-This callback can be used for cases where the second instance
-needs to obtain additional information from the first instance
-before quitting.
-
-Currently, the limit on the message size is kMaxMessageLength,
-or around 32kB. To be safe, keep the amount of data passed to 31kB at most.
-
-In order to call the callback, `event.preventDefault()` must be called, first.
-If the callback is not called in either case, `null` will be sent back.
-If `event.preventDefault()` is not called, but `ackCallback` is called
-by the user in the event, then the behaviour is undefined.
-
 This event is guaranteed to be emitted after the `ready` event of `app`
 gets emitted.
 
 **Note:** Extra command line arguments might be added by Chromium,
 such as `--original-process-start-time`.
 
-### Event: 'first-instance-ack'
-
-Returns:
-
-* `event` Event
-* `additionalData` unknown - A JSON object of additional data passed from the first instance, in response to the first instance's `second-instance` event.
-
-This event will be emitted within the second instance during the call to `app.requestSingleInstanceLock()`, when the first instance calls the `ackCallback` provided by the `second-instance` event handler.
-
 ## Methods
 
 The `app` object has the following methods:
@@ -861,6 +837,8 @@ Returns `Object`:
 
 * `categories` [JumpListCategory[]](structures/jump-list-category.md) | `null` - Array of `JumpListCategory` objects.
 
+Returns `string`
+
 Sets or removes a custom Jump List for the application, and returns one of the
 following strings:
 
@@ -983,13 +961,6 @@ starts:
 const { app } = require('electron')
 let myWindow = null
 
-app.on('first-instance-ack', (event, additionalData) => {
-  // Print out the ack received from the first instance.
-  // Note this event handler must come before the requestSingleInstanceLock call.
-  // Expected output: '{"myAckKey":"myAckValue"}'
-  console.log(JSON.stringify(additionalData))
-})
-
 const additionalData = { myKey: 'myValue' }
 const gotTheLock = app.requestSingleInstanceLock(additionalData)
 
@@ -997,19 +968,14 @@ if (!gotTheLock) {
   app.quit()
 } else {
   app.on('second-instance', (event, commandLine, workingDirectory, additionalData) => {
-    // We must call preventDefault if we're sending back data.
-    event.preventDefault()
     // Print out data received from the second instance.
-    // Expected output: '{"myKey":"myValue"}'
-    console.log(JSON.stringify(additionalData))
+    console.log(additionalData)
 
     // Someone tried to run a second instance, we should focus our window.
     if (myWindow) {
       if (myWindow.isMinimized()) myWindow.restore()
       myWindow.focus()
     }
-    const ackData = { myAckKey: 'myAckValue' }
-    ackCallback(ackData)
   })
 
   // Create myWindow, load the rest of the app, etc...

docs/api/safe-storage.md

@@ -18,8 +18,8 @@ The `safeStorage` module has the following methods:
 
 Returns `boolean` - Whether encryption is available.
 
-On Linux, returns true if the secret key is
-available. On MacOS, returns true if Keychain is available.
+On Linux, returns true if the app has emitted the `ready` event and the secret key is available.
+On MacOS, returns true if Keychain is available.
 On Windows, returns true once the app has emitted the `ready` event.
 
 ### `safeStorage.encryptString(plainText)`

docs/api/session.md

@@ -1025,7 +1025,7 @@ is emitted.
 
 #### `ses.getStoragePath()`
 
-A `string | null` indicating the absolute file system path where data for this
+Returns `string | null` - The absolute file system path where data for this
 session is persisted on disk.  For in memory sessions this returns `null`.
 
 ### Instance Properties

docs/api/system-preferences.md

@@ -84,7 +84,7 @@ that contains the user information dictionary sent along with the notification.
 
 ### `systemPreferences.subscribeNotification(event, callback)` _macOS_
 
-* `event` string
+* `event` string | null
 * `callback` Function
   * `event` string
   * `userInfo` Record<string, unknown>
@@ -109,9 +109,11 @@ example values of `event` are:
 * `AppleColorPreferencesChangedNotification`
 * `AppleShowScrollBarsSettingChanged`
 
+If `event` is null, the `NSDistributedNotificationCenter` doesn’t use it as criteria for delivery to the observer. See [docs](https://developer.apple.com/documentation/foundation/nsnotificationcenter/1411723-addobserverforname?language=objc)  for more information.
+
 ### `systemPreferences.subscribeLocalNotification(event, callback)` _macOS_
 
-* `event` string
+* `event` string | null
 * `callback` Function
   * `event` string
   * `userInfo` Record<string, unknown>
@@ -122,9 +124,11 @@ Returns `number` - The ID of this subscription
 Same as `subscribeNotification`, but uses `NSNotificationCenter` for local defaults.
 This is necessary for events such as `NSUserDefaultsDidChangeNotification`.
 
+If `event` is null, the `NSNotificationCenter` doesn’t use it as criteria for delivery to the observer. See [docs](https://developer.apple.com/documentation/foundation/nsnotificationcenter/1411723-addobserverforname?language=objc) for more information.
+
 ### `systemPreferences.subscribeWorkspaceNotification(event, callback)` _macOS_
 
-* `event` string
+* `event` string | null
 * `callback` Function
   * `event` string
   * `userInfo` Record<string, unknown>
@@ -135,6 +139,8 @@ Returns `number` - The ID of this subscription
 Same as `subscribeNotification`, but uses `NSWorkspace.sharedWorkspace.notificationCenter`.
 This is necessary for events such as `NSWorkspaceDidActivateApplicationNotification`.
 
+If `event` is null, the `NSWorkspaceNotificationCenter` doesn’t use it as criteria for delivery to the observer. See [docs](https://developer.apple.com/documentation/foundation/nsnotificationcenter/1411723-addobserverforname?language=objc) for more information.
+
 ### `systemPreferences.unsubscribeNotification(id)` _macOS_
 
 * `id` Integer

docs/api/tray.md

@@ -25,15 +25,20 @@ app.whenReady().then(() => {
 })
 ```
 
-__Platform limitations:__
+__Platform Considerations__
+
+If you want to keep exact same behaviors on all platforms, you should not
+rely on the `click` event; instead, always attach a context menu to the tray icon.
+
+__Linux__
 
-* On Linux the app indicator will be used if it is supported, otherwise
-  `GtkStatusIcon` will be used instead.
 * On Linux distributions that only have app indicator support, you have to
   install `libappindicator1` to make the tray icon work.
+* The app indicator will be used if it is supported, otherwise
+  `GtkStatusIcon` will be used instead.
 * App indicator will only be shown when it has a context menu.
-* When app indicator is used on Linux, the `click` event is ignored.
-* On Linux in order for changes made to individual `MenuItem`s to take effect,
+* The `click` event is ignored when using the app indicator.
+* In order for changes made to individual `MenuItem`s to take effect,
   you have to call `setContextMenu` again. For example:
 
 ```javascript
@@ -55,10 +60,16 @@ app.whenReady().then(() => {
 })
 ```
 
-* On Windows it is recommended to use `ICO` icons to get best visual effects.
+__MacOS__
 
-If you want to keep exact same behaviors on all platforms, you should not
-rely on the `click` event and always attach a context menu to the tray icon.
+* Icons passed to the Tray constructor should be [Template Images](native-image.md#template-image).
+* To make sure your icon isn't grainy on retina monitors, be sure your `@2x` image is 144dpi.
+* If you are bundling your application (e.g., with webpack for development), be sure that the file names are not being mangled or hashed. The filename needs to end in Template, and the `@2x` image needs to have the same filename as the standard image, or MacOS will not magically invert your image's colors or use the high density image.
+* 16x16 (72dpi) and 32x32@2x (144dpi) work well for most icons.
+
+__Windows__
+
+* It is recommended to use `ICO` icons to get best visual effects.
 
 ### `new Tray(image, [guid])`
 

docs/api/web-frame-main.md

@@ -16,7 +16,7 @@ win.loadURL('https://twitter.com')
 
 win.webContents.on(
   'did-frame-navigate',
-  (event, url, isMainFrame, frameProcessId, frameRoutingId) => {
+  (event, url, httpResponseCode, httpStatusText, isMainFrame, frameProcessId, frameRoutingId) => {
     const frame = webFrameMain.fromId(frameProcessId, frameRoutingId)
     if (frame) {
       const code = 'document.body.innerHTML = document.body.innerHTML.replaceAll("heck", "h*ck")'

docs/breaking-changes.md

@@ -36,7 +36,10 @@ requires unsafe mode), so Electron is unable to support this feature on Linux.
 
 ## Planned Breaking API Changes (19.0)
 
-None
+### Removed: IA32 Linux binaries
+
+This is a result of Chromium 102.0.4999.0 dropping support for IA32 Linux.
+This concludes the [removal of support for IA32 Linux](#removed-ia32-linux-support).
 
 ## Planned Breaking API Changes (18.0)
 
@@ -1203,6 +1206,10 @@ not present, then the native module will fail to load on Windows, with an error
 message like `Cannot find module`. See the [native module
 guide](/docs/tutorial/using-native-node-modules.md) for more.
 
+### Removed: IA32 Linux support
+
+Electron 18 will no longer run on 32-bit Linux systems. See [discontinuing support for 32-bit Linux](https://www.electronjs.org/blog/linux-32bit-support) for more information.
+
 ## Breaking API Changes (3.0)
 
 The following list includes the breaking API changes in Electron 3.0.

docs/fiddles/tutorial-first-app/index.html

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <meta
+      http-equiv="X-Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <title>Hello from Electron renderer!</title>
+  </head>
+  <body>
+    <h1>Hello from Electron renderer!</h1>
+    <p>👋</p>
+    <p id="info"></p>
+  </body>
+  <script src="./renderer.js"></script>
+</html>

docs/fiddles/tutorial-first-app/main.js

@@ -0,0 +1,26 @@
+const { app, BrowserWindow } = require('electron');
+
+const createWindow = () => {
+  const win = new BrowserWindow({
+    width: 800,
+    height: 600,
+  });
+
+  win.loadFile('index.html');
+};
+
+app.whenReady().then(() => {
+  createWindow();
+
+  app.on('activate', () => {
+    if (BrowserWindow.getAllWindows().length === 0) {
+      createWindow();
+    }
+  });
+});
+
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') {
+    app.quit();
+  }
+});

docs/fiddles/tutorial-preload/index.html

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <meta
+      http-equiv="X-Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <title>Hello from Electron renderer!</title>
+  </head>
+  <body>
+    <h1>Hello from Electron renderer!</h1>
+    <p>👋</p>
+    <p id="info"></p>
+  </body>
+  <script src="./renderer.js"></script>
+</html>

docs/fiddles/tutorial-preload/main.js

@@ -0,0 +1,30 @@
+const { app, BrowserWindow } = require('electron');
+const path = require('path');
+
+const createWindow = () => {
+  const win = new BrowserWindow({
+    width: 800,
+    height: 600,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload.js'),
+    },
+  });
+
+  win.loadFile('index.html');
+};
+
+app.whenReady().then(() => {
+  createWindow();
+
+  app.on('activate', () => {
+    if (BrowserWindow.getAllWindows().length === 0) {
+      createWindow();
+    }
+  });
+});
+
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') {
+    app.quit();
+  }
+});

docs/fiddles/tutorial-preload/preload.js

@@ -0,0 +1,7 @@
+const { contextBridge } = require('electron');
+
+contextBridge.exposeInMainWorld('versions', {
+  node: () => process.versions.node,
+  chrome: () => process.versions.chrome,
+  electron: () => process.versions.electron,
+});

docs/fiddles/tutorial-preload/renderer.js

@@ -0,0 +1,2 @@
+const information = document.getElementById('info');
+information.innerText = `This app is using Chrome (v${versions.chrome()}), Node.js (v${versions.node()}), and Electron (v${versions.electron()})`;

docs/tutorial/application-distribution.md

@@ -1,26 +1,26 @@
-# Application Distribution
+---
+title: 'Application Packaging'
+description: 'To distribute your app with Electron, you need to package and rebrand it. To do this, you can either use specialized tooling or manual approaches.'
+slug: application-distribution
+hide_title: false
+---
 
-## Overview
-
-To distribute your app with Electron, you need to package and rebrand it.
-To do this, you can either use specialized tooling or manual approaches.
+To distribute your app with Electron, you need to package and rebrand it. To do this, you
+can either use specialized tooling or manual approaches.
 
 ## With tooling
 
-You can use the following tools to distribute your application:
+There are a couple tools out there that exist to package and distribute your Electron app.
+We recommend using [Electron Forge](https://www.electronforge.io). You can check out
+its documentation directly, or refer to the [Packaging and Distribution](./tutorial-5-packaging.md)
+part of the Electron tutorial.
 
-* [electron-forge](https://github.com/electron-userland/electron-forge)
-* [electron-builder](https://github.com/electron-userland/electron-builder)
-* [electron-packager](https://github.com/electron/electron-packager)
+## Manual packaging
 
-These tools will take care of all the steps you need to take to end up with a
-distributable Electron application, such as bundling your application,
-rebranding the executable, and setting the right icons.
+If you prefer the manual approach, there are 2 ways to distribute your application:
 
-You can check the example of how to package your app with `electron-forge` in
-the [Quick Start guide](quick-start.md#package-and-distribute-your-application).
-
-## Manual distribution
+- With prebuilt binaries
+- With an app source code archive
 
 ### With prebuilt binaries
 
@@ -29,21 +29,19 @@ binaries](https://github.com/electron/electron/releases). Next, the folder
 containing your app should be named `app` and placed in Electron's resources
 directory as shown in the following examples.
 
-> *NOTE:* the location of Electron's prebuilt binaries is indicated
+:::note
+The location of Electron's prebuilt binaries is indicated
 with `electron/` in the examples below.
+:::
 
-*On macOS:*
-
-```plaintext
+```plain title='macOS'
 electron/Electron.app/Contents/Resources/app/
 ├── package.json
 ├── main.js
 └── index.html
 ```
 
-*On Windows and Linux:*
-
-```plaintext
+```plain title='Windows and Linux'
 electron/resources/app
 ├── package.json
 ├── main.js
@@ -54,7 +52,7 @@ Then execute `Electron.app` on macOS, `electron` on Linux, or `electron.exe`
 on Windows, and Electron will start as your app. The `electron` directory
 will then be your distribution to deliver to users.
 
-### With an app source code archive
+### With an app source code archive (asar)
 
 Instead of shipping your app by copying all of its source files, you can
 package your app into an [asar] archive to improve the performance of reading
@@ -65,16 +63,12 @@ To use an `asar` archive to replace the `app` folder, you need to rename the
 archive to `app.asar`, and put it under Electron's resources directory like
 below, and Electron will then try to read the archive and start from it.
 
-*On macOS:*
-
-```plaintext
+```plain title='macOS'
 electron/Electron.app/Contents/Resources/
 └── app.asar
 ```
 
-*On Windows and Linux:*
-
-```plaintext
+```plain title='Windows'
 electron/resources/
 └── app.asar
 ```
@@ -87,47 +81,44 @@ You can find more details on how to use `asar` in the
 After bundling your app into Electron, you will want to rebrand Electron
 before distributing it to users.
 
-#### macOS
+- **Windows:** You can rename `electron.exe` to any name you like, and edit
+  its icon and other information with tools like [rcedit](https://github.com/electron/rcedit).
+- **Linux:** You can rename the `electron` executable to any name you like.
+- **macOS:** You can rename `Electron.app` to any name you want, and you also have to rename
+  the `CFBundleDisplayName`, `CFBundleIdentifier` and `CFBundleName` fields in the
+  following files:
 
-You can rename `Electron.app` to any name you want, and you also have to rename
-the `CFBundleDisplayName`, `CFBundleIdentifier` and `CFBundleName` fields in the
-following files:
+  - `Electron.app/Contents/Info.plist`
+  - `Electron.app/Contents/Frameworks/Electron Helper.app/Contents/Info.plist`
 
-* `Electron.app/Contents/Info.plist`
-* `Electron.app/Contents/Frameworks/Electron Helper.app/Contents/Info.plist`
+  You can also rename the helper app to avoid showing `Electron Helper` in the
+  Activity Monitor, but make sure you have renamed the helper app's executable
+  file's name.
 
-You can also rename the helper app to avoid showing `Electron Helper` in the
-Activity Monitor, but make sure you have renamed the helper app's executable
-file's name.
+  The structure of a renamed app would be like:
 
-The structure of a renamed app would be like:
-
-```plaintext
+```plain
 MyApp.app/Contents
 ├── Info.plist
 ├── MacOS/
-│   └── MyApp
+│   └── MyApp
 └── Frameworks/
     └── MyApp Helper.app
         ├── Info.plist
         └── MacOS/
-            └── MyApp Helper
+            └── MyApp Helper
 ```
 
-#### Windows
+:::note
 
-You can rename `electron.exe` to any name you like, and edit its icon and other
-information with tools like [rcedit](https://github.com/electron/rcedit).
-
-#### Linux
-
-You can rename the `electron` executable to any name you like.
-
-### Rebranding by rebuilding Electron from source
-
-It is also possible to rebrand Electron by changing the product name and
+it is also possible to rebrand Electron by changing the product name and
 building it from source. To do this you need to set the build argument
 corresponding to the product name (`electron_product_name = "YourProductName"`)
 in the `args.gn` file and rebuild.
 
+Keep in mind this is not recommended as setting up the environment to compile
+from source is not trivial and takes significant time.
+
+:::
+
 [asar]: https://github.com/electron/asar

docs/tutorial/code-signing.md

@@ -1,14 +1,20 @@
-# Code Signing
+---
+title: 'Code Signing'
+description: 'Code signing is a security technology that you use to certify that an app was created by you.'
+slug: code-signing
+hide_title: false
+---
 
 Code signing is a security technology that you use to certify that an app was
-created by you.
+created by you. You should sign your application so it does not trigger any
+operating system security checks.
 
-On macOS the system can detect any change to the app, whether the change is
+On macOS, the system can detect any change to the app, whether the change is
 introduced accidentally or by malicious code.
 
 On Windows, the system assigns a trust level to your code signing certificate
 which if you don't have, or if your trust level is low, will cause security
-dialogs to appear when users start using your application.  Trust level builds
+dialogs to appear when users start using your application. Trust level builds
 over time so it's better to start code signing as early as possible.
 
 While it is possible to distribute unsigned apps, it is not recommended. Both
@@ -16,20 +22,19 @@ Windows and macOS will, by default, prevent either the download or the execution
 of unsigned applications. Starting with macOS Catalina (version 10.15), users
 have to go through multiple manual steps to open unsigned applications.
 
-![macOS Catalina Gatekeeper warning: The app cannot be opened because the
-developer cannot be verified](../images/gatekeeper.png)
+![macOS Catalina Gatekeeper warning: The app cannot be opened because the developer cannot be verified](../images/gatekeeper.png)
 
 As you can see, users get two options: Move the app straight to the trash or
 cancel running it. You don't want your users to see that dialog.
 
 If you are building an Electron app that you intend to package and distribute,
-it should be code-signed.
+it should be code signed.
 
-# Signing & notarizing macOS builds
+## Signing & notarizing macOS builds
 
-Properly preparing macOS applications for release requires two steps: First, the
-app needs to be code-signed. Then, the app needs to be uploaded to Apple for a
-process called "notarization", where automated systems will further verify that
+Properly preparing macOS applications for release requires two steps. First, the
+app needs to be code signed. Then, the app needs to be uploaded to Apple for a
+process called **notarization**, where automated systems will further verify that
 your app isn't doing anything to endanger its users.
 
 To start the process, ensure that you fulfill the requirements for signing and
@@ -42,18 +47,18 @@ notarizing your app:
 Electron's ecosystem favors configuration and freedom, so there are multiple
 ways to get your application signed and notarized.
 
-## `electron-forge`
+### Using Electron Forge
 
 If you're using Electron's favorite build tool, getting your application signed
 and notarized requires a few additions to your configuration. [Forge](https://electronforge.io) is a
 collection of the official Electron tools, using [`electron-packager`],
 [`electron-osx-sign`], and [`electron-notarize`] under the hood.
 
-Let's take a look at an example configuration with all required fields. Not all
-of them are required: the tools will be clever enough to automatically find a
-suitable `identity`, for instance, but we recommend that you are explicit.
+Let's take a look at an example `package.json` configuration with all required fields. Not all of them are
+required: the tools will be clever enough to automatically find a suitable `identity`, for instance,
+but we recommend that you are explicit.
 
-```json
+```json title="package.json" {7}
 {
   "name": "my-app",
   "version": "0.0.1",
@@ -69,7 +74,7 @@ suitable `identity`, for instance, but we recommend that you are explicit.
         },
         "osxNotarize": {
           "appleId": "felix@felix.fun",
-          "appleIdPassword": "my-apple-id-password",
+          "appleIdPassword": "my-apple-id-password"
         }
       }
     }
@@ -77,11 +82,11 @@ suitable `identity`, for instance, but we recommend that you are explicit.
 }
 ```
 
-The `plist` file referenced here needs the following macOS-specific entitlements
+The `entitlements.plist` file referenced here needs the following macOS-specific entitlements
 to assure the Apple security mechanisms that your app is doing these things
 without meaning any harm:
 
-```xml
+```xml title="entitlements.plist"
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -104,7 +109,7 @@ file](https://github.com/electron/fiddle/blob/master/forge.config.js).
 If you plan to access the microphone or camera within your app using Electron's APIs, you'll also
 need to add the following entitlements:
 
-```xml
+```xml title="entitlements.plist"
 <key>com.apple.security.device.audio-input</key>
 <true/>
 <key>com.apple.security.device.camera</key>
@@ -113,28 +118,26 @@ need to add the following entitlements:
 
 If these are not present in your app's entitlements when you invoke, for example:
 
-```js
+```js title="main.js"
 const { systemPreferences } = require('electron')
-
 const microphone = systemPreferences.askForMediaAccess('microphone')
 ```
 
 Your app may crash. See the Resource Access section in [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) for more information and entitlements you may need.
 
-## `electron-builder`
+### Using Electron Builder
 
 Electron Builder comes with a custom solution for signing your application. You
 can find [its documentation here](https://www.electron.build/code-signing).
 
-## `electron-packager`
+### Using Electron Packager
 
 If you're not using an integrated build pipeline like Forge or Builder, you
 are likely using [`electron-packager`], which includes [`electron-osx-sign`] and
 [`electron-notarize`].
 
 If you're using Packager's API, you can pass [in configuration that both signs
-and notarizes your
-application](https://electron.github.io/electron-packager/main/interfaces/electronpackager.options.html).
+and notarizes your application](https://electron.github.io/electron-packager/main/interfaces/electronpackager.options.html).
 
 ```js
 const packager = require('electron-packager')
@@ -155,11 +158,11 @@ packager({
 })
 ```
 
-The `plist` file referenced here needs the following macOS-specific entitlements
+The `entitlements.plist` file referenced here needs the following macOS-specific entitlements
 to assure the Apple security mechanisms that your app is doing these things
 without meaning any harm:
 
-```xml
+```xml title="entitlements.plist"
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -175,11 +178,11 @@ without meaning any harm:
 Up until Electron 12, the `com.apple.security.cs.allow-unsigned-executable-memory` entitlement was required
 as well. However, it should not be used anymore if it can be avoided.
 
-## Mac App Store
+### Signing Mac App Store applications
 
 See the [Mac App Store Guide].
 
-# Signing Windows builds
+## Signing Windows builds
 
 Before signing Windows builds, you must do the following:
 
@@ -190,31 +193,140 @@ Before signing Windows builds, you must do the following:
 You can get a code signing certificate from a lot of resellers. Prices vary, so
 it may be worth your time to shop around. Popular resellers include:
 
-* [digicert](https://www.digicert.com/code-signing/microsoft-authenticode.htm)
-* [Sectigo](https://sectigo.com/ssl-certificates-tls/code-signing)
-* Amongst others, please shop around to find one that suits your needs, Google
-  is your friend 😄
+- [digicert](https://www.digicert.com/code-signing/microsoft-authenticode.htm)
+- [Sectigo](https://sectigo.com/ssl-certificates-tls/code-signing)
+- Amongst others, please shop around to find one that suits your needs! 😄
 
-There are a number of tools for signing your packaged app:
+:::caution Keep your certificate password private
+Your certificate password should be a **secret**. Do not share it publicly or
+commit it to your source code.
+:::
 
-* [`electron-winstaller`] will generate an installer for windows and sign it for
-  you
-* [`electron-forge`] can sign installers it generates through the
-  Squirrel.Windows or MSI targets.
-* [`electron-builder`] can sign some of its windows targets
+### Using Electron Forge
 
-## Windows Store
+Once you have a code signing certificate file (`.pfx`), you can sign
+[Squirrel.Windows][maker-squirrel] and [MSI][maker-msi] installers in Electron Forge
+with the `certificateFile` and `certificatePassword` fields in their respective
+configuration objects.
+
+For example, if you keep your Forge config in your `package.json` file and are
+creating a Squirrel.Windows installer:
+
+```json {9-15} title='package.json'
+{
+  "name": "my-app",
+  "version": "0.0.1",
+  //...
+  "config": {
+    "forge": {
+      "packagerConfig": {},
+      "makers": [
+        {
+          "name": "@electron-forge/maker-squirrel",
+          "config": {
+            "certificateFile": "./cert.pfx",
+            "certificatePassword": "this-is-a-secret"
+          }
+        }
+      ]
+    }
+  }
+  //...
+}
+```
+
+### Using electron-winstaller (Squirrel.Windows)
+
+[`electron-winstaller`] is a package that can generate Squirrel.Windows installers for your
+Electron app. This is the tool used under the hood by Electron Forge's
+[Squirrel.Windows Maker][maker-squirrel]. If you're not using Electron Forge and want to use
+`electron-winstaller` directly, use the `certificateFile` and `certificatePassword` configuration
+options when creating your installer.
+
+```js {10-11}
+const electronInstaller = require('electron-winstaller')
+// NB: Use this syntax within an async function, Node does not have support for
+//     top-level await as of Node 12.
+try {
+  await electronInstaller.createWindowsInstaller({
+    appDirectory: '/tmp/build/my-app-64',
+    outputDirectory: '/tmp/build/installer64',
+    authors: 'My App Inc.',
+    exe: 'myapp.exe',
+    certificateFile: './cert.pfx',
+    certificatePassword: 'this-is-a-secret',
+  })
+  console.log('It worked!')
+} catch (e) {
+  console.log(`No dice: ${e.message}`)
+}
+```
+
+For full configuration options, check out the [`electron-winstaller`] repository!
+
+### Using electron-wix-msi (WiX MSI)
+
+[`electron-wix-msi`] is a package that can generate MSI installers for your
+Electron app. This is the tool used under the hood by Electron Forge's [MSI Maker][maker-msi].
+
+If you're not using Electron Forge and want to use `electron-wix-msi` directly, use the
+`certificateFile` and `certificatePassword` configuration options
+or pass in parameters directly to [SignTool.exe] with the `signWithParams` option.
+
+```js {12-13}
+import { MSICreator } from 'electron-wix-msi'
+
+// Step 1: Instantiate the MSICreator
+const msiCreator = new MSICreator({
+  appDirectory: '/path/to/built/app',
+  description: 'My amazing Kitten simulator',
+  exe: 'kittens',
+  name: 'Kittens',
+  manufacturer: 'Kitten Technologies',
+  version: '1.1.2',
+  outputDirectory: '/path/to/output/folder',
+  certificateFile: './cert.pfx',
+  certificatePassword: 'this-is-a-secret',
+})
+
+// Step 2: Create a .wxs template file
+const supportBinaries = await msiCreator.create()
+
+// 🆕 Step 2a: optionally sign support binaries if you
+// sign you binaries as part of of your packaging script
+supportBinaries.forEach(async (binary) => {
+  // Binaries are the new stub executable and optionally
+  // the Squirrel auto updater.
+  await signFile(binary)
+})
+
+// Step 3: Compile the template to a .msi file
+await msiCreator.compile()
+```
+
+For full configuration options, check out the [`electron-wix-msi`] repository!
+
+### Using Electron Builder
+
+Electron Builder comes with a custom solution for signing your application. You
+can find [its documentation here](https://www.electron.build/code-signing).
+
+### Signing Windows Store applications
 
 See the [Windows Store Guide].
 
-[Apple Developer Program]: https://developer.apple.com/programs/
+[apple developer program]: https://developer.apple.com/programs/
 [`electron-builder`]: https://github.com/electron-userland/electron-builder
 [`electron-forge`]: https://github.com/electron-userland/electron-forge
 [`electron-osx-sign`]: https://github.com/electron-userland/electron-osx-sign
 [`electron-packager`]: https://github.com/electron/electron-packager
 [`electron-notarize`]: https://github.com/electron/electron-notarize
 [`electron-winstaller`]: https://github.com/electron/windows-installer
-[Xcode]: https://developer.apple.com/xcode
+[`electron-wix-msi`]: https://github.com/felixrieseberg/electron-wix-msi
+[xcode]: https://developer.apple.com/xcode
 [signing certificates]: https://github.com/electron/electron-osx-sign/wiki/1.-Getting-Started#certificates
-[Mac App Store Guide]: mac-app-store-submission-guide.md
-[Windows Store Guide]: windows-store-guide.md
+[mac app store guide]: ./mac-app-store-submission-guide.md
+[windows store guide]: ./windows-store-guide.md
+[maker-squirrel]: https://www.electronforge.io/config/makers/squirrel.windows
+[maker-msi]: https://www.electronforge.io/config/makers/wix-msi
+[signtool.exe]: https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe

docs/tutorial/distribution-overview.md

@@ -0,0 +1,54 @@
+---
+title: 'Distribution Overview'
+description: 'To distribute your app with Electron, you need to package and rebrand it. To do this, you can either use specialized tooling or manual approaches.'
+slug: distribution-overview
+hide_title: false
+---
+
+Once your app is ready for production, there are a couple steps you need to take before
+you can deliver it to your users.
+
+## Packaging
+
+To distribute your app with Electron, you need to package all your resources and assets
+into an executable and rebrand it. To do this, you can either use specialized tooling
+or do it manually. See the [Application Packaging][application-packaging] tutorial
+for more information.
+
+## Code signing
+
+Code signing is a security technology that you use to certify that an app was
+created by you. You should sign your application so it does not trigger the
+security checks of your user's operating system.
+
+To get started with each operating system's code signing process, please read the
+[Code Signing][code-signing] docs.
+
+## Publishing
+
+Once your app is packaged and signed, you can freely distribute your app directly
+to users by uploading your installers online.
+
+To reach more users, you can also choose to upload your app to each operating system's
+digital distribution platform (i.e. app store). These require another build step aside
+from your direct download app. For more information, check out each individual app store guide:
+
+- [Mac App Store][mac-app]
+- [Windows Store][windows-store]
+- [Snapcraft (Linux)][snapcraft]
+
+## Updating
+
+Electron's auto-updater allows you to deliver application updates to users
+without forcing them to manually download new versions of your application.
+Check out the [Updating Applications][updates] guide for details on implementing automatic updates
+with Electron.
+
+<!-- Link labels -->
+
+[application-packaging]: ./application-distribution.md
+[code-signing]: ./code-signing.md
+[mac-app]: ./mac-app-store-submission-guide.md
+[windows-store]: ./windows-store-guide.md
+[snapcraft]: ./snapcraft.md
+[updates]: ./updates.md

docs/tutorial/electron-timelines.md

@@ -22,11 +22,12 @@ check out our [Electron Versioning](./electron-versioning.md) doc.
 | 12.0.0 | -- | 2020-Nov-19 | 2021-Mar-02 | M89 | v14.16 | 🚫 |
 | 13.0.0 | -- | 2021-Mar-04 | 2021-May-25 | M91 | v14.16 | 🚫 |
 | 14.0.0 | -- | 2021-May-27 | 2021-Aug-31 | M93 | v14.17 | 🚫 |
-| 15.0.0 | 2021-Jul-20 | 2021-Sep-01 | 2021-Sep-21 | M94 | v16.5 | ✅ |
-| 16.0.0 | 2021-Sep-23 | 2021-Oct-20 | 2021-Nov-16 | M96 | v16.9 | ✅ |
+| 15.0.0 | 2021-Jul-20 | 2021-Sep-01 | 2021-Sep-21 | M94 | v16.5 | 🚫 |
+| 16.0.0 | 2021-Sep-23 | 2021-Oct-20 | 2021-Nov-16 | M96 | v16.9 | 🚫 |
 | 17.0.0 | 2021-Nov-18 | 2022-Jan-06 | 2022-Feb-01 | M98 | v16.13 | ✅ |
 | 18.0.0 | 2022-Feb-03 | 2022-Mar-03 | 2022-Mar-29 | M100 | v16.13 | ✅ |
-| 19.0.0 | 2022-Mar-31 | 2022-Apr-26 | 2022-May-24 | M102 | TBD | ✅ |
+| 19.0.0 | 2022-Mar-31 | 2022-Apr-26 | 2022-May-24 | M102 | v16.14 | ✅ |
+| 20.0.0 | 2022-May-26 | 2022-Jun-21 | 2022-Aug-02 | M104 | TBD | ✅ |
 
 **Notes:**
 

docs/tutorial/examples.md

@@ -0,0 +1,56 @@
+---
+title: 'Examples Overview'
+description: 'A set of examples for common Electron features'
+slug: examples
+hide_title: false
+---
+
+# Examples Overview
+
+In this section, we have collected a set of guides for common features
+that you may want to implement in your Electron application. Each guide
+contains a practical example in a minimal, self-contained example app.
+The easiest way to run these examples is by downloading [Electron Fiddle][fiddle].
+
+Once Fiddle is installed, you can press on the "Open in Fiddle" button that you
+will find below code samples like the following one:
+
+```fiddle docs/fiddles/quick-start
+window.addEventListener('DOMContentLoaded', () => {
+  const replaceText = (selector, text) => {
+    const element = document.getElementById(selector)
+    if (element) element.innerText = text
+  }
+
+  for (const type of ['chrome', 'node', 'electron']) {
+    replaceText(`${type}-version`, process.versions[type])
+  }
+})
+```
+
+If there is still something that you do not know how to do, please take a look at the [API][app]
+as there is a chance it might be documented just there (and also open an issue requesting the
+guide!).
+
+<!-- guide-table-start -->
+
+| Guide                 | Description                                                                                                         |
+| :-------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| [Message ports]       | This guide provides some examples of how you might use MessagePorts in your app to communicate different processes. |
+| [Device access]       | Learn how to access the device hardware (Bluetooth, USB, Serial).                                                   |
+| [Keyboard shortcuts]  | Configure local and global keyboard shortcuts for your Electron application.                                        |
+| [Multithreading]      | With Web Workers, it is possible to run JavaScript in OS-level threads                                              |
+| [Offscreen rendering] | Offscreen rendering lets you obtain the content of a BrowserWindow in a bitmap, so it can be rendered anywhere.     |
+| [Spellchecker]        | Learn how to use the built-in spellchecker, set languages, etc.                                                     |
+| [Web embeds]          | Discover the different ways to embed third-party web content in your application.                                   |
+
+<!-- guide-table-end -->
+
+## How to...?
+
+You can find the full list of "How to?" in the sidebar. If there is
+something that you would like to do that is not documented, please join
+our [Discord server][] and let us know!
+
+[discord server]: https://discord.com/invite/electron
+[fiddle]: https://www.electronjs.org/fiddle

docs/tutorial/introduction.md

@@ -1,10 +1,11 @@
-# Introduction
+---
+title: 'Introduction'
+description: 'Welcome to the Electron documentation! If this is your first time developing an Electron app, read through this Getting Started section to get familiar with the basics. Otherwise, feel free to explore our guides and API documentation!'
+slug: /latest/
+hide_title: false
+---
 
-Welcome to the Electron documentation! If this is your first time developing
-an Electron app, read through this Getting Started section to get familiar with the
-basics. Otherwise, feel free to explore our guides and API documentation!
-
-## What is Electron?
+# What is Electron?
 
 Electron is a framework for building desktop applications using JavaScript,
 HTML, and CSS. By embedding [Chromium][chromium] and [Node.js][node] into its
@@ -12,20 +13,12 @@ binary, Electron allows you to maintain one JavaScript codebase and create
 cross-platform apps that work on Windows, macOS, and Linux — no native development
 experience required.
 
-## Prerequisites
+## Getting started
 
-These docs operate under the assumption that the reader is familiar with both
-Node.js and general web development. If you need to get more comfortable with
-either of these areas, we recommend the following resources:
-
-* [Getting started with the Web (MDN)][mdn-guide]
-* [Introduction to Node.js][node-guide]
-
-Moreover, you'll have a better time understanding how Electron works if you get
-acquainted with Chromium's process model. You can get a brief overview of
-Chrome architecture with the [Chrome comic][comic], which was released alongside
-Chrome's launch back in 2008. Although it's been over a decade since then, the
-core principles introduced in the comic remain helpful to understand Electron.
+We recommend you to start with the [tutorial], which guides you through the
+process of developing an Electron app and distributing it to users.
+The [examples] and [API documentation] are also good places to browse around
+and discover new things.
 
 ## Running examples with Electron Fiddle
 
@@ -39,21 +32,45 @@ a code block. If you have Fiddle installed, this button will open a
 `fiddle.electronjs.org` link that will automatically load the example into Fiddle,
 no copy-pasting required.
 
+```fiddle docs/fiddles/quick-start
+```
+
+## What is in the docs?
+
+All the official documentation is available from the sidebar. These
+are the different categories and what you can expect on each one:
+
+- **Tutorial**: An end-to-end guide on how to create and publish your first Electron
+  application.
+- **Processes in Electron**: In-depth reference on Electron processes and how to work with them.
+- **Best Practices**: Important checklists to keep in mind when developing an Electron app.
+- **Examples**: Quick references to add features to your Electron app.
+- **Development**: Miscellaneous development guides.
+- **Distribution**: Learn how to distribute your app to end users.
+- **Testing and debugging**: How to debug JavaScript, write tests, and other tools used
+  to create quality Electron applications.
+- **References**: Useful links to better understand how the Electron project works
+  and is organized.
+- **Contributing**: Compiling Electron and making contributions can be daunting.
+  We try to make it easier in this section.
+
 ## Getting help
 
 Are you getting stuck anywhere? Here are a few links to places to look:
 
-* If you need help with developing your app, our [community Discord server][discord]
-is a great place to get advice from other Electron app developers.
-* If you suspect you're running into a bug with the `electron` package, please check
-the [GitHub issue tracker][issue-tracker] to see if any existing issues match your
-problem. If not, feel free to fill out our bug report template and submit a new issue.
+- If you need help with developing your app, our [community Discord server][discord]
+  is a great place to get advice from other Electron app developers.
+- If you suspect you're running into a bug with the `electron` package, please check
+  the [GitHub issue tracker][issue-tracker] to see if any existing issues match your
+  problem. If not, feel free to fill out our bug report template and submit a new issue.
 
+<!-- Links -->
+
+[tutorial]: tutorial-1-prerequisites.md
+[api documentation]: ../api/app.md
 [chromium]: https://www.chromium.org/
-[node]: https://nodejs.org/
-[mdn-guide]: https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web
-[node-guide]: https://nodejs.dev/learn
-[comic]: https://www.google.com/googlebooks/chrome/
+[discord]: https://discord.com/invite/APGC3k5yaH
+[examples]: examples.md
 [fiddle]: https://electronjs.org/fiddle
 [issue-tracker]: https://github.com/electron/electron/issues
-[discord]: https://discord.gg/electronjs
+[node]: https://nodejs.org/

docs/tutorial/message-ports.md

@@ -8,8 +8,7 @@ your app.
 
 Here is a very brief example of what a MessagePort is and how it works:
 
-```js
-// renderer.js ///////////////////////////////////////////////////////////////
+```js title='renderer.js (Renderer Process)'
 // MessagePorts are created in pairs. A connected pair of message ports is
 // called a channel.
 const channel = new MessageChannel()
@@ -28,8 +27,7 @@ port2.postMessage({ answer: 42 })
 ipcRenderer.postMessage('port', null, [port1])
 ```
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 // In the main process, we receive the port.
 ipcMain.on('port', (event) => {
   // When we receive a MessagePort in the main process, it becomes a
@@ -84,14 +82,84 @@ process, you can listen for the `close` event by calling `port.on('close',
 
 ## Example use cases
 
+### Setting up a MessageChannel between two renderers
+
+In this example, the main process sets up a MessageChannel, then sends each port
+to a different renderer. This allows renderers to send messages to each other
+without needing to use the main process as an in-between.
+
+```js title='main.js (Main Process)'
+const { BrowserWindow, app, MessageChannelMain } = require('electron')
+
+app.whenReady().then(async () => {
+  // create the windows.
+  const mainWindow = new BrowserWindow({
+    show: false,
+    webPreferences: {
+      contextIsolation: false,
+      preload: 'preloadMain.js'
+    }
+  })
+
+  const secondaryWindow = BrowserWindow({
+    show: false,
+    webPreferences: {
+      contextIsolation: false,
+      preload: 'preloadSecondary.js'
+    }
+  })
+
+  // set up the channel.
+  const { port1, port2 } = new MessageChannelMain()
+
+  // once the webContents are ready, send a port to each webContents with postMessage.
+  mainWindow.once('ready-to-show', () => {
+    mainWindow.webContents.postMessage('port', null, [port1])
+  })
+
+  secondaryWindow.once('ready-to-show', () => {
+    secondaryWindow.webContents.postMessage('port', null, [port2])
+  })
+})
+```
+
+Then, in your preload scripts you receive the port through IPC and set up the
+listeners.
+
+```js title='preloadMain.js and preloadSecondary.js (Preload scripts)'
+const { ipcRenderer } = require('electron')
+
+ipcRenderer.on('port', e => {
+  // port received, make it globally available.
+  window.electronMessagePort = e.ports[0]
+
+  window.electronMessagePort.onmessage = messageEvent => {
+    // handle message
+  }
+})
+```
+
+In this example messagePort is bound to the `window` object directly. It is better
+to use `contextIsolation` and set up specific contextBridge calls for each of your
+expected messages, but for the simplicity of this example we don't. You can find an
+example of context isolation further down this page at [Communicating directly between the main process and the main world of a context-isolated page](#communicating-directly-between-the-main-process-and-the-main-world-of-a-context-isolated-page)
+
+That means window.messagePort is globally available and you can call
+`postMessage` on it from anywhere in your app to send a message to the other
+renderer.
+
+```js title='renderer.js (Renderer Process)'
+// elsewhere in your code to send a message to the other renderers message handler
+window.electronMessagePort.postmessage('ping')
+```
+
 ### Worker process
 
 In this example, your app has a worker process implemented as a hidden window.
 You want the app page to be able to communicate directly with the worker
 process, without the performance overhead of relaying via the main process.
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 const { BrowserWindow, app, ipcMain, MessageChannelMain } = require('electron')
 
 app.whenReady().then(async () => {
@@ -129,8 +197,7 @@ app.whenReady().then(async () => {
 })
 ```
 
-```html
-<!-- worker.html ------------------------------------------------------------>
+```html  title='worker.html'
 <script>
 const { ipcRenderer } = require('electron')
 
@@ -153,8 +220,7 @@ ipcRenderer.on('new-client', (event) => {
 </script>
 ```
 
-```html
-<!-- app.html --------------------------------------------------------------->
+```html  title='app.html'
 <script>
 const { ipcRenderer } = require('electron')
 
@@ -182,9 +248,7 @@ Electron's built-in IPC methods only support two modes: fire-and-forget
 can implement a "response stream", where a single request responds with a
 stream of data.
 
-```js
-// renderer.js ///////////////////////////////////////////////////////////////
-
+```js title='renderer.js (Renderer Process)'
 const makeStreamingRequest = (element, callback) => {
   // MessageChannels are lightweight--it's cheap to create a new one for each
   // request.
@@ -213,9 +277,7 @@ makeStreamingRequest(42, (data) => {
 // We will see "got response data: 42" 10 times.
 ```
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
-
+```js  title='main.js (Main Process)'
 ipcMain.on('give-me-a-stream', (event, msg) => {
   // The renderer has sent us a MessagePort that it wants us to send our
   // response over.
@@ -242,8 +304,7 @@ the renderer are delivered to the isolated world, rather than to the main
 world. Sometimes you want to deliver messages to the main world directly,
 without having to step through the isolated world.
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 const { BrowserWindow, app, MessageChannelMain } = require('electron')
 const path = require('path')
 
@@ -278,8 +339,7 @@ app.whenReady().then(async () => {
 })
 ```
 
-```js
-// preload.js ////////////////////////////////////////////////////////////////
+```js title='preload.js (Preload Script)'
 const { ipcRenderer } = require('electron')
 
 // We need to wait until the main world is ready to receive the message before
@@ -297,8 +357,7 @@ ipcRenderer.on('main-world-port', async (event) => {
 })
 ```
 
-```html
-<!-- index.html ------------------------------------------------------------->
+```html title='index.html'
 <script>
 window.onmessage = (event) => {
   // event.source === window means the message is coming from the preload

docs/tutorial/process-model.md

@@ -1,10 +1,17 @@
+---
+title: 'Process Model'
+description: 'Electron inherits its multi-process architecture from Chromium, which makes the framework architecturally very similar to a modern web browser. This guide will expand on the concepts applied in the tutorial.'
+slug: process-model
+hide_title: false
+---
+
 # Process Model
 
 Electron inherits its multi-process architecture from Chromium, which makes the framework
-architecturally very similar to a modern web browser. In this guide, we'll expound on
-the conceptual knowledge of Electron that we applied in the minimal [quick start app][].
+architecturally very similar to a modern web browser. This guide will expand on the
+concepts applied in the [Tutorial][tutorial].
 
-[quick start app]: ./quick-start.md
+[tutorial]: ./tutorial-1-prerequisites.md
 
 ## Why not a single process?
 
@@ -27,10 +34,10 @@ visualizes this model:
 ![Chrome's multi-process architecture](../images/chrome-processes.png)
 
 Electron applications are structured very similarly. As an app developer, you control
-two types of processes: main and renderer. These are analogous to Chrome's own browser
-and renderer processes outlined above.
+two types of processes: [main](#the-main-process) and [renderer](#the-renderer-process).
+These are analogous to Chrome's own browser and renderer processes outlined above.
 
-[Chrome Comic]: https://www.google.com/googlebooks/chrome/
+[chrome comic]: https://www.google.com/googlebooks/chrome/
 
 ## The main process
 
@@ -40,7 +47,7 @@ to `require` modules and use all of Node.js APIs.
 
 ### Window management
 
-The primary purpose of the main process is to create and manage application windows with the
+The main process' primary purpose is to create and manage application windows with the
 [`BrowserWindow`][browser-window] module.
 
 Each instance of the `BrowserWindow` class creates an application window that loads
@@ -68,7 +75,7 @@ When a `BrowserWindow` instance is destroyed, its corresponding renderer process
 terminated as well.
 
 [browser-window]: ../api/browser-window.md
-[web-embed]: ./web-embeds.md
+[web-embed]: ../tutorial/web-embeds.md
 [web-contents]: ../api/web-contents.md
 [event-emitter]: https://nodejs.org/api/events.html#events_class_eventemitter
 
@@ -90,7 +97,7 @@ app.on('window-all-closed', () => {
 ```
 
 [app]: ../api/app.md
-[quick-start-lifecycle]: ./quick-start.md#manage-your-windows-lifecycle
+[quick-start-lifecycle]: ../tutorial/quick-start.md#manage-your-windows-lifecycle
 
 ### Native APIs
 
@@ -105,7 +112,7 @@ For a full list of Electron's main process modules, check out our API documentat
 
 Each Electron app spawns a separate renderer process for each open `BrowserWindow`
 (and each web embed). As its name implies, a renderer is responsible for
-*rendering* web content. For all intents and purposes, code ran in renderer processes
+_rendering_ web content. For all intents and purposes, code ran in renderer processes
 should behave according to web standards (insofar as Chromium does, at least).
 
 Therefore, all user interfaces and app functionality within a single browser
@@ -115,18 +122,22 @@ web.
 Although explaining every web spec is out of scope for this guide, the bare minimum
 to understand is:
 
-* An HTML file is your entry point for the renderer process.
-* UI styling is added through Cascading Style Sheets (CSS).
-* Executable JavaScript code can be added through `<script>` elements.
+- An HTML file is your entry point for the renderer process.
+- UI styling is added through Cascading Style Sheets (CSS).
+- Executable JavaScript code can be added through `<script>` elements.
 
 Moreover, this also means that the renderer has no direct access to `require`
 or other Node.js APIs. In order to directly include NPM modules in the renderer,
 you must use the same bundler toolchains (for example, `webpack` or `parcel`) that you
 use on the web.
 
-> Note: Renderer processes can be spawned with a full Node.js environment for ease of
-> development. Historically, this used to be the default, but this feature was disabled
-> for security reasons.
+:::warning
+
+Renderer processes can be spawned with a full Node.js environment for ease of
+development. Historically, this used to be the default, but this feature was disabled
+for security reasons.
+
+:::
 
 At this point, you might be wondering how your renderer process user interfaces
 can interact with Node.js and Electron's native desktop functionality if these
@@ -135,8 +146,9 @@ way to import Electron's content scripts.
 
 ## Preload scripts
 
-<!-- Note: This guide doesn't take sandboxing into account, which might fundamentally 
+<!-- Note: This guide doesn't take sandboxing into account, which might fundamentally
 change the statements here. -->
+
 Preload scripts contain code that executes in a renderer process before its web content
 begins loading. These scripts run within the renderer context, but are granted more
 privileges by having access to Node.js APIs.
@@ -149,8 +161,8 @@ const { BrowserWindow } = require('electron')
 //...
 const win = new BrowserWindow({
   webPreferences: {
-    preload: 'path/to/preload.js'
-  }
+    preload: 'path/to/preload.js',
+  },
 })
 //...
 ```
@@ -165,7 +177,7 @@ the [`contextIsolation`][context-isolation] default.
 
 ```js title='preload.js'
 window.myAPI = {
-  desktop: true
+  desktop: true,
 }
 ```
 
@@ -184,7 +196,7 @@ securely:
 const { contextBridge } = require('electron')
 
 contextBridge.exposeInMainWorld('myAPI', {
-  desktop: true
+  desktop: true,
 })
 ```
 
@@ -195,14 +207,15 @@ console.log(window.myAPI)
 
 This feature is incredibly useful for two main purposes:
 
-* By exposing [`ipcRenderer`][ipcRenderer] helpers to the renderer, you can use
+- By exposing [`ipcRenderer`][ipcrenderer] helpers to the renderer, you can use
   inter-process communication (IPC) to trigger main process tasks from the
   renderer (and vice-versa).
-* If you're developing an Electron wrapper for an existing web app hosted on a remote
+- If you're developing an Electron wrapper for an existing web app hosted on a remote
   URL, you can add custom properties onto the renderer's `window` global that can
   be used for desktop-only logic on the web client's side.
 
 [window-mdn]: https://developer.mozilla.org/en-US/docs/Web/API/Window
 [context-isolation]: ./context-isolation.md
 [context-bridge]: ../api/context-bridge.md
-[ipcRenderer]: ../api/ipc-renderer.md
+[ipcrenderer]: ../api/ipc-renderer.md
+[tutorial]: ./tutorial-1-prerequisites.md

docs/tutorial/quick-start.md

@@ -131,7 +131,6 @@ folder of your project:
     <meta charset="UTF-8">
     <!-- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -->
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">
-    <meta http-equiv="X-Content-Security-Policy" content="default-src 'self'; script-src 'self'">
     <title>Hello World!</title>
   </head>
   <body>
@@ -427,7 +426,6 @@ window.addEventListener('DOMContentLoaded', () => {
     <meta charset="UTF-8">
     <!-- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -->
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">
-    <meta http-equiv="X-Content-Security-Policy" content="default-src 'self'; script-src 'self'">
     <title>Hello World!</title>
   </head>
   <body>

docs/tutorial/tutorial-1-prerequisites.md

@@ -0,0 +1,143 @@
+---
+title: 'Prerequisites'
+description: 'This guide will step you through the process of creating a barebones Hello World app in Electron, similar to electron/electron-quick-start.'
+slug: tutorial-prerequisites
+hide_title: false
+---
+
+:::info Follow along the tutorial
+
+This is **part 1** of the Electron tutorial.
+
+1. **[Prerequisites][prerequisites]**
+1. [Building your First App][building your first app]
+1. [Using Preload Scripts][preload]
+1. [Adding Features][features]
+1. [Packaging Your Application][packaging]
+1. [Publishing and Updating][updates]
+
+:::
+
+Electron is a framework for building desktop applications using JavaScript,
+HTML, and CSS. By embedding [Chromium][chromium] and [Node.js][node] into a
+single binary file, Electron allows you to create cross-platform apps that
+work on Windows, macOS, and Linux with a single JavaScript codebase.
+
+This tutorial will guide you through the process of developing a desktop
+application with Electron and distributing it to end users.
+
+## Assumptions
+
+Electron is a native wrapper layer for web apps and is run in a Node.js environment.
+Therefore, this tutorial assumes you are generally familiar with Node and
+front-end web development basics. If you need to do some background reading before
+continuing, we recommend the following resources:
+
+- [Getting started with the Web (MDN Web Docs)][mdn-guide]
+- [Introduction to Node.js][node-guide]
+
+## Required tools
+
+### Code editor
+
+You will need a text editor to write your code. We recommend using [Visual Studio Code],
+although you can choose whichever one you prefer.
+
+### Command line
+
+Throughout the tutorial, we will ask you to use various command-line interfaces (CLIs). You can
+type these commands into your system's default terminal:
+
+- Windows: Command Prompt or PowerShell
+- macOS: Terminal
+- Linux: varies depending on distribution (e.g. GNOME Terminal, Konsole)
+
+Most code editors also come with an integrated terminal, which you can also use.
+
+### Git and GitHub
+
+Git is a commonly-used version control system for source code, and GitHub is a collaborative
+development platform built on top of it. Although neither is strictly necessary to building
+an Electron application, we will use GitHub releases to set up automatic updates later
+on in the tutorial. Therefore, we'll require you to:
+
+- [Create a GitHub account](https://github.com/join)
+- [Install Git](https://github.com/git-guides/install-git)
+
+If you're unfamiliar with how Git works, we recommend reading GitHub's [Git guides]. You can also
+use the [GitHub Desktop] app if you prefer using a visual interface over the command line.
+
+We recommend that you create a local Git repository and publish it to GitHub before starting
+the tutorial, and commit your code after every step.
+
+:::info Installing Git via GitHub Desktop
+
+GitHub Desktop will install the latest version of Git on your system if you don't already have
+it installed.
+
+:::
+
+### Node.js and npm
+
+To begin developing an Electron app, you need to install the [Node.js][node-download]
+runtime and its bundled npm package manager onto your system. We recommend that you
+use the latest long-term support (LTS) version.
+
+:::tip
+
+Please install Node.js using pre-built installers for your platform.
+You may encounter incompatibility issues with different development tools otherwise.
+If you are using macOS, we recommend using a package manager like [Homebrew] or
+[nvm] to avoid any directory permission issues.
+
+:::
+
+To check that Node.js was installed correctly, you can use the `-v` flag when
+running the `node` and `npm` commands. These should print out the installed
+versions.
+
+```sh
+$ node -v
+v16.14.2
+$ npm -v
+8.7.0
+```
+
+:::caution
+
+Although you need Node.js installed locally to scaffold an Electron project,
+Electron **does not use your system's Node.js installation to run its code**. Instead, it
+comes bundled with its own Node.js runtime. This means that your end users do not
+need to install Node.js themselves as a prerequisite to running your app.
+
+To check which version of Node.js is running in your app, you can access the global
+[`process.versions`] variable in the main process or preload script. You can also reference
+the list of versions in the [electron/releases] repository.
+
+:::
+
+<!-- Links -->
+
+[chromium]: https://www.chromium.org/
+[electron/releases]: https://github.com/electron/releases/blob/master/readme.md#releases
+[homebrew]: https://brew.sh/
+[mdn-guide]: https://developer.mozilla.org/en-US/docs/Learn/
+[node]: https://nodejs.org/
+[node-guide]: https://nodejs.dev/learn
+[node-download]: https://nodejs.org/en/download/
+[nvm]: https://github.com/nvm-sh/nvm
+[process-model]: ./process-model.md
+[`process.versions`]: https://nodejs.org/api/process.html#processversions
+[github]: https://github.com/
+[git guides]: https://github.com/git-guides/
+[github desktop]: https://desktop.github.com/
+[visual studio code]: https://code.visualstudio.com/
+
+<!-- Tutorial links -->
+
+[prerequisites]: tutorial-1-prerequisites.md
+[building your first app]: tutorial-2-first-app.md
+[preload]: tutorial-3-preload.md
+[features]: tutorial-4-adding-features.md
+[packaging]: tutorial-5-packaging.md
+[updates]: tutorial-6-publishing-updating.md

docs/tutorial/tutorial-2-first-app.md

@@ -0,0 +1,480 @@
+---
+title: 'Building your First App'
+description: 'This guide will step you through the process of creating a barebones Hello World app in Electron, similar to electron/electron-quick-start.'
+slug: tutorial-first-app
+hide_title: false
+---
+
+:::info Follow along the tutorial
+
+This is **part 2** of the Electron tutorial.
+
+1. [Prerequisites][prerequisites]
+1. **[Building your First App][building your first app]**
+1. [Using Preload Scripts][preload]
+1. [Adding Features][features]
+1. [Packaging Your Application][packaging]
+1. [Publishing and Updating][updates]
+
+:::
+
+## Learning goals
+
+In this part of the tutorial, you will learn how to set up your Electron project
+and write a minimal starter application. By the end of this section,
+you should be able to run a working Electron app in development mode from
+your terminal.
+
+## Setting up your project
+
+:::caution Avoid WSL
+
+If you are on a Windows machine, please do not use [Windows Subsystem for Linux][wsl] (WSL)
+when following this tutorial as you will run into issues when trying to execute the
+application.
+
+<!--https://www.electronforge.io/guides/developing-with-wsl-->
+
+:::
+
+### Initializing your npm project
+
+Electron apps are scaffolded using npm, with the package.json file
+as an entry point. Start by creating a folder and initializing an npm package
+within it with `npm init`.
+
+```sh npm2yarn
+mkdir my-electron-app && cd my-electron-app
+npm init
+```
+
+This command will prompt you to configure some fields in your package.json.
+There are a few rules to follow for the purposes of this tutorial:
+
+- _entry point_ should be `main.js` (you will be creating that file soon).
+- _author_, _license_, and _description_ can be any value, but will be necessary for
+  [packaging][packaging] later on.
+
+Then, install Electron into your app's **devDependencies**, which is the list of external
+development-only package dependencies not required in production.
+
+:::info Why is Electron a devDependency?
+
+This may seem counter-intuitive since your production code is running Electron APIs.
+However, packaged apps will come bundled with the Electron binary, eliminating the need to specify
+it as a production dependency.
+
+:::
+
+```sh npm2yarn
+npm install electron --save-dev
+```
+
+Your package.json file should look something like this after initializing your package
+and installing Electron. You should also now have a `node_modules` folder containing
+the Electron executable, as well as a `package-lock.json` lockfile that specifies
+the exact dependency versions to install.
+
+```json title='package.json'
+{
+  "name": "my-electron-app",
+  "version": "1.0.0",
+  "description": "Hello World!",
+  "main": "main.js",
+  "author": "Jane Doe",
+  "license": "MIT",
+  "devDependencies": {
+    "electron": "19.0.0"
+  }
+}
+```
+
+:::info Advanced Electron installation steps
+
+If installing Electron directly fails, please refer to our [Advanced Installation][installation]
+documentation for instructions on download mirrors, proxies, and troubleshooting steps.
+
+:::
+
+### Adding a .gitignore
+
+The [`.gitignore`][gitignore] file specifies which files and directories to avoid tracking
+with Git. You should place a copy of [GitHub's Node.js gitignore template][gitignore-template]
+into your project's root folder to avoid committing your project's `node_modules` folder.
+
+## Running an Electron app
+
+:::tip Further reading
+
+Read [Electron's process model][process-model] documentation to better
+understand how Electron's multiple processes work together.
+
+:::
+
+The [`main`][package-json-main] script you defined in package.json is the entry point of any
+Electron application. This script controls the **main process**, which runs in a Node.js
+environment and is responsible for controlling your app's lifecycle, displaying native
+interfaces, performing privileged operations, and managing renderer processes
+(more on that later).
+
+Before creating your first Electron app, you will first use a trivial script to ensure your
+main process entry point is configured correctly. Create a `main.js` file in the root folder
+of your project with a single line of code:
+
+```js title='main.js'
+console.log(`Hello from Electron 👋`)
+```
+
+Because Electron's main process is a Node.js runtime, you can execute arbitrary Node.js code
+with the `electron` command (you can even use it as a [REPL]). To execute this script,
+add `electron .` to the `start` command in the [`scripts`][package-scripts]
+field of your package.json. This command will tell the Electron executable to look for the main
+script in the current directory and run it in dev mode.
+
+```json {8-10} title='package.json'
+{
+  "name": "my-electron-app",
+  "version": "1.0.0",
+  "description": "Hello World!",
+  "main": "main.js",
+  "author": "Jane Doe",
+  "license": "MIT",
+  "scripts": {
+    "start": "electron ."
+  },
+  "devDependencies": {
+    "electron": "^19.0.0"
+  }
+}
+```
+
+```sh npm2yarn
+npm run start
+```
+
+Your terminal should print out `Hello from Electron 👋`. Congratulations,
+you have executed your first line of code in Electron! Next, you will learn
+how to create user interfaces with HTML and load that into a native window.
+
+## Loading a web page into a BrowserWindow
+
+In Electron, each window displays a web page that can be loaded either from a local HTML
+file or a remote web address. For this example, you will be loading in a local file. Start
+by creating a barebones web page in an `index.html` file in the root folder of your project:
+
+```html title='index.html'
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8" />
+    <!-- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -->
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <meta
+      http-equiv="X-Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <title>Hello from Electron renderer!</title>
+  </head>
+  <body>
+    <h1>Hello from Electron renderer!</h1>
+    <p>👋</p>
+  </body>
+</html>
+```
+
+Now that you have a web page, you can load it into an Electron [BrowserWindow][browser-window].
+Replace the contents your `main.js` file with the following code. We will explain each
+highlighted block separately.
+
+```js {1,3-10,12-14} title='main.js' showLineNumbers
+const { app, BrowserWindow } = require('electron')
+
+const createWindow = () => {
+  const win = new BrowserWindow({
+    width: 800,
+    height: 600,
+  })
+
+  win.loadFile('index.html')
+}
+
+app.whenReady().then(() => {
+  createWindow()
+})
+```
+
+### Importing modules
+
+```js title='main.js (Line 1)'
+const { app, BrowserWindow } = require('electron')
+```
+
+In the first line, we are importing two Electron modules
+with CommonJS module syntax:
+
+- [app][app], which controls your application's event lifecycle.
+- [BrowserWindow][browser-window], which creates and manages app windows.
+
+:::info Capitalization conventions
+
+You might have noticed the capitalization difference between the **a**pp
+and **B**rowser**W**indow modules. Electron follows typical JavaScript conventions here,
+where PascalCase modules are instantiable class constructors (e.g. BrowserWindow, Tray,
+Notification) whereas camelCase modules are not instantiable (e.g. app, ipcRenderer, webContents).
+
+:::
+
+:::warning ES Modules in Electron
+
+[ECMAScript modules](https://nodejs.org/api/esm.html) (i.e. using `import` to load a module)
+are currently not directly supported in Electron. You can find more information about the
+state of ESM in Electron in [electron/electron#21457](https://github.com/electron/electron/issues/21457).
+
+:::
+
+### Writing a reusable function to instantiate windows
+
+The `createWindow()` function loads your web page into a new BrowserWindow instance:
+
+```js title='main.js (Lines 3-10)'
+const createWindow = () => {
+  const win = new BrowserWindow({
+    width: 800,
+    height: 600,
+  })
+
+  win.loadFile('index.html')
+}
+```
+
+### Calling your function when the app is ready
+
+```js title='main.js (Lines 12-14)'
+app.whenReady().then(() => {
+  createWindow()
+})
+```
+
+Many of Electron's core modules are Node.js [event emitters] that adhere to Node's asynchronous
+event-driven architecture. The app module is one of these emitters.
+
+In Electron, BrowserWindows can only be created after the app module's [`ready`][app-ready] event
+is fired. You can wait for this event by using the [`app.whenReady()`][app-when-ready] API and
+calling `createWindow()` once its promise is fulfilled.
+
+:::info
+
+You typically listen to Node.js events by using an emitter's `.on` function.
+
+```diff
++ app.on('ready').then(() => {
+- app.whenReady().then(() => {
+  createWindow()
+})
+```
+
+However, Electron exposes `app.whenReady()` as a helper specifically for the `ready` event to
+avoid subtle pitfalls with directly listening to that event in particular.
+See [electron/electron#21972](https://github.com/electron/electron/pull/21972) for details.
+
+:::
+
+At this point, running your Electron application's `start` command should successfully
+open a window that displays your web page!
+
+Each web page your app displays in a window will run in a separate process called a
+**renderer** process (or simply _renderer_ for short). Renderer processes have access
+to the same JavaScript APIs and tooling you use for typical front-end web
+development, such as using [webpack] to bundle and minify your code or [React][react]
+to build your user interfaces.
+
+## Managing your app's window lifecycle
+
+Application windows behave differently on each operating system. Rather than
+enforce these conventions by default, Electron gives you the choice to implement
+them in your app code if you wish to follow them. You can implement basic window
+conventions by listening for events emitted by the app and BrowserWindow modules.
+
+:::tip Process-specific control flow
+
+Checking against Node's [`process.platform`][node-platform] variable can help you
+to run code conditionally on certain platforms. Note that there are only three
+possible platforms that Electron can run in: `win32` (Windows), `linux` (Linux),
+and `darwin` (macOS).
+
+:::
+
+### Quit the app when all windows are closed (Windows & Linux)
+
+On Windows and Linux, closing all windows will generally quit an application entirely.
+To implement this pattern in your Electron app, listen for the app module's
+[`window-all-closed`][window-all-closed] event, and call [`app.quit()`][app-quit]
+to exit your app if the user is not on macOS.
+
+```js
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') app.quit()
+})
+```
+
+### Open a window if none are open (macOS)
+
+In contrast, macOS apps generally continue running even without any windows open.
+Activating the app when no windows are available should open a new one.
+
+To implement this feature, listen for the app module's [`activate`][activate]
+event, and call your existing `createWindow()` method if no BrowserWindows are open.
+
+Because windows cannot be created before the `ready` event, you should only listen for
+`activate` events after your app is initialized. Do this by only listening for activate
+events inside your existing `whenReady()` callback.
+
+```js
+app.whenReady().then(() => {
+  createWindow()
+
+  app.on('activate', () => {
+    if (BrowserWindow.getAllWindows().length === 0) createWindow()
+  })
+})
+```
+
+## Final starter code
+
+```fiddle docs/fiddles/tutorial-first-app
+
+```
+
+## Optional: Debugging from VS Code
+
+If you want to debug your application using VS Code, you need to attach VS Code to
+both the main and renderer processes. Here is a sample configuration for you to
+run. Create a launch.json configuration in a new `.vscode` folder in your project:
+
+```json title='.vscode/launch.json'
+{
+  "version": "0.2.0",
+  "compounds": [
+    {
+      "name": "Main + renderer",
+      "configurations": ["Main", "Renderer"],
+      "stopAll": true
+    }
+  ],
+  "configurations": [
+    {
+      "name": "Renderer",
+      "port": 9222,
+      "request": "attach",
+      "type": "pwa-chrome",
+      "webRoot": "${workspaceFolder}"
+    },
+    {
+      "name": "Main",
+      "type": "pwa-node",
+      "request": "launch",
+      "cwd": "${workspaceFolder}",
+      "runtimeExecutable": "${workspaceFolder}/node_modules/.bin/electron",
+      "windows": {
+        "runtimeExecutable": "${workspaceFolder}/node_modules/.bin/electron.cmd"
+      },
+      "args": [".", "--remote-debugging-port=9222"],
+      "outputCapture": "std",
+      "console": "integratedTerminal"
+    }
+  ]
+}
+```
+
+The "Main + renderer" option will appear when you select "Run and Debug"
+from the sidebar, allowing you to set breakpoints and inspect all the variables among
+other things in both the main and renderer processes.
+
+What we have done in the `launch.json` file is to create 3 configurations:
+
+- `Main` is used to start the main process and also expose port 9222 for remote debugging
+  (`--remote-debugging-port=9222`). This is the port that we will use to attach the debugger
+  for the `Renderer`. Because the main process is a Node.js process, the type is set to
+  `pwa-node` (`pwa-` is the prefix that tells VS Code to use the latest JavaScript debugger).
+- `Renderer` is used to debug the renderer process. Because the main process is the one
+  that creates the process, we have to "attach" to it (`"request": "attach"`) instead of
+  creating a new one.
+  The renderer process is a web one, so the debugger we have to use is `pwa-chrome`.
+- `Main + renderer` is a [compound task] that executes the previous ones simultaneously.
+
+:::caution
+
+Because we are attaching to a process in `Renderer`, it is possible that the first lines of
+your code will be skipped as the debugger will not have had enough time to connect before they are
+being executed.
+You can work around this by refreshing the page or setting a timeout before executing the code
+in development mode.
+
+:::
+
+:::info Further reading
+
+If you want to dig deeper in the debugging area, the following guides provide more information:
+
+- [Application Debugging]
+- [DevTools Extensions][devtools extension]
+
+:::
+
+## Summary
+
+Electron applications are set up using npm packages. The Electron executable should be installed
+in your project's `devDependencies` and can be run in development mode using a script in your
+package.json file.
+
+The executable runs the JavaScript entry point found in the `main` property of your package.json.
+This file controls Electron's **main process**, which runs an instance of Node.js and is
+responsible for your app's lifecycle, displaying native interfaces, performing privileged operations,
+and managing renderer processes.
+
+**Renderer processes** (or renderers for short) are responsible for display graphical content. You can
+load a web page into a renderer by pointing it to either a web address or a local HTML file.
+Renderers behave very similarly to regular web pages and have access to the same web APIs.
+
+In the next section of the tutorial, we will be learning how to augment the renderer process with
+privileged APIs and how to communicate between processes.
+
+<!-- Links -->
+
+[activate]: ../api/app.md#event-activate-macos
+[advanced-installation]: installation.md
+[app]: ../api/app.md
+[app-quit]: ../api/app.md#appquit
+[app-ready]: ../api/app.md#event-ready
+[app-when-ready]: ../api/app.md#appwhenready
+[application debugging]: ./application-debugging.md
+[browser-window]: ../api/browser-window.md
+[commonjs]: https://nodejs.org/docs/../api/modules.html#modules_modules_commonjs_modules
+[compound task]: https://code.visualstudio.com/Docs/editor/tasks#_compound-tasks
+[devtools extension]: ./devtools-extension.md
+[event emitters]: https://nodejs.org/api/events.html#events
+[gitignore]: https://git-scm.com/docs/gitignore
+[gitignore-template]: https://github.com/github/gitignore/blob/main/Node.gitignore
+[installation]: ./installation.md
+[node-platform]: https://nodejs.org/api/process.html#process_process_platform
+[package-json-main]: https://docs.npmjs.com/cli/v7/configuring-npm/package-json#main
+[package-scripts]: https://docs.npmjs.com/cli/v7/using-npm/scripts
+[process-model]: process-model.md
+[react]: https://reactjs.org
+[repl]: ./repl.md
+[sandbox]: ./sandbox.md
+[webpack]: https://webpack.js.org
+[window-all-closed]: ../api/app.md#event-window-all-closed
+[wsl]: https://docs.microsoft.com/en-us/windows/wsl/about#what-is-wsl-2
+
+<!-- Tutorial links -->
+
+[prerequisites]: tutorial-1-prerequisites.md
+[building your first app]: tutorial-2-first-app.md
+[preload]: tutorial-3-preload.md
+[features]: tutorial-4-adding-features.md
+[packaging]: tutorial-5-packaging.md
+[updates]: tutorial-6-publishing-updating.md

docs/tutorial/tutorial-3-preload.md

@@ -0,0 +1,271 @@
+---
+title: 'Using Preload Scripts'
+description: 'This guide will step you through the process of creating a barebones Hello World app in Electron, similar to electron/electron-quick-start.'
+slug: tutorial-preload
+hide_title: false
+---
+
+:::info Follow along the tutorial
+
+This is **part 3** of the Electron tutorial.
+
+1. [Prerequisites][prerequisites]
+1. [Building your First App][building your first app]
+1. **[Using Preload Scripts][preload]**
+1. [Adding Features][features]
+1. [Packaging Your Application][packaging]
+1. [Publishing and Updating][updates]
+
+:::
+
+## Learning goals
+
+In this part of the tutorial, you will learn what a preload script is and how to use one
+to securely expose privileged APIs into the renderer process. You will also learn how to
+communicate between main and renderer processes with Electron's inter-process
+communication (IPC) modules.
+
+## What is a preload script?
+
+Electron's main process is a Node.js environment that has full operating system access.
+On top of [Electron modules][modules], you can also access [Node.js built-ins][node-api],
+as well as any packages installed via npm. On the other hand, renderer processes run web
+pages and do not run Node.js by default for security reasons.
+
+To bridge Electron's different process types together, we will need to use a special script
+called a **preload**.
+
+## Augmenting the renderer with a preload script
+
+A BrowserWindow's preload script runs in a context that has access to both the HTML DOM
+and a Node.js environment. Preload scripts are injected before a web page loads in the renderer,
+similar to a Chrome extension's [content scripts][content-script]. To add features to your renderer
+that require privileged access, you can define [global] objects through the
+[contextBridge][contextbridge] API.
+
+To demonstrate this concept, you will create a preload script that exposes your app's
+versions of Chrome, Node, and Electron into the renderer.
+
+Add a new `preload.js` script that exposes selected properties of Electron's `process.versions`
+object to the renderer process in a `versions` global variable.
+
+```js title="preload.js"
+const { contextBridge } = require('electron')
+
+contextBridge.exposeInMainWorld('versions', {
+  node: () => process.versions.node,
+  chrome: () => process.versions.chrome,
+  electron: () => process.versions.electron,
+  // we can also expose variables, not just functions
+})
+```
+
+To attach this script to your renderer process, pass its path to the
+`webPreferences.preload` option in the BrowserWindow constructor:
+
+```js {8-10} title="main.js"
+const { app, BrowserWindow } = require('electron')
+const path = require('path')
+
+const createWindow = () => {
+  const win = new BrowserWindow({
+    width: 800,
+    height: 600,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload.js'),
+    },
+  })
+
+  win.loadFile('index.html')
+}
+
+app.whenReady().then(() => {
+  createWindow()
+})
+```
+
+:::info
+
+There are two Node.js concepts that are used here:
+
+- The [`__dirname`][dirname] string points to the path of the currently executing script
+  (in this case, your project's root folder).
+- The [`path.join`][path-join] API joins multiple path segments together, creating a
+  combined path string that works across all platforms.
+
+:::
+
+At this point, the renderer has access to the `versions` global, so let's display that
+information in the window. This variable can be accessed via `window.versions` or simply
+`versions`. Create a `renderer.js` script that uses the [`document.getElementById`]
+DOM API to replace the displayed text for the HTML element with `info` as its `id` property.
+
+```js title="renderer.js"
+const information = document.getElementById('info')
+information.innerText = `This app is using Chrome (v${versions.chrome()}), Node.js (v${versions.node()}), and Electron (v${versions.electron()})`
+```
+
+Then, modify your `index.html` by adding a new element with `info` as its `id` property,
+and attach your `renderer.js` script:
+
+```html {18,20} title="index.html"
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <meta
+      http-equiv="X-Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'"
+    />
+    <title>Hello from Electron renderer!</title>
+  </head>
+  <body>
+    <h1>Hello from Electron renderer!</h1>
+    <p>👋</p>
+    <p id="info"></p>
+  </body>
+  <script src="./renderer.js"></script>
+</html>
+```
+
+After following the above steps, your app should look something like this:
+
+![Electron app showing This app is using Chrome (v102.0.5005.63), Node.js (v16.14.2), and Electron (v19.0.3)](../images/preload-example.png)
+
+And the code should look like this:
+
+```fiddle docs/fiddles/tutorial-preload
+
+```
+
+## Communicating between processes
+
+As we have mentioned above, Electron's main and renderer process have distinct responsibilities
+and are not interchangeable. This means it is not possible to access the Node.js APIs directly
+from the renderer process, nor the HTML Document Object Model (DOM) from the main process.
+
+The solution for this problem is to use Electron's `ipcMain` and `ipcRenderer` modules for
+inter-process communication (IPC). To send a message from your web page to the main process,
+you can set up a main process handler with `ipcMain.handle` and
+then expose a function that calls `ipcRenderer.invoke` to trigger the handler in your preload script.
+
+To illustrate, we will add a global function to the renderer called `ping()`
+that will return a string from the main process.
+
+First, set up the `invoke` call in your preload script:
+
+```js {1,7} title="preload.js"
+const { contextBridge, ipcRenderer } = require('electron')
+
+contextBridge.exposeInMainWorld('versions', {
+  node: () => process.versions.node,
+  chrome: () => process.versions.chrome,
+  electron: () => process.versions.electron,
+  ping: () => ipcRenderer.invoke('ping'),
+  // we can also expose variables, not just functions
+})
+```
+
+:::caution IPC security
+
+Notice how we wrap the `ipcRenderer.invoke('ping')` call in a helper function rather
+than expose the `ipcRenderer` module directly via context bridge. You **never** want to
+directly expose the entire `ipcRenderer` module via preload. This would give your renderer
+the ability to send arbitrary IPC messages to the main process, which becomes a powerful
+attack vector for malicious code.
+
+:::
+
+Then, set up your `handle` listener in the main process. We do this _before_
+loading the HTML file so that the handler is guaranteed to be ready before
+you send out the `invoke` call from the renderer.
+
+```js {1,11} title="main.js"
+const { ipcMain } = require('electron')
+
+const createWindow = () => {
+  const win = new BrowserWindow({
+    width: 800,
+    height: 600,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload.js'),
+    },
+  })
+  ipcMain.handle('ping', () => 'pong')
+  win.loadFile('index.html')
+}
+```
+
+Once you have the sender and receiver set up, you can now send messages from the renderer
+to the main process through the `'ping'` channel you just defined.
+
+```js title='renderer.js'
+const func = async () => {
+  const response = await window.versions.ping()
+  console.log(response) // prints out 'pong'
+}
+
+func()
+```
+
+:::info
+
+For more in-depth explanations on using the `ipcRenderer` and `ipcMain` modules,
+check out the full [Inter-Process Communication][ipc] guide.
+
+:::
+
+## Summary
+
+A preload script contains code that runs before your web page is loaded into the browser
+window. It has access to both DOM APIs and Node.js environment, and is often used to
+expose privileged APIs to the renderer via the `contextBridge` API.
+
+Because the main and renderer processes have very different responsibilities, Electron
+apps often use the preload script to set up inter-process communication (IPC) interfaces
+to pass arbitrary messages between the two kinds of processes.
+
+In the next part of the tutorial, we will be showing you resources on adding more
+functionality to your app, then teaching you distributing your app to users.
+
+<!-- Links -->
+
+[advanced-installation]: ./installation.md
+[application debugging]: ./application-debugging.md
+[app]: ../api/app.md
+[app-ready]: ../api/app.md#event-ready
+[app-when-ready]: ../api/app.md#appwhenready
+[browser-window]: ../api/browser-window.md
+[commonjs]: https://nodejs.org/docs/latest/api/modules.html#modules_modules_commonjs_modules
+[compound task]: https://code.visualstudio.com/Docs/editor/tasks#_compound-tasks
+[content-script]: https://developer.chrome.com/docs/extensions/mv3/content_scripts/
+[contextbridge]: ../api/context-bridge.md
+[context-isolation]: ./context-isolation.md
+[`document.getelementbyid`]: https://developer.mozilla.org/en-US/docs/Web/API/Document/getElementById
+[devtools-extension]: ./devtools-extension.md
+[dirname]: https://nodejs.org/api/modules.html#modules_dirname
+[global]: https://developer.mozilla.org/en-US/docs/Glossary/Global_object
+[ipc]: ./ipc.md
+[mdn-csp]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+[modules]: ../api/app.md
+[node-api]: https://nodejs.org/dist/latest/docs/api/
+[package-json-main]: https://docs.npmjs.com/cli/v7/configuring-npm/package-json#main
+[package-scripts]: https://docs.npmjs.com/cli/v7/using-npm/scripts
+[path-join]: https://nodejs.org/api/path.html#path_path_join_paths
+[process-model]: ./process-model.md
+[react]: https://reactjs.org
+[sandbox]: ./sandbox.md
+[webpack]: https://webpack.js.org
+
+<!-- Tutorial links -->
+
+[prerequisites]: tutorial-1-prerequisites.md
+[building your first app]: tutorial-2-first-app.md
+[preload]: tutorial-3-preload.md
+[features]: tutorial-4-adding-features.md
+[packaging]: tutorial-5-packaging.md
+[updates]: tutorial-6-publishing-updating.md

docs/tutorial/tutorial-4-adding-features.md

@@ -0,0 +1,77 @@
+---
+title: 'Adding Features'
+description: 'In this step of the tutorial, we will share some resources you should read to add features to your application'
+slug: tutorial-adding-features
+hide_title: false
+---
+
+:::info Follow along the tutorial
+
+This is **part 4** of the Electron tutorial.
+
+1. [Prerequisites][prerequisites]
+1. [Building your First App][building your first app]
+1. [Using Preload Scripts][preload]
+1. **[Adding Features][features]**
+1. [Packaging Your Application][packaging]
+1. [Publishing and Updating][updates]
+
+:::
+
+## Adding application complexity
+
+If you have been following along, you should have a functional Electron application
+with a static user interface. From this starting point, you can generally progress
+in developing your app in two broad directions:
+
+1. Adding complexity to your renderer process' web app code
+1. Deeper integrations with the operating system and Node.js
+
+It is important to understand the distinction between these two broad concepts. For the
+first point, Electron-specific resources are not necessary. Building a pretty to-do
+list in Electron is just pointing your Electron BrowserWindow to a pretty
+to-do list web app. Ultimately, you are building your renderer's UI using the same tools
+(HTML, CSS, JavaScript) that you would on the web. Therefore, Electron's docs will
+not go in-depth on how to use standard web tools.
+
+On the other hand, Electron also provides a rich set of tools that allow
+you to integrate with the desktop environment, from creating tray icons to adding
+global shortcuts to displaying native menus. It also gives you all the power of a
+Node.js environment in the main process. This set of capabilities separates
+Electron applications from running a website in a browser tab, and are the
+focus of Electron's documentation.
+
+## How-to examples
+
+Electron's documentation has many tutorials to help you with more advanced topics
+and deeper operating system integrations. To get started, check out the
+[How-To Examples][how-to] doc.
+
+:::note Let us know if something is missing!
+
+If you can't find what you are looking for, please let us know on [GitHub] or in
+our [Discord server][discord]!
+
+:::
+
+## What's next?
+
+For the rest of the tutorial, we will be shifting away from application code
+and giving you a look at how you can get your app from your developer machine
+into end users' hands.
+
+<!-- Link labels -->
+
+[discord]: https://discord.com/invite/APGC3k5yaH
+[github]: https://github.com/electron/electronjs.org-new/issues/new
+[how to]: ./examples.md
+[node-platform]: https://nodejs.org/api/process.html#process_process_platform
+
+<!-- Tutorial links -->
+
+[prerequisites]: tutorial-1-prerequisites.md
+[building your first app]: tutorial-2-first-app.md
+[preload]: tutorial-3-preload.md
+[features]: tutorial-4-adding-features.md
+[packaging]: tutorial-5-packaging.md
+[updates]: tutorial-6-publishing-updating.md

docs/tutorial/tutorial-5-packaging.md

@@ -0,0 +1,225 @@
+---
+title: 'Packaging Your Application'
+description: 'To distribute your app with Electron, you need to package it and create installers.'
+slug: tutorial-packaging
+hide_title: false
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+:::info Follow along the tutorial
+
+This is **part 5** of the Electron tutorial.
+
+1. [Prerequisites][prerequisites]
+1. [Building your First App][building your first app]
+1. [Using Preload Scripts][preload]
+1. [Adding Features][features]
+1. **[Packaging Your Application][packaging]**
+1. [Publishing and Updating][updates]
+
+:::
+
+## Learning goals
+
+In this part of the tutorial, we'll be going over the basics of packaging and distributing
+your app with [Electron Forge].
+
+## Using Electron Forge
+
+Electron does not have any tooling for packaging and distribution bundled into its core
+modules. Once you have a working Electron app in dev mode, you need to use
+additional tooling to create a packaged app you can distribute to your users (also known
+as a **distributable**). Distributables can be either installers (e.g. MSI on Windows) or
+portable executable files (e.g. `.app` on macOS).
+
+Electron Forge is an all-in-one tool that handles the packaging and distribution of Electron
+apps. Under the hood, it combines a lot of existing Electron tools (e.g. [`electron-packager`],
+[`@electron/osx-sign`], [`electron-winstaller`], etc.) into a single interface so you do not
+have to worry about wiring them all together.
+
+### Importing your project into Forge
+
+You can install Electron Forge's CLI in your project's `devDependencies` and import your
+existing project with a handy conversion script.
+
+```sh npm2yarn
+npm install --save-dev @electron-forge/cli
+npx electron-forge import
+```
+
+Once the conversion script is done, Forge should have added a few scripts
+to your `package.json` file.
+
+```json title='package.json'
+  //...
+  "scripts": {
+    "start": "electron-forge start",
+    "package": "electron-forge package",
+    "make": "electron-forge make"
+  },
+  //...
+```
+
+:::info CLI documentation
+
+For more information on `make` and other Forge APIs, check out
+the [Electron Forge CLI documentation].
+
+:::
+
+You should also notice that your package.json now has a few more packages installed
+under your `devDependencies`, and contains an added `config.forge` field with an array
+of makers configured. **Makers** are Forge plugins that create distributables from
+your source code. You should see multiple makers in the pre-populated configuration,
+one for each target platform.
+
+### Creating a distributable
+
+To create a distributable, use your project's new `make` script, which runs the
+`electron-forge make` command.
+
+```sh npm2yarn
+npm run make
+```
+
+This `make` command contains two steps:
+
+1. It will first run `electron-forge package` under the hood, which bundles your app
+   code together with the Electron binary. The packaged code is generated into a folder.
+1. It will then use this packaged app folder to create a separate distributable for each
+   configured maker.
+
+After the script runs, you should see an `out` folder containing both the distributable
+and a folder containing the packaged application code.
+
+```plain title='macOS output example'
+out/
+├── out/make/zip/darwin/x64/my-electron-app-darwin-x64-1.0.0.zip
+├── ...
+└── out/my-electron-app-darwin-x64/my-electron-app.app/Contents/MacOS/my-electron-app
+```
+
+The distributable in the `out/make` folder should be ready to launch! You have now
+created your first bundled Electron application.
+
+:::tip Distributable formats
+
+Electron Forge can be configured to create distributables in different OS-specific formats
+(e.g. DMG, deb, MSI, etc.). See Forge's [Makers] documentation for all configuration options.
+
+:::
+
+:::note Packaging without Electron Forge
+
+If you want to manually package your code, or if you're just interested understanding the
+mechanics behind packaging an Electron app, check out the full [Application Packaging]
+documentation.
+
+:::
+
+## Important: signing your code
+
+In order to distribute desktop applications to end users, we _highly recommended_ for you
+to **code sign** your Electron app. Code signing is an important part of shipping
+desktop applications, and is mandatory for the auto-update step in the final part
+of the tutorial.
+
+Code signing is a security technology that you use to certify that a desktop app was
+created by a known source. Windows and macOS have their own OS-specific code signing
+systems that will make it difficult for users to download or launch unsigned applications.
+
+If you already have code signing certificates for Windows and macOS, you can set your
+credentials in your Forge configuration. Otherwise, please refer to the full
+[Code Signing] documentation to learn how to purchase a certificate and for more information
+on the desktop app code signing process.
+
+On macOS, code signing is done at the app packaging level. On Windows, distributable installers
+are signed instead.
+
+<Tabs>
+  <TabItem value="macos" label="macOS" default>
+
+```json title='package.json' {6-18}
+{
+  //...
+  "config": {
+    "forge": {
+      //...
+      "packagerConfig": {
+        "osxSign": {
+          "identity": "Developer ID Application: Felix Rieseberg (LT94ZKYDCJ)",
+          "hardened-runtime": true,
+          "entitlements": "entitlements.plist",
+          "entitlements-inherit": "entitlements.plist",
+          "signature-flags": "library"
+        },
+        "osxNotarize": {
+          "appleId": "felix@felix.fun",
+          "appleIdPassword": "this-is-a-secret"
+        }
+      }
+      //...
+    }
+  }
+  //...
+}
+```
+
+  </TabItem>
+  <TabItem value="windows" label="Windows">
+
+```json title='package.json'  {6-14}
+{
+  //...
+  "config": {
+    "forge": {
+      //...
+      "makers": [
+        {
+          "name": "@electron-forge/maker-squirrel",
+          "config": {
+            "certificateFile": "./cert.pfx",
+            "certificatePassword": "this-is-a-secret"
+          }
+        }
+      ]
+      //...
+    }
+  }
+  //...
+}
+```
+
+  </TabItem>
+</Tabs>
+
+## Summary
+
+Electron applications need to be packaged to be distributed to users. In this tutorial,
+you imported your app into Electron Forge and configured it to package your app and
+generate installers.
+
+In order for your application to be trusted by the user's system, you need to digitally
+certify that the distributable is authentic and untampered by code signing it. Your app
+can be signed through Forge once you configure it to use your code signing certificate
+information.
+
+[`@electron/osx-sign`]: https://github.com/electron/osx-sign
+[application packaging]: ./application-distribution.md
+[code signing]: ./code-signing.md
+[`electron-packager`]: https://github.com/electron/electron-packager
+[`electron-winstaller`]: https://github.com/electron/windows-installer
+[electron forge]: https://www.electronforge.io
+[electron forge cli documentation]: https://www.electronforge.io/cli#commands
+[makers]: https://www.electronforge.io/config/makers
+
+<!-- Tutorial links -->
+
+[prerequisites]: tutorial-1-prerequisites.md
+[building your first app]: tutorial-2-first-app.md
+[preload]: tutorial-3-preload.md
+[features]: tutorial-4-adding-features.md
+[packaging]: tutorial-5-packaging.md
+[updates]: tutorial-6-publishing-updating.md

docs/tutorial/tutorial-6-publishing-updating.md

@@ -0,0 +1,251 @@
+---
+title: 'Publishing and Updating'
+description: "There are several ways to update an Electron application. The easiest and officially supported one is taking advantage of the built-in Squirrel framework and Electron's autoUpdater module."
+slug: tutorial-publishing-updating
+hide_title: false
+---
+
+:::info Follow along the tutorial
+
+This is **part 6** of the Electron tutorial.
+
+1. [Prerequisites][prerequisites]
+1. [Building your First App][building your first app]
+1. [Using Preload Scripts][preload]
+1. [Adding Features][features]
+1. [Packaging Your Application][packaging]
+1. **[Publishing and Updating][updates]**
+
+:::
+
+## Learning goals
+
+If you've been following along, this is the last step of the tutorial! In this part,
+you will publish your app to GitHub releases and integrate automatic updates
+into your app code.
+
+## Using update.electronjs.org
+
+The Electron maintainers provide a free auto-updating service for open-source apps
+at https://update.electronjs.org. Its requirements are:
+
+- Your app runs on macOS or Windows
+- Your app has a public GitHub repository
+- Builds are published to [GitHub releases]
+- Builds are [code signed][code-signed]
+
+At this point, we'll assume that you have already pushed all your
+code to a public GitHub repository.
+
+:::info Alternative update services
+
+If you're using an alternate repository host (e.g. GitLab or Bitbucket) or if
+you need to keep your code repository private, please refer to our
+[step-by-step guide][update-server] on hosting your own Electron update server.
+
+:::
+
+## Publishing a GitHub release
+
+Electron Forge has [Publisher] plugins that can automate the distribution
+of your packaged application to various sources. In this tutorial, we will
+be using the GitHub Publisher, which will allow us to publish
+our code to GitHub releases.
+
+### Generating a personal access token
+
+Forge cannot publish to any repository on GitHub without permission. You
+need to pass in an authenticated token that gives Forge access to
+your GitHub releases. The easiest way to do this is to
+[create a new personal access token (PAT)][new-pat]
+with the `public_repo` scope, which gives write access to your public repositories.
+**Make sure to keep this token a secret.**
+
+### Setting up the GitHub Publisher
+
+#### Installing the module
+
+Forge's [GitHub Publisher] is a plugin that
+needs to be installed in your project's `devDependencies`:
+
+```sh npm2yarn
+npm install --save-dev @electron-forge/publisher-github
+```
+
+#### Configuring the publisher in Forge
+
+Once you have it installed, you need to set it up in your Forge
+configuration. A full list of options is documented in the Forge's
+[`PublisherGitHubConfig`] API docs.
+
+```json title='package.json' {6-16}
+{
+  //...
+  "config": {
+    "forge": {
+      "publishers": [
+        {
+          "name": "@electron-forge/publisher-github",
+          "config": {
+            "repository": {
+              "owner": "github-user-name",
+              "name": "github-repo-name"
+            },
+            "prerelease": false,
+            "draft": true
+          }
+        }
+      ]
+    }
+  }
+  //...
+}
+```
+
+:::tip Drafting releases before publishing
+
+Notice that you have configured Forge to publish your release as a draft.
+This will allow you to see the release with its generated artifacts
+without actually publishing it to your end users. You can manually
+publish your releases via GitHub after writing release notes and
+double-checking that your distributables work.
+
+:::
+
+#### Setting up your authentication token
+
+You also need to make the Publisher aware of your authentication token.
+By default, it will use the value stored in the `GITHUB_TOKEN` environment
+variable.
+
+### Running the publish command
+
+Add Forge's [publish command] to your npm scripts.
+
+```json {6} title='package.json'
+  //...
+  "scripts": {
+    "start": "electron-forge start",
+    "package": "electron-forge package",
+    "make": "electron-forge make",
+    "publish": "electron-forge publish"
+  },
+  //...
+```
+
+This command will run your configured makers and publish the output distributables to a new
+GitHub release.
+
+```sh npm2yarn
+npm run publish
+```
+
+By default, this will only publish a single distributable for your host operating system and
+architecture. You can publish for different architectures by passing in the `--arch` flag to your
+Forge commands.
+
+The name of this release will correspond to the `version` field in your project's package.json file.
+
+:::tip Tagging releases
+
+Optionally, you can also [tag your releases in Git][git-tag] so that your
+release is associated with a labeled point in your code history. npm comes
+with a handy [`npm version`](https://docs.npmjs.com/cli/v8/commands/npm-version)
+command that can handle the version bumping and tagging for you.
+
+:::
+
+#### Bonus: Publishing in GitHub Actions
+
+Publishing locally can be painful, especially because you can only create distributables
+for your host operating system (i.e. you can't publish a Window `.exe` file from macOS).
+
+A solution for this would be to publish your app via automation workflows
+such as [GitHub Actions], which can run tasks in the
+cloud on Ubuntu, macOS, and Windows. This is the exact approach taken by [Electron Fiddle].
+You can refer to Fiddle's [Build and Release pipeline][fiddle-build]
+and [Forge configuration][fiddle-forge-config]
+for more details.
+
+## Instrumenting your updater code
+
+Now that we have a functional release system via GitHub releases, we now need to tell our
+Electron app to download an update whenever a new release is out. Electron apps do this
+via the [autoUpdater] module, which reads from an update server feed to check if a new version
+is available for download.
+
+The update.electronjs.org service provides an updater-compatible feed. For example, Electron
+Fiddle v0.28.0 will check the endpoint at https://update.electronjs.org/electron/fiddle/darwin/v0.28.0
+to see if a newer GitHub release is available.
+
+After your release is published to GitHub, the update.electronjs.org service should work
+for your application. The only step left is to configure the feed with the autoUpdater module.
+
+To make this process easier, the Electron team maintains the [`update-electron-app`] module,
+which sets up the autoUpdater boilerplate for update.electronjs.org in one function
+call — no configuration required. This module will search for the update.electronjs.org
+feed that matches your project's package.json `"repository"` field.
+
+First, install the module as a runtime dependency.
+
+```sh npm2yarn
+npm install update-electron-app
+```
+
+Then, import the module and call it immediately in the main process.
+
+```js title='main.js'
+require('update-electron-app')()
+```
+
+And that is all it takes! Once your application is packaged, it will update itself for each new
+GitHub release that you publish.
+
+## Summary
+
+In this tutorial, we configured Electron Forge's GitHub Publisher to upload your app's
+distributables to GitHub releases. Since distributables cannot always be generated
+between platforms, we recommend setting up your building and publishing flow
+in a Continuous Integration pipeline if you do not have access to machines.
+
+Electron applications can self-update by pointing the autoUpdater module to an update server feed.
+update.electronjs.org is a free update server provided by Electron for open-source applications
+published on GitHub releases. Configuring your Electron app to use this service is as easy as
+installing and importing the `update-electron-app` module.
+
+If your application is not eligible for update.electronjs.org, you should instead deploy your
+own update server and configure the autoUpdater module yourself.
+
+:::info 🌟 You're done!
+
+From here, you have officially completed our tutorial to Electron. Feel free to explore the
+rest of our docs and happy developing! If you have questions, please stop by our community
+[Discord server].
+
+:::
+
+[autoupdater]: ../api/auto-updater.md
+[code-signed]: ./code-signing.md
+[discord server]: https://discord.com/invite/APGC3k5yaH
+[electron fiddle]: https://electronjs.org/fiddle
+[fiddle-build]: https://github.com/electron/fiddle/blob/master/.github/workflows/build.yaml
+[fiddle-forge-config]: https://github.com/electron/fiddle/blob/master/forge.config.js
+[github actions]: https://github.com/features/actions
+[github publisher]: https://www.electronforge.io/config/publishers/github
+[github releases]: https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository
+[git tag]: https://git-scm.com/book/en/v2/Git-Basics-Tagging
+[new-pat]: https://github.com/settings/tokens/new
+[publish command]: https://www.electronforge.io/cli#publish
+[publisher]: https://www.electronforge.io/config/publishers
+[`publishergithubconfig`]: https://js.electronforge.io/publisher/github/interfaces/publishergithubconfig
+[`update-electron-app`]: https://github.com/electron/update-electron-app
+[update-server]: ./updates.md
+
+<!-- Tutorial links -->
+
+[prerequisites]: tutorial-1-prerequisites.md
+[building your first app]: tutorial-2-first-app.md
+[preload]: tutorial-3-preload.md
+[features]: tutorial-4-adding-features.md
+[packaging]: tutorial-5-packaging.md
+[updates]: tutorial-6-publishing-updating.md

docs/tutorial/updates.md

@@ -1,11 +1,16 @@
-# Updating Applications
+---
+title: 'Updating Applications'
+description: "There are several ways to update an Electron application. The easiest and officially supported one is taking advantage of the built-in Squirrel framework and Electron's autoUpdater module."
+slug: updates
+hide_title: false
+---
 
-There are several ways to update an Electron application. The easiest and
-officially supported one is taking advantage of the built-in
+There are several ways to provide automatic updates to your Electron application.
+The easiest and officially supported one is taking advantage of the built-in
 [Squirrel](https://github.com/Squirrel) framework and
 Electron's [autoUpdater](../api/auto-updater.md) module.
 
-## Using `update.electronjs.org`
+## Using update.electronjs.org
 
 The Electron team maintains [update.electronjs.org], a free and open-source
 webservice that Electron apps can use to self-update. The service is designed
@@ -13,72 +18,77 @@ for Electron apps that meet the following criteria:
 
 - App runs on macOS or Windows
 - App has a public GitHub repository
-- Builds are published to GitHub Releases
-- Builds are code-signed
+- Builds are published to [GitHub Releases][gh-releases]
+- Builds are [code-signed](./code-signing.md)
 
 The easiest way to use this service is by installing [update-electron-app],
 a Node.js module preconfigured for use with update.electronjs.org.
 
-Install the module:
+Install the module using your Node.js package manager of choice:
 
-```sh
+```sh npm2yarn
 npm install update-electron-app
 ```
 
-Invoke the updater from your app's main process file:
+Then, invoke the updater from your app's main process file:
 
-```js
+```js title="main.js"
 require('update-electron-app')()
 ```
 
 By default, this module will check for updates at app startup, then every ten
-minutes. When an update is found, it will automatically be downloaded in the background. When the download completes, a dialog is displayed allowing the user
-to restart the app.
+minutes. When an update is found, it will automatically be downloaded in the background.
+When the download completes, a dialog is displayed allowing the user to restart the app.
 
 If you need to customize your configuration, you can
-[pass options to `update-electron-app`][update-electron-app]
+[pass options to update-electron-app][update-electron-app]
 or
 [use the update service directly][update.electronjs.org].
 
-## Deploying an Update Server
+## Using other update services
 
 If you're developing a private Electron application, or if you're not
 publishing releases to GitHub Releases, it may be necessary to run your own
 update server.
 
+### Step 1: Deploying an update server
+
 Depending on your needs, you can choose from one of these:
 
 - [Hazel][hazel] – Update server for private or open-source apps which can be
-deployed for free on [Vercel][vercel]. It pulls from [GitHub Releases][gh-releases]
-and leverages the power of GitHub's CDN.
+  deployed for free on [Vercel][vercel]. It pulls from [GitHub Releases][gh-releases]
+  and leverages the power of GitHub's CDN.
 - [Nuts][nuts] – Also uses [GitHub Releases][gh-releases], but caches app
-updates on disk and supports private repositories.
+  updates on disk and supports private repositories.
 - [electron-release-server][electron-release-server] – Provides a dashboard for
-handling releases and does not require releases to originate on GitHub.
+  handling releases and does not require releases to originate on GitHub.
 - [Nucleus][nucleus] – A complete update server for Electron apps maintained by
-Atlassian. Supports multiple applications and channels; uses a static file store
-to minify server cost.
+  Atlassian. Supports multiple applications and channels; uses a static file store
+  to minify server cost.
 
-## Implementing Updates in Your App
+Once you've deployed your update server, you can instrument your app code to receive and
+apply the updates with Electron's [autoUpdater] module.
 
-Once you've deployed your update server, continue with importing the required
-modules in your code. The following code might vary for different server
-software, but it works like described when using
-[Hazel][hazel].
+### Step 2: Receiving updates in your app
 
-**Important:** Please ensure that the code below will only be executed in
-your packaged app, and not in development. You can use
-[electron-is-dev](https://github.com/sindresorhus/electron-is-dev) to check for
-the environment.
+First, import the required modules in your main process code. The following code might
+vary for different server software, but it works like described when using [Hazel][hazel].
 
-```javascript
+:::warning Check your execution environment!
+
+Please ensure that the code below will only be executed in your packaged app, and not in development.
+You can use the [app.isPackaged](../api/app.md#appispackaged-readonly) API to check the environment.
+
+:::
+
+```javascript title='main.js'
 const { app, autoUpdater, dialog } = require('electron')
 ```
 
-Next, construct the URL of the update server and tell
+Next, construct the URL of the update server feed and tell
 [autoUpdater](../api/auto-updater.md) about it:
 
-```javascript
+```javascript title='main.js'
 const server = 'https://your-deployment-url.com'
 const url = `${server}/update/${process.platform}/${app.getVersion()}`
 
@@ -87,32 +97,32 @@ autoUpdater.setFeedURL({ url })
 
 As the final step, check for updates. The example below will check every minute:
 
-```javascript
+```javascript title='main.js'
 setInterval(() => {
   autoUpdater.checkForUpdates()
 }, 60000)
 ```
 
-Once your application is [packaged](../tutorial/application-distribution.md),
+Once your application is [packaged](./application-distribution.md),
 it will receive an update for each new
 [GitHub Release](https://help.github.com/articles/creating-releases/) that you
 publish.
 
-## Applying Updates
+### Step 3: Notifying users when updates are available
 
 Now that you've configured the basic update mechanism for your application, you
 need to ensure that the user will get notified when there's an update. This
-can be achieved using the autoUpdater API
-[events](../api/auto-updater.md#events):
+can be achieved using the [autoUpdater API events](../api/auto-updater.md#events):
 
-```javascript
+```javascript title="main.js"
 autoUpdater.on('update-downloaded', (event, releaseNotes, releaseName) => {
   const dialogOpts = {
     type: 'info',
     buttons: ['Restart', 'Later'],
     title: 'Application Update',
     message: process.platform === 'win32' ? releaseNotes : releaseName,
-    detail: 'A new version has been downloaded. Restart the application to apply the updates.'
+    detail:
+      'A new version has been downloaded. Restart the application to apply the updates.',
   }
 
   dialog.showMessageBox(dialogOpts).then((returnValue) => {
@@ -125,16 +135,22 @@ Also make sure that errors are
 [being handled](../api/auto-updater.md#event-error). Here's an example
 for logging them to `stderr`:
 
-```javascript
-autoUpdater.on('error', message => {
+```javascript title="main.js"
+autoUpdater.on('error', (message) => {
   console.error('There was a problem updating the application')
   console.error(message)
 })
 ```
 
-## Handling Updates Manually
+:::info Handling updates manually
 
-Because the requests made by Auto Update aren't under your direct control, you may find situations that are difficult to handle (such as if the update server is behind authentication). The `url` field does support files, which means that with some effort, you can sidestep the server-communication aspect of the process. [Here's an example of how this could work](https://github.com/electron/electron/issues/5020#issuecomment-477636990).
+Because the requests made by autoUpdate aren't under your direct control, you may find situations
+that are difficult to handle (such as if the update server is behind authentication). The `url`
+field supports the `file://` protocol, which means that with some effort, you can sidestep the
+server-communication aspect of the process by loading your update from a local directory.
+[Here's an example of how this could work](https://github.com/electron/electron/issues/5020#issuecomment-477636990).
+
+:::
 
 [vercel]: https://vercel.com
 [hazel]: https://github.com/vercel/hazel

docs/tutorial/windows-taskbar.md

@@ -41,10 +41,9 @@ as quoted from [MSDN][msdn-jumplist]:
 > confuse the user who does not expect that portion of the destination list to
 > change.
 
-![IE](https://i-msdn.sec.s-msft.com/dynimg/IC420539.png)
+![Taskbar JumpList](../images/windows-taskbar-jumplist.png)
 
-> NOTE: The screenshot above is an example of general tasks of
-Internet Explorer
+> NOTE: The screenshot above is an example of general tasks for Microsoft Edge
 
 Unlike the dock menu in macOS which is a real menu, user tasks in Windows work
 like application shortcuts. For example, when a user clicks a task, the program
@@ -109,7 +108,7 @@ As quoted from [MSDN][msdn-thumbnail]:
 > For example, Windows Media Player might offer standard media transport controls
 > such as play, pause, mute, and stop.
 
-![player](https://i-msdn.sec.s-msft.com/dynimg/IC420540.png)
+![Thumbnail toolbar](../images/windows-taskbar-thumbnail-toolbar.png)
 
 > NOTE: The screenshot above is an example of thumbnail toolbar of Windows
 Media Player
@@ -176,7 +175,7 @@ As quoted from [MSDN][msdn-icon-overlay]:
 > network status, messenger status, or new mail. The user should not be
 > presented with constantly changing overlays or animations.
 
-![Overlay on taskbar button](https://i-msdn.sec.s-msft.com/dynimg/IC420441.png)
+![Overlay on taskbar button](../images/windows-taskbar-icon-overlay.png)
 
 > NOTE: The screenshot above is an example of overlay on a taskbar button
 

electron_paks.gni

@@ -65,7 +65,6 @@ template("electron_extra_paks") {
       "$root_gen_dir/net/net_resources.pak",
       "$root_gen_dir/third_party/blink/public/resources/blink_resources.pak",
       "$root_gen_dir/third_party/blink/public/resources/inspector_overlay_resources.pak",
-      "$root_gen_dir/ui/resources/webui_resources.pak",
       "$target_gen_dir/electron_resources.pak",
     ]
     deps = [
@@ -178,6 +177,7 @@ template("electron_paks") {
       "${root_gen_dir}/third_party/blink/public/strings/blink_accessibility_strings_",
       "${root_gen_dir}/third_party/blink/public/strings/blink_strings_",
       "${root_gen_dir}/device/bluetooth/strings/bluetooth_strings_",
+      "${root_gen_dir}/extensions/strings/extensions_strings_",
       "${root_gen_dir}/services/strings/services_strings_",
       "${root_gen_dir}/ui/strings/app_locale_settings_",
       "${root_gen_dir}/ui/strings/ax_strings_",
@@ -187,6 +187,7 @@ template("electron_paks") {
       "//chrome/app/resources:platform_locale_settings",
       "//components/strings:components_strings",
       "//device/bluetooth/strings",
+      "//extensions/strings",
       "//services/strings",
       "//third_party/blink/public/strings",
       "//third_party/blink/public/strings:accessibility_strings",

electron_strings.grdp

@@ -24,6 +24,9 @@
   <message name="IDS_DEFAULT_PRINT_DOCUMENT_TITLE" desc="Default title for a print document">
     Untitled Document
   </message>
+  <message name="IDS_UTILITY_PROCESS_PRINT_BACKEND_SERVICE_NAME" desc="The name of the utility process used for backend interactions with printer drivers.">
+    Print Backend Service
+  </message>
 
   <!-- Desktop Capturer API -->
   <message name="IDS_DESKTOP_MEDIA_PICKER_SINGLE_SCREEN_NAME" desc="Name for screens in the desktop media picker UI when there is only one monitor.">

filenames.gni

@@ -23,6 +23,7 @@ filenames = {
 
   lib_sources_linux = [
     "shell/browser/browser_linux.cc",
+    "shell/browser/electron_browser_main_parts_linux.cc",
     "shell/browser/lib/power_observer_linux.cc",
     "shell/browser/lib/power_observer_linux.h",
     "shell/browser/linux/unity_service.cc",

lib/browser/api/web-contents.ts

@@ -504,6 +504,7 @@ WebContents.prototype._callWindowOpenHandler = function (event: Electron.Event,
   if (!this._windowOpenHandler) {
     return defaultResponse;
   }
+
   const response = this._windowOpenHandler(details);
 
   if (typeof response !== 'object') {
@@ -666,7 +667,15 @@ WebContents.prototype._init = function () {
         postBody,
         disposition
       };
-      const result = this._callWindowOpenHandler(event, details);
+
+      let result: ReturnType<typeof this._callWindowOpenHandler>;
+      try {
+        result = this._callWindowOpenHandler(event, details);
+      } catch (err) {
+        event.preventDefault();
+        throw err;
+      }
+
       const options = result.browserWindowConstructorOptions;
       if (!event.defaultPrevented) {
         openGuestWindow({
@@ -697,7 +706,15 @@ WebContents.prototype._init = function () {
         referrer,
         postBody
       };
-      const result = this._callWindowOpenHandler(event, details);
+
+      let result: ReturnType<typeof this._callWindowOpenHandler>;
+      try {
+        result = this._callWindowOpenHandler(event, details);
+      } catch (err) {
+        event.preventDefault();
+        throw err;
+      }
+
       windowOpenOutlivesOpenerOption = result.outlivesOpener;
       windowOpenOverriddenOptions = result.browserWindowConstructorOptions;
       if (!event.defaultPrevented) {

lib/browser/guest-window-manager.ts

@@ -78,6 +78,19 @@ export function openGuestWindow ({ event, embedder, guest, referrer, disposition
     ...browserWindowOptions
   });
 
+  if (!guest) {
+    // When we open a new window from a link (via OpenURLFromTab),
+    // the browser process is responsible for initiating navigation
+    // in the new window.
+    window.loadURL(url, {
+      httpReferrer: referrer,
+      ...(postData && {
+        postData,
+        extraHeaders: formatPostDataHeaders(postData as Electron.UploadRawData[])
+      })
+    });
+  }
+
   handleWindowLifecycleEvents({ embedder, frameName, guest: window, outlivesOpener });
 
   embedder.emit('did-create-window', window, { url, frameName, options: browserWindowOptions, disposition, referrer, postData });
@@ -243,6 +256,15 @@ export function makeWebPreferences ({ embedder, secureOverrideWebPreferences = {
   };
 }
 
+function formatPostDataHeaders (postData: PostData) {
+  if (!postData) return;
+
+  const { contentType, boundary } = parseContentTypeFormat(postData);
+  if (boundary != null) { return `content-type: ${contentType}; boundary=${boundary}`; }
+
+  return `content-type: ${contentType}`;
+}
+
 const MULTIPART_CONTENT_TYPE = 'multipart/form-data';
 const URL_ENCODED_CONTENT_TYPE = 'application/x-www-form-urlencoded';
 

lib/renderer/security-warnings.ts

@@ -1,7 +1,8 @@
-import { webFrame } from 'electron';
 import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
 import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 
+const { mainFrame: webFrame } = process._linkedBinding('electron_renderer_web_frame');
+
 let shouldLog: boolean | null = null;
 
 const { platform, execPath, env } = process;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "19.0.0-beta.1",
+  "version": "19.0.12",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
@@ -77,7 +77,7 @@
   "scripts": {
     "asar": "asar",
     "generate-version-json": "node script/generate-version-json.js",
-    "lint": "node ./script/lint.js && npm run lint:clang-format && npm run lint:docs",
+    "lint": "node ./script/lint.js && npm run lint:docs",
     "lint:js": "node ./script/lint.js --js",
     "lint:clang-format": "python3 script/run-clang-format.py -r -c shell/ || (echo \"\\nCode not formatted correctly.\" && exit 1)",
     "lint:clang-tidy": "ts-node ./script/run-clang-tidy.ts",
@@ -94,6 +94,7 @@
     "gn-typescript-definitions": "npm run create-typescript-definitions && shx cp electron.d.ts",
     "pre-flight": "pre-flight",
     "gn-check": "node ./script/gn-check.js",
+    "gn-format": "python3 script/run-gn-format.py",
     "precommit": "lint-staged",
     "preinstall": "node -e 'process.exit(0)'",
     "prepack": "check-for-leaks",
@@ -124,7 +125,7 @@
     ],
     "*.{gn,gni}": [
       "npm run gn-check",
-      "python3 script/run-gn-format.py"
+      "npm run gn-format"
     ],
     "*.py": [
       "node script/lint.js --py --fix --only --"

patches/chromium/.patches

@@ -102,12 +102,12 @@ chore_do_not_use_chrome_windows_in_cryptotoken_webrequestsender.patch
 process_singleton.patch
 fix_expose_decrementcapturercount_in_web_contents_impl.patch
 add_ui_scopedcliboardwriter_writeunsaferawdata.patch
+feat_add_data_parameter_to_processsingleton.patch
 mas_gate_private_enterprise_APIs.patch
 load_v8_snapshot_in_browser_process.patch
-fix_patch_out_permissions_checks_in_exclusive_access.patch
+fix_adapt_exclusive_access_for_electron_needs.patch
 fix_aspect_ratio_with_max_size.patch
 fix_dont_delete_SerialPortManager_on_main_thread.patch
-feat_add_data_transfer_to_requestsingleinstancelock.patch
 fix_crash_when_saving_edited_pdf_files.patch
 port_autofill_colors_to_the_color_pipeline.patch
 build_disable_partition_alloc_on_mac.patch
@@ -115,3 +115,19 @@ fix_non-client_mouse_tracking_and_message_bubbling_on_windows.patch
 build_make_libcxx_abi_unstable_false_for_electron.patch
 introduce_ozoneplatform_electron_can_call_x11_property.patch
 make_gtk_getlibgtk_public.patch
+build_disable_print_content_analysis.patch
+feat_move_firstpartysets_to_content_browser_client.patch
+custom_protocols_plzserviceworker.patch
+posix_replace_doubleforkandexec_with_forkandspawn.patch
+cherry-pick-22c61cfae5d1.patch
+remove_default_window_title.patch
+keep_handling_scroll_update_if_you_can.patch
+chore_add_electron_deps_to_gitignores.patch
+chore_allow_chromium_to_handle_synthetic_mouse_events_for_touch.patch
+disable_gpu_acceleration_on_vmware_on_linux.patch
+add_maximized_parameter_to_linuxui_getwindowframeprovider.patch
+cherry-pick-94a8bdafc8c6.patch
+fix_mac_build_with_enable_plugins_false.patch
+fix_windows_build_with_enable_plugins_false.patch
+cherry-pick-bd9724c9fe63.patch
+cherry-pick-c643d18a078d.patch

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -23,10 +23,10 @@ index eb6f4c87c4479d5f4fb8e3f85a231fb9cc744a63..11298b413021b4d438195482db253a93
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 596dc721842c707844a771d64337e9cf0d82bfcc..b9eea3470139e1833b2b23d3b535b11235e2bc8e 100644
+index f217de19126feeeafee01b2be31ced936696ce20..95966ce7f0eeb0a7f2822bef69b540ac6bfe298d 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4465,6 +4465,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4489,6 +4489,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  
@@ -79,10 +79,10 @@ index a6ba8411384855c82712960375bc949c5c2bd522..fc86ca807c9c1bda9236160580b09415
    if (World().IsMainWorld()) {
      GetFrame()->Loader().DispatchDidClearWindowObjectInMainWorld();
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client.h b/third_party/blink/renderer/core/frame/local_frame_client.h
-index bca4cbb2b2ba84fe58b5cfeaf190add5803e27c9..b6c9dd3a2a1c9b6667c563d5da86ccb4871ae81f 100644
+index f36d04ff77481bd30e0de3f6d45c54dfece4067c..d30f569cd68716b9e963cf0fb5da3f7e65cc215a 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client.h
-@@ -301,6 +301,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
+@@ -303,6 +303,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
  
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) = 0;
@@ -92,7 +92,7 @@ index bca4cbb2b2ba84fe58b5cfeaf190add5803e27c9..b6c9dd3a2a1c9b6667c563d5da86ccb4
                                          int32_t world_id) = 0;
    virtual bool AllowScriptExtensions() = 0;
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-index b690ada2d46146b6da38cbb2c688f249ae558464..b03774140883c5bb7de6358f3df95ab8774b9dc7 100644
+index 5a83dcdf50acc27da2b1fbb3e515cb4316305a3a..86f31acc40a2dd296c34f3ecf5ef6ccd97cbc18c 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 @@ -275,6 +275,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
@@ -110,7 +110,7 @@ index b690ada2d46146b6da38cbb2c688f249ae558464..b03774140883c5bb7de6358f3df95ab8
      v8::Local<v8::Context> context,
      int32_t world_id) {
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.h b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
-index 420d82ed07017deba3298c5454666c09240dd23d..15407fb95dcf25875eb76a41fe1834c1f0a53528 100644
+index ac81fdc1ac99ca02458a10c0d258b846a8a9955e..ed838db2474790437ff4b57e23a1e289afce4d47 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
 @@ -80,6 +80,8 @@ class CORE_EXPORT LocalFrameClientImpl final : public LocalFrameClient {
@@ -123,10 +123,10 @@ index 420d82ed07017deba3298c5454666c09240dd23d..15407fb95dcf25875eb76a41fe1834c1
                                  int32_t world_id) override;
  
 diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
-index 8087d1f62e9b1a8ac33a9e92c10a7cb8b8363e08..845c3329674d99dd385316dbfd1287fa3566a60e 100644
+index aab6a77b18f83adeac065083f83b94b7ff251282..0d0e272a162be8d1bee9e0122e3e7a59b0ad32a3 100644
 --- a/third_party/blink/renderer/core/loader/empty_clients.h
 +++ b/third_party/blink/renderer/core/loader/empty_clients.h
-@@ -357,6 +357,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
+@@ -359,6 +359,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
  
    void DidCreateScriptContext(v8::Local<v8::Context>,
                                int32_t world_id) override {}

patches/chromium/add_maximized_parameter_to_linuxui_getwindowframeprovider.patch

@@ -0,0 +1,176 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: msizanoen1 <msizanoen@qtmlabs.xyz>
+Date: Tue, 19 Jul 2022 05:11:06 +0200
+Subject: Add maximized parameter to LinuxUI::GetWindowFrameProvider
+
+This allows ClientFrameViewLinux to instruct the toolkit to draw the window
+decorations in maximized mode where needed, preventing empty space caused
+by decoration shadows and rounded titlebars around the window while maximized.
+
+diff --git a/ui/gtk/gtk_ui.cc b/ui/gtk/gtk_ui.cc
+index c037fa8db6d4a5ebeb7257627db206e9bab57ecc..14eddfd043e748400a9ee81ce5346a53f10ea03c 100644
+--- a/ui/gtk/gtk_ui.cc
++++ b/ui/gtk/gtk_ui.cc
+@@ -757,13 +757,15 @@ std::unique_ptr<views::NavButtonProvider> GtkUi::CreateNavButtonProvider() {
+   return nullptr;
+ }
+ 
+-views::WindowFrameProvider* GtkUi::GetWindowFrameProvider(bool solid_frame) {
++views::WindowFrameProvider* GtkUi::GetWindowFrameProvider(bool solid_frame, bool maximized) {
+   if (!GtkCheckVersion(3, 14))
+     return nullptr;
+   auto& provider =
+-      solid_frame ? solid_frame_provider_ : transparent_frame_provider_;
++      maximized
++        ? (solid_frame ? solid_maximized_frame_provider_ : transparent_maximized_frame_provider_)
++        : (solid_frame ? solid_frame_provider_ : transparent_frame_provider_);
+   if (!provider)
+-    provider = std::make_unique<gtk::WindowFrameProviderGtk>(solid_frame);
++    provider = std::make_unique<gtk::WindowFrameProviderGtk>(solid_frame, maximized);
+   return provider.get();
+ }
+ 
+diff --git a/ui/gtk/gtk_ui.h b/ui/gtk/gtk_ui.h
+index 8e609b8311c6b69ef7b6753117542d9e60b2c8ab..a329822c3285599954d77dd5a8e33ccc10e5f626 100644
+--- a/ui/gtk/gtk_ui.h
++++ b/ui/gtk/gtk_ui.h
+@@ -107,7 +107,7 @@ class GtkUi : public views::LinuxUI {
+   bool PreferDarkTheme() const override;
+   bool AnimationsEnabled() const override;
+   std::unique_ptr<views::NavButtonProvider> CreateNavButtonProvider() override;
+-  views::WindowFrameProvider* GetWindowFrameProvider(bool solid_frame) override;
++  views::WindowFrameProvider* GetWindowFrameProvider(bool solid_frame, bool maximized) override;
+   base::flat_map<std::string, std::string> GetKeyboardLayoutMap() override;
+   std::string GetCursorThemeName() override;
+   int GetCursorThemeSize() override;
+@@ -218,6 +218,8 @@ class GtkUi : public views::LinuxUI {
+   // while Chrome is running.
+   std::unique_ptr<views::WindowFrameProvider> solid_frame_provider_;
+   std::unique_ptr<views::WindowFrameProvider> transparent_frame_provider_;
++  std::unique_ptr<views::WindowFrameProvider> solid_maximized_frame_provider_;
++  std::unique_ptr<views::WindowFrameProvider> transparent_maximized_frame_provider_;
+ };
+ 
+ }  // namespace gtk
+diff --git a/ui/gtk/window_frame_provider_gtk.cc b/ui/gtk/window_frame_provider_gtk.cc
+index e4dbdad327eb77994ffd7f068c67336a19897915..d3ae0636455489a7c7443df85cb769952c98aca2 100644
+--- a/ui/gtk/window_frame_provider_gtk.cc
++++ b/ui/gtk/window_frame_provider_gtk.cc
+@@ -38,16 +38,18 @@ std::string GetThemeName() {
+   return theme_string;
+ }
+ 
+-GtkCssContext WindowContext(bool solid_frame, bool focused) {
++GtkCssContext WindowContext(bool solid_frame, bool maximized, bool focused) {
+   std::string selector = "#window.background.";
+   selector += solid_frame ? "solid-csd" : "csd";
++  if (maximized)
++    selector += ".maximized";
+   if (!focused)
+     selector += ":inactive";
+   return AppendCssNodeToStyleContext({}, selector);
+ }
+ 
+-GtkCssContext DecorationContext(bool solid_frame, bool focused) {
+-  auto context = WindowContext(solid_frame, focused);
++GtkCssContext DecorationContext(bool solid_frame, bool maximized, bool focused) {
++  auto context = WindowContext(solid_frame, maximized, focused);
+   // GTK4 renders the decoration directly on the window.
+   if (!GtkCheckVersion(4))
+     context = AppendCssNodeToStyleContext(context, "#decoration");
+@@ -64,8 +66,8 @@ GtkCssContext DecorationContext(bool solid_frame, bool focused) {
+   return context;
+ }
+ 
+-GtkCssContext HeaderContext(bool solid_frame, bool focused) {
+-  auto context = WindowContext(solid_frame, focused);
++GtkCssContext HeaderContext(bool solid_frame, bool maximized, bool focused) {
++  auto context = WindowContext(solid_frame, maximized, focused);
+   context =
+       AppendCssNodeToStyleContext(context, "#headerbar.header-bar.titlebar");
+   if (!focused)
+@@ -110,8 +112,8 @@ int ComputeTopCornerRadius() {
+   // need to experimentally determine the corner radius by rendering a sample.
+   // Additionally, in GTK4, the headerbar corners get clipped by the window
+   // rather than the headerbar having its own rounded corners.
+-  auto context = GtkCheckVersion(4) ? DecorationContext(false, false)
+-                                    : HeaderContext(false, false);
++  auto context = GtkCheckVersion(4) ? DecorationContext(false, false, false)
++                                    : HeaderContext(false, false, false);
+   ApplyCssToContext(context, R"(window, headerbar {
+     background-image: none;
+     background-color: black;
+@@ -169,8 +171,8 @@ void WindowFrameProviderGtk::Asset::CloneFrom(
+   unfocused_bitmap = src.unfocused_bitmap;
+ }
+ 
+-WindowFrameProviderGtk::WindowFrameProviderGtk(bool solid_frame)
+-    : solid_frame_(solid_frame) {}
++WindowFrameProviderGtk::WindowFrameProviderGtk(bool solid_frame, bool maximized)
++    : solid_frame_(solid_frame), maximized_(maximized) {}
+ 
+ WindowFrameProviderGtk::~WindowFrameProviderGtk() = default;
+ 
+@@ -264,7 +266,7 @@ void WindowFrameProviderGtk::PaintWindowFrame(gfx::Canvas* canvas,
+       top_area_height_dip * scale - asset.frame_thickness_px.top();
+ 
+   auto header = PaintHeaderbar({client_bounds_px.width(), top_area_height_px},
+-                               HeaderContext(solid_frame_, focused), scale);
++                               HeaderContext(solid_frame_, maximized_, focused), scale);
+   image = gfx::ImageSkia::CreateFrom1xBitmap(header);
+   // In GTK4, the headerbar gets clipped by the window.
+   if (GtkCheckVersion(4)) {
+@@ -296,7 +298,7 @@ void WindowFrameProviderGtk::MaybeUpdateBitmaps(float scale) {
+ 
+   gfx::Rect frame_bounds_dip(kMaxFrameSizeDip, kMaxFrameSizeDip,
+                              2 * kMaxFrameSizeDip, 2 * kMaxFrameSizeDip);
+-  auto focused_context = DecorationContext(solid_frame_, true);
++  auto focused_context = DecorationContext(solid_frame_, maximized_, true);
+   frame_bounds_dip.Inset(-GtkStyleContextGetPadding(focused_context));
+   frame_bounds_dip.Inset(-GtkStyleContextGetBorder(focused_context));
+   gfx::Size bitmap_size(BitmapSizePx(asset), BitmapSizePx(asset));
+@@ -304,7 +306,7 @@ void WindowFrameProviderGtk::MaybeUpdateBitmaps(float scale) {
+       PaintBitmap(bitmap_size, frame_bounds_dip, focused_context, scale);
+   asset.unfocused_bitmap =
+       PaintBitmap(bitmap_size, frame_bounds_dip,
+-                  DecorationContext(solid_frame_, false), scale);
++                  DecorationContext(solid_frame_, maximized_, false), scale);
+ 
+   // In GTK4, there's no way to obtain the frame thickness from CSS values
+   // directly, so we must determine it experimentally based on the drawn
+diff --git a/ui/gtk/window_frame_provider_gtk.h b/ui/gtk/window_frame_provider_gtk.h
+index d3039d73161378197557947aece88d2710c1e486..f7d4605938210b0b75517bb7bcab28b588a16520 100644
+--- a/ui/gtk/window_frame_provider_gtk.h
++++ b/ui/gtk/window_frame_provider_gtk.h
+@@ -14,7 +14,7 @@ namespace gtk {
+ 
+ class WindowFrameProviderGtk : public views::WindowFrameProvider {
+  public:
+-  explicit WindowFrameProviderGtk(bool solid_frame);
++  explicit WindowFrameProviderGtk(bool solid_frame, bool maximized);
+ 
+   WindowFrameProviderGtk(const WindowFrameProviderGtk&) = delete;
+   WindowFrameProviderGtk& operator=(const WindowFrameProviderGtk&) = delete;
+@@ -69,6 +69,9 @@ class WindowFrameProviderGtk : public views::WindowFrameProvider {
+ 
+   // Cached bitmaps and metrics.  The scale is rounded to percent.
+   base::flat_map<int, Asset> assets_;
++
++  // Whether to draw the window decorations as maximized.
++  bool maximized_;
+ };
+ 
+ }  // namespace gtk
+diff --git a/ui/views/linux_ui/linux_ui.h b/ui/views/linux_ui/linux_ui.h
+index 5f312e01508c49033bf2d05b9dc083e524f37e5f..7590acd760ba4f36e5a77c1972afc5fc08e616ff 100644
+--- a/ui/views/linux_ui/linux_ui.h
++++ b/ui/views/linux_ui/linux_ui.h
+@@ -189,7 +189,7 @@ class VIEWS_EXPORT LinuxUI : public ui::LinuxInputMethodContextFactory,
+   // if transparency is unsupported and the frame should be rendered opaque.
+   // The returned object is not owned by the caller and will remain alive until
+   // the process ends.
+-  virtual WindowFrameProvider* GetWindowFrameProvider(bool solid_frame) = 0;
++  virtual WindowFrameProvider* GetWindowFrameProvider(bool solid_frame, bool maximized) = 0;
+ 
+   // Returns a map of KeyboardEvent code to KeyboardEvent key values.
+   virtual base::flat_map<std::string, std::string> GetKeyboardLayoutMap() = 0;

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -6,10 +6,10 @@ Subject: allow disabling blink scheduler throttling per RenderView
 This allows us to disable throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
-index 32df5050f5a66c4b4f0981d3777a3b5a4fac9629..d8d9982bc6bd6e472677707b326a5dafa9b7fcf5 100644
+index a9267b633e126f057e914b895f280ed658ff279d..179b5449f53c2d7b9024fb08fe1b1f6c03c6d5b0 100644
 --- a/content/browser/renderer_host/render_view_host_impl.cc
 +++ b/content/browser/renderer_host/render_view_host_impl.cc
-@@ -660,6 +660,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
+@@ -665,6 +665,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
    GetWidget()->GetAssociatedFrameWidget()->SetBackgroundOpaque(opaque);
  }
  
@@ -22,11 +22,11 @@ index 32df5050f5a66c4b4f0981d3777a3b5a4fac9629..d8d9982bc6bd6e472677707b326a5daf
    return is_active();
  }
 diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
-index a099eed10dd061994bff696519099c3ef7437a46..a1f1e9b55272e70b4acd5d1f1515fba7d91538fa 100644
+index 3f0df3df3dd74ced71869ce01abf7b159387b8f4..85b169530a21bcfc016d1439a71d35378077774d 100644
 --- a/content/browser/renderer_host/render_view_host_impl.h
 +++ b/content/browser/renderer_host/render_view_host_impl.h
 @@ -137,6 +137,7 @@ class CONTENT_EXPORT RenderViewHostImpl
-   bool IsRenderViewLive() const override;
+   bool IsRenderViewLiveForTesting() const override;
    void WriteIntoTrace(perfetto::TracedProto<TraceProto> context) const override;
  
 +  void SetSchedulerThrottling(bool allowed) override;
@@ -34,7 +34,7 @@ index a099eed10dd061994bff696519099c3ef7437a46..a1f1e9b55272e70b4acd5d1f1515fba7
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/public/browser/render_view_host.h b/content/public/browser/render_view_host.h
-index a6fe708878eb9afba9a68e0be71ba2c0b2a84d7d..5cc81ceb44d0a8baee3ebcc63aa4137b1e9ef08e 100644
+index 3b01b3419c4361d5d75ad1c37e5baa3a1967bd09..35c82d931242a1180091267c18e0255840acc5ce 100644
 --- a/content/public/browser/render_view_host.h
 +++ b/content/public/browser/render_view_host.h
 @@ -80,6 +80,9 @@ class CONTENT_EXPORT RenderViewHost {
@@ -61,10 +61,10 @@ index fd145f0aa562d6b63fb1d3a8a9241ae1aa1ce7a0..54d30fb9db8b48b94abdb815c487f618
    // ADDING NEW FUNCTIONS? Please keep private functions alphabetized and put
    // it in the same order in the .cc file as it was in the header.
 diff --git a/third_party/blink/public/mojom/page/page.mojom b/third_party/blink/public/mojom/page/page.mojom
-index befd736a9cf362514b9a2ee475dc4a814c85a87b..24b2617f56673a3075697802cf5b574b0c766610 100644
+index 39bfc2200e924d0c589cfd07f085f182ef6853a6..bddff6d5ad3f6d08c4dc48e66ebc5319b1a5ec28 100644
 --- a/third_party/blink/public/mojom/page/page.mojom
 +++ b/third_party/blink/public/mojom/page/page.mojom
-@@ -97,4 +97,7 @@ interface PageBroadcast {
+@@ -108,4 +108,7 @@ interface PageBroadcast {
  
    // Sent to whole page, but should only be used by the main frame.
    SetPageBaseBackgroundColor(skia.mojom.SkColor? color);
@@ -73,7 +73,7 @@ index befd736a9cf362514b9a2ee475dc4a814c85a87b..24b2617f56673a3075697802cf5b574b
 +  SetSchedulerThrottling(bool allowed);
  };
 diff --git a/third_party/blink/public/web/web_view.h b/third_party/blink/public/web/web_view.h
-index a1427a6a95583ae853284b97cab77d577172e60e..4645764213c82e73532f7c61ed03f919f8241393 100644
+index 5e4032ccf916f969cd669af7d983becddb57c72b..a858c9f2fa609ae756a2e70d0362f2de372dd5be 100644
 --- a/third_party/blink/public/web/web_view.h
 +++ b/third_party/blink/public/web/web_view.h
 @@ -364,6 +364,7 @@ class WebView {
@@ -85,10 +85,10 @@ index a1427a6a95583ae853284b97cab77d577172e60e..4645764213c82e73532f7c61ed03f919
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index d7b5e40a26026b7f4640c2f405fadab4a800e267..b2a2e38397fdf3e9bb52c4532a1d14463ed4110d 100644
+index 6504c73f614bebad7b899c8b76c4b3034b7dab7a..f76a0ee0778d7b4e4df69a4c43b4a6bfdc89294d 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -3688,6 +3688,13 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -3689,6 +3689,13 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  
@@ -102,7 +102,7 @@ index d7b5e40a26026b7f4640c2f405fadab4a800e267..b2a2e38397fdf3e9bb52c4532a1d1446
  void WebViewImpl::SetVisibilityState(
      mojom::blink::PageVisibilityState visibility_state,
      bool is_initial_state) {
-@@ -3699,7 +3706,8 @@ void WebViewImpl::SetVisibilityState(
+@@ -3700,7 +3707,8 @@ void WebViewImpl::SetVisibilityState(
    }
    GetPage()->SetVisibilityState(visibility_state, is_initial_state);
    GetPage()->GetPageScheduler()->SetPageVisible(
@@ -113,10 +113,10 @@ index d7b5e40a26026b7f4640c2f405fadab4a800e267..b2a2e38397fdf3e9bb52c4532a1d1446
  
  mojom::blink::PageVisibilityState WebViewImpl::GetVisibilityState() {
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index 08a54c62b7f4eeb6a8b0e0cb192723e1aecad915..1eeb122ac5db86c53d328a308dc2b7a4a5ca9fed 100644
+index 5c9609a6a8d1e18981ac14ad5321fa82c3eb38e0..0a2564a8e45210ba58438e95caa70d01fac22aee 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
-@@ -419,6 +419,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -420,6 +420,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    LocalDOMWindow* PagePopupWindow() const;
  
    PageScheduler* Scheduler() const override;
@@ -124,7 +124,7 @@ index 08a54c62b7f4eeb6a8b0e0cb192723e1aecad915..1eeb122ac5db86c53d328a308dc2b7a4
    void SetVisibilityState(mojom::blink::PageVisibilityState visibility_state,
                            bool is_initial_state) override;
    mojom::blink::PageVisibilityState GetVisibilityState() override;
-@@ -854,6 +855,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -855,6 +856,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    // If true, we send IPC messages when |preferred_size_| changes.
    bool send_preferred_size_changes_ = false;
  

patches/chromium/blink_local_frame.patch

@@ -15,10 +15,10 @@ Refs changes in:
 This patch reverts the changes to fix associated crashes in Electron.
 
 diff --git a/third_party/blink/renderer/core/frame/frame.cc b/third_party/blink/renderer/core/frame/frame.cc
-index 0396836ad4ae67e26b6920afbcd702ccb24d391e..f207eda80b6cd1d3a739cc27499691ad1ac8e13e 100644
+index a519c49a01987feab4dadbc4ba48b73e943fa404..c8d2a65cb428e85c33675668cc106f0af124dfee 100644
 --- a/third_party/blink/renderer/core/frame/frame.cc
 +++ b/third_party/blink/renderer/core/frame/frame.cc
-@@ -122,14 +122,6 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -123,14 +123,6 @@ bool Frame::Detach(FrameDetachType type) {
  
    DCHECK(!IsDetached());
  
@@ -33,7 +33,7 @@ index 0396836ad4ae67e26b6920afbcd702ccb24d391e..f207eda80b6cd1d3a739cc27499691ad
    if (type == FrameDetachType::kRemove) {
      if (provisional_frame_) {
        provisional_frame_->Detach(FrameDetachType::kRemove);
-@@ -153,6 +145,14 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -154,6 +146,14 @@ bool Frame::Detach(FrameDetachType type) {
      GetWindowProxyManager()->ClearForSwap();
    }
  
@@ -49,7 +49,7 @@ index 0396836ad4ae67e26b6920afbcd702ccb24d391e..f207eda80b6cd1d3a739cc27499691ad
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index b95ed440737ccdf32607c90831d13a482315d515..73f7aeee21f0116e46dad91cb9a088ab5adda6e3 100644
+index 3efc0a04ae3fa60dce4aeb9a296c8dd1bb43320a..5dac7c18f39abefcc318ba2a7b8fad449189d0b6 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
 @@ -543,10 +543,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {

patches/chromium/build_disable_print_content_analysis.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: VerteDinde <vertedinde@electronjs.org>
+Date: Sun, 1 May 2022 18:01:42 -0700
+Subject: build: disable print_content_analysis
+
+Print Content Analysis enables enterprise users to scan to-be-printed
+pages and documents for sensitive data if the OnPrintEnterpriseConnector
+policy is enabled. A conversation with the Chromium team confirmed
+this feature was intended for enterprise Chrome users and not embedders,
+so we're disabling it to prevent build issues/additional unneeded files.
+
+This patch can be removed when enable_print_content_analysis can be more
+easily enabled or disabled by default with buildflags.
+
+diff --git a/printing/buildflags/buildflags.gni b/printing/buildflags/buildflags.gni
+index 559ac76d4e4b9d9c1824c4da186a6b0f7619fcca..72855e0c5fadb286b67144b34ff71f45e1434c73 100644
+--- a/printing/buildflags/buildflags.gni
++++ b/printing/buildflags/buildflags.gni
+@@ -36,8 +36,7 @@ declare_args() {
+ 
+   # Enable snapshotting a page when printing for its content to be analyzed for
+   # sensitive content by enterprise users.
+-  enable_print_content_analysis =
+-      is_chromeos_ash || is_chromeos_lacros || is_win || is_linux || is_mac
++  enable_print_content_analysis = is_chromeos_ash || is_chromeos_lacros
+ }
+ 
+ declare_args() {

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -33,10 +33,10 @@ index 3c40d999a9545051e91a9f0ad3bf7ca2a95d80c4..b5a20be5e22238e7e1969bdaf52c0b05
          "//base",
          "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index bd16a798301785507629f24726c1cec636956fe2..86ab85c51a0a6192f1ea040007966464439465ab 100644
+index 948d05358b89895faa97a7d383bfac66a45464a8..43859d267010103daf80525a5af0f312a577411c 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4552,7 +4552,7 @@ static_library("browser") {
+@@ -4560,7 +4560,7 @@ static_library("browser") {
  
      # On Windows, the hashes are embedded in //chrome:chrome_initial rather
      # than here in :chrome_dll.
@@ -46,10 +46,10 @@ index bd16a798301785507629f24726c1cec636956fe2..86ab85c51a0a6192f1ea040007966464
        sources += [ "certificate_viewer_stub.cc" ]
      }
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 060e49987d27be37afb2b85e658525d4edc08df6..3333bb6be0d07eff9d4ef5aea446c44c00b3d3af 100644
+index 641f52eb7952858738a6623b480f767261e5d009..6d0c624ea62a9125ef7e5579da197de2327a12ff 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -5995,7 +5995,6 @@ test("unit_tests") {
+@@ -6002,7 +6002,6 @@ test("unit_tests") {
  
      deps += [
        "//chrome:other_version",
@@ -57,7 +57,7 @@ index 060e49987d27be37afb2b85e658525d4edc08df6..3333bb6be0d07eff9d4ef5aea446c44c
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/browser:chrome_process_finder",
-@@ -6018,6 +6017,10 @@ test("unit_tests") {
+@@ -6025,6 +6024,10 @@ test("unit_tests") {
        "//ui/resources",
      ]
  
@@ -68,7 +68,7 @@ index 060e49987d27be37afb2b85e658525d4edc08df6..3333bb6be0d07eff9d4ef5aea446c44c
      ldflags = [
        "/DELAYLOAD:api-ms-win-core-winrt-error-l1-1-0.dll",
        "/DELAYLOAD:api-ms-win-core-winrt-l1-1-0.dll",
-@@ -6706,7 +6709,6 @@ test("unit_tests") {
+@@ -6712,7 +6715,6 @@ test("unit_tests") {
      }
  
      deps += [
@@ -76,7 +76,7 @@ index 060e49987d27be37afb2b85e658525d4edc08df6..3333bb6be0d07eff9d4ef5aea446c44c
        "//chrome/browser:cart_db_content_proto",
        "//chrome/browser:coupon_db_content_proto",
        "//chrome/browser/media/router:test_support",
-@@ -6754,6 +6756,11 @@ test("unit_tests") {
+@@ -6760,6 +6762,11 @@ test("unit_tests") {
      if (is_chromeos) {
        deps += [ "//ui/chromeos" ]
      }

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 9b08d7bbbda75390813ff07e0dc83bb9d16992a6..b47dc4a90a0294c5d7e73f01c496fd2b4f621400 100644
+index ec886101b6e5347bdd832684a5c3b2cc3179c657..0287e414f4020147ddee297f7c1447c32a118905 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -6939,6 +6939,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -6943,6 +6943,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index 9b08d7bbbda75390813ff07e0dc83bb9d16992a6..b47dc4a90a0294c5d7e73f01c496fd2b
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index d0092176fd24acb0657819d666e4f76ec65012ec..df03de0a810bbce796d5bc421b92000e02dbd449 100644
+index 335e70179a03ee379082525bb4c7d596983bd633..faa795be3a6cbc7ae13d9a42a1bdbd01ac0406a9 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -3943,6 +3943,14 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3947,6 +3947,14 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    }
    auto* new_contents_impl = new_contents.get();
  
@@ -39,7 +39,7 @@ index d0092176fd24acb0657819d666e4f76ec65012ec..df03de0a810bbce796d5bc421b92000e
    new_contents_impl->GetController().SetSessionStorageNamespace(
        partition_config, session_storage_namespace);
  
-@@ -3987,12 +3995,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3991,12 +3999,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -102,7 +102,7 @@ index ae3dda4b9b40bb0d4c1a10eaedda9270d3543a8b..9b988bb631ab759739ae01c918efb1d5
        bool opener_suppressed,
        bool* no_javascript_access);
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index f132199113778f6b50972419b61a187e6272300c..7bb1680553c405a9016cfd67eca5fa3c6439b692 100644
+index 9bbc7cf6d9542a3f013313e0c497839da2beb9d1..c01e06b08b1cca7a663e30476a551904ce9c6db8 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
 @@ -26,6 +26,17 @@ namespace content {
@@ -124,7 +124,7 @@ index f132199113778f6b50972419b61a187e6272300c..7bb1680553c405a9016cfd67eca5fa3c
                                                   const OpenURLParams& params) {
    return nullptr;
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 85335ff06c87ea3986360fad18df6cf01a4a7cca..eeafde1fa6067804665954525eafdd482d8eb3f3 100644
+index 04aa4d993b331396ee20464f6e1d2da10c91c834..2556c044b6e28501a5fac9b0040e623b8f35f497 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
 @@ -16,6 +16,7 @@
@@ -150,7 +150,7 @@ index 85335ff06c87ea3986360fad18df6cf01a4a7cca..eeafde1fa6067804665954525eafdd48
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
-index f7fbc40e8df8b996d6079f2e691771529ca42497..5580f245477b713d0f1f92ca9d15de847c4f8c92 100644
+index 89b07508aef80680a847c106fea0e2fa58ff964b..6630af3583a6bac6135d46644280d6444fe981b8 100644
 --- a/content/renderer/render_view_impl.cc
 +++ b/content/renderer/render_view_impl.cc
 @@ -33,6 +33,7 @@
@@ -220,10 +220,10 @@ index 84d32491a56528a84b4395fba1d54cdbb38d522b..09998a83c449ef8cd9f360fbcdcf7edc
  
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
-index 00af75f5295251fb19c874d2b7d877c4a53f7f12..c0042534907dfca1789b8dde2ffa11956d3e029e 100644
+index 2e2ba228a7f179b7cf9c43434bd20ca20b1f1af6..de9f95426ad2dcc99bc4961a0e57539d287408e4 100644
 --- a/third_party/blink/renderer/core/frame/local_dom_window.cc
 +++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
-@@ -2076,6 +2076,7 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
+@@ -2074,6 +2074,7 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
  
    WebWindowFeatures window_features =
        GetWindowFeaturesFromString(features, incumbent_window);

patches/chromium/cherry-pick-22c61cfae5d1.patch

@@ -0,0 +1,97 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Austin Sullivan <asully@chromium.org>
+Date: Thu, 12 May 2022 04:52:20 +0000
+Subject: FSA: Sanitize .url files
+
+Bug: 1307930
+Change-Id: I7ed3cca5942a5334ba761d269bdd8961fa9d13fe
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3638698
+Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
+Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
+Auto-Submit: Austin Sullivan <asully@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1002495}
+
+diff --git a/content/browser/file_system_access/file_system_chooser.cc b/content/browser/file_system_access/file_system_chooser.cc
+index f8cd9d51222c70166a82cdd6dd4b7d0c24970606..8c38f004109aa967e1e5439a17dc35d3013e8ecf 100644
+--- a/content/browser/file_system_access/file_system_chooser.cc
++++ b/content/browser/file_system_access/file_system_chooser.cc
+@@ -275,13 +275,15 @@ bool FileSystemChooser::IsShellIntegratedExtension(
+   base::FilePath::StringType extension_lower =
+       base::ToLowerASCII(GetLastExtension(extension));
+ 
+-  // .lnk and .scf files may be used to execute arbitrary code (see
++  // '.lnk' and '.scf' files may be used to execute arbitrary code (see
+   // https://nvd.nist.gov/vuln/detail/CVE-2010-2568 and
+-  // https://crbug.com/1227995, respectively). .local files are used by Windows
+-  // to determine which DLLs to load for an application.
++  // https://crbug.com/1227995, respectively). '.local' files are used by
++  // Windows to determine which DLLs to load for an application. '.url' files
++  // can be used to read arbirtary files (see https://crbug.com/1307930).
+   if ((extension_lower == FILE_PATH_LITERAL("lnk")) ||
+       (extension_lower == FILE_PATH_LITERAL("local")) ||
+-      (extension_lower == FILE_PATH_LITERAL("scf"))) {
++      (extension_lower == FILE_PATH_LITERAL("scf")) ||
++      (extension_lower == FILE_PATH_LITERAL("url"))) {
+     return true;
+   }
+ 
+diff --git a/content/browser/file_system_access/file_system_chooser_browsertest.cc b/content/browser/file_system_access/file_system_chooser_browsertest.cc
+index 9ea4db7807f6bbac799452fd138848b2a650d6fd..79dda31bd228e785d54e5486bb4417a75ee62b3a 100644
+--- a/content/browser/file_system_access/file_system_chooser_browsertest.cc
++++ b/content/browser/file_system_access/file_system_chooser_browsertest.cc
+@@ -1556,13 +1556,21 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, SuggestedName) {
+   name_infos.push_back({"not_matching.jpg", ListValueOf(".txt"), false,
+                         "not_matching.jpg", false});
+ 
+-  // ".lnk", ".local", and ".scf" extensions should be sanitized.
+-  name_infos.push_back({"dangerous_extension.local", ListValueOf(".local"),
+-                        true, "dangerous_extension.download", false});
++  // ".lnk", ".local", ".scf", and ".url" extensions should be sanitized.
+   name_infos.push_back({"dangerous_extension.lnk", ListValueOf(".lnk"), true,
+                         "dangerous_extension.download", false});
++  name_infos.push_back({"dangerous_extension.lnk", ListValueOf(".LNK"), true,
++                        "dangerous_extension.download", false});
++  name_infos.push_back({"dangerous_extension.LNK", ListValueOf(".lnk"), true,
++                        "dangerous_extension.download", false});
++  name_infos.push_back({"dangerous_extension.LNK", ListValueOf(".LNK"), true,
++                        "dangerous_extension.download", false});
++  name_infos.push_back({"dangerous_extension.local", ListValueOf(".local"),
++                        true, "dangerous_extension.download", false});
+   name_infos.push_back({"dangerous_extension.scf", ListValueOf(".scf"), true,
+                         "dangerous_extension.download", false});
++  name_infos.push_back({"dangerous_extension.url", ListValueOf(".url"), true,
++                        "dangerous_extension.download", false});
+   // Compound extensions ending in a dangerous extension should be sanitized.
+   name_infos.push_back({"dangerous_extension.png.local", ListValueOf(".local"),
+                         true, "dangerous_extension.png.download", false});
+@@ -1570,6 +1578,8 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, SuggestedName) {
+                         true, "dangerous_extension.png.download", false});
+   name_infos.push_back({"dangerous_extension.png.scf", ListValueOf(".scf"),
+                         true, "dangerous_extension.png.download", false});
++  name_infos.push_back({"dangerous_extension.png.url", ListValueOf(".url"),
++                        true, "dangerous_extension.png.download", false});
+   // Compound extensions not ending in a dangerous extension should not be
+   // sanitized.
+   name_infos.push_back({"dangerous_extension.local.png", ListValueOf(".png"),
+@@ -1578,6 +1588,8 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, SuggestedName) {
+                         true, "dangerous_extension.lnk.png", true});
+   name_infos.push_back({"dangerous_extension.scf.png", ListValueOf(".png"),
+                         true, "dangerous_extension.scf.png", true});
++  name_infos.push_back({"dangerous_extension.url.png", ListValueOf(".png"),
++                        true, "dangerous_extension.url.png", true});
+   // Invalid characters should be sanitized.
+   name_infos.push_back({R"(inv*l:d\\ch%rבאמת!a<ters🤓.txt)",
+                         ListValueOf(".txt"), true,
+diff --git a/content/browser/file_system_access/file_system_chooser_unittest.cc b/content/browser/file_system_access/file_system_chooser_unittest.cc
+index 9b27d6305bd00a19d94b5ec49f21a7ecff7ddc48..3082c088f9733de9335437278c0d023954a953d9 100644
+--- a/content/browser/file_system_access/file_system_chooser_unittest.cc
++++ b/content/browser/file_system_access/file_system_chooser_unittest.cc
+@@ -189,7 +189,7 @@ TEST_F(FileSystemChooserTest, IgnoreShellIntegratedExtensions) {
+   accepts.emplace_back(blink::mojom::ChooseFileSystemEntryAcceptsOption::New(
+       u"", std::vector<std::string>({}),
+       std::vector<std::string>(
+-          {"lnk", "foo.lnk", "foo.bar.local", "text", "local", "scf"})));
++          {"lnk", "foo.lnk", "foo.bar.local", "text", "local", "scf", "url"})));
+   SyncShowDialog(std::move(accepts), /*include_accepts_all=*/false);
+ 
+   ASSERT_TRUE(dialog_params.file_types);

patches/chromium/cherry-pick-94a8bdafc8c6.patch

@@ -0,0 +1,414 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Keren Zhu <kerenzhu@chromium.org>
+Date: Thu, 9 Jun 2022 14:50:26 +0000
+Subject: Fix use-after-free vulnerability in ComboboxModel
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Stop the Combobox from observing the model when the model gets
+destroyed. This is done by adding a virtual OnComboboxModelDestroying()
+to the base observer class and calling it in ~ComboboxModel().
+
+This fix will prevent the use-after-free that happens when the combobox outlives the model, usually because the model lifetime
+is managed by non-UI component.
+
+Bug: 1264288
+Change-Id: Ia00881a9b674bbc83bbf54dd228490c1cc1290bc
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3693825
+Commit-Queue: Keren Zhu <kerenzhu@chromium.org>
+Reviewed-by: Matthias Körber <koerber@google.com>
+Auto-Submit: Keren Zhu <kerenzhu@chromium.org>
+Reviewed-by: Peter Boström <pbos@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1012504}
+
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
+index 323f85651611ff98e45884e3b0b7211eaa25039b..0d0bb0d21b1d96841a30bfea336af918b6da83f8 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
+@@ -130,16 +130,6 @@ int RecentlyUsedFoldersComboModel::GetDefaultIndex() const {
+   return it == items_.end() ? 0 : static_cast<int>(it - items_.begin());
+ }
+ 
+-void RecentlyUsedFoldersComboModel::AddObserver(
+-    ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void RecentlyUsedFoldersComboModel::RemoveObserver(
+-    ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ void RecentlyUsedFoldersComboModel::BookmarkModelLoaded(BookmarkModel* model,
+                                                         bool ids_reassigned) {}
+ 
+@@ -176,7 +166,7 @@ void RecentlyUsedFoldersComboModel::OnWillRemoveBookmarks(
+     }
+   }
+   if (changed) {
+-    for (ui::ComboboxModelObserver& observer : observers_)
++    for (ui::ComboboxModelObserver& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ }
+@@ -219,7 +209,7 @@ void RecentlyUsedFoldersComboModel::BookmarkAllUserNodesRemoved(
+     }
+   }
+   if (changed) {
+-    for (ui::ComboboxModelObserver& observer : observers_)
++    for (ui::ComboboxModelObserver& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
+index 8682e750f4407e615264986024e2a7dd0bae038f..0c02c685a02875c7b91ca9e6228864bc04e45c10 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
+@@ -38,8 +38,6 @@ class RecentlyUsedFoldersComboModel : public ui::ComboboxModel,
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+   int GetDefaultIndex() const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+   // Overriden from bookmarks::BookmarkModelObserver:
+   void BookmarkModelLoaded(bookmarks::BookmarkModel* model,
+@@ -90,8 +88,6 @@ class RecentlyUsedFoldersComboModel : public ui::ComboboxModel,
+   const raw_ptr<bookmarks::BookmarkModel> bookmark_model_;
+ 
+   const raw_ptr<const bookmarks::BookmarkNode> parent_node_;
+-
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ #endif  // CHROME_BROWSER_UI_BOOKMARKS_RECENTLY_USED_FOLDERS_COMBO_MODEL_H_
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
+index 60455386b7d5f1da72c92424ccf95fd971e7590a..3bfe6852b8a54a53aafea5eeec2da850097b2f0a 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
+@@ -41,6 +41,8 @@ class TestComboboxModelObserver : public ui::ComboboxModelObserver {
+     changed_ = true;
+   }
+ 
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override {}
++
+  private:
+   bool changed_;
+ };
+diff --git a/components/autofill/core/browser/ui/address_combobox_model.cc b/components/autofill/core/browser/ui/address_combobox_model.cc
+index c7e6f906ff32cb198f8723d6678971ae6cff28a2..d52dc0e925c54634452f86ca90792b318776e895 100644
+--- a/components/autofill/core/browser/ui/address_combobox_model.cc
++++ b/components/autofill/core/browser/ui/address_combobox_model.cc
+@@ -84,14 +84,6 @@ int AddressComboboxModel::GetDefaultIndex() const {
+   return ui::ComboboxModel::GetDefaultIndex();
+ }
+ 
+-void AddressComboboxModel::AddObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void AddressComboboxModel::RemoveObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ int AddressComboboxModel::AddNewProfile(const AutofillProfile& profile) {
+   profiles_cache_.push_back(std::make_unique<AutofillProfile>(profile));
+   UpdateAddresses();
+@@ -131,7 +123,7 @@ void AddressComboboxModel::UpdateAddresses() {
+   for (size_t i = 0; i < profiles_cache_.size(); ++i)
+     addresses_.emplace_back(profiles_cache_[i]->guid(), labels[i]);
+ 
+-  for (auto& observer : observers_) {
++  for (auto& observer : observers()) {
+     observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/components/autofill/core/browser/ui/address_combobox_model.h b/components/autofill/core/browser/ui/address_combobox_model.h
+index 02d65209d2729deae608481411e1539ba08f5f7e..3a41b30c92543633da29e40e2c64cc4597e322d2 100644
+--- a/components/autofill/core/browser/ui/address_combobox_model.h
++++ b/components/autofill/core/browser/ui/address_combobox_model.h
+@@ -40,8 +40,6 @@ class AddressComboboxModel : public ui::ComboboxModel {
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+   int GetDefaultIndex() const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+   // Adds |profile| to model and return its combobox index. The lifespan of
+   // |profile| beyond this call is undefined so a copy must be made.
+@@ -72,9 +70,6 @@ class AddressComboboxModel : public ui::ComboboxModel {
+ 
+   // If non empty, the guid of the address that should be selected by default.
+   std::string default_selected_guid_;
+-
+-  // To be called when the data for the given country code was loaded.
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ }  // namespace autofill
+diff --git a/components/autofill/core/browser/ui/region_combobox_model.cc b/components/autofill/core/browser/ui/region_combobox_model.cc
+index 6439ccb1f074f1c3965dfb2b45ab6f6636437c17..42626aff427f1b3f3400aba399e3f9c89faa06ba 100644
+--- a/components/autofill/core/browser/ui/region_combobox_model.cc
++++ b/components/autofill/core/browser/ui/region_combobox_model.cc
+@@ -67,14 +67,6 @@ bool RegionComboboxModel::IsItemSeparatorAt(int index) const {
+   return regions_[index].first.empty();
+ }
+ 
+-void RegionComboboxModel::AddObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void RegionComboboxModel::RemoveObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ void RegionComboboxModel::OnRegionDataLoaded(
+     const std::vector<const ::i18n::addressinput::RegionData*>& regions) {
+   // The RegionDataLoader will eventually self destruct after this call.
+@@ -95,7 +87,7 @@ void RegionComboboxModel::OnRegionDataLoaded(
+     failed_to_load_data_ = true;
+   }
+ 
+-  for (auto& observer : observers_) {
++  for (auto& observer : observers()) {
+     observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/components/autofill/core/browser/ui/region_combobox_model.h b/components/autofill/core/browser/ui/region_combobox_model.h
+index d1b5d8b9db0c4d9d15e4f2a50a6cba38b33f1be8..52cffd5d00649f8e2be7189bca128ba4c3e8a97d 100644
+--- a/components/autofill/core/browser/ui/region_combobox_model.h
++++ b/components/autofill/core/browser/ui/region_combobox_model.h
+@@ -54,8 +54,6 @@ class RegionComboboxModel : public ui::ComboboxModel {
+   int GetItemCount() const override;
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+  private:
+   // Callback for the RegionDataLoader.
+@@ -72,9 +70,6 @@ class RegionComboboxModel : public ui::ComboboxModel {
+   // List of <code, name> pairs for ADDRESS_HOME_STATE combobox values;
+   std::vector<std::pair<std::string, std::string>> regions_;
+ 
+-  // To be called when the data for the given country code was loaded.
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+-
+   // Weak pointer factory.
+   base::WeakPtrFactory<RegionComboboxModel> weak_factory_{this};
+ };
+diff --git a/ui/base/models/combobox_model.cc b/ui/base/models/combobox_model.cc
+index d307ee0ec592ae01a1d04cef85c0a492b7f7e29e..413adebd0349e304006de0cc0c4e2a4536ebbf06 100644
+--- a/ui/base/models/combobox_model.cc
++++ b/ui/base/models/combobox_model.cc
+@@ -4,10 +4,18 @@
+ 
+ #include "ui/base/models/combobox_model.h"
+ 
++#include "ui/base/models/combobox_model_observer.h"
+ #include "ui/base/models/image_model.h"
+ 
+ namespace ui {
+ 
++ComboboxModel::ComboboxModel() = default;
++
++ComboboxModel::~ComboboxModel() {
++  for (auto& observer : observers_)
++    observer.OnComboboxModelDestroying(this);
++}
++
+ std::u16string ComboboxModel::GetDropDownTextAt(int index) const {
+   return GetItemAt(index);
+ }
+@@ -36,4 +44,12 @@ bool ComboboxModel::IsItemEnabledAt(int index) const {
+   return true;
+ }
+ 
++void ComboboxModel::AddObserver(ComboboxModelObserver* observer) {
++  observers_.AddObserver(observer);
++}
++
++void ComboboxModel::RemoveObserver(ComboboxModelObserver* observer) {
++  observers_.RemoveObserver(observer);
++}
++
+ }  // namespace ui
+diff --git a/ui/base/models/combobox_model.h b/ui/base/models/combobox_model.h
+index 5264aaa5550859fce39a8485feff16c8fd83d897..eeff7dc8444e77fd598eb7ce05ab18259a9d7ef5 100644
+--- a/ui/base/models/combobox_model.h
++++ b/ui/base/models/combobox_model.h
+@@ -8,6 +8,7 @@
+ #include <string>
+ 
+ #include "base/component_export.h"
++#include "base/observer_list.h"
+ 
+ namespace ui {
+ 
+@@ -17,7 +18,8 @@ class ImageModel;
+ // A data model for a combo box.
+ class COMPONENT_EXPORT(UI_BASE) ComboboxModel {
+  public:
+-  virtual ~ComboboxModel() {}
++  ComboboxModel();
++  virtual ~ComboboxModel();
+ 
+   // Returns the number of items in the combo box.
+   virtual int GetItemCount() const = 0;
+@@ -52,9 +54,17 @@ class COMPONENT_EXPORT(UI_BASE) ComboboxModel {
+   // Returns true if the item at |index| is enabled.
+   virtual bool IsItemEnabledAt(int index) const;
+ 
+-  // Adds/removes an observer. Override if model supports mutation.
+-  virtual void AddObserver(ComboboxModelObserver* observer) {}
+-  virtual void RemoveObserver(ComboboxModelObserver* observer) {}
++  // Adds/removes an observer.
++  void AddObserver(ComboboxModelObserver* observer);
++  void RemoveObserver(ComboboxModelObserver* observer);
++
++ protected:
++  base::ObserverList<ui::ComboboxModelObserver>& observers() {
++    return observers_;
++  }
++
++ private:
++  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ }  // namespace ui
+diff --git a/ui/base/models/combobox_model_observer.h b/ui/base/models/combobox_model_observer.h
+index 5e00ab68a0c14d0b48317ca287e3f105351a102c..44325ff0aa94b75eb662be1637f44aa5524a33e8 100644
+--- a/ui/base/models/combobox_model_observer.h
++++ b/ui/base/models/combobox_model_observer.h
+@@ -16,10 +16,13 @@ class ComboboxModel;
+ class COMPONENT_EXPORT(UI_BASE) ComboboxModelObserver
+     : public base::CheckedObserver {
+  public:
+-  // Invoked when |model| has changed in some way. The observer should assume
++  // Invoked when `model` has changed in some way. The observer should assume
+   // everything changed.
+   virtual void OnComboboxModelChanged(ComboboxModel* model) = 0;
+ 
++  // Invoked when `model` is destroyed. The observer should stop observing.
++  virtual void OnComboboxModelDestroying(ComboboxModel* model) = 0;
++
+  protected:
+   ~ComboboxModelObserver() override = default;
+ };
+diff --git a/ui/views/controls/combobox/combobox.cc b/ui/views/controls/combobox/combobox.cc
+index aa135250e469d2405fba618c96b0bf38acaf59f0..b8d41cfeb67f3b4c098b2b329b2dfa7fe246dabb 100644
+--- a/ui/views/controls/combobox/combobox.cc
++++ b/ui/views/controls/combobox/combobox.cc
+@@ -578,6 +578,10 @@ void Combobox::OnComboboxModelChanged(ui::ComboboxModel* model) {
+   OnContentSizeMaybeChanged();
+ }
+ 
++void Combobox::OnComboboxModelDestroying(ui::ComboboxModel* model) {
++  SetModel(nullptr);
++}
++
+ const base::RepeatingClosure& Combobox::GetCallback() const {
+   return callback_;
+ }
+diff --git a/ui/views/controls/combobox/combobox.h b/ui/views/controls/combobox/combobox.h
+index fc77f8e49cead5fb689fba3d56c65c1b8e69f298..1a3f533256eca91e4fd4552ee5425b7ca8e7ad7e 100644
+--- a/ui/views/controls/combobox/combobox.h
++++ b/ui/views/controls/combobox/combobox.h
+@@ -131,6 +131,7 @@ class VIEWS_EXPORT Combobox : public View,
+  protected:
+   // Overridden from ComboboxModelObserver:
+   void OnComboboxModelChanged(ui::ComboboxModel* model) override;
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override;
+ 
+   // Getters to be used by metadata.
+   const base::RepeatingClosure& GetCallback() const;
+diff --git a/ui/views/controls/combobox/combobox_unittest.cc b/ui/views/controls/combobox/combobox_unittest.cc
+index 7ce20acc4b3ecd6470d5f017f9171d0be35c09d2..91661f33074d3453b4f28a410ecc918b793f86c6 100644
+--- a/ui/views/controls/combobox/combobox_unittest.cc
++++ b/ui/views/controls/combobox/combobox_unittest.cc
+@@ -84,13 +84,6 @@ class TestComboboxModel : public ui::ComboboxModel {
+     return 0;
+   }
+ 
+-  void AddObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.AddObserver(observer);
+-  }
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.RemoveObserver(observer);
+-  }
+-
+   void SetSeparators(const std::set<int>& separators) {
+     separators_ = separators;
+     OnModelChanged();
+@@ -103,11 +96,10 @@ class TestComboboxModel : public ui::ComboboxModel {
+ 
+  private:
+   void OnModelChanged() {
+-    for (auto& observer : observers_)
++    for (auto& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ 
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+   std::set<int> separators_;
+   int item_count_ = kItemCount;
+ };
+@@ -134,20 +126,13 @@ class VectorComboboxModel : public ui::ComboboxModel {
+   }
+   bool IsItemSeparatorAt(int index) const override { return false; }
+   int GetDefaultIndex() const override { return default_index_; }
+-  void AddObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.AddObserver(observer);
+-  }
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.RemoveObserver(observer);
+-  }
+ 
+   void ValuesChanged() {
+-    for (auto& observer : observers_)
++    for (auto& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ 
+  private:
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+   int default_index_ = 0;
+   const raw_ptr<std::vector<std::string>> values_;
+ };
+@@ -884,6 +869,15 @@ TEST_F(ComboboxTest, SetTooltipTextNotifiesAccessibilityEvent) {
+   EXPECT_EQ(test_tooltip_text, ASCIIToUTF16(name));
+ }
+ 
++// Regression test for crbug.com/1264288.
++// Should fail in ASan build before the fix.
++TEST_F(ComboboxTest, NoCrashWhenComboboxOutlivesModel) {
++  auto model = std::make_unique<TestComboboxModel>();
++  auto combobox = std::make_unique<TestCombobox>(model.get());
++  model.reset();
++  combobox.reset();
++}
++
+ namespace {
+ 
+ using ComboboxDefaultTest = ViewsTestBase;
+diff --git a/ui/views/controls/editable_combobox/editable_combobox.cc b/ui/views/controls/editable_combobox/editable_combobox.cc
+index b5301bfb0a3c8da3daa1d3646c2f4872cef2cdab..faac607fefcc8caf572eb83456e7520146c1d0ad 100644
+--- a/ui/views/controls/editable_combobox/editable_combobox.cc
++++ b/ui/views/controls/editable_combobox/editable_combobox.cc
+@@ -190,10 +190,15 @@ class EditableCombobox::EditableComboboxMenuModel
+     return combobox_model_->GetDropDownIconAt(items_shown_[index].index);
+   }
+ 
++  // ComboboxModelObserver:
+   void OnComboboxModelChanged(ui::ComboboxModel* model) override {
+     UpdateItemsShown();
+   }
+ 
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override {
++    observation_.Reset();
++  }
++
+   int GetItemCount() const override { return items_shown_.size(); }
+ 
+  private:

patches/chromium/cherry-pick-bd9724c9fe63.patch

@@ -0,0 +1,203 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Min Qin <qinmin@chromium.org>
+Date: Tue, 28 Jun 2022 16:27:43 +0000
+Subject: passing update_first_party_url_on_redirect=false for fetch
+
+Background fetch doesn't work like regular download as it is not
+considered a top frame navigation. This CL let background fetch to
+pass update_first_party_url_on_redirect=false to DownloadURLParameters,
+and handle it properly w.r.t samesite cookies.
+
+BUG=1268580
+
+(cherry picked from commit bf1e93c6af21dad12088b615feda07a90a85c158)
+
+Change-Id: I3a1cc33be8578d5d8c796dbbb21fa35a47bdda36
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3712307
+Reviewed-by: Rayan Kanso <rayankans@chromium.org>
+Commit-Queue: Min Qin <qinmin@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1016316}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3727786
+Cr-Commit-Position: refs/branch-heads/5112@{#397}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/components/background_fetch/background_fetch_delegate_base.cc b/components/background_fetch/background_fetch_delegate_base.cc
+index 5f88192eb4e92d4c41c79db188b8b9982f005258..26f7716ae83b70cdcf7cdb23652c2c56d7dc27bf 100644
+--- a/components/background_fetch/background_fetch_delegate_base.cc
++++ b/components/background_fetch/background_fetch_delegate_base.cc
+@@ -101,6 +101,7 @@ void BackgroundFetchDelegateBase::DownloadUrl(
+                           weak_ptr_factory_.GetWeakPtr());
+   params.traffic_annotation =
+       net::MutableNetworkTrafficAnnotationTag(traffic_annotation);
++  params.request_params.update_first_party_url_on_redirect = false;
+ 
+   JobDetails* job_details = GetJobDetails(job_id);
+   if (job_details->job_state == JobDetails::State::kPendingWillStartPaused ||
+diff --git a/components/download/content/internal/download_driver_impl.cc b/components/download/content/internal/download_driver_impl.cc
+index 2b2da55b06e3b4859f439d5b3bf7013b981b75a0..b207ce5c6bd3c332a34885e1dc58cc11d91fe31c 100644
+--- a/components/download/content/internal/download_driver_impl.cc
++++ b/components/download/content/internal/download_driver_impl.cc
+@@ -229,6 +229,8 @@ void DownloadDriverImpl::Start(
+     download_url_params->set_isolation_info(
+         request_params.isolation_info.value());
+   }
++  download_url_params->set_update_first_party_url_on_redirect(
++      request_params.update_first_party_url_on_redirect);
+ 
+   download_manager_coordinator_->DownloadUrl(std::move(download_url_params));
+ }
+diff --git a/components/download/internal/common/download_utils.cc b/components/download/internal/common/download_utils.cc
+index 11f524861320eae8ab694022d97a6fe2ac7366ce..454326720b5c88cc61e4527790797fd7f522014d 100644
+--- a/components/download/internal/common/download_utils.cc
++++ b/components/download/internal/common/download_utils.cc
+@@ -386,8 +386,10 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
+     // cross-site URL has been visited before.
+     url::Origin origin = url::Origin::Create(params->url());
+     request->trusted_params->isolation_info = net::IsolationInfo::Create(
+-        net::IsolationInfo::RequestType::kMainFrame, origin, origin,
+-        net::SiteForCookies::FromOrigin(origin));
++        params->update_first_party_url_on_redirect()
++            ? net::IsolationInfo::RequestType::kMainFrame
++            : net::IsolationInfo::RequestType::kOther,
++        origin, origin, net::SiteForCookies::FromOrigin(origin));
+     request->site_for_cookies = net::SiteForCookies::FromUrl(params->url());
+   }
+ 
+@@ -395,7 +397,8 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
+   request->referrer = params->referrer();
+   request->referrer_policy = params->referrer_policy();
+   request->is_outermost_main_frame = true;
+-  request->update_first_party_url_on_redirect = true;
++  request->update_first_party_url_on_redirect =
++      params->update_first_party_url_on_redirect();
+ 
+   // Downloads should be treated as navigations from Fetch spec perspective.
+   // See also:
+diff --git a/components/download/public/background_service/download_params.h b/components/download/public/background_service/download_params.h
+index 8b911276e757ee889ed05a3fd60cc365ad8f1982..a976d470094462be735e81cf097f32b34c258270 100644
+--- a/components/download/public/background_service/download_params.h
++++ b/components/download/public/background_service/download_params.h
+@@ -126,6 +126,12 @@ struct RequestParams {
+   // be invalidate during download resumption in new browser session. Not
+   // supported on iOS.
+   absl::optional<net::IsolationInfo> isolation_info;
++
++  // First-party URL redirect policy: During server redirects, whether the
++  // first-party URL for cookies will need to be changed. Download is normally
++  // considered a main frame navigation. However, this is not true for
++  // background fetch.
++  bool update_first_party_url_on_redirect = true;
+ };
+ 
+ // The parameters that describe a download request made to the DownloadService.
+diff --git a/components/download/public/common/download_url_parameters.cc b/components/download/public/common/download_url_parameters.cc
+index 3dec7148d86cd3892670df8b95dcb78d49616e89..25ea6f13e0df9f23364b75c48b870d8ea6a53e92 100644
+--- a/components/download/public/common/download_url_parameters.cc
++++ b/components/download/public/common/download_url_parameters.cc
+@@ -34,7 +34,8 @@ DownloadUrlParameters::DownloadUrlParameters(
+       traffic_annotation_(traffic_annotation),
+       download_source_(DownloadSource::UNKNOWN),
+       require_safety_checks_(true),
+-      has_user_gesture_(false) {}
++      has_user_gesture_(false),
++      update_first_party_url_on_redirect_(true) {}
+ 
+ DownloadUrlParameters::~DownloadUrlParameters() = default;
+ 
+diff --git a/components/download/public/common/download_url_parameters.h b/components/download/public/common/download_url_parameters.h
+index ba0a03cb035a79651967ac2882f89f577bd0c012..61eb9af8a00c3e4adf700178994a9e6e864bcf0c 100644
+--- a/components/download/public/common/download_url_parameters.h
++++ b/components/download/public/common/download_url_parameters.h
+@@ -279,6 +279,11 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+     has_user_gesture_ = has_user_gesture;
+   }
+ 
++  void set_update_first_party_url_on_redirect(
++      bool update_first_party_url_on_redirect) {
++    update_first_party_url_on_redirect_ = update_first_party_url_on_redirect;
++  }
++
+   OnStartedCallback& callback() { return callback_; }
+   bool content_initiated() const { return content_initiated_; }
+   const std::string& last_modified() const { return last_modified_; }
+@@ -335,6 +340,9 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+     return isolation_info_;
+   }
+   bool has_user_gesture() const { return has_user_gesture_; }
++  bool update_first_party_url_on_redirect() const {
++    return update_first_party_url_on_redirect_;
++  }
+ 
+   // STATE CHANGING: All save_info_ sub-objects will be in an indeterminate
+   // state following this call.
+@@ -383,6 +391,7 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+   bool require_safety_checks_;
+   absl::optional<net::IsolationInfo> isolation_info_;
+   bool has_user_gesture_;
++  bool update_first_party_url_on_redirect_;
+ };
+ 
+ }  // namespace download
+diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
+index 6dcc861171b7034d7426c5c683cafca689e3d7ea..500521ce2c383d40c13a9359ba4c49d3417670f7 100644
+--- a/content/browser/download/download_browsertest.cc
++++ b/content/browser/download/download_browsertest.cc
+@@ -3763,6 +3763,58 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, UpdateSiteForCookies) {
+                                 site_a.GetURL("a.test", "/")));
+ }
+ 
++// Tests that if `update_first_party_url_on_redirect` is set to false, download
++// will not behave like a top-level frame navigation and SameSite=Strict cookies
++// will not be set on a redirection.
++IN_PROC_BROWSER_TEST_F(
++    DownloadContentTest,
++    SiteForCookies_DownloadUrl_NotUpdateFirstPartyUrlOnRedirect) {
++  net::EmbeddedTestServer site_a;
++  net::EmbeddedTestServer site_b;
++
++  base::StringPairs cookie_headers;
++  cookie_headers.push_back(std::make_pair(
++      std::string("Set-Cookie"), std::string("A=strict; SameSite=Strict")));
++  cookie_headers.push_back(std::make_pair(std::string("Set-Cookie"),
++                                          std::string("B=lax; SameSite=Lax")));
++
++  // This will request a URL on b.test, which redirects to a url that sets the
++  // cookies on a.test.
++  site_a.RegisterRequestHandler(CreateBasicResponseHandler(
++      "/sets-samesite-cookies", net::HTTP_OK, cookie_headers,
++      "application/octet-stream", "abcd"));
++  ASSERT_TRUE(site_a.Start());
++  site_b.RegisterRequestHandler(
++      CreateRedirectHandler("/redirected-download",
++                            site_a.GetURL("a.test", "/sets-samesite-cookies")));
++  ASSERT_TRUE(site_b.Start());
++
++  // Download the file.
++  SetupEnsureNoPendingDownloads();
++  std::unique_ptr<download::DownloadUrlParameters> download_parameters(
++      DownloadRequestUtils::CreateDownloadForWebContentsMainFrame(
++          shell()->web_contents(),
++          site_b.GetURL("b.test", "/redirected-download"),
++          TRAFFIC_ANNOTATION_FOR_TESTS));
++  download_parameters->set_update_first_party_url_on_redirect(false);
++  std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
++  DownloadManagerForShell(shell())->DownloadUrl(std::move(download_parameters));
++  observer->WaitForFinished();
++
++  // Get the important info from other threads and check it.
++  EXPECT_TRUE(EnsureNoPendingDownloads());
++
++  std::vector<download::DownloadItem*> downloads;
++  DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
++  ASSERT_EQ(1u, downloads.size());
++  ASSERT_EQ(download::DownloadItem::COMPLETE, downloads[0]->GetState());
++
++  // Check that the cookies were not set on a.test.
++  EXPECT_EQ("",
++            content::GetCookies(shell()->web_contents()->GetBrowserContext(),
++                                site_a.GetURL("a.test", "/")));
++}
++
+ // Verifies that isolation info set in DownloadUrlParameters can be populated.
+ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
+                        SiteForCookies_DownloadUrl_IsolationInfoPopulated) {

patches/chromium/cherry-pick-c643d18a078d.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Rayan Kanso <rayankans@google.com>
+Date: Tue, 7 Jun 2022 13:13:36 +0000
+Subject: Don't expose URL chain in case of CO redirect
+
+Bug: 1278255
+Change-Id: If853327b853e29792e5c8d1dfaeecf21d6fec004
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3693143
+Reviewed-by: Susanne Westphal <swestphal@google.com>
+Commit-Queue: Rayan Kanso <rayankans@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1011409}
+
+diff --git a/content/browser/background_fetch/storage/mark_request_complete_task.cc b/content/browser/background_fetch/storage/mark_request_complete_task.cc
+index 32a818ba8723f020fa536eb93a31c16b76ed92a1..d729dfc5d505c4c23872ef535a8b09f1af065914 100644
+--- a/content/browser/background_fetch/storage/mark_request_complete_task.cc
++++ b/content/browser/background_fetch/storage/mark_request_complete_task.cc
+@@ -104,6 +104,8 @@ void MarkRequestCompleteTask::StoreResponse(base::OnceClosure done_closure) {
+   BackgroundFetchCrossOriginFilter filter(
+       registration_id_.storage_key().origin(), *request_info_);
+   if (!filter.CanPopulateBody()) {
++    // Don't expose the initial URL in case of cross-origin redirects.
++    response_->url_list.resize(1);
+     failure_reason_ = proto::BackgroundFetchRegistration::FETCH_ERROR;
+     // No point writing the response to the cache since it won't be exposed.
+     CreateAndStoreCompletedRequest(std::move(done_closure));

patches/chromium/chore_add_electron_deps_to_gitignores.patch

@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Samuel Attard <sattard@salesforce.com>
+Date: Tue, 26 Jul 2022 00:05:29 -0700
+Subject: chore: add electron deps to gitignores
+
+Makes things like "git status" quicker when developing electron locally
+
+diff --git a/.gitignore b/.gitignore
+index cc0150c39bf635fa09d3efe9bfea2997b0b8263a..cdca4c4a9cccb7de0b13c8b803d6c74ba4d63d3a 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -224,6 +224,7 @@ vs-chromium-project.txt
+ /delegate_execute
+ /device/serial/device_serial_mojo.xml
+ /docs/website
++/electron
+ /google_apis/gcm/gcm.xml
+ /google_apis/internal
+ /googleurl
+diff --git a/third_party/.gitignore b/third_party/.gitignore
+index 567e1de3c31b2275e07b897c2644c91aef9ca076..a6744fa9d31781c6ee866ba6291588caf44e8559 100644
+--- a/third_party/.gitignore
++++ b/third_party/.gitignore
+@@ -83,6 +83,7 @@
+ /directxsdk
+ /dom_distiller_js/dist
+ /eigen3/src
++/electron_node
+ /elfutils/src
+ /emoji-segmenter/src
+ /emoji-metadata/src
+@@ -177,6 +178,7 @@
+ /mocha
+ /mockito/src
+ /nacl_sdk_binaries/
++/nan
+ /nasm
+ /nearby/src
+ /neon_2_sse/src
+@@ -239,6 +241,7 @@
+ /speex
+ /sqlite/src
+ /sqlite4java/lib/
++/squirrel.mac
+ /subresource-filter-ruleset/data/UnindexedRules
+ /swift-format
+ /swiftshader/

patches/chromium/chore_allow_chromium_to_handle_synthetic_mouse_events_for_touch.patch

@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: deepak1556 <hop2deep@gmail.com>
+Date: Fri, 29 Jul 2022 00:29:35 +0900
+Subject: chore: allow chromium to handle synthetic mouse events for touch
+
+With WCO, allow chromium to handle synthetic mouse events generated for touch
+actions in the non-client caption area.
+
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+index 9fd052c00a484cd1acd2031fda79e6307fd01b60..016dfe880a48168154c08839afa540880c2d52be 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+@@ -1169,6 +1169,10 @@ void DesktopWindowTreeHostWin::HandleWindowScaleFactorChanged(
+   }
+ }
+ 
++bool DesktopWindowTreeHostWin::HandleMouseEventForCaption(UINT message) const {
++  return false;
++}
++
+ DesktopNativeCursorManager*
+ DesktopWindowTreeHostWin::GetSingletonDesktopNativeCursorManager() {
+   return new DesktopNativeCursorManagerWin();
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+index 444581249014a8ce301591f269dbb194f0520732..9377f26b081b717db6b50c13ce3795907cf2fcd2 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+@@ -262,6 +262,7 @@ class VIEWS_EXPORT DesktopWindowTreeHostWin
+   void HandleWindowSizeChanging() override;
+   void HandleWindowSizeUnchanged() override;
+   void HandleWindowScaleFactorChanged(float window_scale_factor) override;
++  bool HandleMouseEventForCaption(UINT message) const override;
+ 
+   Widget* GetWidget();
+   const Widget* GetWidget() const;
+diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
+index 01ff95be00b3911749f66a136b2b5a6c02156bd3..23e8794c0551c377269ebecd6684206fc7087553 100644
+--- a/ui/views/win/hwnd_message_handler.cc
++++ b/ui/views/win/hwnd_message_handler.cc
+@@ -3064,15 +3064,19 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
+       SetMsgHandled(FALSE);
+     // We must let Windows handle the caption buttons if it's drawing them, or
+     // they won't work.
++    bool simulate_mouse_event_for_caption = false;
+     if (delegate_->GetFrameMode() == FrameMode::SYSTEM_DRAWN &&
+         (hittest == HTCLOSE || hittest == HTMINBUTTON ||
+          hittest == HTMAXBUTTON)) {
+-      SetMsgHandled(FALSE);
++      simulate_mouse_event_for_caption =
++          delegate_->HandleMouseEventForCaption(message);
++      if (!simulate_mouse_event_for_caption)
++        SetMsgHandled(FALSE);
+     }
+     // Let resize events fall through. Ignore everything else, as we're either
+     // letting Windows handle it above or we've already handled the equivalent
+     // touch message.
+-    if (!IsHitTestOnResizeHandle(hittest))
++    if (!IsHitTestOnResizeHandle(hittest) && !simulate_mouse_event_for_caption)
+       return 0;
+   }
+ 
+diff --git a/ui/views/win/hwnd_message_handler_delegate.h b/ui/views/win/hwnd_message_handler_delegate.h
+index 5dbb192d0840ca0ded61397c399b774a8cb05cce..098a9c3140e9e140fdc8f0dc9cf4e8ec84451221 100644
+--- a/ui/views/win/hwnd_message_handler_delegate.h
++++ b/ui/views/win/hwnd_message_handler_delegate.h
+@@ -258,6 +258,10 @@ class VIEWS_EXPORT HWNDMessageHandlerDelegate {
+   // Called when the window scale factor has changed.
+   virtual void HandleWindowScaleFactorChanged(float window_scale_factor) = 0;
+ 
++  // Called when synthetic mouse event is generated for touch event on
++  // caption buttons.
++  virtual bool HandleMouseEventForCaption(UINT message) const = 0;
++
+  protected:
+   virtual ~HWNDMessageHandlerDelegate() = default;
+ };

patches/chromium/chore_provide_iswebcontentscreationoverridden_with_full_params.patch

@@ -108,7 +108,7 @@ index 6688ba8ba2fb7d930773144cdbc43f1f6fa2b685..22015c7b9b50e1264551ce226757f90e
    }
  
 diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
-index 70ee9049e3cb73f55bed81c3e08037df2f4c9e07..8d230826aaf867d9046a6b9ac93a60f4750e52be 100644
+index 7548e63c57dc8463cb59614122e32c574ae17437..a9e1c335e3fae4fa795059c9b28bd5d404184c2e 100644
 --- a/chrome/browser/ui/browser.cc
 +++ b/chrome/browser/ui/browser.cc
 @@ -1786,12 +1786,11 @@ bool Browser::IsWebContentsCreationOverridden(
@@ -246,10 +246,10 @@ index c6bd5c19f8a7ceec17c9e32af5296a9617f3a619..02199b439fba7fdc617b7f7980d958b7
    void AddNewContents(content::WebContents* source,
                        std::unique_ptr<content::WebContents> new_contents,
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index b9309e1cbc4a8b701534aa8be2827c40d98d6678..c1b1bfc8333e93456178842db392eabff96bf4c9 100644
+index add5ba98f4409460b93aa2f8c49eb49a1f59470a..4b77c71375a7375e168c9bee93a73c3af6fe1252 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -3891,8 +3891,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3895,8 +3895,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
  
    if (delegate_ && delegate_->IsWebContentsCreationOverridden(
                         source_site_instance, params.window_container_type,
@@ -260,7 +260,7 @@ index b9309e1cbc4a8b701534aa8be2827c40d98d6678..c1b1bfc8333e93456178842db392eabf
          static_cast<WebContentsImpl*>(delegate_->CreateCustomWebContents(
              opener, source_site_instance, is_new_browsing_instance,
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index 7bb1680553c405a9016cfd67eca5fa3c6439b692..3aa2cca04340098859e1072eaa80a46a8e0463b1 100644
+index c01e06b08b1cca7a663e30476a551904ce9c6db8..9f50a8721560f734270308776f2f37ad49a8cb91 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
 @@ -134,8 +134,7 @@ bool WebContentsDelegate::IsWebContentsCreationOverridden(
@@ -274,7 +274,7 @@ index 7bb1680553c405a9016cfd67eca5fa3c6439b692..3aa2cca04340098859e1072eaa80a46a
  }
  
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index eeafde1fa6067804665954525eafdd482d8eb3f3..b17f371aa489a5b61c28fbcd316b19815f072df9 100644
+index 2556c044b6e28501a5fac9b0040e623b8f35f497..4c6cd654551b2f5cfd59a5271a8d95a9e6862d3c 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
 @@ -317,8 +317,7 @@ class CONTENT_EXPORT WebContentsDelegate {

patches/chromium/chore_use_electron_resources_not_chrome_for_spellchecker.patch

@@ -7,10 +7,10 @@ spellchecker uses a few IDS_ resources.  We need to load these from
 Electrons grit header instead of Chromes
 
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 02e4b0e27f4a0d3409327ba929f78b129dc06385..bd16a798301785507629f24726c1cec636956fe2 100644
+index af2fd82cbc458b396107a161d9c3dd31077e57a7..948d05358b89895faa97a7d383bfac66a45464a8 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -7164,6 +7164,7 @@ static_library("browser") {
+@@ -7182,6 +7182,7 @@ static_library("browser") {
      deps += [
        "//components/spellcheck/browser",
        "//components/spellcheck/common",

patches/chromium/custom_protocols_plzserviceworker.patch

@@ -0,0 +1,53 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: deepak1556 <hop2deep@gmail.com>
+Date: Fri, 20 May 2022 00:29:34 +0900
+Subject: custom_protocols_plzserviceworker.patch
+
+Allow registering custom protocols to handle service worker main script fetching with PlzServiceWorker.
+
+Refs https://bugs.chromium.org/p/chromium/issues/detail?id=996511
+
+diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
+index f827745b9800d4f11a17e405b0eb22601d7e4dd4..0cecbfb2a6fd3daa71338c94bda4b1f45eb51d5e 100644
+--- a/content/browser/service_worker/service_worker_context_wrapper.cc
++++ b/content/browser/service_worker/service_worker_context_wrapper.cc
+@@ -1591,6 +1591,28 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+       loader_factory_bundle_info =
+           context()->loader_factory_bundle_for_update_check()->Clone();
+ 
++  // Give the embedder a chance to register custom schemes that can
++  // handle loading the service worker main script.
++  // Previous registration triggered by
++  // ServiceWorkerContextWrapper::CreateNonNetworkPendingURLLoaderFactoryBundleForUpdateCheck
++  // happens early on browser startup before the JS in the main process
++  // is run by the embedder.
++  auto* factory_bundle = static_cast<blink::PendingURLLoaderFactoryBundle*>(
++          loader_factory_bundle_info.get());
++  ContentBrowserClient::NonNetworkURLLoaderFactoryMap non_network_factories;
++  GetContentClient()
++      ->browser()
++      ->RegisterNonNetworkServiceWorkerUpdateURLLoaderFactories(
++          storage_partition_->browser_context(), &non_network_factories);
++  for (auto& pair : non_network_factories) {
++    const std::string& scheme = pair.first;
++    mojo::PendingRemote<network::mojom::URLLoaderFactory>& factory_remote =
++        pair.second;
++
++    factory_bundle->pending_scheme_specific_factories().emplace(
++        scheme, std::move(factory_remote));
++  }
++
+   if (base::FeatureList::IsEnabled(
+           features::kEnableServiceWorkersForChromeUntrusted) &&
+       scope.scheme_piece() == kChromeUIUntrustedScheme) {
+@@ -1611,9 +1633,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+             browser_context(), scope_origin)) {
+       config->RegisterURLDataSource(browser_context());
+ 
+-      static_cast<blink::PendingURLLoaderFactoryBundle*>(
+-          loader_factory_bundle_info.get())
+-          ->pending_scheme_specific_factories()
++      factory_bundle->pending_scheme_specific_factories()
+           .emplace(kChromeUIUntrustedScheme,
+                    CreateWebUIServiceWorkerLoaderFactory(
+                        browser_context(), kChromeUIUntrustedScheme,

patches/chromium/disable_color_correct_rendering.patch

@@ -20,14 +20,15 @@ to deal with color spaces. That is being tracked at
 https://crbug.com/634542 and https://crbug.com/711107.
 
 diff --git a/cc/trees/layer_tree_host_impl.cc b/cc/trees/layer_tree_host_impl.cc
-index 14e13169de8b5e808e3284792237bef9939b1e00..7628a96dc8b2c9e8128cd462138d3487304c6e10 100644
+index 14e13169de8b5e808e3284792237bef9939b1e00..67839f87fb0dcb2eed9bc001806020befbed5f66 100644
 --- a/cc/trees/layer_tree_host_impl.cc
 +++ b/cc/trees/layer_tree_host_impl.cc
-@@ -1894,6 +1894,9 @@ void LayerTreeHostImpl::SetIsLikelyToRequireADraw(
+@@ -1894,6 +1894,10 @@ void LayerTreeHostImpl::SetIsLikelyToRequireADraw(
  TargetColorParams LayerTreeHostImpl::GetTargetColorParams(
      gfx::ContentColorUsage content_color_usage) const {
    TargetColorParams params;
 +  if (!settings_.enable_color_correct_rendering) {
++    params.color_space = gfx::ColorSpace();
 +    return params;
 +  }
  
@@ -240,10 +241,10 @@ index 8cd9a960ca1de81857af60daa91596c1dbb17786..7455afe4d81eac31fe3792a4459834a7
      sandbox::policy::switches::kGpuSandboxAllowSysVShm,
      sandbox::policy::switches::kGpuSandboxFailuresFatal,
 diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
-index 927e182bbba7a3700fd20c8c964da7cc162c4210..f099940c5b8fd92c04401cfbd231c04cb413d286 100644
+index 09f72f1fbd7b782c5bf52245482b358103f0c243..80d9fd40efed1edc90e7bdf1db534acb876206ca 100644
 --- a/content/browser/renderer_host/render_process_host_impl.cc
 +++ b/content/browser/renderer_host/render_process_host_impl.cc
-@@ -197,6 +197,7 @@
+@@ -198,6 +198,7 @@
  #include "ui/accessibility/accessibility_switches.h"
  #include "ui/base/ui_base_switches.h"
  #include "ui/display/display_switches.h"
@@ -251,7 +252,7 @@ index 927e182bbba7a3700fd20c8c964da7cc162c4210..f099940c5b8fd92c04401cfbd231c04c
  #include "ui/gl/gl_switches.h"
  #include "url/gurl.h"
  #include "url/origin.h"
-@@ -3213,6 +3214,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
+@@ -3219,6 +3220,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
    // Propagate the following switches to the renderer command line (along
    // with any associated values) if present in the browser command line.
    static const char* const kSwitchNames[] = {
@@ -260,7 +261,7 @@ index 927e182bbba7a3700fd20c8c964da7cc162c4210..f099940c5b8fd92c04401cfbd231c04c
      sandbox::policy::switches::kDisableSeccompFilterSandbox,
      sandbox::policy::switches::kNoSandbox,
 diff --git a/third_party/blink/renderer/platform/graphics/canvas_color_params.cc b/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
-index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..0f87961ecd8c24e3ba82c6bae187a12c9b112bd4 100644
+index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..e42f8ba89070477b06777c7a0c37d30c8c5e4ed1 100644
 --- a/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
 +++ b/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
 @@ -4,6 +4,7 @@
@@ -279,7 +280,18 @@ index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..0f87961ecd8c24e3ba82c6bae187a12c
  
  namespace blink {
  
-@@ -118,6 +120,11 @@ uint8_t CanvasColorParams::BytesPerPixel() const {
+@@ -19,6 +21,10 @@ namespace blink {
+ // Level 4 specification.
+ gfx::ColorSpace PredefinedColorSpaceToGfxColorSpace(
+     PredefinedColorSpace color_space) {
++  auto* cmd_line = base::CommandLine::ForCurrentProcess();
++  if (cmd_line->HasSwitch(switches::kDisableColorCorrectRendering)) {
++    return gfx::ColorSpace();
++  }
+   switch (color_space) {
+     case PredefinedColorSpace::kSRGB:
+       return gfx::ColorSpace::CreateSRGB();
+@@ -118,6 +124,11 @@ uint8_t CanvasColorParams::BytesPerPixel() const {
  }
  
  gfx::ColorSpace CanvasColorParams::GetStorageGfxColorSpace() const {

patches/chromium/disable_gpu_acceleration_on_vmware_on_linux.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Zhenyao Mo <zmo@chromium.org>
+Date: Mon, 23 May 2022 21:43:16 +0000
+Subject: Disable GPU acceleration on VMware on Linux
+
+TEST=manual
+R=sunnyps@chromium.org
+
+Bug: 1327939
+Change-Id: Ib09b6623665ffecf0af1f9f8bc3ebef1ac042b2f
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3661941
+Auto-Submit: Zhenyao Mo <zmo@chromium.org>
+Commit-Queue: Zhenyao Mo <zmo@chromium.org>
+Commit-Queue: Maggie Chen <magchen@chromium.org>
+Reviewed-by: Maggie Chen <magchen@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1006613}
+
+diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
+index 8ed8faf0a0733568a81d955a5546d864d24f78b5..73b6e998f753cee5d77e6bd5983ed46702f13580 100644
+--- a/gpu/config/software_rendering_list.json
++++ b/gpu/config/software_rendering_list.json
+@@ -1699,6 +1699,18 @@
+       "features": [
+         "accelerated_video_encode"
+       ]
++    },
++    {
++      "id": 176,
++      "description": "VMware is buggy on Linux",
++      "cr_bugs": [1327939],
++      "os": {
++        "type": "linux"
++      },
++      "vendor_id": "0x15ad",
++      "features": [
++        "all"
++      ]
+     }
+   ]
+ }

patches/chromium/disable_unload_metrics.patch

@@ -24,10 +24,10 @@ This patch temporarily disables the metrics so we can have green CI, and we
 should continue seeking for a real fix.
 
 diff --git a/content/browser/renderer_host/navigator.cc b/content/browser/renderer_host/navigator.cc
-index cd286b4925b3d2d9e74caecee759360488f2b8ba..0bc714a78e58719824ffeba8ced7854474fa6e92 100644
+index c289c888bc9d74d3f696714650b65aa373be27b4..aad7ec5ed0b6f6ab5cdfe0d7902d952c7c9e36c6 100644
 --- a/content/browser/renderer_host/navigator.cc
 +++ b/content/browser/renderer_host/navigator.cc
-@@ -1177,6 +1177,7 @@ void Navigator::RecordNavigationMetrics(
+@@ -1286,6 +1286,7 @@ void Navigator::RecordNavigationMetrics(
              .InMilliseconds());
    }
  
@@ -35,7 +35,7 @@ index cd286b4925b3d2d9e74caecee759360488f2b8ba..0bc714a78e58719824ffeba8ced78544
    // If this is a same-process navigation and we have timestamps for unload
    // durations, fill those metrics out as well.
    if (params.unload_start && params.unload_end &&
-@@ -1223,6 +1224,7 @@ void Navigator::RecordNavigationMetrics(
+@@ -1332,6 +1333,7 @@ void Navigator::RecordNavigationMetrics(
           first_before_unload_start_time)
              .InMilliseconds());
    }

patches/chromium/don_t_use_potentially_null_getwebframe_-_view_when_get_blink.patch

@@ -11,10 +11,10 @@ This regressed in https://chromium-review.googlesource.com/c/chromium/src/+/2572
 Upstream: https://chromium-review.googlesource.com/c/chromium/src/+/2598393
 
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index b9eea3470139e1833b2b23d3b535b11235e2bc8e..fbc1f6d8387e33cb7daafc96b7514897f067f008 100644
+index 95966ce7f0eeb0a7f2822bef69b540ac6bfe298d..34c2bdc5d4dda2fb0bdf2a8c3e5f8f9a5e11b977 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -2377,7 +2377,7 @@ const blink::WebView* RenderFrameImpl::GetWebView() const {
+@@ -2398,7 +2398,7 @@ const blink::WebView* RenderFrameImpl::GetWebView() const {
  }
  
  const blink::web_pref::WebPreferences& RenderFrameImpl::GetBlinkPreferences() {

patches/chromium/expose_setuseragent_on_networkcontext.patch

@@ -33,10 +33,10 @@ index 14c71cc69388da46f62d9835e2a06fef0870da02..9481ea08401ae29ae9c1d960491b05b3
  
  }  // namespace net
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index 98268925da14d61256f8dee3aa899f17ce7acaf6..1abdc204e278383818dc073f96c90e91ec1f3fb9 100644
+index f06a04983571623b542dba11933c4c95c3dcf398..606573a33573884baa173b796e1870b8defcda2a 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -1404,6 +1404,13 @@ void NetworkContext::SetNetworkConditions(
+@@ -1407,6 +1407,13 @@ void NetworkContext::SetNetworkConditions(
                                        std::move(network_conditions));
  }
  
@@ -51,7 +51,7 @@ index 98268925da14d61256f8dee3aa899f17ce7acaf6..1abdc204e278383818dc073f96c90e91
    // This may only be called on NetworkContexts created with the constructor
    // that calls MakeURLRequestContext().
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index 58671094857cdfe5d853c8a284d51bc1b8a09660..7af71839aa1bc970370a91cd35f3cbefe06e67e5 100644
+index 2cd8707b120deb41683e13def5d446fd3bf93afe..c654d54cbb1427e700d918a94390c022b5b1cb14 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
 @@ -302,6 +302,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext

patches/chromium/extend_apply_webpreferences.patch

@@ -12,10 +12,10 @@ Ideally we could add an embedder observer pattern here but that can be
 done in future work.
 
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index b2a2e38397fdf3e9bb52c4532a1d14463ed4110d..9f0f209f279cc3dbe35efc12eb1e51449dfda470 100644
+index f76a0ee0778d7b4e4df69a4c43b4a6bfdc89294d..45baa4d62cb4e5aebedebba993ddbc9f06711d35 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -160,6 +160,7 @@
+@@ -159,6 +159,7 @@
  #include "third_party/blink/renderer/core/timing/window_performance.h"
  #include "third_party/blink/renderer/platform/fonts/font_cache.h"
  #include "third_party/blink/renderer/platform/fonts/generic_font_family_settings.h"
@@ -23,7 +23,7 @@ index b2a2e38397fdf3e9bb52c4532a1d14463ed4110d..9f0f209f279cc3dbe35efc12eb1e5144
  #include "third_party/blink/renderer/platform/graphics/image.h"
  #include "third_party/blink/renderer/platform/graphics/paint/cull_rect.h"
  #include "third_party/blink/renderer/platform/graphics/paint/paint_record_builder.h"
-@@ -1777,6 +1778,7 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
+@@ -1776,6 +1777,7 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
  #if BUILDFLAG(IS_MAC)
    web_view_impl->SetMaximumLegibleScale(
        prefs.default_maximum_page_scale_factor);

patches/chromium/feat_add_data_parameter_to_processsingleton.patch

@@ -0,0 +1,348 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Raymond Zhao <raymondzhao@microsoft.com>
+Date: Tue, 7 Sep 2021 14:54:25 -0700
+Subject: feat: Add data parameter to ProcessSingleton
+
+This patch adds an additional_data parameter to the constructor of
+ProcessSingleton, so that the second instance can send additional
+data over to the first instance while requesting the ProcessSingleton
+lock.
+
+On the Electron side, we then expose an extra parameter to the
+app.requestSingleInstanceLock API so that users can pass in a JSON
+object for the second instance to send to the first instance.
+
+diff --git a/chrome/browser/process_singleton.h b/chrome/browser/process_singleton.h
+index 5a64220aaf1309832dc0ad543e353de67fe0a779..e75c4f0d7cf1cac2e5862eb858800359e2001eb6 100644
+--- a/chrome/browser/process_singleton.h
++++ b/chrome/browser/process_singleton.h
+@@ -18,6 +18,7 @@
+ #include "base/files/file_path.h"
+ #include "base/memory/ref_counted.h"
+ #include "base/process/process.h"
++#include "base/containers/span.h"
+ #include "ui/gfx/native_widget_types.h"
+ 
+ #if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_ANDROID)
+@@ -99,22 +100,25 @@ class ProcessSingleton {
+   // handled within the current browser instance or false if the remote process
+   // should handle it (i.e., because the current process is shutting down).
+   using NotificationCallback =
+-      base::RepeatingCallback<bool(const base::CommandLine& command_line,
+-                                   const base::FilePath& current_directory)>;
++       base::RepeatingCallback<bool(const base::CommandLine& command_line,
++                                   const base::FilePath& current_directory,
++                                   const std::vector<const uint8_t> additional_data)>;
+ 
+ #if BUILDFLAG(IS_WIN)
+   ProcessSingleton(const std::string& program_name,
+                    const base::FilePath& user_data_dir,
++                   const base::span<const uint8_t> additional_data,
+                    bool is_sandboxed,
+                    const NotificationCallback& notification_callback);
+ #else
+   ProcessSingleton(const base::FilePath& user_data_dir,
++                   const base::span<const uint8_t> additional_data,
+                    const NotificationCallback& notification_callback);
++#endif
+ 
+   ProcessSingleton(const ProcessSingleton&) = delete;
+   ProcessSingleton& operator=(const ProcessSingleton&) = delete;
+ 
+-#endif
+   ~ProcessSingleton();
+ 
+   // Notify another process, if available. Otherwise sets ourselves as the
+@@ -177,7 +181,10 @@ class ProcessSingleton {
+ #endif
+ 
+  private:
+-  NotificationCallback notification_callback_;  // Handler for notifications.
++  // A callback to run when the first instance receives data from the second.
++  NotificationCallback notification_callback_;
++  // Custom data to pass to the other instance during notify.
++  base::span<const uint8_t> additional_data_;
+ 
+ #if BUILDFLAG(IS_WIN)
+   bool EscapeVirtualization(const base::FilePath& user_data_dir);
+diff --git a/chrome/browser/process_singleton_posix.cc b/chrome/browser/process_singleton_posix.cc
+index be2c417c07a4206fac4a9a6c03e516fd0493c942..9a1f7b80e9ec538977f9b492829646a62d2a67cd 100644
+--- a/chrome/browser/process_singleton_posix.cc
++++ b/chrome/browser/process_singleton_posix.cc
+@@ -612,6 +612,7 @@ class ProcessSingleton::LinuxWatcher
+   // |reader| is for sending back ACK message.
+   void HandleMessage(const std::string& current_dir,
+                      const std::vector<std::string>& argv,
++                     const std::vector<const uint8_t> additional_data,
+                      SocketReader* reader);
+ 
+  private:
+@@ -666,13 +667,16 @@ void ProcessSingleton::LinuxWatcher::StartListening(int socket) {
+ }
+ 
+ void ProcessSingleton::LinuxWatcher::HandleMessage(
+-    const std::string& current_dir, const std::vector<std::string>& argv,
++    const std::string& current_dir,
++    const std::vector<std::string>& argv,
++    const std::vector<const uint8_t> additional_data,
+     SocketReader* reader) {
+   DCHECK(ui_task_runner_->BelongsToCurrentThread());
+   DCHECK(reader);
+ 
+   if (parent_->notification_callback_.Run(base::CommandLine(argv),
+-                                          base::FilePath(current_dir))) {
++                                          base::FilePath(current_dir),
++                                          std::move(additional_data))) {
+     // Send back "ACK" message to prevent the client process from starting up.
+     reader->FinishWithACK(kACKToken, std::size(kACKToken) - 1);
+   } else {
+@@ -720,7 +724,8 @@ void ProcessSingleton::LinuxWatcher::SocketReader::
+     }
+   }
+ 
+-  // Validate the message.  The shortest message is kStartToken\0x\0x
++  // Validate the message.  The shortest message kStartToken\0\00
++  // The shortest message with additional data is kStartToken\0\00\00\0.
+   const size_t kMinMessageLength = std::size(kStartToken) + 4;
+   if (bytes_read_ < kMinMessageLength) {
+     buf_[bytes_read_] = 0;
+@@ -750,10 +755,28 @@ void ProcessSingleton::LinuxWatcher::SocketReader::
+   tokens.erase(tokens.begin());
+   tokens.erase(tokens.begin());
+ 
++  size_t num_args;
++  base::StringToSizeT(tokens[0], &num_args);
++  std::vector<std::string> command_line(tokens.begin() + 1, tokens.begin() + 1 + num_args);
++
++  std::vector<const uint8_t> additional_data;
++  if (tokens.size() >= 3 + num_args) {
++    size_t additional_data_size;
++    base::StringToSizeT(tokens[1 + num_args], &additional_data_size);
++    std::string remaining_args = base::JoinString(
++        base::make_span(tokens.begin() + 2 + num_args, tokens.end()),
++        std::string(1, kTokenDelimiter));
++    const uint8_t* additional_data_bits =
++        reinterpret_cast<const uint8_t*>(remaining_args.c_str());
++    additional_data = std::vector<const uint8_t>(
++        additional_data_bits, additional_data_bits + additional_data_size);
++  }
++
+   // Return to the UI thread to handle opening a new browser tab.
+   ui_task_runner_->PostTask(
+       FROM_HERE, base::BindOnce(&ProcessSingleton::LinuxWatcher::HandleMessage,
+-                                parent_, current_dir, tokens, this));
++                                parent_, current_dir, command_line,
++                                std::move(additional_data), this));
+   fd_watch_controller_.reset();
+ 
+   // LinuxWatcher::HandleMessage() is in charge of destroying this SocketReader
+@@ -782,8 +805,10 @@ void ProcessSingleton::LinuxWatcher::SocketReader::FinishWithACK(
+ //
+ ProcessSingleton::ProcessSingleton(
+     const base::FilePath& user_data_dir,
++    const base::span<const uint8_t> additional_data,
+     const NotificationCallback& notification_callback)
+     : notification_callback_(notification_callback),
++      additional_data_(additional_data),
+       current_pid_(base::GetCurrentProcId()),
+       watcher_(new LinuxWatcher(this)) {
+   socket_path_ = user_data_dir.Append(chrome::kSingletonSocketFilename);
+@@ -902,7 +927,8 @@ ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcessWithTimeout(
+              sizeof(socket_timeout));
+ 
+   // Found another process, prepare our command line
+-  // format is "START\0<current dir>\0<argv[0]>\0...\0<argv[n]>".
++  // format is "START\0<current-dir>\0<n-args>\0<argv[0]>\0...\0<argv[n]>
++  // \0<additional-data-length>\0<additional-data>".
+   std::string to_send(kStartToken);
+   to_send.push_back(kTokenDelimiter);
+ 
+@@ -912,11 +938,21 @@ ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcessWithTimeout(
+   to_send.append(current_dir.value());
+ 
+   const std::vector<std::string>& argv = cmd_line.argv();
++  to_send.push_back(kTokenDelimiter);
++  to_send.append(base::NumberToString(argv.size()));
+   for (auto it = argv.begin(); it != argv.end(); ++it) {
+     to_send.push_back(kTokenDelimiter);
+     to_send.append(*it);
+   }
+ 
++  size_t data_to_send_size = additional_data_.size_bytes();
++  if (data_to_send_size) {
++    to_send.push_back(kTokenDelimiter);
++    to_send.append(base::NumberToString(data_to_send_size));
++    to_send.push_back(kTokenDelimiter);
++    to_send.append(reinterpret_cast<const char*>(additional_data_.data()), data_to_send_size);
++  }
++
+   // Send the message
+   if (!WriteToSocket(socket.fd(), to_send.data(), to_send.length())) {
+     // Try to kill the other process, because it might have been dead.
+diff --git a/chrome/browser/process_singleton_win.cc b/chrome/browser/process_singleton_win.cc
+index ec725b44296266bea1a51aea889463a0bba8449c..beb2925f2fd7a1a93435bf4b1a40b5c71b49e449 100644
+--- a/chrome/browser/process_singleton_win.cc
++++ b/chrome/browser/process_singleton_win.cc
+@@ -80,10 +80,12 @@ BOOL CALLBACK BrowserWindowEnumeration(HWND window, LPARAM param) {
+ 
+ bool ParseCommandLine(const COPYDATASTRUCT* cds,
+                       base::CommandLine* parsed_command_line,
+-                      base::FilePath* current_directory) {
++                      base::FilePath* current_directory,
++                      std::vector<const uint8_t>* parsed_additional_data) {
+   // We should have enough room for the shortest command (min_message_size)
+   // and also be a multiple of wchar_t bytes. The shortest command
+-  // possible is L"START\0\0" (empty current directory and command line).
++  // possible is L"START\0\0" (empty command line, current directory,
++  // and additional data).
+   static const int min_message_size = 7;
+   if (cds->cbData < min_message_size * sizeof(wchar_t) ||
+       cds->cbData % sizeof(wchar_t) != 0) {
+@@ -133,6 +135,37 @@ bool ParseCommandLine(const COPYDATASTRUCT* cds,
+     const std::wstring cmd_line =
+         msg.substr(second_null + 1, third_null - second_null);
+     *parsed_command_line = base::CommandLine::FromString(cmd_line);
++
++    const std::wstring::size_type fourth_null =
++        msg.find_first_of(L'\0', third_null + 1);
++    if (fourth_null == std::wstring::npos ||
++        fourth_null == msg.length()) {
++      // No additional data was provided.
++      return true;
++    }
++
++    // Get length of the additional data.
++    const std::wstring additional_data_length_string =
++        msg.substr(third_null + 1, fourth_null - third_null);
++    size_t additional_data_length;
++    base::StringToSizeT(additional_data_length_string, &additional_data_length);
++
++    const std::wstring::size_type fifth_null =
++        msg.find_first_of(L'\0', fourth_null + 1);
++    if (fifth_null == std::wstring::npos ||
++        fifth_null == msg.length()) {
++      LOG(WARNING) << "Invalid format for start command, we need a string in 6 "
++        "parts separated by NULLs";
++    }
++
++    // Get the actual additional data.
++    const std::wstring additional_data =
++        msg.substr(fourth_null + 1, fifth_null - fourth_null);
++    const uint8_t* additional_data_bytes =
++        reinterpret_cast<const uint8_t*>(additional_data.c_str());
++    *parsed_additional_data = std::vector<const uint8_t>(additional_data_bytes,
++        additional_data_bytes + additional_data_length);
++
+     return true;
+   }
+   return false;
+@@ -154,13 +187,14 @@ bool ProcessLaunchNotification(
+ 
+   base::CommandLine parsed_command_line(base::CommandLine::NO_PROGRAM);
+   base::FilePath current_directory;
+-  if (!ParseCommandLine(cds, &parsed_command_line, &current_directory)) {
++  std::vector<const uint8_t> additional_data;
++  if (!ParseCommandLine(cds, &parsed_command_line, &current_directory, &additional_data)) {
+     *result = TRUE;
+     return true;
+   }
+ 
+-  *result = notification_callback.Run(parsed_command_line, current_directory) ?
+-      TRUE : FALSE;
++  *result = notification_callback.Run(parsed_command_line,
++      current_directory, std::move(additional_data)) ? TRUE : FALSE;
+   return true;
+ }
+ 
+@@ -261,9 +295,11 @@ bool ProcessSingleton::EscapeVirtualization(
+ ProcessSingleton::ProcessSingleton(
+     const std::string& program_name,
+     const base::FilePath& user_data_dir,
++    const base::span<const uint8_t> additional_data,
+     bool is_app_sandboxed,
+     const NotificationCallback& notification_callback)
+     : notification_callback_(notification_callback),
++      additional_data_(additional_data),
+       program_name_(program_name),
+       is_app_sandboxed_(is_app_sandboxed),
+       is_virtualized_(false),
+@@ -290,7 +326,7 @@ ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcess() {
+     return PROCESS_NONE;
+   }
+ 
+-  switch (chrome::AttemptToNotifyRunningChrome(remote_window_)) {
++  switch (chrome::AttemptToNotifyRunningChrome(remote_window_, additional_data_)) {
+     case chrome::NOTIFY_SUCCESS:
+       return PROCESS_NOTIFIED;
+     case chrome::NOTIFY_FAILED:
+diff --git a/chrome/browser/win/chrome_process_finder.cc b/chrome/browser/win/chrome_process_finder.cc
+index b64ed1d155a30582e48c9cdffcee9d0f25a53a6a..cfdb2d75532d270e3dd548eb7475a6cdbddf1016 100644
+--- a/chrome/browser/win/chrome_process_finder.cc
++++ b/chrome/browser/win/chrome_process_finder.cc
+@@ -36,7 +36,9 @@ HWND FindRunningChromeWindow(const base::FilePath& user_data_dir) {
+   return base::win::MessageWindow::FindWindow(user_data_dir.value());
+ }
+ 
+-NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window) {
++NotifyChromeResult AttemptToNotifyRunningChrome(
++    HWND remote_window,
++    const base::span<const uint8_t> additional_data) {
+   TRACE_EVENT0("startup", "AttemptToNotifyRunningChrome");
+ 
+   DCHECK(remote_window);
+@@ -50,7 +52,8 @@ NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window) {
+   }
+ 
+   // Send the command line to the remote chrome window.
+-  // Format is "START\0<<<current directory>>>\0<<<commandline>>>".
++  // Format is
++  // "START\0<current-directory>\0<command-line>\0<additional-data-length>\0<additional-data>".
+   std::wstring to_send(L"START\0", 6);  // want the NULL in the string.
+   base::FilePath cur_dir;
+   if (!base::GetCurrentDirectory(&cur_dir)) {
+@@ -64,6 +67,22 @@ NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window) {
+       base::CommandLine::ForCurrentProcess()->GetCommandLineString());
+   to_send.append(L"\0", 1);  // Null separator.
+ 
++  size_t additional_data_size = additional_data.size_bytes();
++  if (additional_data_size) {
++    // Send over the size, because the reinterpret cast to wchar_t could
++    // add padding.
++    to_send.append(base::UTF8ToWide(base::NumberToString(additional_data_size)));
++    to_send.append(L"\0", 1);  // Null separator.
++
++    size_t padded_size = additional_data_size / sizeof(wchar_t);
++    if (additional_data_size % sizeof(wchar_t) != 0) {
++      padded_size++;
++    }
++    to_send.append(reinterpret_cast<const wchar_t*>(additional_data.data()),
++                   padded_size);
++    to_send.append(L"\0", 1);  // Null separator.
++  }
++
+   // Allow the current running browser window to make itself the foreground
+   // window (otherwise it will just flash in the taskbar).
+   ::AllowSetForegroundWindow(process_id);
+diff --git a/chrome/browser/win/chrome_process_finder.h b/chrome/browser/win/chrome_process_finder.h
+index 5516673cee019f6060077091e59498bf9038cd6e..8edea5079b46c2cba67833114eb9c21d85cfc22d 100644
+--- a/chrome/browser/win/chrome_process_finder.h
++++ b/chrome/browser/win/chrome_process_finder.h
+@@ -7,6 +7,7 @@
+ 
+ #include <windows.h>
+ 
++#include "base/containers/span.h"
+ #include "base/time/time.h"
+ 
+ namespace base {
+@@ -27,7 +28,9 @@ HWND FindRunningChromeWindow(const base::FilePath& user_data_dir);
+ // Attempts to send the current command line to an already running instance of
+ // Chrome via a WM_COPYDATA message.
+ // Returns true if a running Chrome is found and successfully notified.
+-NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window);
++NotifyChromeResult AttemptToNotifyRunningChrome(
++    HWND remote_window,
++    const base::span<const uint8_t> additional_data);
+ 
+ // Changes the notification timeout to |new_timeout|, returns the old timeout.
+ base::TimeDelta SetNotificationTimeoutForTesting(base::TimeDelta new_timeout);

patches/chromium/feat_add_data_transfer_to_requestsingleinstancelock.patch

@@ -1,600 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Raymond Zhao <raymondzhao@microsoft.com>
-Date: Tue, 7 Sep 2021 14:54:25 -0700
-Subject: feat: Add data transfer mechanism to requestSingleInstanceLock flow
-
-This patch adds code that allows for the second instance to send
-additional data to the first instance, and for the first instance
-to send additional data back to the second instance, during the
-app.requestSingleInstanceLock call.
-
-Firstly, this patch adds an additional_data parameter
-to the constructor of ProcessSingleton, so that the second instance
-can send additional data over to the first instance
-while requesting the ProcessSingleton lock.
-
-Then, we add additional processing to the second-instance event, both
-so the first instance can receive additional data from the second
-instance, but also so the second instance can send back additional
-data to the first instance if needed.
-
-diff --git a/chrome/browser/process_singleton.h b/chrome/browser/process_singleton.h
-index 5a64220aaf1309832dc0ad543e353de67fe0a779..5b701b1361707b610ed60c344e441e67ca701362 100644
---- a/chrome/browser/process_singleton.h
-+++ b/chrome/browser/process_singleton.h
-@@ -18,6 +18,7 @@
- #include "base/files/file_path.h"
- #include "base/memory/ref_counted.h"
- #include "base/process/process.h"
-+#include "base/containers/span.h"
- #include "ui/gfx/native_widget_types.h"
- 
- #if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_ANDROID)
-@@ -93,6 +94,9 @@ class ProcessSingleton {
- 
-   static constexpr int kNumNotifyResults = LAST_VALUE + 1;
- 
-+  using NotificationAckCallback =
-+      base::RepeatingCallback<void(const base::span<const uint8_t>* ack_data)>;
-+
-   // Implement this callback to handle notifications from other processes. The
-   // callback will receive the command line and directory with which the other
-   // Chrome process was launched. Return true if the command line will be
-@@ -100,21 +104,27 @@ class ProcessSingleton {
-   // should handle it (i.e., because the current process is shutting down).
-   using NotificationCallback =
-       base::RepeatingCallback<bool(const base::CommandLine& command_line,
--                                   const base::FilePath& current_directory)>;
-+                                   const base::FilePath& current_directory,
-+                                   const std::vector<uint8_t> additional_data,
-+                                   const NotificationAckCallback& ack_callback)>;
- 
- #if BUILDFLAG(IS_WIN)
-   ProcessSingleton(const std::string& program_name,
-                    const base::FilePath& user_data_dir,
-+                   const base::span<const uint8_t> additional_data,
-                    bool is_sandboxed,
--                   const NotificationCallback& notification_callback);
-+                   const NotificationCallback& notification_callback,
-+                   const NotificationAckCallback& ack_notification_callback);
- #else
-   ProcessSingleton(const base::FilePath& user_data_dir,
--                   const NotificationCallback& notification_callback);
-+                   const base::span<const uint8_t> additional_data,
-+                   const NotificationCallback& notification_callback,
-+                   const NotificationAckCallback& ack_notification_callback);
-+#endif
- 
-   ProcessSingleton(const ProcessSingleton&) = delete;
-   ProcessSingleton& operator=(const ProcessSingleton&) = delete;
- 
--#endif
-   ~ProcessSingleton();
- 
-   // Notify another process, if available. Otherwise sets ourselves as the
-@@ -177,7 +187,13 @@ class ProcessSingleton {
- #endif
- 
-  private:
--  NotificationCallback notification_callback_;  // Handler for notifications.
-+  // A callback to run when the first instance receives data from the second.
-+  NotificationCallback notification_callback_;
-+  // A callback to run when the second instance
-+  // receives an acknowledgement from the first.
-+  NotificationAckCallback notification_ack_callback_;
-+  // Custom data to pass to the other instance during notify.
-+  base::span<const uint8_t> additional_data_;
- 
- #if BUILDFLAG(IS_WIN)
-   bool EscapeVirtualization(const base::FilePath& user_data_dir);
-@@ -190,6 +206,7 @@ class ProcessSingleton {
-   HANDLE lock_file_;
-   base::FilePath user_data_dir_;
-   ShouldKillRemoteProcessCallback should_kill_remote_process_callback_;
-+  HANDLE ack_pipe_;
- #elif BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_ANDROID)
-   // Return true if the given pid is one of our child processes.
-   // Assumes that the current pid is the root of all pids of the current
-diff --git a/chrome/browser/process_singleton_posix.cc b/chrome/browser/process_singleton_posix.cc
-index be2c417c07a4206fac4a9a6c03e516fd0493c942..78f74b0b21242553b6af98628dc48190f7d1137d 100644
---- a/chrome/browser/process_singleton_posix.cc
-+++ b/chrome/browser/process_singleton_posix.cc
-@@ -146,7 +146,7 @@ const char kACKToken[] = "ACK";
- const char kShutdownToken[] = "SHUTDOWN";
- const char kTokenDelimiter = '\0';
- const int kMaxMessageLength = 32 * 1024;
--const int kMaxACKMessageLength = std::size(kShutdownToken) - 1;
-+const int kMaxACKMessageLength = kMaxMessageLength;
- 
- bool g_disable_prompt = false;
- bool g_skip_is_chrome_process_check = false;
-@@ -612,6 +612,7 @@ class ProcessSingleton::LinuxWatcher
-   // |reader| is for sending back ACK message.
-   void HandleMessage(const std::string& current_dir,
-                      const std::vector<std::string>& argv,
-+                     const std::vector<uint8_t> additional_data,
-                      SocketReader* reader);
- 
-  private:
-@@ -636,6 +637,9 @@ class ProcessSingleton::LinuxWatcher
-   // The ProcessSingleton that owns us.
-   ProcessSingleton* const parent_;
- 
-+  bool ack_callback_called_ = false;
-+  void AckCallback(SocketReader* reader, const base::span<const uint8_t>* response);
-+
-   std::set<std::unique_ptr<SocketReader>, base::UniquePtrComparator> readers_;
- };
- 
-@@ -666,16 +670,21 @@ void ProcessSingleton::LinuxWatcher::StartListening(int socket) {
- }
- 
- void ProcessSingleton::LinuxWatcher::HandleMessage(
--    const std::string& current_dir, const std::vector<std::string>& argv,
-+    const std::string& current_dir,
-+    const std::vector<std::string>& argv,
-+    const std::vector<uint8_t> additional_data,
-     SocketReader* reader) {
-   DCHECK(ui_task_runner_->BelongsToCurrentThread());
-   DCHECK(reader);
- 
--  if (parent_->notification_callback_.Run(base::CommandLine(argv),
--                                          base::FilePath(current_dir))) {
--    // Send back "ACK" message to prevent the client process from starting up.
--    reader->FinishWithACK(kACKToken, std::size(kACKToken) - 1);
--  } else {
-+  auto wrapped_ack_callback =
-+      base::BindRepeating(&ProcessSingleton::LinuxWatcher::AckCallback,
-+                          base::Unretained(this), reader);
-+  ack_callback_called_ = false;
-+  if (!parent_->notification_callback_.Run(base::CommandLine(argv),
-+                                          base::FilePath(current_dir),
-+                                          std::move(additional_data),
-+                                          wrapped_ack_callback)) {
-     LOG(WARNING) << "Not handling interprocess notification as browser"
-                     " is shutting down";
-     // Send back "SHUTDOWN" message, so that the client process can start up
-@@ -685,6 +694,22 @@ void ProcessSingleton::LinuxWatcher::HandleMessage(
-   }
- }
- 
-+void ProcessSingleton::LinuxWatcher::AckCallback(
-+    SocketReader* reader,
-+    const base::span<const uint8_t>* response) {
-+  // Send back "ACK" message to prevent the client process from starting up.
-+  if (!ack_callback_called_) {
-+    ack_callback_called_ = true;
-+    std::string ack_message;
-+    ack_message.append(kACKToken, std::size(kACKToken) - 1);
-+    if (response && response->size_bytes()) {
-+      ack_message.append(reinterpret_cast<const char*>(response->data()),
-+                         response->size_bytes());
-+    }
-+    reader->FinishWithACK(ack_message.c_str(), ack_message.size());
-+  }
-+}
-+
- void ProcessSingleton::LinuxWatcher::RemoveSocketReader(SocketReader* reader) {
-   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-   DCHECK(reader);
-@@ -720,7 +745,8 @@ void ProcessSingleton::LinuxWatcher::SocketReader::
-     }
-   }
- 
--  // Validate the message.  The shortest message is kStartToken\0x\0x
-+  // Validate the message.  The shortest message kStartToken\0\00
-+  // The shortest message with additional data is kStartToken\0\00\00\0.
-   const size_t kMinMessageLength = std::size(kStartToken) + 4;
-   if (bytes_read_ < kMinMessageLength) {
-     buf_[bytes_read_] = 0;
-@@ -750,10 +776,28 @@ void ProcessSingleton::LinuxWatcher::SocketReader::
-   tokens.erase(tokens.begin());
-   tokens.erase(tokens.begin());
- 
-+  size_t num_args;
-+  base::StringToSizeT(tokens[0], &num_args);
-+  std::vector<std::string> command_line(tokens.begin() + 1, tokens.begin() + 1 + num_args);
-+
-+  std::vector<uint8_t> additional_data;
-+  if (tokens.size() >= 3 + num_args) {
-+    size_t additional_data_size;
-+    base::StringToSizeT(tokens[1 + num_args], &additional_data_size);
-+    std::string remaining_args = base::JoinString(
-+        base::make_span(tokens.begin() + 2 + num_args, tokens.end()),
-+        std::string(1, kTokenDelimiter));
-+    const uint8_t* additional_data_bits =
-+        reinterpret_cast<const uint8_t*>(remaining_args.c_str());
-+    additional_data = std::vector<uint8_t>(additional_data_bits,
-+        additional_data_bits + additional_data_size);
-+  }
-+
-   // Return to the UI thread to handle opening a new browser tab.
-   ui_task_runner_->PostTask(
-       FROM_HERE, base::BindOnce(&ProcessSingleton::LinuxWatcher::HandleMessage,
--                                parent_, current_dir, tokens, this));
-+                                parent_, current_dir, command_line,
-+                                std::move(additional_data), this));
-   fd_watch_controller_.reset();
- 
-   // LinuxWatcher::HandleMessage() is in charge of destroying this SocketReader
-@@ -782,8 +826,12 @@ void ProcessSingleton::LinuxWatcher::SocketReader::FinishWithACK(
- //
- ProcessSingleton::ProcessSingleton(
-     const base::FilePath& user_data_dir,
--    const NotificationCallback& notification_callback)
-+    const base::span<const uint8_t> additional_data,
-+    const NotificationCallback& notification_callback,
-+    const NotificationAckCallback& notification_ack_callback)
-     : notification_callback_(notification_callback),
-+      notification_ack_callback_(notification_ack_callback),
-+      additional_data_(additional_data),
-       current_pid_(base::GetCurrentProcId()),
-       watcher_(new LinuxWatcher(this)) {
-   socket_path_ = user_data_dir.Append(chrome::kSingletonSocketFilename);
-@@ -902,7 +950,8 @@ ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcessWithTimeout(
-              sizeof(socket_timeout));
- 
-   // Found another process, prepare our command line
--  // format is "START\0<current dir>\0<argv[0]>\0...\0<argv[n]>".
-+  // format is "START\0<current-dir>\0<n-args>\0<argv[0]>\0...\0<argv[n]>
-+  // \0<additional-data-length>\0<additional-data>".
-   std::string to_send(kStartToken);
-   to_send.push_back(kTokenDelimiter);
- 
-@@ -912,11 +961,21 @@ ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcessWithTimeout(
-   to_send.append(current_dir.value());
- 
-   const std::vector<std::string>& argv = cmd_line.argv();
-+  to_send.push_back(kTokenDelimiter);
-+  to_send.append(base::NumberToString(argv.size()));
-   for (auto it = argv.begin(); it != argv.end(); ++it) {
-     to_send.push_back(kTokenDelimiter);
-     to_send.append(*it);
-   }
- 
-+  size_t data_to_send_size = additional_data_.size_bytes();
-+  if (data_to_send_size) {
-+    to_send.push_back(kTokenDelimiter);
-+    to_send.append(base::NumberToString(data_to_send_size));
-+    to_send.push_back(kTokenDelimiter);
-+    to_send.append(reinterpret_cast<const char*>(additional_data_.data()), data_to_send_size);
-+  }
-+
-   // Send the message
-   if (!WriteToSocket(socket.fd(), to_send.data(), to_send.length())) {
-     // Try to kill the other process, because it might have been dead.
-@@ -958,6 +1017,17 @@ ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcessWithTimeout(
-       linux_ui->NotifyWindowManagerStartupComplete();
- #endif
- 
-+    size_t ack_data_len = len - (std::size(kACKToken) - 1);
-+    if (ack_data_len) {
-+      const uint8_t* raw_ack_data =
-+          reinterpret_cast<const uint8_t*>(buf + std::size(kACKToken) - 1);
-+      base::span<const uint8_t> ack_data =
-+          base::make_span(raw_ack_data, raw_ack_data + ack_data_len);
-+      notification_ack_callback_.Run(&ack_data);
-+    } else {
-+      notification_ack_callback_.Run(nullptr);
-+    }
-+
-     // Assume the other process is handling the request.
-     return PROCESS_NOTIFIED;
-   }
-diff --git a/chrome/browser/process_singleton_win.cc b/chrome/browser/process_singleton_win.cc
-index ec725b44296266bea1a51aea889463a0bba8449c..a3d4dd1efc950033855a1f2783f941384b249a5d 100644
---- a/chrome/browser/process_singleton_win.cc
-+++ b/chrome/browser/process_singleton_win.cc
-@@ -21,6 +21,7 @@
- #include "base/strings/string_number_conversions.h"
- #include "base/strings/utf_string_conversions.h"
- #include "base/time/time.h"
-+#include "base/timer/timer.h"
- #include "base/trace_event/base_tracing.h"
- #include "base/win/registry.h"
- #include "base/win/scoped_handle.h"
-@@ -45,6 +46,14 @@
- namespace {
- 
- const char kLockfile[] = "lockfile";
-+const LPCWSTR kPipeName = L"\\\\.\\pipe\\electronAckPipe";
-+const DWORD kPipeTimeout = 10000;
-+const DWORD kMaxMessageLength = 32 * 1024;
-+
-+std::unique_ptr<std::vector<uint8_t>> g_ack_data;
-+base::OneShotTimer g_ack_timer;
-+HANDLE g_write_ack_pipe;
-+bool g_write_ack_callback_called = false;
- 
- // A helper class that acquires the given |mutex| while the AutoLockMutex is in
- // scope.
-@@ -80,10 +89,12 @@ BOOL CALLBACK BrowserWindowEnumeration(HWND window, LPARAM param) {
- 
- bool ParseCommandLine(const COPYDATASTRUCT* cds,
-                       base::CommandLine* parsed_command_line,
--                      base::FilePath* current_directory) {
-+                      base::FilePath* current_directory,
-+                      std::vector<uint8_t>* parsed_additional_data) {
-   // We should have enough room for the shortest command (min_message_size)
-   // and also be a multiple of wchar_t bytes. The shortest command
--  // possible is L"START\0\0" (empty current directory and command line).
-+  // possible is L"START\0\0" (empty command line, current directory,
-+  // and additional data).
-   static const int min_message_size = 7;
-   if (cds->cbData < min_message_size * sizeof(wchar_t) ||
-       cds->cbData % sizeof(wchar_t) != 0) {
-@@ -133,11 +144,82 @@ bool ParseCommandLine(const COPYDATASTRUCT* cds,
-     const std::wstring cmd_line =
-         msg.substr(second_null + 1, third_null - second_null);
-     *parsed_command_line = base::CommandLine::FromString(cmd_line);
-+
-+    const std::wstring::size_type fourth_null =
-+        msg.find_first_of(L'\0', third_null + 1);
-+    if (fourth_null == std::wstring::npos ||
-+        fourth_null == msg.length()) {
-+      // No additional data was provided.
-+      return true;
-+    }
-+
-+    // Get length of the additional data.
-+    const std::wstring additional_data_length_string =
-+        msg.substr(third_null + 1, fourth_null - third_null);
-+    size_t additional_data_length;
-+    base::StringToSizeT(additional_data_length_string, &additional_data_length);
-+
-+    const std::wstring::size_type fifth_null =
-+        msg.find_first_of(L'\0', fourth_null + 1);
-+    if (fifth_null == std::wstring::npos ||
-+        fifth_null == msg.length()) {
-+      LOG(WARNING) << "Invalid format for start command, we need a string in 6 "
-+        "parts separated by NULLs";
-+    }
-+
-+    // Get the actual additional data.
-+    const std::wstring additional_data =
-+        msg.substr(fourth_null + 1, fifth_null - fourth_null);
-+    const uint8_t* additional_data_bytes =
-+        reinterpret_cast<const uint8_t*>(additional_data.c_str());
-+    *parsed_additional_data = std::vector<uint8_t>(additional_data_bytes,
-+        additional_data_bytes + additional_data_length);
-+
-     return true;
-   }
-   return false;
- }
- 
-+void StoreAck(const base::span<const uint8_t>* ack_data) {
-+  if (ack_data) {
-+    g_ack_data = std::make_unique<std::vector<uint8_t>>(ack_data->begin(),
-+                                                        ack_data->end());
-+  } else {
-+    g_ack_data = nullptr;
-+  }
-+}
-+
-+void SendBackAck() {
-+  // This is the first instance sending the ack back to the second instance.
-+  if (!g_write_ack_callback_called) {
-+    g_write_ack_callback_called = true;
-+    const uint8_t* data_buffer = nullptr;
-+    DWORD data_to_send_size = 0;
-+    if (g_ack_data) {
-+      data_buffer = g_ack_data->data();
-+      DWORD ack_data_size = g_ack_data->size() * sizeof(uint8_t);
-+      data_to_send_size = (ack_data_size < kMaxMessageLength) ? ack_data_size : kMaxMessageLength;
-+    }
-+
-+    ::ConnectNamedPipe(g_write_ack_pipe, NULL);
-+
-+    DWORD bytes_written = 0;
-+    ::WriteFile(g_write_ack_pipe,
-+      (LPCVOID)data_buffer,
-+      data_to_send_size,
-+      &bytes_written,
-+      NULL);
-+    DCHECK(bytes_written == data_to_send_size);
-+
-+    ::FlushFileBuffers(g_write_ack_pipe);
-+    ::DisconnectNamedPipe(g_write_ack_pipe);
-+
-+    if (g_ack_data) {
-+      g_ack_data.reset();
-+    }
-+  }
-+}
-+
- bool ProcessLaunchNotification(
-     const ProcessSingleton::NotificationCallback& notification_callback,
-     UINT message,
-@@ -151,16 +233,23 @@ bool ProcessLaunchNotification(
- 
-   // Handle the WM_COPYDATA message from another process.
-   const COPYDATASTRUCT* cds = reinterpret_cast<COPYDATASTRUCT*>(lparam);
--
-   base::CommandLine parsed_command_line(base::CommandLine::NO_PROGRAM);
-   base::FilePath current_directory;
--  if (!ParseCommandLine(cds, &parsed_command_line, &current_directory)) {
-+  std::vector<uint8_t> additional_data;
-+  if (!ParseCommandLine(cds, &parsed_command_line, &current_directory,
-+                        &additional_data)) {
-     *result = TRUE;
-     return true;
-   }
- 
--  *result = notification_callback.Run(parsed_command_line, current_directory) ?
--      TRUE : FALSE;
-+  g_write_ack_callback_called = false;
-+  *result = notification_callback.Run(parsed_command_line, current_directory,
-+                                      std::move(additional_data),
-+                                      base::BindRepeating(&StoreAck))
-+                ? TRUE
-+                : FALSE;
-+  g_ack_timer.Start(FROM_HERE, base::Seconds(0),
-+                    base::BindOnce(&SendBackAck));
-   return true;
- }
- 
-@@ -261,9 +350,13 @@ bool ProcessSingleton::EscapeVirtualization(
- ProcessSingleton::ProcessSingleton(
-     const std::string& program_name,
-     const base::FilePath& user_data_dir,
-+    const base::span<const uint8_t> additional_data,
-     bool is_app_sandboxed,
--    const NotificationCallback& notification_callback)
-+    const NotificationCallback& notification_callback,
-+    const NotificationAckCallback& notification_ack_callback)
-     : notification_callback_(notification_callback),
-+      notification_ack_callback_(notification_ack_callback),
-+      additional_data_(additional_data),
-       program_name_(program_name),
-       is_app_sandboxed_(is_app_sandboxed),
-       is_virtualized_(false),
-@@ -278,6 +371,37 @@ ProcessSingleton::~ProcessSingleton() {
-     ::CloseHandle(lock_file_);
- }
- 
-+void ReadAck(const ProcessSingleton::NotificationAckCallback& ack_callback) {
-+  // We are reading the ack from the first instance.
-+  // First, wait for the pipe.
-+  ::WaitNamedPipe(kPipeName, NMPWAIT_USE_DEFAULT_WAIT);
-+
-+  HANDLE read_ack_pipe = ::CreateFile(kPipeName,
-+    GENERIC_READ,
-+    FILE_SHARE_READ,
-+    NULL,
-+    OPEN_EXISTING,
-+    FILE_ATTRIBUTE_NORMAL,
-+    NULL);
-+  CHECK(read_ack_pipe != INVALID_HANDLE_VALUE);
-+
-+  DWORD bytes_read;
-+  uint8_t read_ack_buffer[kMaxMessageLength];
-+  ::ReadFile(read_ack_pipe,
-+    (LPVOID)read_ack_buffer,
-+    kMaxMessageLength,
-+    &bytes_read,
-+    NULL);
-+
-+  if (!bytes_read) {
-+    ack_callback.Run(nullptr);
-+  } else {
-+    base::span<const uint8_t> out_span(read_ack_buffer, read_ack_buffer + bytes_read);
-+    ack_callback.Run(&out_span);
-+  }
-+  ::CloseHandle(read_ack_pipe);
-+}
-+
- // Code roughly based on Mozilla.
- ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcess() {
-   TRACE_EVENT0("startup", "ProcessSingleton::NotifyOtherProcess");
-@@ -290,8 +414,9 @@ ProcessSingleton::NotifyResult ProcessSingleton::NotifyOtherProcess() {
-     return PROCESS_NONE;
-   }
- 
--  switch (chrome::AttemptToNotifyRunningChrome(remote_window_)) {
-+  switch (chrome::AttemptToNotifyRunningChrome(remote_window_, additional_data_)) {
-     case chrome::NOTIFY_SUCCESS:
-+      ReadAck(notification_ack_callback_);
-       return PROCESS_NOTIFIED;
-     case chrome::NOTIFY_FAILED:
-       remote_window_ = NULL;
-@@ -429,6 +554,18 @@ bool ProcessSingleton::Create() {
-           << "Lock file can not be created! Error code: " << error;
- 
-       if (lock_file_ != INVALID_HANDLE_VALUE) {
-+        // We are the first instance. Create a pipe to send out ack data.
-+        ack_pipe_ = ::CreateNamedPipe(kPipeName,
-+          PIPE_ACCESS_OUTBOUND,
-+          PIPE_TYPE_BYTE | PIPE_REJECT_REMOTE_CLIENTS,
-+          PIPE_UNLIMITED_INSTANCES,
-+          kMaxMessageLength,
-+          0,
-+          kPipeTimeout,
-+          NULL);
-+        CHECK(ack_pipe_ != INVALID_HANDLE_VALUE);
-+        g_write_ack_pipe = ack_pipe_;
-+
-         // Set the window's title to the path of our user data directory so
-         // other Chrome instances can decide if they should forward to us.
-         TRACE_EVENT0("startup", "ProcessSingleton::Create:CreateWindow");
-@@ -456,6 +593,7 @@ bool ProcessSingleton::Create() {
- }
- 
- void ProcessSingleton::Cleanup() {
-+  ::CloseHandle(ack_pipe_);
- }
- 
- void ProcessSingleton::OverrideShouldKillRemoteProcessCallbackForTesting(
-diff --git a/chrome/browser/win/chrome_process_finder.cc b/chrome/browser/win/chrome_process_finder.cc
-index b64ed1d155a30582e48c9cdffcee9d0f25a53a6a..ce851d09d501ebcc6d6c4065e746e869d5275b2b 100644
---- a/chrome/browser/win/chrome_process_finder.cc
-+++ b/chrome/browser/win/chrome_process_finder.cc
-@@ -36,9 +36,10 @@ HWND FindRunningChromeWindow(const base::FilePath& user_data_dir) {
-   return base::win::MessageWindow::FindWindow(user_data_dir.value());
- }
- 
--NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window) {
-+NotifyChromeResult AttemptToNotifyRunningChrome(
-+    HWND remote_window,
-+    const base::span<const uint8_t> additional_data) {
-   TRACE_EVENT0("startup", "AttemptToNotifyRunningChrome");
--
-   DCHECK(remote_window);
-   DWORD process_id = 0;
-   DWORD thread_id = GetWindowThreadProcessId(remote_window, &process_id);
-@@ -50,7 +51,8 @@ NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window) {
-   }
- 
-   // Send the command line to the remote chrome window.
--  // Format is "START\0<<<current directory>>>\0<<<commandline>>>".
-+  // Format is
-+  // "START\0<current-directory>\0<command-line>\0<additional-data-length>\0<additional-data>".
-   std::wstring to_send(L"START\0", 6);  // want the NULL in the string.
-   base::FilePath cur_dir;
-   if (!base::GetCurrentDirectory(&cur_dir)) {
-@@ -64,6 +66,22 @@ NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window) {
-       base::CommandLine::ForCurrentProcess()->GetCommandLineString());
-   to_send.append(L"\0", 1);  // Null separator.
- 
-+  size_t additional_data_size = additional_data.size_bytes();
-+  if (additional_data_size) {
-+    // Send over the size, because the reinterpret cast to wchar_t could
-+    // add padding.
-+    to_send.append(base::UTF8ToWide(base::NumberToString(additional_data_size)));
-+    to_send.append(L"\0", 1);  // Null separator.
-+
-+    size_t padded_size = additional_data_size / sizeof(wchar_t);
-+    if (additional_data_size % sizeof(wchar_t) != 0) {
-+      padded_size++;
-+    }
-+    to_send.append(reinterpret_cast<const wchar_t*>(additional_data.data()),
-+                   padded_size);
-+    to_send.append(L"\0", 1);  // Null separator.
-+  }
-+
-   // Allow the current running browser window to make itself the foreground
-   // window (otherwise it will just flash in the taskbar).
-   ::AllowSetForegroundWindow(process_id);
-diff --git a/chrome/browser/win/chrome_process_finder.h b/chrome/browser/win/chrome_process_finder.h
-index 5516673cee019f6060077091e59498bf9038cd6e..8edea5079b46c2cba67833114eb9c21d85cfc22d 100644
---- a/chrome/browser/win/chrome_process_finder.h
-+++ b/chrome/browser/win/chrome_process_finder.h
-@@ -7,6 +7,7 @@
- 
- #include <windows.h>
- 
-+#include "base/containers/span.h"
- #include "base/time/time.h"
- 
- namespace base {
-@@ -27,7 +28,9 @@ HWND FindRunningChromeWindow(const base::FilePath& user_data_dir);
- // Attempts to send the current command line to an already running instance of
- // Chrome via a WM_COPYDATA message.
- // Returns true if a running Chrome is found and successfully notified.
--NotifyChromeResult AttemptToNotifyRunningChrome(HWND remote_window);
-+NotifyChromeResult AttemptToNotifyRunningChrome(
-+    HWND remote_window,
-+    const base::span<const uint8_t> additional_data);
- 
- // Changes the notification timeout to |new_timeout|, returns the old timeout.
- base::TimeDelta SetNotificationTimeoutForTesting(base::TimeDelta new_timeout);

patches/chromium/feat_enable_offscreen_rendering_with_viz_compositor.patch

@@ -503,7 +503,7 @@ index 583e3e2525c753a0962d481fc67a3582df75d0e9..9416ec929bebcff7f07088e635376ef2
    waiting_on_draw_ack_ = true;
  
 diff --git a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
-index df92bab44402330869b44aa76bb40fc20e33b16a..2b3fbaee17c0a8bb7b04cd4c4edb13626dd1bb27 100644
+index 4e38e0f49054cef3fd1a712c89608ce39003edeb..427882f8ed0d85c6e4170b213c3a3678b60a62df 100644
 --- a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
 +++ b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
 @@ -84,7 +84,8 @@ RootCompositorFrameSinkImpl::Create(
@@ -621,7 +621,7 @@ index 80bff73a5886e8e79d7d91de5e27bc747fcfce02..8bc43d1359fa2551713992d6ccb73949
    raw_ptr<Layer> root_layer_ = nullptr;
  
 diff --git a/ui/gfx/ca_layer_params.h b/ui/gfx/ca_layer_params.h
-index c5fb29b30b9c5b7483998c567ed9a479d8743939..dc10d78315f76a3914ccd6e2e99af97fa909918b 100644
+index 12e115cd6a128d8d150abc786d4d38b1d5119d91..b6320de28750333bee7ee83393849f4eb0a956ac 100644
 --- a/ui/gfx/ca_layer_params.h
 +++ b/ui/gfx/ca_layer_params.h
 @@ -6,6 +6,7 @@
@@ -632,7 +632,7 @@ index c5fb29b30b9c5b7483998c567ed9a479d8743939..dc10d78315f76a3914ccd6e2e99af97f
  #include "ui/gfx/geometry/size.h"
  #include "ui/gfx/gfx_export.h"
  
-@@ -41,6 +42,8 @@ struct GFX_EXPORT CALayerParams {
+@@ -51,6 +52,8 @@ struct GFX_EXPORT CALayerParams {
    gfx::ScopedRefCountedIOSurfaceMachPort io_surface_mach_port;
  #endif
  

patches/chromium/feat_expose_raw_response_headers_from_urlloader.patch

@@ -17,43 +17,43 @@ headers, moving forward we should find a way in upstream to provide
 access to these headers for loader clients created on the browser process.
 
 diff --git a/services/network/public/cpp/resource_request.cc b/services/network/public/cpp/resource_request.cc
-index 87868727a78223baef9ffd2591f49fced240ef4e..f6a6ff28f33e2d1c065f2abeb96733b2d28a6ea1 100644
+index a15e3c4bed344364f9c43e3f0b5c494d58dff789..24e3b291f8c25de2a0b82184fd731538b6586f86 100644
 --- a/services/network/public/cpp/resource_request.cc
 +++ b/services/network/public/cpp/resource_request.cc
 @@ -233,6 +233,7 @@ bool ResourceRequest::EqualsForTesting(const ResourceRequest& request) const {
           do_not_prompt_for_login == request.do_not_prompt_for_login &&
-          is_main_frame == request.is_main_frame &&
+          is_outermost_main_frame == request.is_outermost_main_frame &&
           transition_type == request.transition_type &&
 +         report_raw_headers == request.report_raw_headers &&
           previews_state == request.previews_state &&
           upgrade_if_insecure == request.upgrade_if_insecure &&
           is_revalidating == request.is_revalidating &&
 diff --git a/services/network/public/cpp/resource_request.h b/services/network/public/cpp/resource_request.h
-index 8b9a7b36f53a4cfcd159ac18c06d1724072013c8..ef0191bae8a07e531ae129cf32b22f4930c5e266 100644
+index 2ff43cc1ef683707001bf22c9b030bf6e7223e0f..cfaf9170666f04407adb5738ce6723900d234735 100644
 --- a/services/network/public/cpp/resource_request.h
 +++ b/services/network/public/cpp/resource_request.h
-@@ -156,6 +156,7 @@ struct COMPONENT_EXPORT(NETWORK_CPP_BASE) ResourceRequest {
+@@ -158,6 +158,7 @@ struct COMPONENT_EXPORT(NETWORK_CPP_BASE) ResourceRequest {
    bool do_not_prompt_for_login = false;
-   bool is_main_frame = false;
+   bool is_outermost_main_frame = false;
    int transition_type = 0;
 +  bool report_raw_headers = false;
    int previews_state = 0;
    bool upgrade_if_insecure = false;
    bool is_revalidating = false;
 diff --git a/services/network/public/cpp/url_request_mojom_traits.cc b/services/network/public/cpp/url_request_mojom_traits.cc
-index 1fcf54cac11c38352e14774cd08bcaa162443e9c..5356da11391d52a8f9aaa57a27616cee6dc0f2b6 100644
+index 4f2740ebf2dc4bee423cdbb72cae128f28a03f12..d3f531429598b3666aaba655356155c470e8b645 100644
 --- a/services/network/public/cpp/url_request_mojom_traits.cc
 +++ b/services/network/public/cpp/url_request_mojom_traits.cc
 @@ -209,6 +209,7 @@ bool StructTraits<
    out->do_not_prompt_for_login = data.do_not_prompt_for_login();
-   out->is_main_frame = data.is_main_frame();
+   out->is_outermost_main_frame = data.is_outermost_main_frame();
    out->transition_type = data.transition_type();
 +  out->report_raw_headers = data.report_raw_headers();
    out->previews_state = data.previews_state();
    out->upgrade_if_insecure = data.upgrade_if_insecure();
    out->is_revalidating = data.is_revalidating();
 diff --git a/services/network/public/cpp/url_request_mojom_traits.h b/services/network/public/cpp/url_request_mojom_traits.h
-index 3a1c5bd943c110514e4da06491190476d6e6de38..6a80fb16242865d398bcbcd380893ccc9a3fe167 100644
+index 069768e7ca727fc2ad8f5379900ad4a959a87f4f..3e6bc18564e2a3cdbac9af686636f75d64082464 100644
 --- a/services/network/public/cpp/url_request_mojom_traits.h
 +++ b/services/network/public/cpp/url_request_mojom_traits.h
 @@ -269,6 +269,9 @@ struct COMPONENT_EXPORT(NETWORK_CPP_BASE)
@@ -67,7 +67,7 @@ index 3a1c5bd943c110514e4da06491190476d6e6de38..6a80fb16242865d398bcbcd380893ccc
      return request.previews_state;
    }
 diff --git a/services/network/public/mojom/url_request.mojom b/services/network/public/mojom/url_request.mojom
-index 79b5d03ded03ced9e6ff4d17d10935004bfb0062..923883fd010f9621c790dd5381a7e1f0cb36e740 100644
+index ef3e8e68621402db5a97977f49ac74c438b0a563..aa1c1bcf7ca30adde4c25ed9bd8ed8a70eb919e0 100644
 --- a/services/network/public/mojom/url_request.mojom
 +++ b/services/network/public/mojom/url_request.mojom
 @@ -312,6 +312,9 @@ struct URLRequest {
@@ -103,7 +103,7 @@ index 4c4cc16db82d7434573f7740855fbe72d68815e6..f71290800b6bb51a39b1f86be36f02d6
    string mime_type;
  
 diff --git a/services/network/url_loader.cc b/services/network/url_loader.cc
-index 4c11fd542a66f514a6c36e684a34d0a62053c1f4..6852fd470c79e2fb041bf57a01e2b0b913cb94db 100644
+index 85e984259a1e067c76d57e5e54eb3ed1d9694ec0..dbe9e809898ee720c0670e9c6db73c38658613b2 100644
 --- a/services/network/url_loader.cc
 +++ b/services/network/url_loader.cc
 @@ -469,6 +469,7 @@ URLLoader::URLLoader(
@@ -123,7 +123,7 @@ index 4c11fd542a66f514a6c36e684a34d0a62053c1f4..6852fd470c79e2fb041bf57a01e2b0b9
      url_request_->SetResponseHeadersCallback(base::BindRepeating(
          &URLLoader::SetRawResponseHeaders, base::Unretained(this)));
    }
-@@ -1411,6 +1412,19 @@ void URLLoader::OnResponseStarted(net::URLRequest* url_request, int net_error) {
+@@ -1428,6 +1429,19 @@ void URLLoader::OnResponseStarted(net::URLRequest* url_request, int net_error) {
    }
  
    response_ = BuildResponseHead();
@@ -144,7 +144,7 @@ index 4c11fd542a66f514a6c36e684a34d0a62053c1f4..6852fd470c79e2fb041bf57a01e2b0b9
  
    // Parse and remove the Trust Tokens response headers, if any are expected,
 diff --git a/services/network/url_loader.h b/services/network/url_loader.h
-index 53822d17b20f4e6d163d0dc84eea6c455254a5f7..c494a63b0c1dcb39120e8aabc84a60ebbf2ff224 100644
+index e235b3cc8657e081063709f6d2cd6e0b2e99f2b2..15b77b8648b905711df8551b1645b14dd7d6fd87 100644
 --- a/services/network/url_loader.h
 +++ b/services/network/url_loader.h
 @@ -502,6 +502,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) URLLoader

patches/chromium/feat_move_firstpartysets_to_content_browser_client.patch

@@ -0,0 +1,874 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: VerteDinde <keeleymhammond@gmail.com>
+Date: Sun, 8 May 2022 17:21:12 -0700
+Subject: feat: replace ad-hoc SetPublicFirstPartySets calls with method in
+ ContentBrowserClient
+
+Cherry-picked from upstream Chromium. This patch can be removed when the
+fix is inherited from the next Chromium roll backport.
+
+This essentially requires
+embedders to indicate whether they will
+(maybe asynchronously) call SetPublicFirstPartySets during startup, or
+not. This makes it easier to initialize First-Party Sets properly, since
+it is now done via a pull-based interface rather than a push-based
+interface (which would require code in every embedder in order to
+set up the First-Party Sets backend). Now, there is a single place (in
+content) that handles every embedder that won't need to explicitly call
+SetPublicFirstPartySets at some point (e.g. after initializing
+Component Updater, in Chrome's case).
+
+Bug: 1321908
+Change-Id: I47eaaaf77e548079e1bd6360fd573e877aa79b32
+Reviewed-on:
+https://chromium-review.googlesource.com/c/chromium/src/+/3623985
+Reviewed-by: Avi Drissman <avi@chromium.org>
+Commit-Queue: Chris Fredrickson <cfredric@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#999047}
+
+Patch-Filename:
+feat_move_firstpartysets_to_content_browser_client.patch
+
+diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_browser_main.cc
+index e07874dc5a2fab83dff0a07d35aeb0cad7a1a67c..9f635870282f0f2a9b8bfaaa59e34f91675dcda3 100644
+--- a/chrome/browser/chrome_browser_main.cc
++++ b/chrome/browser/chrome_browser_main.cc
+@@ -1601,10 +1601,6 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+   // called inside PostProfileInit and depends on it.
+   if (!parsed_command_line().HasSwitch(switches::kDisableComponentUpdate)) {
+     component_updater::RegisterComponentsForUpdate();
+-  } else {
+-    // Initialize First-Party Sets even if component updater is disabled.
+-    content::FirstPartySetsHandler::GetInstance()->SetPublicFirstPartySets(
+-        base::File());
+   }
+ 
+   // TODO(stevenjb): Move WIN and MACOSX specific code to appropriate Parts.
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+index 3943c32ab29e785f401c2a5b31f1f6ed832514f0..939c28a029418bc353795aa1a007508680f42e57 100644
+--- a/chrome/browser/chrome_content_browser_client.cc
++++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -6462,6 +6462,12 @@ bool ChromeContentBrowserClient::IsFirstPartySetsEnabled() {
+   return local_state->GetBoolean(first_party_sets::kFirstPartySetsEnabled);
+ }
+ 
++bool ChromeContentBrowserClient::WillProvidePublicFirstPartySets() {
++  return !base::CommandLine::ForCurrentProcess()->HasSwitch(
++             switches::kDisableComponentUpdate) &&
++         base::FeatureList::IsEnabled(features::kFirstPartySets);
++}
++
+ base::Value::Dict ChromeContentBrowserClient::GetFirstPartySetsOverrides() {
+   if (!g_browser_process) {
+     // If browser process doesn't exist (e.g. in minimal mode on Android),
+diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
+index f0415a5099cdf181ab620fb6400db4f524c2c892..016b8276feeb6c35c88bc779ae84eea38d66f57d 100644
+--- a/chrome/browser/chrome_content_browser_client.h
++++ b/chrome/browser/chrome_content_browser_client.h
+@@ -772,6 +772,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+ 
+   bool IsFindInPageDisabledForOrigin(const url::Origin& origin) override;
+   bool IsFirstPartySetsEnabled() override;
++  bool WillProvidePublicFirstPartySets() override;
+   base::Value::Dict GetFirstPartySetsOverrides() override;
+ 
+   bool ShouldPreconnectNavigation(
+diff --git a/content/browser/first_party_sets/first_party_set_parser.cc b/content/browser/first_party_sets/first_party_set_parser.cc
+index b03570f072f407a1d2c6a58646db0f48a845429d..3ac5c0d206c7910e5ae653004e96780c14c8315d 100644
+--- a/content/browser/first_party_sets/first_party_set_parser.cc
++++ b/content/browser/first_party_sets/first_party_set_parser.cc
+@@ -323,4 +323,4 @@ FirstPartySetParser::ParseSetsFromEnterprisePolicy(
+   return absl::nullopt;
+ }
+ 
+-}  // namespace content
++}  // namespace content
+\ No newline at end of file
+diff --git a/content/browser/first_party_sets/first_party_set_parser.h b/content/browser/first_party_sets/first_party_set_parser.h
+index 491a8b508ef0d093f37608d2fde615427b9319df..3f33b1604fecbff0d4db8739ad138d95223b579c 100644
+--- a/content/browser/first_party_sets/first_party_set_parser.h
++++ b/content/browser/first_party_sets/first_party_set_parser.h
+@@ -102,4 +102,4 @@ class CONTENT_EXPORT FirstPartySetParser {
+ 
+ }  // namespace content
+ 
+-#endif  // CONTENT_BROWSER_FIRST_PARTY_SETS_FIRST_PARTY_SET_PARSER_H_
++#endif  // CONTENT_BROWSER_FIRST_PARTY_SETS_FIRST_PARTY_SET_PARSER_H_
+\ No newline at end of file
+diff --git a/content/browser/first_party_sets/first_party_sets_handler_impl.cc b/content/browser/first_party_sets/first_party_sets_handler_impl.cc
+index e5d277236b6393d35e8cf5a69c7f6d16f3394582..bb6840eecabfab9e9f0ae6b0fdc4e4436d1ea3b1 100644
+--- a/content/browser/first_party_sets/first_party_sets_handler_impl.cc
++++ b/content/browser/first_party_sets/first_party_sets_handler_impl.cc
+@@ -74,7 +74,8 @@ FirstPartySetsHandler* FirstPartySetsHandler::GetInstance() {
+ // static
+ FirstPartySetsHandlerImpl* FirstPartySetsHandlerImpl::GetInstance() {
+   static base::NoDestructor<FirstPartySetsHandlerImpl> instance(
+-      GetContentClient()->browser()->IsFirstPartySetsEnabled());
++      GetContentClient()->browser()->IsFirstPartySetsEnabled(),
++      GetContentClient()->browser()->WillProvidePublicFirstPartySets());
+   return instance.get();
+ }
+ 
+@@ -89,8 +90,12 @@ FirstPartySetsHandler::ValidateEnterprisePolicy(
+       policy, /*out_sets=*/nullptr);
+ }
+ 
+-FirstPartySetsHandlerImpl::FirstPartySetsHandlerImpl(bool enabled)
+-    : enabled_(enabled) {
++FirstPartySetsHandlerImpl::FirstPartySetsHandlerImpl(
++    bool enabled,
++    bool embedder_will_provide_public_sets)
++    : enabled_(enabled),
++      embedder_will_provide_public_sets_(enabled &&
++                                         embedder_will_provide_public_sets) {
+   sets_loader_ = std::make_unique<FirstPartySetsLoader>(
+       base::BindOnce(&FirstPartySetsHandlerImpl::SetCompleteSets,
+                      // base::Unretained(this) is safe here because
+@@ -112,12 +117,23 @@ void FirstPartySetsHandlerImpl::Init(const base::FilePath& user_data_dir,
+                                      const std::string& flag_value,
+                                      SetsReadyOnceCallback on_sets_ready) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  DCHECK(!initialized_);
++  DCHECK(persisted_sets_path_.empty());
++  DCHECK(on_sets_ready_.is_null());
++
++  initialized_ = true;
+   on_sets_ready_ = std::move(on_sets_ready);
+   SetPersistedSets(user_data_dir);
+-  SetManuallySpecifiedSet(flag_value);
+ 
+-  if (!IsEnabled())
++  if (IsEnabled()) {
++    DCHECK(!on_sets_ready_.is_null());
++    sets_loader_->SetManuallySpecifiedSet(flag_value);
++    if (!embedder_will_provide_public_sets_) {
++      sets_loader_->SetComponentSets(base::File());
++    }
++  } else {
+     SetCompleteSets({});
++  }
+ }
+ 
+ bool FirstPartySetsHandlerImpl::IsEnabled() const {
+@@ -127,16 +143,17 @@ bool FirstPartySetsHandlerImpl::IsEnabled() const {
+ 
+ void FirstPartySetsHandlerImpl::SetPublicFirstPartySets(base::File sets_file) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  if (!IsEnabled()) {
+-    sets_loader_->DisposeFile(std::move(sets_file));
+-    return;
+-  }
++  DCHECK(enabled_);
++  DCHECK(embedder_will_provide_public_sets_);
+   sets_loader_->SetComponentSets(std::move(sets_file));
+ }
+ 
+ void FirstPartySetsHandlerImpl::ResetForTesting() {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  initialized_ = false;
+   enabled_ = GetContentClient()->browser()->IsFirstPartySetsEnabled();
++  embedder_will_provide_public_sets_ =
++      GetContentClient()->browser()->WillProvidePublicFirstPartySets();
+ 
+   // Initializes the `sets_loader_` member with a callback to SetCompleteSets
+   // and the result of content::GetFirstPartySetsOverrides.
+@@ -153,19 +170,16 @@ void FirstPartySetsHandlerImpl::ResetForTesting() {
+   raw_persisted_sets_ = absl::nullopt;
+ }
+ 
+-void FirstPartySetsHandlerImpl::SetManuallySpecifiedSet(
+-    const std::string& flag_value) {
+-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  if (!IsEnabled())
+-    return;
+-  sets_loader_->SetManuallySpecifiedSet(flag_value);
+-}
+-
+ void FirstPartySetsHandlerImpl::SetPersistedSets(
+     const base::FilePath& user_data_dir) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  DCHECK(!raw_persisted_sets_.has_value());
++  DCHECK(persisted_sets_path_.empty());
+   if (user_data_dir.empty()) {
+     VLOG(1) << "Empty path. Failed loading serialized First-Party Sets file.";
++    // We have to continue, in case the embedder has enabled FPS but has not
++    // provided a directory to store persisted sets.
++    OnReadPersistedSetsFile("");
+     return;
+   }
+   persisted_sets_path_ = user_data_dir.Append(kPersistedFirstPartySetsFileName);
+@@ -184,19 +198,36 @@ void FirstPartySetsHandlerImpl::SetPersistedSets(
+ void FirstPartySetsHandlerImpl::OnReadPersistedSetsFile(
+     const std::string& raw_persisted_sets) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  DCHECK(!persisted_sets_path_.empty());
++  DCHECK(!raw_persisted_sets_.has_value());
+   raw_persisted_sets_ = raw_persisted_sets;
+   UmaHistogramTimes(
+-      "Cookie.FirstPartySets.InitializationDuration.ReadPersistedSets",
++      "Cookie.FirstPartySets.InitializationDuration.ReadPersistedSets2",
+       construction_timer_.Elapsed());
+-  ClearSiteDataOnChangedSetsIfReady();
++
++  if (sets_.has_value()) {
++    ClearSiteDataOnChangedSets();
++
++    if (IsEnabled()) {
++      DCHECK(!on_sets_ready_.is_null());
++      std::move(on_sets_ready_).Run(sets_.value());
++    }
++  }
+ }
+ 
+ void FirstPartySetsHandlerImpl::SetCompleteSets(
+     base::flat_map<net::SchemefulSite, net::SchemefulSite> sets) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  DCHECK(!sets_.has_value());
+   sets_ = std::move(sets);
+-  ClearSiteDataOnChangedSetsIfReady();
++
++  if (raw_persisted_sets_.has_value()) {
++    ClearSiteDataOnChangedSets();
++
++    if (IsEnabled()) {
++      DCHECK(!on_sets_ready_.is_null());
++      std::move(on_sets_ready_).Run(sets_.value());
++    }
++  }
+ }
+ 
+ // static
+@@ -229,10 +260,10 @@ base::flat_set<net::SchemefulSite> FirstPartySetsHandlerImpl::ComputeSetsDiff(
+   return result;
+ }
+ 
+-void FirstPartySetsHandlerImpl::ClearSiteDataOnChangedSetsIfReady() {
++void FirstPartySetsHandlerImpl::ClearSiteDataOnChangedSets() const {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  if (!raw_persisted_sets_.has_value() || !sets_.has_value())
+-    return;
++  DCHECK(sets_.has_value());
++  DCHECK(raw_persisted_sets_.has_value());
+ 
+   base::flat_set<net::SchemefulSite> diff =
+       ComputeSetsDiff(FirstPartySetParser::DeserializeFirstPartySets(
+@@ -241,14 +272,13 @@ void FirstPartySetsHandlerImpl::ClearSiteDataOnChangedSetsIfReady() {
+ 
+   // TODO(shuuran@chromium.org): Implement site state clearing.
+ 
+-  if (!on_sets_ready_.is_null() && IsEnabledAndReady())
+-    std::move(on_sets_ready_).Run(sets_.value());
+-
+-  base::ThreadPool::PostTask(
+-      FROM_HERE, {base::MayBlock(), base::TaskPriority::BEST_EFFORT},
+-      base::BindOnce(
+-          &MaybeWriteSetsToDisk, persisted_sets_path_,
+-          FirstPartySetParser::SerializeFirstPartySets(sets_.value())));
++  if (!persisted_sets_path_.empty()) {
++    base::ThreadPool::PostTask(
++        FROM_HERE, {base::MayBlock(), base::TaskPriority::BEST_EFFORT},
++        base::BindOnce(
++            &MaybeWriteSetsToDisk, persisted_sets_path_,
++            FirstPartySetParser::SerializeFirstPartySets(sets_.value())));
++  }
+ }
+ 
+ bool FirstPartySetsHandlerImpl::IsEnabledAndReady() const {
+@@ -256,4 +286,4 @@ bool FirstPartySetsHandlerImpl::IsEnabledAndReady() const {
+   return IsEnabled() && sets_.has_value();
+ }
+ 
+-}  // namespace content
++}  // namespace content
+\ No newline at end of file
+diff --git a/content/browser/first_party_sets/first_party_sets_handler_impl.h b/content/browser/first_party_sets/first_party_sets_handler_impl.h
+index a60adcd16b5b8911965f9a22c2e70b5044150758..829cd96245cbe39eeddecf2e0403f2ba1ab88793 100644
+--- a/content/browser/first_party_sets/first_party_sets_handler_impl.h
++++ b/content/browser/first_party_sets/first_party_sets_handler_impl.h
+@@ -55,10 +55,9 @@ class CONTENT_EXPORT FirstPartySetsHandlerImpl : public FirstPartySetsHandler {
+   // persisted sets, since we may still need to clear data from a previous
+   // invocation of Chromium which had First-Party Sets enabled.
+   //
+-  // TODO(https://crbug.com/1309188): Init() should be called in the
+-  // BrowserMainLoop::PreMainMessageLoopRun(). But just in case it's
+-  // accidentally called from other places, make sure it's no-op for the
+-  // following calls.
++  // If First-Party Sets is enabled, `on_sets_ready` must not be null.
++  //
++  // Must be called exactly once.
+   void Init(const base::FilePath& user_data_dir,
+             const std::string& flag_value,
+             SetsReadyOnceCallback on_sets_ready);
+@@ -78,6 +77,11 @@ class CONTENT_EXPORT FirstPartySetsHandlerImpl : public FirstPartySetsHandler {
+     enabled_ = enabled;
+   }
+ 
++  void SetEmbedderWillProvidePublicSetsForTesting(bool will_provide) {
++    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++    embedder_will_provide_public_sets_ = enabled_ && will_provide;
++  }
++
+   // Compares the map `old_sets` to `current_sets` and returns the set of sites
+   // that: 1) were in `old_sets` but are no longer in `current_sets`, i.e. leave
+   // the FPSs; or, 2) mapped to a different owner site.
+@@ -92,41 +96,38 @@ class CONTENT_EXPORT FirstPartySetsHandlerImpl : public FirstPartySetsHandler {
+  private:
+   friend class base::NoDestructor<FirstPartySetsHandlerImpl>;
+ 
+-  explicit FirstPartySetsHandlerImpl(bool enabled);
++  FirstPartySetsHandlerImpl(bool enabled,
++                            bool embedder_will_provide_public_sets);
+ 
+   // This method reads the persisted First-Party Sets from the file under
+-  // `user_data_dir`.
++  // `user_data_dir`. Must be called exactly once.
+   void SetPersistedSets(const base::FilePath& user_data_dir);
+ 
+-  // Stores the read persisted sets in `raw_persisted_sets_`.
++  // Stores the read persisted sets in `raw_persisted_sets_`. Must be called
++  // exactly once.
+   void OnReadPersistedSetsFile(const std::string& raw_persisted_sets);
+ 
+-  // Parses and sets the First-Party Set that was provided via the
+-  // `kUseFirstPartySet` flag/switch.
+-  //
+-  // Has no effect if `kFirstPartySets` is disabled, or
+-  // `SetPublicFirstPartySets` is not called.
+-  void SetManuallySpecifiedSet(const std::string& flag_value);
+-
+-  // Sets the current First-Party Sets data.
++  // Sets the current First-Party Sets data. Must be called exactly once.
+   void SetCompleteSets(FlattenedSets sets);
+ 
+-  // Checks the required inputs have been received, and if so:
++  // Does the following:
+   // 1) computes the diff between the `sets_` and the parsed
+   // `raw_persisted_sets_`;
+   // 2) clears the site data of the set of sites based on the diff;
+-  // 3) calls `on_sets_ready_` if conditions are met;
+-  // 4) writes the current First-Party Sets to the file in
++  // 3) writes the current First-Party Sets to the file in
+   // `persisted_sets_path_`.
+   //
+   // TODO(shuuran@chromium.org): Implement the code to clear site state.
+-  void ClearSiteDataOnChangedSetsIfReady();
++  void ClearSiteDataOnChangedSets() const;
+ 
+   // Returns true if:
+   // * First-Party Sets are enabled;
+   // * `sets_` is ready to be used.
+   bool IsEnabledAndReady() const;
+ 
++  // Whether Init has been called already or not.
++  bool initialized_ = false;
++
+   // Represents the mapping of site -> site, where keys are members of sets, and
+   // values are owners of the sets. Owners are explicitly represented as members
+   // of the set.
+@@ -144,6 +145,7 @@ class CONTENT_EXPORT FirstPartySetsHandlerImpl : public FirstPartySetsHandler {
+   base::FilePath persisted_sets_path_ GUARDED_BY_CONTEXT(sequence_checker_);
+ 
+   bool enabled_ GUARDED_BY_CONTEXT(sequence_checker_);
++  bool embedder_will_provide_public_sets_ GUARDED_BY_CONTEXT(sequence_checker_);
+ 
+   // We use a OnceCallback to ensure we only pass along the sets once
+   // during Chrome's lifetime (modulo reconfiguring the network service).
+@@ -160,4 +162,4 @@ class CONTENT_EXPORT FirstPartySetsHandlerImpl : public FirstPartySetsHandler {
+ 
+ }  // namespace content
+ 
+-#endif  // CONTENT_BROWSER_FIRST_PARTY_SETS_FIRST_PARTY_SETS_HANDLER_IMPL_H_
++#endif  // CONTENT_BROWSER_FIRST_PARTY_SETS_FIRST_PARTY_SETS_HANDLER_IMPL_H_
+\ No newline at end of file
+diff --git a/content/browser/first_party_sets/first_party_sets_handler_impl_unittest.cc b/content/browser/first_party_sets/first_party_sets_handler_impl_unittest.cc
+index 0c0eeda67a8a4bdc9876f5ad3fe78c06c4f18b5d..3e92801eb25e339e6b3a43b5fadab8f1b78b23f9 100644
+--- a/content/browser/first_party_sets/first_party_sets_handler_impl_unittest.cc
++++ b/content/browser/first_party_sets/first_party_sets_handler_impl_unittest.cc
+@@ -367,14 +367,6 @@ TEST_F(FirstPartySetsHandlerImplDisabledTest, IgnoresValid) {
+             FAIL();  // Should not be called.
+           }));
+ 
+-  // Set required inputs to be able to receive the merged sets from
+-  // FirstPartySetsLoader.
+-  const std::string input =
+-      "{\"owner\": \"https://example.test\",\"members\": "
+-      "[\"https://aaaa.test\"]}";
+-  ASSERT_TRUE(base::JSONReader::Read(input));
+-  SetPublicFirstPartySetsAndWait(input);
+-
+   env().RunUntilIdle();
+ 
+   // TODO(shuuran@chromium.org): test site state is cleared.
+@@ -397,9 +389,6 @@ TEST_F(FirstPartySetsHandlerImplDisabledTest,
+             FAIL();  // Should not be called.
+           }));
+ 
+-  SetPublicFirstPartySetsAndWait(R"({"owner": "https://example.test", )"
+-                                 R"("members": ["https://member.test"]})");
+-
+   EXPECT_EQ(
+       FirstPartySetsHandlerImpl::GetInstance()->GetSetsIfEnabledAndReady(),
+       absl::nullopt);
+@@ -413,11 +402,6 @@ class FirstPartySetsHandlerImplEnabledTest
+ };
+ 
+ TEST_F(FirstPartySetsHandlerImplEnabledTest, PersistedSetsNotReady) {
+-  const std::string input = R"({"owner": "https://foo.test", )"
+-                            R"("members": ["https://member2.test"]})";
+-  ASSERT_TRUE(base::JSONReader::Read(input));
+-  SetPublicFirstPartySetsAndWait(input);
+-
+   // Empty `user_data_dir` will fail loading persisted sets.
+   FirstPartySetsHandlerImpl::GetInstance()->Init(
+       /*user_data_dir=*/{},
+@@ -431,6 +415,8 @@ TEST_F(FirstPartySetsHandlerImplEnabledTest, PersistedSetsNotReady) {
+ }
+ 
+ TEST_F(FirstPartySetsHandlerImplEnabledTest, PublicFirstPartySetsNotReady) {
++  FirstPartySetsHandlerImpl::GetInstance()
++      ->SetEmbedderWillProvidePublicSetsForTesting(true);
+   ASSERT_TRUE(base::WriteFile(persisted_sets_path_, "{}"));
+ 
+   // Persisted sets are expected to be loaded with the provided path.
+@@ -447,6 +433,8 @@ TEST_F(FirstPartySetsHandlerImplEnabledTest, PublicFirstPartySetsNotReady) {
+ 
+ TEST_F(FirstPartySetsHandlerImplEnabledTest,
+        Successful_PersistedSetsFileNotExist) {
++  FirstPartySetsHandlerImpl::GetInstance()
++      ->SetEmbedderWillProvidePublicSetsForTesting(true);
+   const std::string input = R"({"owner": "https://foo.test", )"
+                             R"("members": ["https://member2.test"]})";
+   ASSERT_TRUE(base::JSONReader::Read(input));
+@@ -479,6 +467,8 @@ TEST_F(FirstPartySetsHandlerImplEnabledTest,
+ }
+ 
+ TEST_F(FirstPartySetsHandlerImplEnabledTest, Successful_PersistedSetsEmpty) {
++  FirstPartySetsHandlerImpl::GetInstance()
++      ->SetEmbedderWillProvidePublicSetsForTesting(true);
+   ASSERT_TRUE(base::WriteFile(persisted_sets_path_, "{}"));
+ 
+   const std::string input = R"({"owner": "https://foo.test", )"
+@@ -514,6 +504,8 @@ TEST_F(FirstPartySetsHandlerImplEnabledTest, Successful_PersistedSetsEmpty) {
+ 
+ TEST_F(FirstPartySetsHandlerImplEnabledTest,
+        GetSetsIfEnabledAndReady_AfterSetsReady) {
++  FirstPartySetsHandlerImpl::GetInstance()
++      ->SetEmbedderWillProvidePublicSetsForTesting(true);
+   ASSERT_TRUE(base::WriteFile(persisted_sets_path_, "{}"));
+ 
+   const std::string input = R"({"owner": "https://example.test", )"
+@@ -549,6 +541,8 @@ TEST_F(FirstPartySetsHandlerImplEnabledTest,
+ 
+ TEST_F(FirstPartySetsHandlerImplEnabledTest,
+        GetSetsIfEnabledAndReady_BeforeSetsReady) {
++  FirstPartySetsHandlerImpl::GetInstance()
++      ->SetEmbedderWillProvidePublicSetsForTesting(true);
+   ASSERT_TRUE(base::WriteFile(persisted_sets_path_, "{}"));
+ 
+   // Call GetSetsIfEnabledAndReady before the sets are ready.
+diff --git a/content/browser/first_party_sets/first_party_sets_loader.cc b/content/browser/first_party_sets/first_party_sets_loader.cc
+index 52acedfde41b85acfc9246121ccfd6e63290270e..c229815ff14160c4f325fb51473e3b4baf5a9891 100644
+--- a/content/browser/first_party_sets/first_party_sets_loader.cc
++++ b/content/browser/first_party_sets/first_party_sets_loader.cc
+@@ -20,6 +20,7 @@
+ #include "base/strings/string_split.h"
+ #include "base/task/thread_pool.h"
+ #include "base/values.h"
++#include "content/browser/first_party_sets/addition_overlaps_union_find.h"
+ #include "content/browser/first_party_sets/first_party_set_parser.h"
+ #include "net/base/schemeful_site.h"
+ #include "third_party/abseil-cpp/absl/types/optional.h"
+@@ -66,6 +67,37 @@ std::string ReadSetsFile(base::File sets_file) {
+   return base::ReadStreamToString(file.get(), &raw_sets) ? raw_sets : "";
+ }
+ 
++// Creates a set of SchemefulSites present with the given list of SingleSets.
++base::flat_set<net::SchemefulSite> FlattenSingleSetList(
++    const std::vector<content::FirstPartySetsLoader::SingleSet>& sets) {
++  std::vector<net::SchemefulSite> sites;
++  for (const content::FirstPartySetsLoader::SingleSet& set : sets) {
++    sites.push_back(set.first);
++    sites.insert(sites.end(), set.second.begin(), set.second.end());
++  }
++  return sites;
++}
++
++// Populates the `policy_set_overlaps` out-parameter by checking
++// `existing_sets`. If `site` is equal to an existing site e in `sets`, then
++// `policy_set_index` will be added to the list of set indices at
++// `policy_set_overlaps`[e].
++void AddIfPolicySetOverlaps(
++    const net::SchemefulSite& site,
++    size_t policy_set_index,
++    FirstPartySetsLoader::FlattenedSets existing_sets,
++    base::flat_map<net::SchemefulSite, base::flat_set<size_t>>&
++        policy_set_overlaps) {
++  // Check `site` for membership in `existing_sets`.
++  if (auto it = existing_sets.find(site); it != existing_sets.end()) {
++    // Add the index of `site`'s policy set to the list of policy set indices
++    // that also overlap with site_owner.
++    auto [site_and_sets, inserted] =
++        policy_set_overlaps.insert({it->second, {}});
++    site_and_sets->second.insert(policy_set_index);
++  }
++}
++
+ }  // namespace
+ 
+ FirstPartySetsLoader::FirstPartySetsLoader(
+@@ -89,7 +121,7 @@ void FirstPartySetsLoader::SetManuallySpecifiedSet(
+   manually_specified_set_ = {CanonicalizeSet(base::SplitString(
+       flag_value, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY))};
+   UmaHistogramTimes(
+-      "Cookie.FirstPartySets.InitializationDuration.ReadCommandLineSet",
++      "Cookie.FirstPartySets.InitializationDuration.ReadCommandLineSet2",
+       construction_timer_.Elapsed());
+ 
+   MaybeFinishLoading();
+@@ -127,7 +159,7 @@ void FirstPartySetsLoader::OnReadSetsFile(const std::string& raw_sets) {
+ 
+   component_sets_parse_progress_ = Progress::kFinished;
+   UmaHistogramTimes(
+-      "Cookie.FirstPartySets.InitializationDuration.ReadComponentSets",
++      "Cookie.FirstPartySets.InitializationDuration.ReadComponentSets2",
+       construction_timer_.Elapsed());
+   MaybeFinishLoading();
+ }
+@@ -144,33 +176,141 @@ void FirstPartySetsLoader::DisposeFile(base::File sets_file) {
+   }
+ }
+ 
++std::vector<FirstPartySetsLoader::SingleSet>
++FirstPartySetsLoader::NormalizeAdditionSets(
++    const FlattenedSets& existing_sets,
++    const std::vector<SingleSet>& addition_sets) {
++  // Create a mapping from an owner site in `existing_sets` to all policy sets
++  // that intersect with the set that it owns.
++  base::flat_map<net::SchemefulSite, base::flat_set<size_t>>
++      policy_set_overlaps;
++  for (size_t set_idx = 0; set_idx < addition_sets.size(); set_idx++) {
++    const net::SchemefulSite& owner = addition_sets[set_idx].first;
++    AddIfPolicySetOverlaps(owner, set_idx, existing_sets, policy_set_overlaps);
++    for (const net::SchemefulSite& member : addition_sets[set_idx].second) {
++      AddIfPolicySetOverlaps(member, set_idx, existing_sets,
++                             policy_set_overlaps);
++    }
++  }
++
++  AdditionOverlapsUnionFind union_finder(addition_sets.size());
++  for (auto& [public_site, policy_set_indices] : policy_set_overlaps) {
++    // Union together all overlapping policy sets to determine which one will
++    // take ownership.
++    for (size_t representative : policy_set_indices) {
++      union_finder.Union(*policy_set_indices.begin(), representative);
++    }
++  }
++
++  // The union-find data structure now knows which policy set should be given
++  // the role of representative for each entry in policy_set_overlaps.
++  // AdditionOverlapsUnionFind::SetsMapping returns a map from representative
++  // index to list of its children.
++  std::vector<SingleSet> normalized_additions;
++  for (auto& [rep, children] : union_finder.SetsMapping()) {
++    SingleSet normalized = addition_sets[rep];
++    for (size_t child_set_idx : children) {
++      // Update normalized to absorb the child_set_idx-th addition set.
++      const SingleSet& child_set = addition_sets[child_set_idx];
++      normalized.second.insert(child_set.first);
++      normalized.second.insert(child_set.second.begin(),
++                               child_set.second.end());
++    }
++    normalized_additions.push_back(normalized);
++  }
++  return normalized_additions;
++}
++
+ void FirstPartySetsLoader::ApplyManuallySpecifiedSet() {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  DCHECK_EQ(component_sets_parse_progress_, Progress::kFinished);
+-  DCHECK(manually_specified_set_.has_value());
++  DCHECK(HasAllInputs());
+   if (!manually_specified_set_.value().has_value())
+     return;
++  ApplyReplacementOverrides({manually_specified_set_->value()});
++  RemoveAllSingletons();
++}
++
++void FirstPartySetsLoader::ApplyReplacementOverrides(
++    const std::vector<SingleSet>& override_sets) {
++  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  DCHECK(HasAllInputs());
++
++  base::flat_set<net::SchemefulSite> all_override_sites =
++      FlattenSingleSetList(override_sets);
++
++  // Erase the intersection between |sets_| and the list of |override_sets| and
++  // any members whose owner was in the intersection.
++  base::EraseIf(
++      sets_, [&all_override_sites](
++                 const std::pair<net::SchemefulSite, net::SchemefulSite>& p) {
++        return all_override_sites.contains(p.first) ||
++               all_override_sites.contains(p.second);
++      });
++
++  // Next, we must add each site in the override_sets to |sets_|.
++  for (auto& [owner, members] : override_sets) {
++    sets_.emplace(owner, owner);
++    for (const net::SchemefulSite& member : members) {
++      sets_.emplace(member, owner);
++    }
++  }
++}
++
++void FirstPartySetsLoader::ApplyAdditionOverrides(
++    const std::vector<SingleSet>& new_sets) {
++  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  DCHECK(HasAllInputs());
++
++  if (new_sets.empty())
++    return;
+ 
+-  const net::SchemefulSite& manual_owner =
+-      manually_specified_set_.value()->first;
+-  const base::flat_set<net::SchemefulSite>& manual_members =
+-      manually_specified_set_.value()->second;
++  std::vector<SingleSet> normalized_additions =
++      NormalizeAdditionSets(sets_, new_sets);
+ 
+-  const auto was_manually_provided =
+-      [&manual_members, &manual_owner](const net::SchemefulSite& site) {
+-        return site == manual_owner || manual_members.contains(site);
+-      };
++  FlattenedSets flattened_additions;
++  for (const auto& [owner, members] : normalized_additions) {
++    for (const net::SchemefulSite& member : members)
++      flattened_additions.emplace(member, owner);
++    flattened_additions.emplace(owner, owner);
++  }
+ 
+-  // Erase the intersection between the manually-specified set and the
+-  // CU-supplied set, and any members whose owner was in the intersection.
+-  base::EraseIf(sets_, [&was_manually_provided](const auto& p) {
+-    return was_manually_provided(p.first) || was_manually_provided(p.second);
+-  });
++  // Identify intersections between addition sets and existing sets. This will
++  // be used to reparent existing sets if they intersect with an addition set.
++  //
++  // Since we reparent every member of an existing set (regardless of whether
++  // the intersection was via one of its members or its owner), we just keep
++  // track of the set itself, via its owner.
++  base::flat_map<net::SchemefulSite, net::SchemefulSite> owners_in_intersection;
++  for (const auto& [site, owner] : flattened_additions) {
++    // Found an overlap with an existing set. Add the existing owner to the
++    // map.
++    if (auto it = sets_.find(site); it != sets_.end()) {
++      owners_in_intersection[it->second] = owner;
++    }
++  }
++
++  // Update the (site, owner) mappings in sets_ such that if owner is in the
++  // intersection, then the site is mapped to owners_in_intersection[owner].
++  //
++  // This reparents existing sets to their owner given by the normalized
++  // addition sets.
++  for (auto& [site, owner] : sets_) {
++    if (auto owner_entry = owners_in_intersection.find(owner);
++        owner_entry != owners_in_intersection.end()) {
++      owner = owner_entry->second;
++    }
++  }
+ 
+-  // Now remove singleton sets. We already removed any sites that were part
+-  // of the intersection, or whose owner was part of the intersection. This
+-  // leaves sites that *are* owners, which no longer have any (other)
+-  // members.
++  // Since the intersection between sets_ and flattened_additions has already
++  // been updated above, we can insert flattened_additions into sets_ without
++  // affecting any existing mappings in sets_.
++  sets_.insert(flattened_additions.begin(), flattened_additions.end());
++}
++
++void FirstPartySetsLoader::RemoveAllSingletons() {
++  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  // Now remove singleton sets, which are sets that just contain sites that
++  // *are* owners, but no longer have any (other) members.
+   std::set<net::SchemefulSite> owners_with_members;
+   for (const auto& it : sets_) {
+     if (it.first != it.second)
+@@ -179,21 +319,29 @@ void FirstPartySetsLoader::ApplyManuallySpecifiedSet() {
+   base::EraseIf(sets_, [&owners_with_members](const auto& p) {
+     return p.first == p.second && !base::Contains(owners_with_members, p.first);
+   });
++}
+ 
+-  // Next, we must add the manually-added set to the parsed value.
+-  for (const net::SchemefulSite& member : manual_members) {
+-    sets_.emplace(member, manual_owner);
+-  }
+-  sets_.emplace(manual_owner, manual_owner);
++void FirstPartySetsLoader::ApplyAllPolicyOverrides() {
++  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  DCHECK(HasAllInputs());
++  ApplyReplacementOverrides(policy_overrides_.replacements);
++  ApplyAdditionOverrides(policy_overrides_.additions);
++  RemoveAllSingletons();
+ }
+ 
+ void FirstPartySetsLoader::MaybeFinishLoading() {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  if (component_sets_parse_progress_ != Progress::kFinished ||
+-      !manually_specified_set_.has_value())
++  if (!HasAllInputs())
+     return;
+   ApplyManuallySpecifiedSet();
++  ApplyAllPolicyOverrides();
+   std::move(on_load_complete_).Run(std::move(sets_));
+ }
+ 
+-}  // namespace content
++bool FirstPartySetsLoader::HasAllInputs() const {
++  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
++  return component_sets_parse_progress_ == Progress::kFinished &&
++         manually_specified_set_.has_value();
++}
++
++}  // namespace content
+\ No newline at end of file
+diff --git a/content/browser/first_party_sets/first_party_sets_loader.h b/content/browser/first_party_sets/first_party_sets_loader.h
+index c27d2300c4c3533df91a8e814e89827bbd7d72ae..8588fe5f9922b36c9fe8e16ac16d02ccf00c8723 100644
+--- a/content/browser/first_party_sets/first_party_sets_loader.h
++++ b/content/browser/first_party_sets/first_party_sets_loader.h
+@@ -57,6 +57,19 @@ class CONTENT_EXPORT FirstPartySetsLoader {
+   // Close the file on thread pool that allows blocking.
+   void DisposeFile(base::File sets_file);
+ 
++  // Handles addition sets which overlap by intersecting with the same existing
++  // set, known as a transitive-overlap.
++  //
++  // This uses a Union-Find algorithm to select the earliest-provided addition
++  // set as the representative of all other addition sets that
++  // transitively-overlap with it.
++  //
++  // The "earliest-provided" tie-breaker is determined using a set's index in
++  // `addition_sets`.
++  static std::vector<SingleSet> NormalizeAdditionSets(
++      const FlattenedSets& existing_sets,
++      const std::vector<SingleSet>& addition_sets);
++
+  private:
+   // Parses the contents of `raw_sets` as a collection of First-Party Set
+   // declarations, and assigns to `sets_`.
+@@ -67,10 +80,42 @@ class CONTENT_EXPORT FirstPartySetsLoader {
+   // `SetManuallySpecifiedSet`, and the public sets via `SetComponentSets`.
+   void ApplyManuallySpecifiedSet();
+ 
++  // Removes the intersection between `sets_` and `override_sets` from the
++  // `sets_` member variable, and then adds the `override_sets` into `sets_`.
++  void ApplyReplacementOverrides(const std::vector<SingleSet>& override_sets);
++
++  // Updates the intersection between `sets_` and `override_sets` within the
++  // `sets_` member variable, and then adds the `override_sets` into
++  // `sets_`.
++  //
++  // The applied update ensures that invariants of First-Party Sets are
++  // maintained, and that all sets in sets_ are disjoint.
++  //
++  // This will add in the `override_sets` into `sets_` without removing
++  // any existing sites from the list of First-Party Sets.
++  void ApplyAdditionOverrides(const std::vector<SingleSet>& override_sets);
++
++  // Removes all singletons (owners that have no members) from sets_.
++  void RemoveAllSingletons();
++
++  // Applies the First-Party Sets overrides provided by policy.
++  //
++  // Must not be called until the loader has already received the public sets
++  // via `SetComponentSets` and the CLI-provided sets have been applied to
++  // `sets_`.
++  //
++  // Applies "Replacement" overrides before applying "Addition" overrides.
++  void ApplyAllPolicyOverrides();
++
+   // Checks the required inputs have been received, and if so, invokes the
+   // callback `on_load_complete_`, after merging sets appropriately.
+   void MaybeFinishLoading();
+ 
++  // Returns true if all sources are present (Component Updater sets, CLI set,
++  // and Policy sets). The Policy sets are provided at construction time, so
++  // this effectively checks that the other two sources are ready.
++  bool HasAllInputs() const;
++
+   // Represents the mapping of site -> site, where keys are members of sets,
+   // and values are owners of the sets (explicitly including an entry of owner
+   // -> owner).
+@@ -117,4 +162,4 @@ class CONTENT_EXPORT FirstPartySetsLoader {
+ 
+ }  // namespace content
+ 
+-#endif  // CONTENT_BROWSER_FIRST_PARTY_SETS_FIRST_PARTY_SETS_LOADER_H_
++#endif  // CONTENT_BROWSER_FIRST_PARTY_SETS_FIRST_PARTY_SETS_LOADER_H_
+\ No newline at end of file
+diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
+index 16fb4946cb3ea2d097e8ed05bb340cc3f0782ed6..b751bf43d41a149579047faeec958646ecc3a5e0 100644
+--- a/content/public/browser/content_browser_client.cc
++++ b/content/public/browser/content_browser_client.cc
+@@ -1327,6 +1327,10 @@ bool ContentBrowserClient::IsFirstPartySetsEnabled() {
+   return base::FeatureList::IsEnabled(features::kFirstPartySets);
+ }
+ 
++bool ContentBrowserClient::WillProvidePublicFirstPartySets() {
++  return false;
++}
++
+ base::Value::Dict ContentBrowserClient::GetFirstPartySetsOverrides() {
+   return base::Value::Dict();
+ }
+diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
+index 4db1e6c2dbea27249ca15d5660b7fcd8c6736ad1..8aac2a95a3ac66f0b0c180f46ec29ca7341a1d4c 100644
+--- a/content/public/browser/content_browser_client.h
++++ b/content/public/browser/content_browser_client.h
+@@ -2227,6 +2227,16 @@ class CONTENT_EXPORT ContentBrowserClient {
+   // should not change in a single browser session.
+   virtual bool IsFirstPartySetsEnabled();
+ 
++  // Returns true iff the embedder will provide a list of First-Party Sets via
++  // content::FirstPartySetsHandler::SetPublicFirstPartySets during startup, at
++  // some point. If `IsFirstPartySetsEnabled()` returns false, this method will
++  // still be called, but its return value will be ignored.
++  //
++  // If this method returns false but `IsFirstPartySetsEnabled()` returns true
++  // (e.g. in tests), an empty list will be used instead of waiting for the
++  // embedder to call content::FirstPartySetsHandler::SetPublicFirstPartySets.
++  virtual bool WillProvidePublicFirstPartySets();
++
+   // Returns a base::Value::Dict containing the value of the First-Party Sets
+   // Overrides enterprise policy.
+   // If the policy was not present or it was invalid, this returns an empty
+diff --git a/content/public/browser/first_party_sets_handler.h b/content/public/browser/first_party_sets_handler.h
+index 8bd62717732a4afe1e8c02fd5ceb39bd1790e3e0..3ff5dea5612fe3329c7c612818f1436a980ea9e3 100644
+--- a/content/public/browser/first_party_sets_handler.h
++++ b/content/public/browser/first_party_sets_handler.h
+@@ -72,7 +72,9 @@ class CONTENT_EXPORT FirstPartySetsHandler {
+   //
+   // Embedder should call this method as early as possible during browser
+   // startup if First-Party Sets are enabled, since no First-Party Sets queries
+-  // are answered until initialization is complete.
++  // are answered until initialization is complete. Must not be called if
++  // `ContentBrowserClient::WillProvidePublicFirstPartySets` returns false or
++  // `ContentBrowserClient::IsFrstpartySetsEnabled` returns false.
+   virtual void SetPublicFirstPartySets(base::File sets_file) = 0;
+ 
+   // Resets the state on the instance for testing.
+diff --git a/content/shell/browser/shell_browser_main_parts.cc b/content/shell/browser/shell_browser_main_parts.cc
+index 89040432c9f56d8285d8e9f59e1e0280abc25199..bd412789695f49253f67f237b2a92b8dee298e7a 100644
+--- a/content/shell/browser/shell_browser_main_parts.cc
++++ b/content/shell/browser/shell_browser_main_parts.cc
+@@ -189,8 +189,6 @@ int ShellBrowserMainParts::PreMainMessageLoopRun() {
+   net::NetModule::SetResourceProvider(PlatformResourceProvider);
+   ShellDevToolsManagerDelegate::StartHttpHandler(browser_context_.get());
+   InitializeMessageLoopContext();
+-  // The First-Party Sets feature always expects to be initialized
+-  FirstPartySetsHandler::GetInstance()->SetPublicFirstPartySets(base::File());
+   return 0;
+ }
+ 

patches/chromium/fix_adapt_exclusive_access_for_electron_needs.patch

@@ -1,20 +1,22 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Shelley Vohr <shelley.vohr@gmail.com>
 Date: Mon, 25 Oct 2021 21:45:57 +0200
-Subject: fix: patch out permissions checks in exclusive_access
+Subject: fix: adapt exclusive_access for electron needs
 
 This patch is necessary in order to properly enable
 navigator.keyboard.{(un)?lock}() functionality. We don't have a concept
 of PermissionManager nor of a Profile, so this would not affect usage of
 the API.
 
-We might consider potentially using our own permissions handler,
-but it's not strictly necessary for this API to work to spec.
-
-Profile check has been upstreamed at https://chromium-review.googlesource.com/c/chromium/src/+/3247196
+We also need to ensure that NotifyExclusiveTabAccessLost is called
+on all platforms in FullscreenController::ExitFullscreenModeInternal()
+and not just macOS, since Electron's native window impls report state
+change fairly instantly as well, and so pressing escape won't work on
+Linux or Windows to un-fullscreen in some circumstances without this
+change.
 
 diff --git a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
-index 41cd193087f8d4f246993e96da96ea0523ab50ed..96cd17afad81037ce94ca3ea3583ebbbdd7f157b 100644
+index 467fed776d390e1a10075d62dab75fd8a6789627..d6f3c20fabee755373add6ee1e5722c106204e42 100644
 --- a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
 +++ b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
 @@ -16,12 +16,16 @@
@@ -34,7 +36,7 @@ index 41cd193087f8d4f246993e96da96ea0523ab50ed..96cd17afad81037ce94ca3ea3583ebbb
  #include "chrome/common/chrome_switches.h"
  #include "content/public/browser/navigation_details.h"
  #include "content/public/browser/navigation_entry.h"
-@@ -159,6 +163,7 @@ void FullscreenController::EnterFullscreenModeForTab(
+@@ -164,6 +168,7 @@ void FullscreenController::EnterFullscreenModeForTab(
      return;
    }
  
@@ -42,7 +44,7 @@ index 41cd193087f8d4f246993e96da96ea0523ab50ed..96cd17afad81037ce94ca3ea3583ebbb
    if (base::FeatureList::IsEnabled(
            blink::features::kWindowPlacementFullscreenCompanionWindow)) {
      if (!popunder_preventer_)
-@@ -166,6 +171,7 @@ void FullscreenController::EnterFullscreenModeForTab(
+@@ -171,6 +176,7 @@ void FullscreenController::EnterFullscreenModeForTab(
      else
        popunder_preventer_->WillActivateWebContents(web_contents);
    }
@@ -50,7 +52,7 @@ index 41cd193087f8d4f246993e96da96ea0523ab50ed..96cd17afad81037ce94ca3ea3583ebbb
  
    // Keep the current state. |SetTabWithExclusiveAccess| may change the return
    // value of |IsWindowFullscreenForTabOrPending|.
-@@ -218,7 +224,9 @@ void FullscreenController::EnterFullscreenModeForTab(
+@@ -220,7 +226,9 @@ void FullscreenController::EnterFullscreenModeForTab(
  }
  
  void FullscreenController::ExitFullscreenModeForTab(WebContents* web_contents) {
@@ -60,7 +62,7 @@ index 41cd193087f8d4f246993e96da96ea0523ab50ed..96cd17afad81037ce94ca3ea3583ebbb
  
    if (MaybeToggleFullscreenWithinTab(web_contents, false)) {
      // During tab capture of fullscreen-within-tab views, the browser window
-@@ -263,11 +271,13 @@ void FullscreenController::ExitFullscreenModeForTab(WebContents* web_contents) {
+@@ -275,11 +283,13 @@ void FullscreenController::ExitFullscreenModeForTab(WebContents* web_contents) {
  void FullscreenController::FullscreenTabOpeningPopup(
      content::WebContents* opener,
      content::WebContents* popup) {
@@ -74,7 +76,7 @@ index 41cd193087f8d4f246993e96da96ea0523ab50ed..96cd17afad81037ce94ca3ea3583ebbb
  }
  
  void FullscreenController::OnTabDeactivated(
-@@ -417,13 +427,9 @@ void FullscreenController::EnterFullscreenModeInternal(
+@@ -429,17 +439,15 @@ void FullscreenController::EnterFullscreenModeInternal(
    // Do not enter fullscreen mode if disallowed by pref. This prevents the user
    // from manually entering fullscreen mode and also disables kiosk mode on
    // desktop platforms.
@@ -90,27 +92,49 @@ index 41cd193087f8d4f246993e96da96ea0523ab50ed..96cd17afad81037ce94ca3ea3583ebbb
  #endif
  
    toggled_into_fullscreen_ = true;
-@@ -436,6 +442,7 @@ void FullscreenController::EnterFullscreenModeInternal(
++#if 0
+   bool entering_tab_fullscreen = option == TAB && !tab_fullscreen_;
++#endif
+   GURL url;
+   if (option == TAB) {
+     url = GetRequestingOrigin();
+@@ -449,6 +457,7 @@ void FullscreenController::EnterFullscreenModeInternal(
        url = extension_caused_fullscreen_;
    }
  
 +#if 0
-   if (display_id != display::kInvalidDisplayId) {
+   if (option == TAB && display_id != display::kInvalidDisplayId) {
      // Check, but do not prompt, for permission to request a specific screen.
      // Sites generally need permission to get the display id in the first place.
-@@ -449,6 +456,7 @@ void FullscreenController::EnterFullscreenModeInternal(
-       display_id = display::kInvalidDisplayId;
+@@ -466,6 +475,7 @@ void FullscreenController::EnterFullscreenModeInternal(
+           GetDisplayId(WebContents::FromRenderFrameHost(requesting_frame));
      }
    }
 +#endif
  
    if (option == BROWSER)
      base::RecordAction(base::UserMetricsAction("ToggleFullscreen"));
+@@ -492,12 +502,12 @@ void FullscreenController::ExitFullscreenModeInternal() {
+ 
+   RecordExitingUMA();
+   toggled_into_fullscreen_ = false;
+-#if BUILDFLAG(IS_MAC)
+-  // Mac windows report a state change instantly, and so we must also clear
++
++  // Electron native windows report a state change instantly, and so we must also clear
+   // state_prior_to_tab_fullscreen_ to match them else other logic using
+   // state_prior_to_tab_fullscreen_ will be incorrect.
+   NotifyTabExclusiveAccessLost();
+-#endif
++
+   exclusive_access_manager()->context()->ExitFullscreen();
+   extension_caused_fullscreen_ = GURL();
+ 
 diff --git a/chrome/browser/ui/exclusive_access/fullscreen_controller.h b/chrome/browser/ui/exclusive_access/fullscreen_controller.h
-index 7bd40f52ef5f6b04a7ea114ec4d18c8a98ec6d42..fb04fed5cc1e2e255c9e67c180fababe1fbb3fe0 100644
+index 58a1ff5fb9fecd8c85905045ba43f43f0c63c2bb..15f868ac651c05eae6505adb80f2b4573a1166ef 100644
 --- a/chrome/browser/ui/exclusive_access/fullscreen_controller.h
 +++ b/chrome/browser/ui/exclusive_access/fullscreen_controller.h
-@@ -222,10 +222,12 @@ class FullscreenController : public ExclusiveAccessControllerBase {
+@@ -224,10 +224,12 @@ class FullscreenController : public ExclusiveAccessControllerBase {
    // Used in testing to set the state to tab fullscreen.
    bool is_tab_fullscreen_for_testing_ = false;
  

patches/chromium/fix_expose_decrementcapturercount_in_web_contents_impl.patch

@@ -8,7 +8,7 @@ we invoke it in order to expose contents.decrementCapturerCount([stayHidden, sta
 to users. We should try to upstream this.
 
 diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
-index 07355cb194bd429a693e587072d11432d6c0888a..b74b4209931c6acd6bc2e93a100c3e65a834ead9 100644
+index 2a29af8d9aa67768ec521e87190174397a25b722..7a5ce3038427756c26e38c91c5b3211a9a8999dd 100644
 --- a/content/browser/web_contents/web_contents_impl.h
 +++ b/content/browser/web_contents/web_contents_impl.h
 @@ -1828,7 +1828,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,

patches/chromium/fix_mac_build_with_enable_plugins_false.patch

@@ -0,0 +1,119 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Thu, 23 Jun 2022 17:54:12 +0000
+Subject: Fix Mac build with enable_plugins=false.
+
+Remove spurious includes of plugin headers, and add appropriate #ifs.
+
+Bug: 1027360
+Change-Id: I445252f5de14dff8e89ab371429a24ad3e57ca97
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3719213
+Reviewed-by: Robert Sesek <rsesek@chromium.org>
+Reviewed-by: Thomas Lukaszewicz <tluk@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1017248}
+
+diff --git a/chrome/browser/app_controller_mac.mm b/chrome/browser/app_controller_mac.mm
+index 480244fb50f636f519485693b8d1a4cf5033c3b0..f426e30ff371c35382512d7ec7846ca6cf58515e 100644
+--- a/chrome/browser/app_controller_mac.mm
++++ b/chrome/browser/app_controller_mac.mm
+@@ -108,7 +108,6 @@
+ #include "components/prefs/pref_service.h"
+ #include "components/sessions/core/tab_restore_service.h"
+ #include "content/public/browser/download_manager.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "extensions/browser/extension_registry.h"
+ #include "extensions/browser/extension_system.h"
+ #include "net/base/filename_util.h"
+diff --git a/content/browser/sandbox_mac_unittest.mm b/content/browser/sandbox_mac_unittest.mm
+index 05e9b29d7a039094fb6fd63fb8b152439f089d41..b860c1e54f0ced814fb269087924d2f695f816f3 100644
+--- a/content/browser/sandbox_mac_unittest.mm
++++ b/content/browser/sandbox_mac_unittest.mm
+@@ -30,6 +30,7 @@
+ #include "content/browser/sandbox_parameters_mac.h"
+ #include "content/common/mac/font_loader.h"
+ #include "crypto/openssl_util.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "sandbox/mac/seatbelt.h"
+ #include "sandbox/mac/seatbelt_exec.h"
+ #include "sandbox/policy/mac/sandbox_mac.h"
+@@ -93,7 +94,9 @@ void ExecuteInAllSandboxTypes(const std::string& multiprocess_main,
+         sandbox::mojom::Sandbox::kCdm,
+         sandbox::mojom::Sandbox::kGpu,
+         sandbox::mojom::Sandbox::kNaClLoader,
++#if BUILDFLAG(ENABLE_PLUGINS)
+         sandbox::mojom::Sandbox::kPpapi,
++#endif
+         sandbox::mojom::Sandbox::kPrintBackend,
+         sandbox::mojom::Sandbox::kPrintCompositor,
+         sandbox::mojom::Sandbox::kRenderer,
+diff --git a/content/browser/sandbox_parameters_mac.mm b/content/browser/sandbox_parameters_mac.mm
+index 76a22420f605994ebe0a7ffa9a7f2a0535c2440f..cf8b251180177c3ea4f8ddb2450f0483d201ba2b 100644
+--- a/content/browser/sandbox_parameters_mac.mm
++++ b/content/browser/sandbox_parameters_mac.mm
+@@ -20,7 +20,6 @@
+ #include "base/strings/sys_string_conversions.h"
+ #include "base/system/sys_info.h"
+ #include "content/public/browser/content_browser_client.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/content_client.h"
+ #include "content/public/common/content_features.h"
+ #include "content/public/common/content_switches.h"
+@@ -34,6 +33,7 @@
+ #include "third_party/abseil-cpp/absl/types/optional.h"
+ 
+ #if BUILDFLAG(ENABLE_PLUGINS)
++#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/pepper_plugin_info.h"
+ #endif
+ 
+@@ -229,11 +229,11 @@ void SetupSandboxParameters(sandbox::mojom::Sandbox sandbox_type,
+     case sandbox::mojom::Sandbox::kNetwork:
+       SetupNetworkSandboxParameters(client);
+       break;
+-    case sandbox::mojom::Sandbox::kPpapi:
+ #if BUILDFLAG(ENABLE_PLUGINS)
++    case sandbox::mojom::Sandbox::kPpapi:
+       SetupPPAPISandboxParameters(client);
+-#endif
+       break;
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+       CHECK(false) << "Unhandled parameters for sandbox_type "
+                    << static_cast<int>(sandbox_type);
+diff --git a/sandbox/policy/mac/sandbox_mac.mm b/sandbox/policy/mac/sandbox_mac.mm
+index 34f8b003c96b9fff00b666ae184b5076e5d6fd45..11392b99ecad98f2cf39e67d545fe1947ede1593 100644
+--- a/sandbox/policy/mac/sandbox_mac.mm
++++ b/sandbox/policy/mac/sandbox_mac.mm
+@@ -12,6 +12,7 @@
+ #include "base/files/scoped_file.h"
+ #include "base/logging.h"
+ #include "base/posix/eintr_wrapper.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "printing/buildflags/buildflags.h"
+ #include "sandbox/policy/mac/audio.sb.h"
+ #include "sandbox/policy/mac/cdm.sb.h"
+@@ -69,9 +70,11 @@
+     case sandbox::mojom::Sandbox::kNetwork:
+       profile += kSeatbeltPolicyString_network;
+       break;
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
+       profile += kSeatbeltPolicyString_ppapi;
+       break;
++#endif
+ #if BUILDFLAG(ENABLE_PRINTING)
+     case sandbox::mojom::Sandbox::kPrintBackend:
+       profile += kSeatbeltPolicyString_print_backend;
+diff --git a/ui/views_content_client/views_content_client_main_parts_mac.mm b/ui/views_content_client/views_content_client_main_parts_mac.mm
+index 044600ad464fc48a805bf3e47811808983d43fef..df23f797e4f0898d9dc7742e05d286f540bfdacb 100644
+--- a/ui/views_content_client/views_content_client_main_parts_mac.mm
++++ b/ui/views_content_client/views_content_client_main_parts_mac.mm
+@@ -12,7 +12,6 @@
+ #include "base/mac/scoped_nsobject.h"
+ #include "base/path_service.h"
+ #include "content/public/browser/context_factory.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/content_paths.h"
+ #include "content/public/common/result_codes.h"
+ #include "content/shell/browser/shell_application_mac.h"

patches/chromium/fix_media_key_usage_with_globalshortcuts.patch

@@ -59,10 +59,10 @@ index ad366d0fd4c3a637d75a102ab56984f0d01bfc04..d63eb133fd4bab1ea309bb8c742acf88
    // true if register successfully, or false if 1) the specificied |accelerator|
    // has been registered by another caller or other native applications, or
 diff --git a/content/browser/media/media_keys_listener_manager_impl.cc b/content/browser/media/media_keys_listener_manager_impl.cc
-index b954f8dde00d4f5257223c464e9145a6bef48900..b58999f295586a61bcc2648488a8b28f15d80a7e 100644
+index b954f8dde00d4f5257223c464e9145a6bef48900..ee9da826014d3aae9675daac6cdbc0f447a14efd 100644
 --- a/content/browser/media/media_keys_listener_manager_impl.cc
 +++ b/content/browser/media/media_keys_listener_manager_impl.cc
-@@ -56,7 +56,12 @@ bool MediaKeysListenerManagerImpl::StartWatchingMediaKey(
+@@ -56,7 +56,11 @@ bool MediaKeysListenerManagerImpl::StartWatchingMediaKey(
                                 CanActiveMediaSessionControllerReceiveEvents();
  
    // Tell the underlying MediaKeysListener to listen for the key.
@@ -71,12 +71,11 @@ index b954f8dde00d4f5257223c464e9145a6bef48900..b58999f295586a61bcc2648488a8b28f
 +#if BUILDFLAG(IS_MAC)
 +      !media_key_handling_enabled_ &&
 +#endif  // BUILDFLAG(IS_MAC)
-+      should_start_watching &&
-+      media_keys_listener_ &&
++      should_start_watching && media_keys_listener_ &&
        !media_keys_listener_->StartWatchingMediaKey(key_code)) {
      return false;
    }
-@@ -239,18 +244,18 @@ void MediaKeysListenerManagerImpl::StartListeningForMediaKeysIfNecessary() {
+@@ -239,6 +243,7 @@ void MediaKeysListenerManagerImpl::StartListeningForMediaKeysIfNecessary() {
  #endif
  
    if (system_media_controls_) {
@@ -84,19 +83,22 @@ index b954f8dde00d4f5257223c464e9145a6bef48900..b58999f295586a61bcc2648488a8b28f
      system_media_controls_->AddObserver(this);
      system_media_controls_notifier_ =
          std::make_unique<SystemMediaControlsNotifier>(
-             system_media_controls_.get());
--  } else {
--    // If we can't access system media controls, then directly listen for media
--    // key keypresses instead.
--    media_keys_listener_ = ui::MediaKeysListener::Create(
--        this, ui::MediaKeysListener::Scope::kGlobal);
--    DCHECK(media_keys_listener_);
+@@ -251,6 +256,19 @@ void MediaKeysListenerManagerImpl::StartListeningForMediaKeysIfNecessary() {
+     DCHECK(media_keys_listener_);
    }
  
-+  // Directly listen for media key keypresses when using GlobalShortcuts.
-+  media_keys_listener_ = ui::MediaKeysListener::Create(
-+    this, ui::MediaKeysListener::Scope::kGlobal);
-+  DCHECK(media_keys_listener_);
++#if BUILDFLAG(IS_MAC)
++  // Chromium's implementation of SystemMediaControls falls
++  // down into MPRemoteCommandCenter, which makes it such that an app will not
++  // will not receive remote control events until it begins playing audio.
++  // If there's not already a MediaKeysListener instance, create one so
++  // that globalShortcuts work correctly.
++  if (!media_keys_listener_) {
++    media_keys_listener_ = ui::MediaKeysListener::Create(
++        this, ui::MediaKeysListener::Scope::kGlobal);
++    DCHECK(media_keys_listener_);
++  }
++#endif
 +
    EnsureAuxiliaryServices();
  }

patches/chromium/fix_windows_build_with_enable_plugins_false.patch

@@ -0,0 +1,108 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Thu, 23 Jun 2022 18:52:27 +0000
+Subject: Fix Windows build with enable_plugins=false.
+
+Add some #if checks to Windows-only code so plugins enums are only
+referenced when plugins are enabled. Also only build
+plugin_list_unittest.cc when plugins are enabled.
+
+Bug: 1027360
+Change-Id: I0d265ae711e5e3401076dc89d1d49329f423ca64
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3719402
+Reviewed-by: Alex Gough <ajgo@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1017281}
+
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+index 939c28a029418bc353795aa1a007508680f42e57..2db6a0d23d72c3d77db6eec4de7c9d0f0500fbe2 100644
+--- a/chrome/browser/chrome_content_browser_client.cc
++++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -3951,7 +3951,9 @@ std::wstring ChromeContentBrowserClient::GetAppContainerSidForSandboxType(
+       return std::wstring();
+     case sandbox::mojom::Sandbox::kGpu:
+       return std::wstring();
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+     case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
+     case sandbox::mojom::Sandbox::kXrCompositing:
+@@ -4023,7 +4025,9 @@ bool ChromeContentBrowserClient::PreSpawnChild(
+       break;
+     case sandbox::mojom::Sandbox::kUtility:
+     case sandbox::mojom::Sandbox::kGpu:
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+     case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
+     case sandbox::mojom::Sandbox::kXrCompositing:
+diff --git a/chrome/child/pdf_child_init.cc b/chrome/child/pdf_child_init.cc
+index e53cfc60b41fe0d4eeb0362e9923f1e39e61a64d..8e0d72623bbb0c92c8fd8b97ab833c947806667b 100644
+--- a/chrome/child/pdf_child_init.cc
++++ b/chrome/child/pdf_child_init.cc
+@@ -14,6 +14,7 @@
+ #include "base/win/windows_version.h"
+ #include "content/public/child/child_thread.h"
+ #include "content/public/common/content_switches.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "sandbox/policy/mojom/sandbox.mojom.h"
+ #include "sandbox/policy/sandbox_type.h"
+ #include "sandbox/policy/switches.h"
+@@ -57,7 +58,9 @@ void MaybePatchGdiGetFontData() {
+   auto service_sandbox_type =
+       sandbox::policy::SandboxTypeFromCommandLine(command_line);
+   bool need_gdi =
++#if BUILDFLAG(ENABLE_PLUGINS)
+       service_sandbox_type == sandbox::mojom::Sandbox::kPpapi ||
++#endif
+       service_sandbox_type == sandbox::mojom::Sandbox::kPrintCompositor ||
+       service_sandbox_type == sandbox::mojom::Sandbox::kPdfConversion ||
+       (service_sandbox_type == sandbox::mojom::Sandbox::kRenderer &&
+diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
+index dec80de25675467a07d3c213538d240507916254..1df3675fed1656094e808fa4477ffd2ea126b83d 100644
+--- a/content/test/BUILD.gn
++++ b/content/test/BUILD.gn
+@@ -2168,7 +2168,6 @@ test("content_unittests") {
+     "../browser/payments/payment_manager_unittest.cc",
+     "../browser/permissions/permission_controller_impl_unittest.cc",
+     "../browser/picture_in_picture/picture_in_picture_service_impl_unittest.cc",
+-    "../browser/plugin_list_unittest.cc",
+     "../browser/ppapi_plugin_sandboxed_process_launcher_delegate_unittest.cc",
+     "../browser/prerender/prerender_host_registry_unittest.cc",
+     "../browser/prerender/prerender_host_unittest.cc",
+@@ -2870,8 +2869,8 @@ test("content_unittests") {
+     deps += [ "//ui/events:test_support" ]
+   }
+ 
+-  if (!is_win && !is_mac) {
+-    sources -= [ "../browser/plugin_list_unittest.cc" ]
++  if (enable_plugins && (is_win || is_mac)) {
++    sources += [ "../browser/plugin_list_unittest.cc" ]
+   }
+ 
+   if (use_ozone) {
+diff --git a/sandbox/policy/win/sandbox_win.cc b/sandbox/policy/win/sandbox_win.cc
+index e4e7cfe65b87ef3bc6b88073dc384a50fd8256ea..0f89e8b8e971fe77cc537cb2e92b54f1d988bc2a 100644
+--- a/sandbox/policy/win/sandbox_win.cc
++++ b/sandbox/policy/win/sandbox_win.cc
+@@ -38,6 +38,7 @@
+ #include "base/win/sid.h"
+ #include "base/win/win_util.h"
+ #include "base/win/windows_version.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "printing/buildflags/buildflags.h"
+ #include "sandbox/features.h"
+ #include "sandbox/policy/features.h"
+@@ -1216,8 +1217,10 @@ std::string SandboxWin::GetSandboxTypeInEnglish(Sandbox sandbox_type) {
+       return "Utility";
+     case Sandbox::kGpu:
+       return "GPU";
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case Sandbox::kPpapi:
+       return "PPAPI";
++#endif
+     case Sandbox::kNetwork:
+       return "Network";
+     case Sandbox::kCdm:

patches/chromium/frame_host_manager.patch

@@ -6,10 +6,10 @@ Subject: frame_host_manager.patch
 Allows embedder to intercept site instances created by chromium.
 
 diff --git a/content/browser/renderer_host/render_frame_host_manager.cc b/content/browser/renderer_host/render_frame_host_manager.cc
-index 390ac74f01b5080880dcab65537a22fb7ef0cc41..103dc143f6310a2b9f0a834f7d25cf32207bea86 100644
+index b17180351e6e693352fcda973bdc23da79d8bfac..307ea58a72fe05f283b2cdfd6027625f96c5a99b 100644
 --- a/content/browser/renderer_host/render_frame_host_manager.cc
 +++ b/content/browser/renderer_host/render_frame_host_manager.cc
-@@ -3180,6 +3180,9 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
+@@ -3167,6 +3167,9 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
      request->ResetStateForSiteInstanceChange();
    }
  

patches/chromium/hack_to_allow_gclient_sync_with_host_os_mac_on_linux_in_ci.patch

@@ -11,7 +11,7 @@ If removing this patch causes no sync failures, it's safe to delete :+1:
 Ref https://chromium-review.googlesource.com/c/chromium/src/+/2953903
 
 diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
-index 694a67b7a0f622c7a8bfc1d46148398140d51384..00b588b268aa059ff84adbbc6ae266aa67e174b1 100755
+index 6bd25626dc999438316c2084442a29389d4154fb..bc27370e73d3061dfacbd96a3b8cf576b94e3d9b 100755
 --- a/tools/clang/scripts/update.py
 +++ b/tools/clang/scripts/update.py
 @@ -298,6 +298,8 @@ def GetDefaultHostOs():

patches/chromium/keep_handling_scroll_update_if_you_can.patch

@@ -0,0 +1,164 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mehdi Kazemi <mehdika@chromium.org>
+Date: Tue, 7 Jun 2022 17:32:20 +0000
+Subject: Keep handling scroll update if you can!
+
+If scroll_gesture_handling_node_ doesn't have a layout object, but you can still handle GSU, do that!
+
+Change-Id: Ib82dad96d319b186a5cc2f2eb07495ca5ae994a3
+Bug: 1330045
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3681882
+Reviewed-by: Steve Kobes <skobes@chromium.org>
+Commit-Queue: Mehdi Kazemi <mehdika@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1011539}
+
+diff --git a/third_party/blink/renderer/core/input/scroll_manager.cc b/third_party/blink/renderer/core/input/scroll_manager.cc
+index 28b6092d264219802f718bfaf58f2da4c6054e43..604cad242a9e5626c7d6bac305cb2e323e1f1fca 100644
+--- a/third_party/blink/renderer/core/input/scroll_manager.cc
++++ b/third_party/blink/renderer/core/input/scroll_manager.cc
+@@ -589,12 +589,6 @@ WebInputEventResult ScrollManager::HandleGestureScrollUpdate(
+     return WebInputEventResult::kNotHandled;
+   }
+ 
+-  Node* node = scroll_gesture_handling_node_.Get();
+-  if (!node || !node->GetLayoutObject()) {
+-    TRACE_EVENT_INSTANT0("input", "Lost scroll_gesture_handling_node",
+-                         TRACE_EVENT_SCOPE_THREAD);
+-    return WebInputEventResult::kNotHandled;
+-  }
+   if (snap_fling_controller_) {
+     if (snap_fling_controller_->HandleGestureScrollUpdate(
+             GetGestureScrollUpdateInfo(gesture_event))) {
+@@ -615,7 +609,10 @@ WebInputEventResult ScrollManager::HandleGestureScrollUpdate(
+   if (delta.IsZero())
+     return WebInputEventResult::kNotHandled;
+ 
+-  LayoutObject* layout_object = node->GetLayoutObject();
++  LayoutObject* layout_object =
++      scroll_gesture_handling_node_
++          ? scroll_gesture_handling_node_->GetLayoutObject()
++          : nullptr;
+ 
+   // Try to send the event to the correct view.
+   WebInputEventResult result =
+diff --git a/third_party/blink/web_tests/fast/events/touch/touch-latched-scroll-node-removed.html b/third_party/blink/web_tests/fast/events/touch/touch-latched-scroll-node-removed.html
+index 90265f908ad0ce93d7bd401df2aa6657cf25e6fb..b9b34c24496868355c6eff06f738a95832956481 100644
+--- a/third_party/blink/web_tests/fast/events/touch/touch-latched-scroll-node-removed.html
++++ b/third_party/blink/web_tests/fast/events/touch/touch-latched-scroll-node-removed.html
+@@ -62,6 +62,7 @@ childDiv.addEventListener('scroll', () => {
+ 
+ promise_test( async () => {
+   setUpForTest();
++  await waitForCompositorCommit();
+   // Start scrolling on the child div and remove the div in the middle of
+   // scrolling, then check that parentDiv have not scrolled.
+   var x = (rect.left + rect.right) / 2;
+@@ -69,6 +70,7 @@ promise_test( async () => {
+   // Slow scrolling gives enough time to switch from cc to main.
+   var pixels_per_sec = 100;
+   await smoothScroll(400, x, y, GestureSourceType.TOUCH_INPUT, 'down', pixels_per_sec);
+-  await waitFor( () => {return parentDiv.scrollTop === 0});
+-}, "New node must start wheel scrolling when the latched node is removed.");
++  await conditionHolds( () => { return parentDiv.scrollTop === 0; },
++    "parentDiv has scrolled, which should not have!" );
++}, "New node must NOT start wheel scrolling when the latched node is removed.");
+ </script>
+diff --git a/third_party/blink/web_tests/fast/events/wheel/wheel-latched-scroll-node-removed.html b/third_party/blink/web_tests/fast/events/wheel/wheel-latched-scroll-node-removed.html
+index 966a887b2129fa26cd990b367a7df1fc9135a207..493f13d9c519422b00fe0e11874032fdf25130db 100644
+--- a/third_party/blink/web_tests/fast/events/wheel/wheel-latched-scroll-node-removed.html
++++ b/third_party/blink/web_tests/fast/events/wheel/wheel-latched-scroll-node-removed.html
+@@ -62,6 +62,7 @@ childDiv.addEventListener('scroll', () => {
+ 
+ promise_test( async () => {
+   setUpForTest();
++  await waitForCompositorCommit();
+   // Start scrolling on the child div and remove the div in the middle of
+   // scrolling, then check that parentDiv have not scrolled.
+   var x = (rect.left + rect.right) / 2;
+@@ -69,6 +70,7 @@ promise_test( async () => {
+   // Slow scrolling gives enough time to switch from cc to main.
+   var pixels_per_sec = 100;
+   await smoothScroll(400, x, y, GestureSourceType.MOUSE_INPUT, 'down', pixels_per_sec);
+-  await waitFor( () => {return parentDiv.scrollTop === 0});
+-}, "New node must start wheel scrolling when the latched node is removed.");
++  await conditionHolds( () => { return parentDiv.scrollTop === 0; },
++    "parentDiv has scrolled, which should not have!" );
++}, "New node must NOT start wheel scrolling when the latched node is removed.");
+ </script>
+diff --git a/third_party/blink/web_tests/fast/scrolling/inertial-scrolling-with-pointer-events-none-overlay.html b/third_party/blink/web_tests/fast/scrolling/inertial-scrolling-with-pointer-events-none-overlay.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..47291b70316beaac16adaa6ddd0035ebeb9ec84f
+--- /dev/null
++++ b/third_party/blink/web_tests/fast/scrolling/inertial-scrolling-with-pointer-events-none-overlay.html
+@@ -0,0 +1,71 @@
++<!DOCTYPE HTML>
++<script src="../../resources/testharness.js"></script>
++<script src="../../resources/testharnessreport.js"></script>
++<script src="../../resources/testdriver.js"></script>
++<script src="../../resources/testdriver-actions.js"></script>
++<script src="../../resources/testdriver-vendor.js"></script>
++<script src="../../resources/gesture-util.js"></script>
++
++<style>
++#container {
++  width: 400px;
++  height: 400px;
++  overflow: auto;
++}
++
++#inner {
++  height: 3000px;
++  background-color: #eee;
++}
++
++#overlay {
++  position: absolute;
++  left: 0;
++  top: 0;
++  width: 100%;
++  height: 100%;
++  pointer-events: none;
++}
++
++p {
++ margin: 0;
++ padding: 1000px 0;
++}
++</style>
++
++<body style="margin:0" onload=runTest()>
++  <div id="container">
++    <div id="inner"></div>
++  </div>
++  <div id="overlay"></div>
++</body>
++
++<script>
++const container = document.getElementById('container');
++const inner = document.getElementById('inner');
++
++const update = () => inner.innerHTML = '<p>Content</p>';
++setInterval(update, 200);
++
++function runTest() {
++  promise_test (async (t) => {
++    const pixels_to_scroll = 100;
++    const start_x = 200;
++    const start_y = 200;
++    const speed_in_pixels_s = 900;
++
++    await waitForCompositorCommit();
++    await swipe(pixels_to_scroll, start_x, start_y, 'up', speed_in_pixels_s);
++    await waitForAnimationEndTimeBased(() => { return container.scrollTop; });
++    assert_greater_than(container.scrollTop, pixels_to_scroll,
++      "container should scroll at least 100 pixels, which is the length of the swipe.");
++
++    const scroll_top_previous_value = container.scrollTop;
++
++    await waitForCompositorCommit();
++    await swipe(pixels_to_scroll, start_x, start_y, 'up', speed_in_pixels_s);
++    await waitForAnimationEndTimeBased(() => { return container.scrollTop; });
++    assert_greater_than(container.scrollTop, scroll_top_previous_value + pixels_to_scroll);
++  }, "Make sure inertial scrolling is not broken with pointer-events:none overlay.");
++}
++</script>

patches/chromium/make_gtk_getlibgtk_public.patch

@@ -1,16 +1,28 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: deepak1556 <hop2deep@gmail.com>
 Date: Thu, 7 Apr 2022 20:30:16 +0900
-Subject: Make gtk::GetLibGtk public
+Subject: Make gtk::GetLibGtk and gtk::GetLibGdkPixbuf public
 
-Allows embedders to get a handle to the gtk library
-already loaded in the process.
+Allows embedders to get a handle to the gtk and
+gdk_pixbuf libraries already loaded in the process.
 
 diff --git a/ui/gtk/gtk_compat.cc b/ui/gtk/gtk_compat.cc
-index 0ed04582106639911d9a4e0284ff880be9c3bc74..bfda81b08be52406048be9b96d2de59223d56ee7 100644
+index 0ed04582106639911d9a4e0284ff880be9c3bc74..0f7aaf3254864e92a54634dedb2fd2fbf8eb8990 100644
 --- a/ui/gtk/gtk_compat.cc
 +++ b/ui/gtk/gtk_compat.cc
-@@ -86,12 +86,6 @@ void* GetLibGtk4(bool check = true) {
+@@ -66,11 +66,6 @@ void* GetLibGio() {
+   return libgio;
+ }
+ 
+-void* GetLibGdkPixbuf() {
+-  static void* libgdk_pixbuf = DlOpen("libgdk_pixbuf-2.0.so.0");
+-  return libgdk_pixbuf;
+-}
+-
+ void* GetLibGdk3() {
+   static void* libgdk3 = DlOpen("libgdk-3.so.0");
+   return libgdk3;
+@@ -86,12 +81,6 @@ void* GetLibGtk4(bool check = true) {
    return libgtk4;
  }
  
@@ -23,10 +35,15 @@ index 0ed04582106639911d9a4e0284ff880be9c3bc74..bfda81b08be52406048be9b96d2de592
  bool LoadGtk3() {
    if (!GetLibGtk3(false))
      return false;
-@@ -134,6 +128,12 @@ gfx::Insets InsetsFromGtkBorder(const GtkBorder& border) {
+@@ -134,6 +123,17 @@ gfx::Insets InsetsFromGtkBorder(const GtkBorder& border) {
  
  }  // namespace
  
++void* GetLibGdkPixbuf() {
++  static void* libgdk_pixbuf = DlOpen("libgdk_pixbuf-2.0.so.0");
++  return libgdk_pixbuf;
++}
++
 +void* GetLibGtk() {
 +  if (GtkCheckVersion(4))
 +    return GetLibGtk4();
@@ -37,13 +54,16 @@ index 0ed04582106639911d9a4e0284ff880be9c3bc74..bfda81b08be52406048be9b96d2de592
    static bool loaded = LoadGtkImpl();
    return loaded;
 diff --git a/ui/gtk/gtk_compat.h b/ui/gtk/gtk_compat.h
-index 72981270fe26579211afcaf3c596a412f69f5fac..b5dbfde5b011d57d26960d245e0dc61cac9341e4 100644
+index 72981270fe26579211afcaf3c596a412f69f5fac..63e383f03f51124f67a0c522f57eb4cc23857bc1 100644
 --- a/ui/gtk/gtk_compat.h
 +++ b/ui/gtk/gtk_compat.h
-@@ -37,6 +37,9 @@ using SkColor = uint32_t;
+@@ -37,6 +37,12 @@ using SkColor = uint32_t;
  
  namespace gtk {
  
++// Get handle to the currently loaded gdk-pixbuf library in the process.
++void* GetLibGdkPixbuf();
++
 +// Get handle to the currently loaded gtk library in the process.
 +void* GetLibGtk();
 +

patches/chromium/mas_disable_remote_accessibility.patch

@@ -167,7 +167,7 @@ index 961c759eca96ffc0ffcf40cfdaf42388f47d9c2b..18c77a5520ea2ae7cfee4eea3ed01fa8
  
  ///////////////////////////////////////////////////////////////////////////////
 diff --git a/ui/base/BUILD.gn b/ui/base/BUILD.gn
-index 244b208e6a7872ea4d25fcf74a78abc9248a9ac3..45bafcaaa10641ca3a8306a6685ee9ed730d1e02 100644
+index 028a97becd88fb12481b1de0395c7c81857d3af3..4491be85cb82f050cc70c24e933e841a08b9123f 100644
 --- a/ui/base/BUILD.gn
 +++ b/ui/base/BUILD.gn
 @@ -319,6 +319,13 @@ component("base") {
@@ -205,7 +205,7 @@ index e7adfee3210ec723c687adfcc4bee8827ef643e7..25a924a47eeb30d783ef83dbb4896c4b
 +
  #endif  // UI_BASE_COCOA_REMOTE_ACCESSIBILITY_API_H_
 diff --git a/ui/views/cocoa/native_widget_mac_ns_window_host.h b/ui/views/cocoa/native_widget_mac_ns_window_host.h
-index d4051a7a8755c7b10d4df3746cb2857471f07c45..de04616893d1c97e3607eb5a4b942733ae597b05 100644
+index c93aedbce83c398a55c478df60d5ba6dd5324a0b..dfa1983e5605d14e44efae3c1418b4e53c392333 100644
 --- a/ui/views/cocoa/native_widget_mac_ns_window_host.h
 +++ b/ui/views/cocoa/native_widget_mac_ns_window_host.h
 @@ -31,7 +31,9 @@
@@ -218,7 +218,7 @@ index d4051a7a8755c7b10d4df3746cb2857471f07c45..de04616893d1c97e3607eb5a4b942733
  @class NSView;
  
  namespace remote_cocoa {
-@@ -449,11 +451,13 @@ class VIEWS_EXPORT NativeWidgetMacNSWindowHost
+@@ -452,11 +454,13 @@ class VIEWS_EXPORT NativeWidgetMacNSWindowHost
    mojo::AssociatedRemote<remote_cocoa::mojom::NativeWidgetNSWindow>
        remote_ns_window_remote_;
  
@@ -233,10 +233,10 @@ index d4051a7a8755c7b10d4df3746cb2857471f07c45..de04616893d1c97e3607eb5a4b942733
    // Used to force the NSApplication's focused accessibility element to be the
    // views::Views accessibility tree when the NSView for this is focused.
 diff --git a/ui/views/cocoa/native_widget_mac_ns_window_host.mm b/ui/views/cocoa/native_widget_mac_ns_window_host.mm
-index c9294c5358401da716b6d8d2846e20e9a04f4e2d..c9a3cdee33e3aa8bfbfa9c6678c2828a94b90061 100644
+index 1c4c4a774e4d5e199ae50e8df4499a497d3b0674..b2265079021d10e2944b9474fafe32ccca95d3de 100644
 --- a/ui/views/cocoa/native_widget_mac_ns_window_host.mm
 +++ b/ui/views/cocoa/native_widget_mac_ns_window_host.mm
-@@ -297,14 +297,22 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
+@@ -296,14 +296,22 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
  NativeWidgetMacNSWindowHost::GetNativeViewAccessibleForNSView() const {
    if (in_process_ns_window_bridge_)
      return in_process_ns_window_bridge_->ns_view();
@@ -259,7 +259,7 @@ index c9294c5358401da716b6d8d2846e20e9a04f4e2d..c9a3cdee33e3aa8bfbfa9c6678c2828a
  }
  
  remote_cocoa::mojom::NativeWidgetNSWindow*
-@@ -1288,6 +1296,7 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
+@@ -1287,6 +1295,7 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
  void NativeWidgetMacNSWindowHost::SetRemoteAccessibilityTokens(
      const std::vector<uint8_t>& window_token,
      const std::vector<uint8_t>& view_token) {
@@ -267,7 +267,7 @@ index c9294c5358401da716b6d8d2846e20e9a04f4e2d..c9a3cdee33e3aa8bfbfa9c6678c2828a
    remote_window_accessible_ =
        ui::RemoteAccessibility::GetRemoteElementFromToken(window_token);
    remote_view_accessible_ =
-@@ -1295,14 +1304,17 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
+@@ -1294,14 +1303,17 @@ void HandleAccelerator(const ui::Accelerator& accelerator,
    [remote_view_accessible_ setWindowUIElement:remote_window_accessible_.get()];
    [remote_view_accessible_
        setTopLevelUIElement:remote_window_accessible_.get()];

patches/chromium/mas_no_private_api.patch

@@ -122,7 +122,7 @@ index c15f3a631292b538698625328fb429ee3c9964f5..37e038753ecf1b82ec92c06b2c0729b5
  }
  
 diff --git a/device/bluetooth/bluetooth_adapter_mac.mm b/device/bluetooth/bluetooth_adapter_mac.mm
-index 3f7dce0281f7b5a540d7b9377ef14a8a6aa9a2fa..11d8419791f3e45d5242081422d452d4fc703833 100644
+index d342eb4e9fc94de4365d86c2d1af4b85a8bf63a3..012f9ce97d9ed6b00deb718a88f432e053cb3bd1 100644
 --- a/device/bluetooth/bluetooth_adapter_mac.mm
 +++ b/device/bluetooth/bluetooth_adapter_mac.mm
 @@ -42,6 +42,7 @@

patches/chromium/network_service_allow_remote_certificate_verification_logic.patch

@@ -7,10 +7,10 @@ This adds a callback from the network service that's used to implement
 session.setCertificateVerifyCallback.
 
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index e9a56db142f5f31e567bff7414db110f600fc7f2..98268925da14d61256f8dee3aa899f17ce7acaf6 100644
+index ecc38d1584570c46826084054f0a3249f9e2eb92..f06a04983571623b542dba11933c4c95c3dcf398 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -127,6 +127,11 @@
+@@ -128,6 +128,11 @@
  #include "third_party/abseil-cpp/absl/types/optional.h"
  #include "url/gurl.h"
  
@@ -22,7 +22,7 @@ index e9a56db142f5f31e567bff7414db110f600fc7f2..98268925da14d61256f8dee3aa899f17
  #if BUILDFLAG(IS_CT_SUPPORTED)
  #include "components/certificate_transparency/chrome_ct_policy_enforcer.h"
  #include "components/certificate_transparency/chrome_require_ct_delegate.h"
-@@ -435,6 +440,91 @@ bool GetFullDataFilePath(
+@@ -436,6 +441,91 @@ bool GetFullDataFilePath(
  
  }  // namespace
  
@@ -114,7 +114,7 @@ index e9a56db142f5f31e567bff7414db110f600fc7f2..98268925da14d61256f8dee3aa899f17
  constexpr uint32_t NetworkContext::kMaxOutstandingRequestsPerProcess;
  
  NetworkContext::PendingCertVerify::PendingCertVerify() = default;
-@@ -732,6 +822,13 @@ void NetworkContext::SetClient(
+@@ -733,6 +823,13 @@ void NetworkContext::SetClient(
    client_.Bind(std::move(client));
  }
  
@@ -128,7 +128,7 @@ index e9a56db142f5f31e567bff7414db110f600fc7f2..98268925da14d61256f8dee3aa899f17
  void NetworkContext::CreateURLLoaderFactory(
      mojo::PendingReceiver<mojom::URLLoaderFactory> receiver,
      mojom::URLLoaderFactoryParamsPtr params) {
-@@ -2298,6 +2395,9 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
+@@ -2301,6 +2398,9 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
          std::move(cert_verifier));
      cert_verifier = base::WrapUnique(cert_verifier_with_trust_anchors_);
  #endif  // BUILDFLAG(IS_CHROMEOS)
@@ -139,10 +139,10 @@ index e9a56db142f5f31e567bff7414db110f600fc7f2..98268925da14d61256f8dee3aa899f17
  
    builder.SetCertVerifier(IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index 53e3f293150e725cd1261f09a8f9bfcb5371a76c..58671094857cdfe5d853c8a284d51bc1b8a09660 100644
+index 994712b56fb25fbfa7559ac034cfd7e1c76597de..2cd8707b120deb41683e13def5d446fd3bf93afe 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
-@@ -108,6 +108,7 @@ class URLMatcher;
+@@ -109,6 +109,7 @@ class URLMatcher;
  
  namespace network {
  class CertVerifierWithTrustAnchors;

patches/chromium/notification_provenance.patch

@@ -130,10 +130,10 @@ index 69f000e5cd25c6d89c88238873f638923bafdf0e..4f0068a92a0e99e2b34f105954689c7b
        const GURL& document_url,
        mojo::PendingReceiver<blink::mojom::NotificationService> receiver);
 diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
-index b769a06dc9443317a1073738c6fd38816ebeb186..20a697be32f7e27a9fa33d0225c94520aa5ebf2e 100644
+index b74b4c2028ccb22349253960b9aa6c5bfe87579c..396377fd4041cced3c68f8d57c8f868098bb8923 100644
 --- a/content/browser/renderer_host/render_process_host_impl.cc
 +++ b/content/browser/renderer_host/render_process_host_impl.cc
-@@ -2083,7 +2083,8 @@ void RenderProcessHostImpl::CreateNotificationService(
+@@ -2088,7 +2088,8 @@ void RenderProcessHostImpl::CreateNotificationService(
      document_url = rfh->GetLastCommittedURL();
  
    storage_partition_impl_->GetPlatformNotificationContext()->CreateService(

patches/chromium/port_autofill_colors_to_the_color_pipeline.patch

@@ -8,10 +8,10 @@ needed in chromium but our autofill implementation uses them.  This patch can be
 our autofill implementation to work like Chromium's.
 
 diff --git a/ui/color/color_id.h b/ui/color/color_id.h
-index d1a9c517a69bcc79a4b42f8eb8b6fcc3cea2f4da..04569140589c25d37bad2cd5ff979cfc6b1f3f43 100644
+index 13c1a8c9760fa0f286c6c5adc8f74fdae910ab50..b7a967642ff059c97f55002a9a0962709d806959 100644
 --- a/ui/color/color_id.h
 +++ b/ui/color/color_id.h
-@@ -125,6 +125,16 @@
+@@ -128,6 +128,16 @@
    E_CPONLY(kColorOverlayScrollbarStrokeHoveredDark) \
    E_CPONLY(kColorOverlayScrollbarStrokeHoveredLight) \
    E_CPONLY(kColorProgressBar) \
@@ -28,7 +28,7 @@ index d1a9c517a69bcc79a4b42f8eb8b6fcc3cea2f4da..04569140589c25d37bad2cd5ff979cfc
    E_CPONLY(kColorSeparator) \
    E_CPONLY(kColorShadowBase) \
    E_CPONLY(kColorShadowValueAmbientShadowElevationSixteen) \
-@@ -177,6 +187,7 @@
+@@ -180,6 +190,7 @@
    E_CPONLY(kColorTreeNodeForeground) \
    E_CPONLY(kColorTreeNodeForegroundSelectedFocused) \
    E_CPONLY(kColorTreeNodeForegroundSelectedUnfocused) \
@@ -37,10 +37,10 @@ index d1a9c517a69bcc79a4b42f8eb8b6fcc3cea2f4da..04569140589c25d37bad2cd5ff979cfc
  
  #if BUILDFLAG(IS_CHROMEOS)
 diff --git a/ui/color/ui_color_mixer.cc b/ui/color/ui_color_mixer.cc
-index b404ef6063c3a6c542565de46458b7401f129963..ce6fca0516d91b8acfe5fe6bc89bc09ae03a17d6 100644
+index 3e44d34fe1317822c340ebbcc895d7d8b55bed0b..be1737a96058c29d03645cc00999b6d7fc315f48 100644
 --- a/ui/color/ui_color_mixer.cc
 +++ b/ui/color/ui_color_mixer.cc
-@@ -143,6 +143,17 @@ void AddUiColorMixer(ColorProvider* provider,
+@@ -148,6 +148,17 @@ void AddUiColorMixer(ColorProvider* provider,
        SetAlpha(GetColorWithMaxContrast(kColorOverlayScrollbarFillHoveredLight),
                 gfx::kGoogleGreyAlpha500);
    mixer[kColorProgressBar] = {kColorAccent};
@@ -58,7 +58,7 @@ index b404ef6063c3a6c542565de46458b7401f129963..ce6fca0516d91b8acfe5fe6bc89bc09a
    mixer[kColorSeparator] = {kColorMidground};
    mixer[kColorShadowBase] = {dark_mode ? SK_ColorBLACK : gfx::kGoogleGrey800};
    mixer[kColorShadowValueAmbientShadowElevationThree] =
-@@ -218,6 +229,7 @@ void AddUiColorMixer(ColorProvider* provider,
+@@ -223,6 +234,7 @@ void AddUiColorMixer(ColorProvider* provider,
    mixer[kColorTreeNodeForegroundSelectedFocused] = {kColorTreeNodeForeground};
    mixer[kColorTreeNodeForegroundSelectedUnfocused] = {
        kColorTreeNodeForegroundSelectedFocused};

patches/chromium/posix_replace_doubleforkandexec_with_forkandspawn.patch

@@ -0,0 +1,641 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Darshan Sen <raisinten@gmail.com>
+Date: Fri, 17 Jun 2022 13:19:32 +0530
+Subject: posix: Replace DoubleForkAndExec() with ForkAndSpawn()
+
+The DoubleForkAndExec() function was taking over 622 milliseconds to run
+on macOS 11 (BigSur) on Intel i5-1038NG7. I did some debugging by adding
+some custom traces and found that the fork() syscall is the bottleneck
+here, i.e., the first fork() takes around 359 milliseconds and the
+nested fork() takes around 263 milliseconds. Replacing the nested fork()
+and exec() with posix_spawn() reduces the time consumption to 257
+milliseconds!
+
+See https://github.com/libuv/libuv/pull/3064 to know why fork() is so
+slow on macOS and why posix_spawn() is a better replacement.
+
+Another point to note is that even base::LaunchProcess() from Chromium
+calls posix_spawnp() on macOS -
+https://source.chromium.org/chromium/chromium/src/+/8f8d82dea0fa8f11f57c74dbb65126f8daba58f7:base/process/launch_mac.cc;l=295-296
+
+Change-Id: I25c6ee9629a1ae5d0c32b361b56a1ce0b4b0fd26
+Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3641386
+Reviewed-by: Mark Mentovai <mark@chromium.org>
+Commit-Queue: Mark Mentovai <mark@chromium.org>
+
+diff --git a/third_party/crashpad/crashpad/AUTHORS b/third_party/crashpad/crashpad/AUTHORS
+index 8dcac3238870920d374b86033d05d77ebde351e9..02103924332eddbd158c04f8a395bb4a247e8bd9 100644
+--- a/third_party/crashpad/crashpad/AUTHORS
++++ b/third_party/crashpad/crashpad/AUTHORS
+@@ -12,3 +12,4 @@ Opera Software ASA
+ Vewd Software AS
+ LG Electronics, Inc.
+ MIPS Technologies, Inc.
++Darshan Sen <raisinten@gmail.com>
+diff --git a/third_party/crashpad/crashpad/client/crashpad_client_linux.cc b/third_party/crashpad/crashpad/client/crashpad_client_linux.cc
+index 53c2dadac9d6cb74a3c3e07d9917e9162474b8a0..6761db0e8ac5edba6fac90cdf79e38dfd4cd9d70 100644
+--- a/third_party/crashpad/crashpad/client/crashpad_client_linux.cc
++++ b/third_party/crashpad/crashpad/client/crashpad_client_linux.cc
+@@ -45,7 +45,7 @@
+ #include "util/linux/socket.h"
+ #include "util/misc/address_sanitizer.h"
+ #include "util/misc/from_pointer_cast.h"
+-#include "util/posix/double_fork_and_exec.h"
++#include "util/posix/fork_and_spawn.h"
+ #include "util/posix/scoped_mmap.h"
+ #include "util/posix/signals.h"
+ 
+@@ -454,7 +454,7 @@ bool CrashpadClient::StartHandler(
+ 
+   argv.push_back(FormatArgumentInt("initial-client-fd", handler_sock.get()));
+   argv.push_back("--shared-client-connection");
+-  if (!DoubleForkAndExec(argv, nullptr, handler_sock.get(), false, nullptr)) {
++  if (!ForkAndSpawn(argv, nullptr, handler_sock.get(), false, nullptr)) {
+     return false;
+   }
+ 
+@@ -609,7 +609,7 @@ bool CrashpadClient::StartJavaHandlerForClient(
+     int socket) {
+   std::vector<std::string> argv = BuildAppProcessArgs(
+       class_name, database, metrics_dir, url, annotations, arguments, socket);
+-  return DoubleForkAndExec(argv, env, socket, false, nullptr);
++  return ForkAndSpawn(argv, env, socket, false, nullptr);
+ }
+ 
+ bool CrashpadClient::StartHandlerWithLinkerAtCrash(
+@@ -658,7 +658,7 @@ bool CrashpadClient::StartHandlerWithLinkerForClient(
+                                   annotations,
+                                   arguments,
+                                   socket);
+-  return DoubleForkAndExec(argv, env, socket, false, nullptr);
++  return ForkAndSpawn(argv, env, socket, false, nullptr);
+ }
+ 
+ #endif
+@@ -692,7 +692,7 @@ bool CrashpadClient::StartHandlerForClient(
+ 
+   argv.push_back(FormatArgumentInt("initial-client-fd", socket));
+ 
+-  return DoubleForkAndExec(argv, nullptr, socket, true, nullptr);
++  return ForkAndSpawn(argv, nullptr, socket, true, nullptr);
+ }
+ 
+ // static
+diff --git a/third_party/crashpad/crashpad/client/crashpad_client_mac.cc b/third_party/crashpad/crashpad/client/crashpad_client_mac.cc
+index 39e35678ecdd036f8c8ae27c973c27102b77da96..84385f2569f2bd00ca8aed0aa332fb450b2de1d3 100644
+--- a/third_party/crashpad/crashpad/client/crashpad_client_mac.cc
++++ b/third_party/crashpad/crashpad/client/crashpad_client_mac.cc
+@@ -36,7 +36,7 @@
+ #include "util/mach/notify_server.h"
+ #include "util/misc/clock.h"
+ #include "util/misc/implicit_cast.h"
+-#include "util/posix/double_fork_and_exec.h"
++#include "util/posix/fork_and_spawn.h"
+ 
+ namespace crashpad {
+ 
+@@ -343,7 +343,7 @@ class HandlerStarter final : public NotifyServer::DefaultInterface {
+     // this parent process, which was probably using the exception server now
+     // being restarted. The handler can’t monitor itself for its own crashes via
+     // this interface.
+-    if (!DoubleForkAndExec(
++    if (!ForkAndSpawn(
+             argv,
+             nullptr,
+             server_write_fd.get(),
+diff --git a/third_party/crashpad/crashpad/handler/linux/cros_crash_report_exception_handler.cc b/third_party/crashpad/crashpad/handler/linux/cros_crash_report_exception_handler.cc
+index 9e58d94aa499fdb7271a78ea21a1dcc1b12e3a52..3caa3b987b35be575558a312026cf6f19485c418 100644
+--- a/third_party/crashpad/crashpad/handler/linux/cros_crash_report_exception_handler.cc
++++ b/third_party/crashpad/crashpad/handler/linux/cros_crash_report_exception_handler.cc
+@@ -29,7 +29,7 @@
+ #include "util/linux/ptrace_client.h"
+ #include "util/misc/metrics.h"
+ #include "util/misc/uuid.h"
+-#include "util/posix/double_fork_and_exec.h"
++#include "util/posix/fork_and_spawn.h"
+ 
+ namespace crashpad {
+ 
+@@ -266,12 +266,11 @@ bool CrosCrashReportExceptionHandler::HandleExceptionWithConnection(
+     argv.push_back("--always_allow_feedback");
+   }
+ 
+-  if (!DoubleForkAndExec(argv,
+-                         nullptr /* envp */,
+-                         file_writer.fd() /* preserve_fd */,
+-                         false /* use_path */,
+-                         nullptr /* child_function */)) {
+-    LOG(ERROR) << "DoubleForkAndExec failed";
++  if (!ForkAndSpawn(argv,
++                    nullptr /* envp */,
++                    file_writer.fd() /* preserve_fd */,
++                    false /* use_path */,
++                    nullptr /* child_function */)) {
+     Metrics::ExceptionCaptureResult(
+         Metrics::CaptureResult::kFinishedWritingCrashReportFailed);
+     return false;
+diff --git a/third_party/crashpad/crashpad/util/BUILD.gn b/third_party/crashpad/crashpad/util/BUILD.gn
+index 30f03b13f3a018e6a96b0689452a344992675c23..64fa2e9e89b700d8a265a9737cb6a30a210cdffe 100644
+--- a/third_party/crashpad/crashpad/util/BUILD.gn
++++ b/third_party/crashpad/crashpad/util/BUILD.gn
+@@ -296,10 +296,10 @@ crashpad_static_library("util") {
+       sources += [
+         "posix/close_multiple.cc",
+         "posix/close_multiple.h",
+-        "posix/double_fork_and_exec.cc",
+-        "posix/double_fork_and_exec.h",
+         "posix/drop_privileges.cc",
+         "posix/drop_privileges.h",
++        "posix/fork_and_spawn.cc",
++        "posix/fork_and_spawn.h",
+         "posix/process_info.h",
+ 
+         # These map signals to and from strings. While Fuchsia defines some of
+diff --git a/third_party/crashpad/crashpad/util/posix/double_fork_and_exec.cc b/third_party/crashpad/crashpad/util/posix/double_fork_and_exec.cc
+deleted file mode 100644
+index 1960430954d3f6459dce688493db5c42047567b0..0000000000000000000000000000000000000000
+--- a/third_party/crashpad/crashpad/util/posix/double_fork_and_exec.cc
++++ /dev/null
+@@ -1,166 +0,0 @@
+-// Copyright 2017 The Crashpad Authors. All rights reserved.
+-//
+-// Licensed under the Apache License, Version 2.0 (the "License");
+-// you may not use this file except in compliance with the License.
+-// You may obtain a copy of the License at
+-//
+-//     http://www.apache.org/licenses/LICENSE-2.0
+-//
+-// Unless required by applicable law or agreed to in writing, software
+-// distributed under the License is distributed on an "AS IS" BASIS,
+-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-// See the License for the specific language governing permissions and
+-// limitations under the License.
+-
+-#include "util/posix/double_fork_and_exec.h"
+-
+-#include <stdlib.h>
+-#include <string.h>
+-#include <sys/wait.h>
+-#include <unistd.h>
+-
+-#include "base/check_op.h"
+-#include "base/logging.h"
+-#include "base/posix/eintr_wrapper.h"
+-#include "base/strings/stringprintf.h"
+-#include "util/posix/close_multiple.h"
+-
+-namespace crashpad {
+-
+-bool DoubleForkAndExec(const std::vector<std::string>& argv,
+-                       const std::vector<std::string>* envp,
+-                       int preserve_fd,
+-                       bool use_path,
+-                       void (*child_function)()) {
+-  DCHECK(!envp || !use_path);
+-
+-  // argv_c contains const char* pointers and is terminated by nullptr. This is
+-  // suitable for passing to execv(). Although argv_c is not used in the parent
+-  // process, it must be built in the parent process because it’s unsafe to do
+-  // so in the child or grandchild process.
+-  std::vector<const char*> argv_c;
+-  argv_c.reserve(argv.size() + 1);
+-  for (const std::string& argument : argv) {
+-    argv_c.push_back(argument.c_str());
+-  }
+-  argv_c.push_back(nullptr);
+-
+-  std::vector<const char*> envp_c;
+-  if (envp) {
+-    envp_c.reserve(envp->size() + 1);
+-    for (const std::string& variable : *envp) {
+-      envp_c.push_back(variable.c_str());
+-    }
+-    envp_c.push_back(nullptr);
+-  }
+-
+-  // Double-fork(). The three processes involved are parent, child, and
+-  // grandchild. The grandchild will call execv(). The child exits immediately
+-  // after spawning the grandchild, so the grandchild becomes an orphan and its
+-  // parent process ID becomes 1. This relieves the parent and child of the
+-  // responsibility to reap the grandchild with waitpid() or similar. The
+-  // grandchild is expected to outlive the parent process, so the parent
+-  // shouldn’t be concerned with reaping it. This approach means that accidental
+-  // early termination of the handler process will not result in a zombie
+-  // process.
+-  pid_t pid = fork();
+-  if (pid < 0) {
+-    PLOG(ERROR) << "fork";
+-    return false;
+-  }
+-
+-  if (pid == 0) {
+-    // Child process.
+-
+-    if (child_function) {
+-      child_function();
+-    }
+-
+-    // Call setsid(), creating a new process group and a new session, both led
+-    // by this process. The new process group has no controlling terminal. This
+-    // disconnects it from signals generated by the parent process’ terminal.
+-    //
+-    // setsid() is done in the child instead of the grandchild so that the
+-    // grandchild will not be a session leader. If it were a session leader, an
+-    // accidental open() of a terminal device without O_NOCTTY would make that
+-    // terminal the controlling terminal.
+-    //
+-    // It’s not desirable for the grandchild to have a controlling terminal. The
+-    // grandchild manages its own lifetime, such as by monitoring clients on its
+-    // own and exiting when it loses all clients and when it deems it
+-    // appropraite to do so. It may serve clients in different process groups or
+-    // sessions than its original client, and receiving signals intended for its
+-    // original client’s process group could be harmful in that case.
+-    PCHECK(setsid() != -1) << "setsid";
+-
+-    pid = fork();
+-    if (pid < 0) {
+-      PLOG(FATAL) << "fork";
+-    }
+-
+-    if (pid > 0) {
+-      // Child process.
+-
+-      // _exit() instead of exit(), because fork() was called.
+-      _exit(EXIT_SUCCESS);
+-    }
+-
+-    // Grandchild process.
+-
+-    CloseMultipleNowOrOnExec(STDERR_FILENO + 1, preserve_fd);
+-
+-    // &argv_c[0] is a pointer to a pointer to const char data, but because of
+-    // how C (not C++) works, execvp() wants a pointer to a const pointer to
+-    // char data. It modifies neither the data nor the pointers, so the
+-    // const_cast is safe.
+-    char* const* argv_for_execv = const_cast<char* const*>(&argv_c[0]);
+-
+-    if (envp) {
+-      // This cast is safe for the same reason that the argv_for_execv cast is.
+-      char* const* envp_for_execv = const_cast<char* const*>(&envp_c[0]);
+-      execve(argv_for_execv[0], argv_for_execv, envp_for_execv);
+-      PLOG(FATAL) << "execve " << argv_for_execv[0];
+-    }
+-
+-    if (use_path) {
+-      execvp(argv_for_execv[0], argv_for_execv);
+-      PLOG(FATAL) << "execvp " << argv_for_execv[0];
+-    }
+-
+-    execv(argv_for_execv[0], argv_for_execv);
+-    PLOG(FATAL) << "execv " << argv_for_execv[0];
+-  }
+-
+-  // waitpid() for the child, so that it does not become a zombie process. The
+-  // child normally exits quickly.
+-  //
+-  // Failures from this point on may result in the accumulation of a zombie, but
+-  // should not be considered fatal. Log only warnings, but don’t treat these
+-  // failures as a failure of the function overall.
+-  int status;
+-  pid_t wait_pid = HANDLE_EINTR(waitpid(pid, &status, 0));
+-  if (wait_pid == -1) {
+-    PLOG(WARNING) << "waitpid";
+-    return true;
+-  }
+-  DCHECK_EQ(wait_pid, pid);
+-
+-  if (WIFSIGNALED(status)) {
+-    int sig = WTERMSIG(status);
+-    LOG(WARNING) << base::StringPrintf(
+-        "intermediate process terminated by signal %d (%s)%s",
+-        sig,
+-        strsignal(sig),
+-        WCOREDUMP(status) ? " (core dumped)" : "");
+-  } else if (!WIFEXITED(status)) {
+-    LOG(WARNING) << base::StringPrintf(
+-        "intermediate process: unknown termination 0x%x", status);
+-  } else if (WEXITSTATUS(status) != EXIT_SUCCESS) {
+-    LOG(WARNING) << "intermediate process exited with code "
+-                 << WEXITSTATUS(status);
+-  }
+-
+-  return true;
+-}
+-
+-}  // namespace crashpad
+diff --git a/third_party/crashpad/crashpad/util/posix/fork_and_spawn.cc b/third_party/crashpad/crashpad/util/posix/fork_and_spawn.cc
+new file mode 100644
+index 0000000000000000000000000000000000000000..c6a95bbfdcba45995b0034789c8bdb4423a25642
+--- /dev/null
++++ b/third_party/crashpad/crashpad/util/posix/fork_and_spawn.cc
+@@ -0,0 +1,235 @@
++// Copyright 2017 The Crashpad Authors. All rights reserved.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++//
++//     http://www.apache.org/licenses/LICENSE-2.0
++//
++// Unless required by applicable law or agreed to in writing, software
++// distributed under the License is distributed on an "AS IS" BASIS,
++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++// See the License for the specific language governing permissions and
++// limitations under the License.
++
++#include "util/posix/fork_and_spawn.h"
++
++#include <errno.h>
++#include <spawn.h>
++#include <stdlib.h>
++#include <string.h>
++#include <sys/wait.h>
++#include <unistd.h>
++
++#include "base/check.h"
++#include "base/check_op.h"
++#include "base/logging.h"
++#include "base/posix/eintr_wrapper.h"
++#include "base/strings/stringprintf.h"
++#include "build/build_config.h"
++#include "util/posix/close_multiple.h"
++
++extern char** environ;
++
++namespace crashpad {
++
++namespace {
++
++#if BUILDFLAG(IS_APPLE)
++
++class PosixSpawnAttr {
++ public:
++  PosixSpawnAttr() {
++    PCHECK((errno = posix_spawnattr_init(&attr_)) == 0)
++        << "posix_spawnattr_init";
++  }
++
++  PosixSpawnAttr(const PosixSpawnAttr&) = delete;
++  PosixSpawnAttr& operator=(const PosixSpawnAttr&) = delete;
++
++  ~PosixSpawnAttr() {
++    PCHECK((errno = posix_spawnattr_destroy(&attr_)) == 0)
++        << "posix_spawnattr_destroy";
++  }
++
++  void SetFlags(short flags) {
++    PCHECK((errno = posix_spawnattr_setflags(&attr_, flags)) == 0)
++        << "posix_spawnattr_setflags";
++  }
++
++  const posix_spawnattr_t* Get() const { return &attr_; }
++
++ private:
++  posix_spawnattr_t attr_;
++};
++
++class PosixSpawnFileActions {
++ public:
++  PosixSpawnFileActions() {
++    PCHECK((errno = posix_spawn_file_actions_init(&file_actions_)) == 0)
++        << "posix_spawn_file_actions_init";
++  }
++
++  PosixSpawnFileActions(const PosixSpawnFileActions&) = delete;
++  PosixSpawnFileActions& operator=(const PosixSpawnFileActions&) = delete;
++
++  ~PosixSpawnFileActions() {
++    PCHECK((errno = posix_spawn_file_actions_destroy(&file_actions_)) == 0)
++        << "posix_spawn_file_actions_destroy";
++  }
++
++  void AddInheritedFileDescriptor(int fd) {
++    PCHECK((errno = posix_spawn_file_actions_addinherit_np(&file_actions_,
++                                                           fd)) == 0)
++        << "posix_spawn_file_actions_addinherit_np";
++  }
++
++  const posix_spawn_file_actions_t* Get() const { return &file_actions_; }
++
++ private:
++  posix_spawn_file_actions_t file_actions_;
++};
++
++#endif
++
++}  // namespace
++
++bool ForkAndSpawn(const std::vector<std::string>& argv,
++                  const std::vector<std::string>* envp,
++                  int preserve_fd,
++                  bool use_path,
++                  void (*child_function)()) {
++  // argv_c contains const char* pointers and is terminated by nullptr. This is
++  // suitable for passing to posix_spawn() or posix_spawnp(). Although argv_c is
++  // not used in the parent process, it must be built in the parent process
++  // because it’s unsafe to do so in the child.
++  std::vector<const char*> argv_c;
++  argv_c.reserve(argv.size() + 1);
++  for (const std::string& argument : argv) {
++    argv_c.push_back(argument.c_str());
++  }
++  argv_c.push_back(nullptr);
++
++  std::vector<const char*> envp_c;
++  if (envp) {
++    envp_c.reserve(envp->size() + 1);
++    for (const std::string& variable : *envp) {
++      envp_c.push_back(variable.c_str());
++    }
++    envp_c.push_back(nullptr);
++  }
++
++  // The three processes involved are parent, child, and grandchild. The child
++  // exits immediately after spawning the grandchild, so the grandchild becomes
++  // an orphan and its parent process ID becomes 1. This relieves the parent and
++  // child of the responsibility to reap the grandchild with waitpid() or
++  // similar. The grandchild is expected to outlive the parent process, so the
++  // parent shouldn’t be concerned with reaping it. This approach means that
++  // accidental early termination of the handler process will not result in a
++  // zombie process.
++  pid_t pid = fork();
++  if (pid < 0) {
++    PLOG(ERROR) << "fork";
++    return false;
++  }
++
++  if (pid == 0) {
++    // Child process.
++
++    if (child_function) {
++      child_function();
++    }
++
++    // Call setsid(), creating a new process group and a new session, both led
++    // by this process. The new process group has no controlling terminal. This
++    // disconnects it from signals generated by the parent process’ terminal.
++    //
++    // setsid() is done in the child instead of the grandchild so that the
++    // grandchild will not be a session leader. If it were a session leader, an
++    // accidental open() of a terminal device without O_NOCTTY would make that
++    // terminal the controlling terminal.
++    //
++    // It’s not desirable for the grandchild to have a controlling terminal. The
++    // grandchild manages its own lifetime, such as by monitoring clients on its
++    // own and exiting when it loses all clients and when it deems it
++    // appropraite to do so. It may serve clients in different process groups or
++    // sessions than its original client, and receiving signals intended for its
++    // original client’s process group could be harmful in that case.
++    PCHECK(setsid() != -1) << "setsid";
++
++    // &argv_c[0] is a pointer to a pointer to const char data, but because of
++    // how C (not C++) works, posix_spawn() and posix_spawnp() want a pointer to
++    // a const pointer to char data. They modifies neither the data nor the
++    // pointers, so the const_cast is safe.
++    char* const* argv_for_spawn = const_cast<char* const*>(argv_c.data());
++
++    // This cast is safe for the same reason that the argv_for_spawn cast is.
++    char* const* envp_for_spawn =
++        envp ? const_cast<char* const*>(envp_c.data()) : environ;
++
++#if BUILDFLAG(IS_APPLE)
++    PosixSpawnAttr attr;
++    attr.SetFlags(POSIX_SPAWN_CLOEXEC_DEFAULT);
++
++    PosixSpawnFileActions file_actions;
++    for (int fd = 0; fd <= STDERR_FILENO; ++fd) {
++      file_actions.AddInheritedFileDescriptor(fd);
++    }
++    file_actions.AddInheritedFileDescriptor(preserve_fd);
++
++    const posix_spawnattr_t* attr_p = attr.Get();
++    const posix_spawn_file_actions_t* file_actions_p = file_actions.Get();
++#else
++    CloseMultipleNowOrOnExec(STDERR_FILENO + 1, preserve_fd);
++
++    const posix_spawnattr_t* attr_p = nullptr;
++    const posix_spawn_file_actions_t* file_actions_p = nullptr;
++#endif
++
++    auto posix_spawn_fp = use_path ? posix_spawnp : posix_spawn;
++    if ((errno = posix_spawn_fp(&pid,
++                                argv_for_spawn[0],
++                                file_actions_p,
++                                attr_p,
++                                argv_for_spawn,
++                                envp_for_spawn)) != 0) {
++      PLOG(FATAL) << (use_path ? "posix_spawnp" : "posix_spawn");
++    }
++
++    // _exit() instead of exit(), because fork() was called.
++    _exit(EXIT_SUCCESS);
++  }
++
++  // waitpid() for the child, so that it does not become a zombie process. The
++  // child normally exits quickly.
++  //
++  // Failures from this point on may result in the accumulation of a zombie, but
++  // should not be considered fatal. Log only warnings, but don’t treat these
++  // failures as a failure of the function overall.
++  int status;
++  pid_t wait_pid = HANDLE_EINTR(waitpid(pid, &status, 0));
++  if (wait_pid == -1) {
++    PLOG(WARNING) << "waitpid";
++    return true;
++  }
++  DCHECK_EQ(wait_pid, pid);
++
++  if (WIFSIGNALED(status)) {
++    int sig = WTERMSIG(status);
++    LOG(WARNING) << base::StringPrintf(
++        "intermediate process terminated by signal %d (%s)%s",
++        sig,
++        strsignal(sig),
++        WCOREDUMP(status) ? " (core dumped)" : "");
++  } else if (!WIFEXITED(status)) {
++    LOG(WARNING) << base::StringPrintf(
++        "intermediate process: unknown termination 0x%x", status);
++  } else if (WEXITSTATUS(status) != EXIT_SUCCESS) {
++    LOG(WARNING) << "intermediate process exited with code "
++                 << WEXITSTATUS(status);
++  }
++
++  return true;
++}
++
++}  // namespace crashpad
+diff --git a/third_party/crashpad/crashpad/util/posix/double_fork_and_exec.h b/third_party/crashpad/crashpad/util/posix/fork_and_spawn.h
+similarity index 76%
+rename from third_party/crashpad/crashpad/util/posix/double_fork_and_exec.h
+rename to third_party/crashpad/crashpad/util/posix/fork_and_spawn.h
+index 02fc0f28f196b447132a2dcfaebdaaa5a916a38a..fc55aa3a37652e4ba18c66db90124abd9cad2e51 100644
+--- a/third_party/crashpad/crashpad/util/posix/double_fork_and_exec.h
++++ b/third_party/crashpad/crashpad/util/posix/fork_and_spawn.h
+@@ -12,8 +12,8 @@
+ // See the License for the specific language governing permissions and
+ // limitations under the License.
+ 
+-#ifndef CRASHPAD_UTIL_POSIX_DOUBLE_FORK_AND_EXEC_H_
+-#define CRASHPAD_UTIL_POSIX_DOUBLE_FORK_AND_EXEC_H_
++#ifndef CRASHPAD_UTIL_POSIX_FORK_AND_SPAWN_H_
++#define CRASHPAD_UTIL_POSIX_FORK_AND_SPAWN_H_
+ 
+ #include <string>
+ #include <vector>
+@@ -23,7 +23,7 @@ namespace crashpad {
+ //! \brief Executes a (grand-)child process.
+ //!
+ //! The grandchild process will be started through the
+-//! double-`fork()`-and-`execv()` pattern. This allows the grandchild to fully
++//! `fork()`-and-`posix_spawn()` pattern. This allows the grandchild to fully
+ //! disassociate from the parent. The grandchild will not be a member of the
+ //! parent’s process group or session and will not have a controlling terminal,
+ //! providing isolation from signals not intended for it. The grandchild’s
+@@ -37,7 +37,7 @@ namespace crashpad {
+ //! \param[in] argv The argument vector to start the grandchild process with.
+ //!     `argv[0]` is used as the path to the executable.
+ //! \param[in] envp A vector of environment variables of the form `var=value` to
+-//!     be passed to `execve()`. If this value is `nullptr`, the current
++//!     be passed to `posix_spawn()`. If this value is `nullptr`, the current
+ //!     environment is used.
+ //! \param[in] preserve_fd A file descriptor to be inherited by the grandchild
+ //!     process. This file descriptor is inherited in addition to the three file
+@@ -45,16 +45,13 @@ namespace crashpad {
+ //!     if no additional file descriptors are to be inherited.
+ //! \param[in] use_path Whether to consult the `PATH` environment variable when
+ //!     requested to start an executable at a non-absolute path. If `false`,
+-//!     `execv()`, which does not consult `PATH`, will be used. If `true`,
+-//!     `execvp()`, which does consult `PATH`, will be used.
++//!     `posix_spawn()`, which does not consult `PATH`, will be used. If `true`,
++//!     `posix_spawnp()`, which does consult `PATH`, will be used.
+ //! \param[in] child_function If not `nullptr`, this function will be called in
+-//!     the intermediate child process, prior to the second `fork()`. Take note
++//!     the intermediate child process, prior to the `posix_spawn()`. Take note
+ //!     that this function will run in the context of a forked process, and must
+ //!     be safe for that purpose.
+ //!
+-//! Setting both \a envp to a value other than `nullptr` and \a use_path to
+-//! `true` is not currently supported.
+-//!
+ //! \return `true` on success, and `false` on failure with a message logged.
+ //!     Only failures that occur in the parent process that indicate a definite
+ //!     failure to start the the grandchild are reported in the return value.
+@@ -63,12 +60,12 @@ namespace crashpad {
+ //!     terminating. The caller assumes the responsibility for detecting such
+ //!     failures, for example, by observing a failure to perform a successful
+ //!     handshake with the grandchild process.
+-bool DoubleForkAndExec(const std::vector<std::string>& argv,
+-                       const std::vector<std::string>* envp,
+-                       int preserve_fd,
+-                       bool use_path,
+-                       void (*child_function)());
++bool ForkAndSpawn(const std::vector<std::string>& argv,
++                  const std::vector<std::string>* envp,
++                  int preserve_fd,
++                  bool use_path,
++                  void (*child_function)());
+ 
+ }  // namespace crashpad
+ 
+-#endif  // CRASHPAD_UTIL_POSIX_DOUBLE_FORK_AND_EXEC_H_
++#endif  // CRASHPAD_UTIL_POSIX_FORK_AND_SPAWN_H_

patches/chromium/printing.patch

@@ -10,8 +10,21 @@ majority of changes originally come from these PRs:
 
 This patch also fixes callback for manual user cancellation and success.
 
+diff --git a/chrome/browser/printing/print_backend_service_manager.cc b/chrome/browser/printing/print_backend_service_manager.cc
+index 27eb7cf1480e7a56ab6b7d010cdee65c72e62c10..76d265b8de17244ed9d3727f1bebe730a224cd56 100644
+--- a/chrome/browser/printing/print_backend_service_manager.cc
++++ b/chrome/browser/printing/print_backend_service_manager.cc
+@@ -18,7 +18,7 @@
+ #include "base/unguessable_token.h"
+ #include "build/build_config.h"
+ #include "chrome/browser/browser_process.h"
+-#include "chrome/grit/generated_resources.h"
++#include "electron/grit/electron_resources.h"
+ #include "chrome/services/printing/public/mojom/print_backend_service.mojom.h"
+ #include "components/crash/core/common/crash_keys.h"
+ #include "content/public/browser/browser_thread.h"
 diff --git a/chrome/browser/printing/print_job.cc b/chrome/browser/printing/print_job.cc
-index 8d40bbf98d4d58704f118cb42039b0956a9f6639..06196c0fa02012a5faa82471bd39fac087918f54 100644
+index 6408cbee8b5a8e45c4276ed966b57c1e61ad1137..e951c41a1bd92a33e32f6835841d3935a05dde53 100644
 --- a/chrome/browser/printing/print_job.cc
 +++ b/chrome/browser/printing/print_job.cc
 @@ -89,6 +89,7 @@ bool PrintWithReducedRasterization(PrefService* prefs) {
@@ -30,7 +43,7 @@ index 8d40bbf98d4d58704f118cb42039b0956a9f6639..06196c0fa02012a5faa82471bd39fac0
  
  #endif  // BUILDFLAG(IS_WIN)
  
-@@ -356,8 +358,10 @@ void PrintJob::StartPdfToEmfConversion(
+@@ -360,8 +362,10 @@ void PrintJob::StartPdfToEmfConversion(
  
    const PrintSettings& settings = document()->settings();
  
@@ -42,7 +55,7 @@ index 8d40bbf98d4d58704f118cb42039b0956a9f6639..06196c0fa02012a5faa82471bd39fac0
  
    using RenderMode = PdfRenderSettings::Mode;
    RenderMode mode = print_with_reduced_rasterization
-@@ -447,8 +451,10 @@ void PrintJob::StartPdfToPostScriptConversion(
+@@ -451,8 +455,10 @@ void PrintJob::StartPdfToPostScriptConversion(
    if (ps_level2) {
      mode = PdfRenderSettings::Mode::POSTSCRIPT_LEVEL2;
    } else {
@@ -54,22 +67,8 @@ index 8d40bbf98d4d58704f118cb42039b0956a9f6639..06196c0fa02012a5faa82471bd39fac0
                 ? PdfRenderSettings::Mode::POSTSCRIPT_LEVEL3_WITH_TYPE42_FONTS
                 : PdfRenderSettings::Mode::POSTSCRIPT_LEVEL3;
    }
-diff --git a/chrome/browser/printing/print_job.h b/chrome/browser/printing/print_job.h
-index 650c78f16c812170aeda99d75300ff88f47347a0..c33ce445a23f97a744db3a4ac30ef471c359553b 100644
---- a/chrome/browser/printing/print_job.h
-+++ b/chrome/browser/printing/print_job.h
-@@ -261,6 +261,9 @@ class JobEventDetails : public base::RefCountedThreadSafe<JobEventDetails> {
-  public:
-   // Event type.
-   enum Type {
-+    // Print... dialog box has been closed with CANCEL button.
-+    USER_INIT_CANCELED,
-+
-     // A new document started printing.
-     NEW_DOC,
- 
 diff --git a/chrome/browser/printing/print_job_worker.cc b/chrome/browser/printing/print_job_worker.cc
-index f989f040cb9ff6df001225057202fb1653ade9fc..9430feb1d90667bbdbbb2c9f419936c9fb679dca 100644
+index 86770178101d411bdf84617678c65a4a29ddbb5c..16e1fe8fc650fba441bcc7e467d58e0071dbc945 100644
 --- a/chrome/browser/printing/print_job_worker.cc
 +++ b/chrome/browser/printing/print_job_worker.cc
 @@ -20,7 +20,6 @@
@@ -88,7 +87,7 @@ index f989f040cb9ff6df001225057202fb1653ade9fc..9430feb1d90667bbdbbb2c9f419936c9
  #include "printing/backend/print_backend.h"
  #include "printing/buildflags/buildflags.h"
  #include "printing/mojom/print.mojom.h"
-@@ -230,16 +230,21 @@ void PrintJobWorker::UpdatePrintSettings(base::Value new_settings,
+@@ -229,16 +229,21 @@ void PrintJobWorker::UpdatePrintSettings(base::Value::Dict new_settings,
  #endif  // BUILDFLAG(IS_LINUX) && defined(USE_CUPS)
    }
  
@@ -114,10 +113,10 @@ index f989f040cb9ff6df001225057202fb1653ade9fc..9430feb1d90667bbdbbb2c9f419936c9
  
  #if BUILDFLAG(IS_CHROMEOS)
 diff --git a/chrome/browser/printing/print_job_worker_oop.cc b/chrome/browser/printing/print_job_worker_oop.cc
-index 02dfcad0c6b208f7df4d2b10112739554f6ab75c..0774aa95ee1521b0e76fe72d8d9e8de4540f0ff1 100644
+index dd27bbf387718d6abda5080e7d2c609cd0eaff17..8837cf2aeaa2f87d51be8d00aa356c8a2c5e15c7 100644
 --- a/chrome/browser/printing/print_job_worker_oop.cc
 +++ b/chrome/browser/printing/print_job_worker_oop.cc
-@@ -331,7 +331,7 @@ void PrintJobWorkerOop::OnFailure() {
+@@ -345,7 +345,7 @@ void PrintJobWorkerOop::OnFailure() {
  }
  
  void PrintJobWorkerOop::ShowErrorDialog() {
@@ -127,7 +126,7 @@ index 02dfcad0c6b208f7df4d2b10112739554f6ab75c..0774aa95ee1521b0e76fe72d8d9e8de4
  
  void PrintJobWorkerOop::UnregisterServiceManagerClient() {
 diff --git a/chrome/browser/printing/print_view_manager_base.cc b/chrome/browser/printing/print_view_manager_base.cc
-index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4a81d835e 100644
+index fb69efbfa8e355f8389abf9490cf338e70f16c7b..52099b2312b042b0afdd5ee3d2df5c66ea25df8b 100644
 --- a/chrome/browser/printing/print_view_manager_base.cc
 +++ b/chrome/browser/printing/print_view_manager_base.cc
 @@ -30,10 +30,10 @@
@@ -143,15 +142,15 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  #include "components/prefs/pref_service.h"
  #include "components/printing/browser/print_composite_client.h"
  #include "components/printing/browser/print_manager_utils.h"
-@@ -49,6 +49,7 @@
+@@ -48,6 +48,7 @@
+ #include "content/public/browser/render_frame_host.h"
  #include "content/public/browser/render_process_host.h"
- #include "content/public/browser/render_view_host.h"
  #include "content/public/browser/web_contents.h"
 +#include "electron/grit/electron_resources.h"
  #include "mojo/public/cpp/system/buffer.h"
  #include "printing/buildflags/buildflags.h"
  #include "printing/metafile_skia.h"
-@@ -88,6 +89,8 @@ using PrintSettingsCallback =
+@@ -87,6 +88,8 @@ using PrintSettingsCallback =
      base::OnceCallback<void(std::unique_ptr<PrinterQuery>)>;
  
  void ShowWarningMessageBox(const std::u16string& message) {
@@ -160,7 +159,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    // Runs always on the UI thread.
    static bool is_dialog_shown = false;
    if (is_dialog_shown)
-@@ -96,6 +99,7 @@ void ShowWarningMessageBox(const std::u16string& message) {
+@@ -95,6 +98,7 @@ void ShowWarningMessageBox(const std::u16string& message) {
    base::AutoReset<bool> auto_reset(&is_dialog_shown, true);
  
    chrome::ShowWarningMessageBox(nullptr, std::u16string(), message);
@@ -168,7 +167,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  }
  
  #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
-@@ -193,7 +197,9 @@ void UpdatePrintSettingsReplyOnIO(
+@@ -192,7 +196,9 @@ void UpdatePrintSettingsReplyOnIO(
    DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
    DCHECK(printer_query);
    mojom::PrintPagesParamsPtr params = CreateEmptyPrintPagesParamsPtr();
@@ -179,7 +178,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
      RenderParamsFromPrintSettings(printer_query->settings(),
                                    params->params.get());
      params->params->document_cookie = printer_query->cookie();
-@@ -246,6 +252,7 @@ void ScriptedPrintReplyOnIO(
+@@ -245,6 +251,7 @@ void ScriptedPrintReplyOnIO(
      mojom::PrintManagerHost::ScriptedPrintCallback callback) {
    DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
    mojom::PrintPagesParamsPtr params = CreateEmptyPrintPagesParamsPtr();
@@ -187,7 +186,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    if (printer_query->last_status() == mojom::ResultCode::kSuccess &&
        printer_query->settings().dpi()) {
      RenderParamsFromPrintSettings(printer_query->settings(),
-@@ -255,8 +262,9 @@ void ScriptedPrintReplyOnIO(
+@@ -254,8 +261,9 @@ void ScriptedPrintReplyOnIO(
    }
    bool has_valid_cookie = params->params->document_cookie;
    bool has_dpi = !params->params->dpi.IsEmpty();
@@ -198,7 +197,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  
    if (has_dpi && has_valid_cookie) {
      queue->QueuePrinterQuery(std::move(printer_query));
-@@ -294,12 +302,14 @@ PrintViewManagerBase::PrintViewManagerBase(content::WebContents* web_contents)
+@@ -293,12 +301,14 @@ PrintViewManagerBase::PrintViewManagerBase(content::WebContents* web_contents)
      : PrintManager(web_contents),
        queue_(g_browser_process->print_job_manager()->queue()) {
    DCHECK(queue_);
@@ -213,30 +212,29 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  }
  
  PrintViewManagerBase::~PrintViewManagerBase() {
-@@ -307,7 +317,10 @@ PrintViewManagerBase::~PrintViewManagerBase() {
+@@ -306,7 +316,10 @@ PrintViewManagerBase::~PrintViewManagerBase() {
    DisconnectFromCurrentPrintJob();
  }
  
 -bool PrintViewManagerBase::PrintNow(content::RenderFrameHost* rfh) {
 +bool PrintViewManagerBase::PrintNow(content::RenderFrameHost* rfh,
 +                                    bool silent,
-+                                    base::Value settings,
++                                    base::Value::Dict settings,
 +                                    CompletionCallback callback)  {
    // Remember the ID for `rfh`, to enable checking that the `RenderFrameHost`
    // is still valid after a possible inner message loop runs in
    // `DisconnectFromCurrentPrintJob()`.
-@@ -333,7 +346,9 @@ bool PrintViewManagerBase::PrintNow(content::RenderFrameHost* rfh) {
+@@ -332,6 +345,9 @@ bool PrintViewManagerBase::PrintNow(content::RenderFrameHost* rfh) {
  #endif
  
    SetPrintingRFH(rfh);
--  GetPrintRenderFrame(rfh)->PrintRequestedPages();
 +  callback_ = std::move(callback);
 +
 +  GetPrintRenderFrame(rfh)->PrintRequestedPages(silent, std::move(settings));
  
-   for (auto& observer : GetObservers())
-     observer.OnPrintNow(rfh);
-@@ -486,7 +501,8 @@ void PrintViewManagerBase::GetDefaultPrintSettingsReply(
+ #if BUILDFLAG(ENABLE_PRINT_CONTENT_ANALYSIS)
+   enterprise_connectors::ContentAnalysisDelegate::Data scanning_data;
+@@ -500,7 +516,8 @@ void PrintViewManagerBase::GetDefaultPrintSettingsReply(
  void PrintViewManagerBase::ScriptedPrintReply(
      ScriptedPrintCallback callback,
      int process_id,
@@ -246,7 +244,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
  
  #if BUILDFLAG(ENABLE_OOP_PRINTING)
-@@ -499,16 +515,19 @@ void PrintViewManagerBase::ScriptedPrintReply(
+@@ -513,16 +530,19 @@ void PrintViewManagerBase::ScriptedPrintReply(
      return;
    }
  
@@ -270,7 +268,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  }
  
  void PrintViewManagerBase::NavigationStopped() {
-@@ -624,11 +643,14 @@ void PrintViewManagerBase::DidPrintDocument(
+@@ -638,11 +658,14 @@ void PrintViewManagerBase::DidPrintDocument(
  void PrintViewManagerBase::GetDefaultPrintSettings(
      GetDefaultPrintSettingsCallback callback) {
    DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
@@ -285,8 +283,8 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  #if BUILDFLAG(ENABLE_OOP_PRINTING)
    if (printing::features::kEnableOopPrintDriversJobPrint.Get() &&
        !service_manager_client_id_.has_value()) {
-@@ -658,18 +680,20 @@ void PrintViewManagerBase::UpdatePrintSettings(
-     base::Value job_settings,
+@@ -672,18 +695,20 @@ void PrintViewManagerBase::UpdatePrintSettings(
+     base::Value::Dict job_settings,
      UpdatePrintSettingsCallback callback) {
    DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 +#if 0 // Printing is always enabled.
@@ -297,7 +295,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    }
 -
 +#endif
-   if (!job_settings.FindIntKey(kSettingPrinterType)) {
+   if (!job_settings.FindInt(kSettingPrinterType)) {
      UpdatePrintSettingsReply(std::move(callback),
                               CreateEmptyPrintPagesParamsPtr(), false);
      return;
@@ -307,15 +305,15 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    content::BrowserContext* context =
        web_contents() ? web_contents()->GetBrowserContext() : nullptr;
    PrefService* prefs =
-@@ -679,6 +703,7 @@ void PrintViewManagerBase::UpdatePrintSettings(
+@@ -693,6 +718,7 @@ void PrintViewManagerBase::UpdatePrintSettings(
      if (value > 0)
-       job_settings.SetIntKey(kSettingRasterizePdfDpi, value);
+       job_settings.Set(kSettingRasterizePdfDpi, value);
    }
 +#endif
  
    auto callback_wrapper =
        base::BindOnce(&PrintViewManagerBase::UpdatePrintSettingsReply,
-@@ -704,14 +729,14 @@ void PrintViewManagerBase::ScriptedPrint(mojom::ScriptedPrintParamsPtr params,
+@@ -718,14 +744,14 @@ void PrintViewManagerBase::ScriptedPrint(mojom::ScriptedPrintParamsPtr params,
      // didn't happen for some reason.
      bad_message::ReceivedBadMessage(
          render_process_host, bad_message::PVMB_SCRIPTED_PRINT_FENCED_FRAME);
@@ -332,7 +330,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
      return;
    }
  #endif
-@@ -734,7 +759,6 @@ void PrintViewManagerBase::PrintingFailed(int32_t cookie) {
+@@ -748,7 +774,6 @@ void PrintViewManagerBase::PrintingFailed(int32_t cookie) {
    PrintManager::PrintingFailed(cookie);
  
  #if !BUILDFLAG(IS_ANDROID)  // Android does not implement this function.
@@ -340,7 +338,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  #endif
  
    ReleasePrinterQuery();
-@@ -749,6 +773,11 @@ void PrintViewManagerBase::RemoveObserver(Observer& observer) {
+@@ -763,6 +788,11 @@ void PrintViewManagerBase::RemoveObserver(Observer& observer) {
  }
  
  void PrintViewManagerBase::ShowInvalidPrinterSettingsError() {
@@ -352,7 +350,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    base::ThreadTaskRunnerHandle::Get()->PostTask(
        FROM_HERE, base::BindOnce(&ShowWarningMessageBox,
                                  l10n_util::GetStringUTF16(
-@@ -759,10 +788,12 @@ void PrintViewManagerBase::RenderFrameHostStateChanged(
+@@ -773,10 +803,12 @@ void PrintViewManagerBase::RenderFrameHostStateChanged(
      content::RenderFrameHost* render_frame_host,
      content::RenderFrameHost::LifecycleState /*old_state*/,
      content::RenderFrameHost::LifecycleState new_state) {
@@ -365,7 +363,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  }
  
  void PrintViewManagerBase::DidStartLoading() {
-@@ -822,6 +853,11 @@ void PrintViewManagerBase::OnJobDone() {
+@@ -836,6 +868,11 @@ void PrintViewManagerBase::OnJobDone() {
    ReleasePrintJob();
  }
  
@@ -377,7 +375,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
  void PrintViewManagerBase::OnFailed() {
    TerminatePrintJob(true);
  }
-@@ -883,7 +919,10 @@ bool PrintViewManagerBase::CreateNewPrintJob(
+@@ -893,7 +930,10 @@ bool PrintViewManagerBase::CreateNewPrintJob(
  
    // Disconnect the current |print_job_|.
    auto weak_this = weak_ptr_factory_.GetWeakPtr();
@@ -389,7 +387,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    if (!weak_this)
      return false;
  
-@@ -965,6 +1004,13 @@ void PrintViewManagerBase::ReleasePrintJob() {
+@@ -972,6 +1012,13 @@ void PrintViewManagerBase::ReleasePrintJob() {
    UnregisterSystemPrintClient();
  #endif
  
@@ -403,7 +401,7 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
    if (!print_job_)
      return;
  
-@@ -1014,7 +1060,7 @@ bool PrintViewManagerBase::RunInnerMessageLoop() {
+@@ -1021,7 +1068,7 @@ bool PrintViewManagerBase::RunInnerMessageLoop() {
  }
  
  bool PrintViewManagerBase::OpportunisticallyCreatePrintJob(int cookie) {
@@ -412,11 +410,20 @@ index 3a3f733c45e08e461a74d2458172c38ec0e572bf..2c04243257e72825a7fa6d8956045cb4
      return true;
  
    if (!cookie) {
+@@ -1129,7 +1176,7 @@ void PrintViewManagerBase::SendPrintingEnabled(bool enabled,
+ }
+ 
+ void PrintViewManagerBase::CompletePrintNow(content::RenderFrameHost* rfh) {
+-  GetPrintRenderFrame(rfh)->PrintRequestedPages();
++  GetPrintRenderFrame(rfh)->PrintRequestedPages(/*silent=*/true, /*job_settings=*/base::Value::Dict());
+ 
+   for (auto& observer : GetObservers())
+     observer.OnPrintNow(rfh);
 diff --git a/chrome/browser/printing/print_view_manager_base.h b/chrome/browser/printing/print_view_manager_base.h
-index 3a4cfa1e44d781a94030dec6992ffd6f6391020f..d14804d02cc61b6f75d47893f6dd61ddde6cd552 100644
+index 48895e0f8a846aeb725e306c7f22ac159d5d96a7..027794e38f86ab1905c5cdd95140b2cb1e5c5653 100644
 --- a/chrome/browser/printing/print_view_manager_base.h
 +++ b/chrome/browser/printing/print_view_manager_base.h
-@@ -37,6 +37,8 @@ namespace printing {
+@@ -41,6 +41,8 @@ namespace printing {
  class PrintQueriesQueue;
  class PrinterQuery;
  
@@ -425,19 +432,19 @@ index 3a4cfa1e44d781a94030dec6992ffd6f6391020f..d14804d02cc61b6f75d47893f6dd61dd
  // Base class for managing the print commands for a WebContents.
  class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
   public:
-@@ -58,7 +60,10 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -62,7 +64,10 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
    // Prints the current document immediately. Since the rendering is
    // asynchronous, the actual printing will not be completed on the return of
    // this function. Returns false if printing is impossible at the moment.
 -  virtual bool PrintNow(content::RenderFrameHost* rfh);
 +  virtual bool PrintNow(content::RenderFrameHost* rfh,
 +                        bool silent = true,
-+                        base::Value settings = {},
++                        base::Value::Dict settings = {},
 +                        CompletionCallback callback = {});
  
  #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
    // Prints the document in `print_data` with settings specified in
-@@ -106,6 +111,7 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -110,6 +115,7 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
                       ScriptedPrintCallback callback) override;
    void ShowInvalidPrinterSettingsError() override;
    void PrintingFailed(int32_t cookie) override;
@@ -445,7 +452,7 @@ index 3a4cfa1e44d781a94030dec6992ffd6f6391020f..d14804d02cc61b6f75d47893f6dd61dd
  
    // Adds and removes observers for `PrintViewManagerBase` events. The order in
    // which notifications are sent to observers is undefined. Observers must be
-@@ -207,7 +213,8 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -231,7 +237,8 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
    // Runs `callback` with `params` to reply to ScriptedPrint().
    void ScriptedPrintReply(ScriptedPrintCallback callback,
                            int process_id,
@@ -455,7 +462,7 @@ index 3a4cfa1e44d781a94030dec6992ffd6f6391020f..d14804d02cc61b6f75d47893f6dd61dd
  
    // Requests the RenderView to render all the missing pages for the print job.
    // No-op if no print job is pending. Returns true if at least one page has
-@@ -262,9 +269,15 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -297,9 +304,15 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
    // The current RFH that is printing with a system printing dialog.
    raw_ptr<content::RenderFrameHost> printing_rfh_ = nullptr;
  
@@ -472,7 +479,7 @@ index 3a4cfa1e44d781a94030dec6992ffd6f6391020f..d14804d02cc61b6f75d47893f6dd61dd
    // This means we are _blocking_ until all the necessary pages have been
    // rendered or the print settings are being loaded.
 diff --git a/chrome/browser/ui/webui/print_preview/fake_print_render_frame.cc b/chrome/browser/ui/webui/print_preview/fake_print_render_frame.cc
-index 879004c790d57b28e7a816ebf560971876c17168..334509d3ab45af4bb7877f656ca5aca7ee1bce00 100644
+index 016e0d8fcc575bfa77323d8600d5daba152abbc6..dfb856f57767e24c0ec495c94e515afbb83e19ea 100644
 --- a/chrome/browser/ui/webui/print_preview/fake_print_render_frame.cc
 +++ b/chrome/browser/ui/webui/print_preview/fake_print_render_frame.cc
 @@ -20,7 +20,7 @@ FakePrintRenderFrame::FakePrintRenderFrame(
@@ -480,25 +487,25 @@ index 879004c790d57b28e7a816ebf560971876c17168..334509d3ab45af4bb7877f656ca5aca7
  FakePrintRenderFrame::~FakePrintRenderFrame() = default;
  
 -void FakePrintRenderFrame::PrintRequestedPages() {}
-+void FakePrintRenderFrame::PrintRequestedPages(bool /*silent*/, ::base::Value /*settings*/) {}
++void FakePrintRenderFrame::PrintRequestedPages(bool /*silent*/, ::base::Value::Dict /*settings*/) {}
  
  void FakePrintRenderFrame::PrintForSystemDialog() {}
  
 diff --git a/chrome/browser/ui/webui/print_preview/fake_print_render_frame.h b/chrome/browser/ui/webui/print_preview/fake_print_render_frame.h
-index 10f46664d8337d6be2fac24d9a6933429f3b2c2b..6de833f2da3ae85cf0752284146974f2026ab174 100644
+index 3c95ee5c0d169f677947427a6ace55b4bfe80277..63ba8aca503968d0409b63b991a9276228d60d4a 100644
 --- a/chrome/browser/ui/webui/print_preview/fake_print_render_frame.h
 +++ b/chrome/browser/ui/webui/print_preview/fake_print_render_frame.h
-@@ -24,7 +24,7 @@ class FakePrintRenderFrame : public mojom::PrintRenderFrame {
+@@ -25,7 +25,7 @@ class FakePrintRenderFrame : public mojom::PrintRenderFrame {
  
   private:
    // printing::mojom::PrintRenderFrame:
 -  void PrintRequestedPages() override;
-+  void PrintRequestedPages(bool silent, ::base::Value settings) override;
++  void PrintRequestedPages(bool silent, ::base::Value::Dict settings) override;
    void PrintForSystemDialog() override;
    void SetPrintPreviewUI(
        mojo::PendingAssociatedRemote<mojom::PrintPreviewUI> preview) override;
 diff --git a/components/printing/browser/print_to_pdf/pdf_print_manager.cc b/components/printing/browser/print_to_pdf/pdf_print_manager.cc
-index 66810a2a5f0c77ba107c71d2abaef8692bda0fea..cd6103af4571f82f11652a3c7ecf0e534428dc49 100644
+index 3ba45e77f66531bc6b81717eb9c7d3faca1e9fa9..41271d3fe390dd16d1c2b9839ac32013f495df51 100644
 --- a/components/printing/browser/print_to_pdf/pdf_print_manager.cc
 +++ b/components/printing/browser/print_to_pdf/pdf_print_manager.cc
 @@ -116,7 +116,8 @@ void PdfPrintManager::PrintToPdf(
@@ -547,7 +554,7 @@ index 66810a2a5f0c77ba107c71d2abaef8692bda0fea..cd6103af4571f82f11652a3c7ecf0e53
  
  void PdfPrintManager::ShowInvalidPrinterSettingsError() {
 diff --git a/components/printing/common/print.mojom b/components/printing/common/print.mojom
-index 6cd585d597315940be144506b9bb819137a7981e..8ea9c38a46460edd237f003ddd7362240a02887e 100644
+index 156b987aa9cafb69c04bed483aa78f26baa9cd97..3d3f2cb97b59a6e46bf0c16dd2355aa8e21ec5da 100644
 --- a/components/printing/common/print.mojom
 +++ b/components/printing/common/print.mojom
 @@ -275,7 +275,7 @@ interface PrintPreviewUI {
@@ -555,11 +562,11 @@ index 6cd585d597315940be144506b9bb819137a7981e..8ea9c38a46460edd237f003ddd736224
    // Tells the RenderFrame to switch the CSS to print media type, render every
    // requested page, and then switch back the CSS to display media type.
 -  PrintRequestedPages();
-+  PrintRequestedPages(bool silent, mojo_base.mojom.DeprecatedDictionaryValue settings);
++  PrintRequestedPages(bool silent, mojo_base.mojom.DictionaryValue settings);
  
    // Tells the RenderFrame to switch the CSS to print media type, render every
    // requested page using the print preview document's frame/node, and then
-@@ -342,7 +342,7 @@ interface PrintManagerHost {
+@@ -348,7 +348,7 @@ interface PrintManagerHost {
    // Request the print settings from the user. This step is about showing
    // UI to the user to select the final print settings.
    [Sync]
@@ -569,10 +576,10 @@ index 6cd585d597315940be144506b9bb819137a7981e..8ea9c38a46460edd237f003ddd736224
    // Tells the browser that there are invalid printer settings.
    ShowInvalidPrinterSettingsError();
 diff --git a/components/printing/renderer/print_render_frame_helper.cc b/components/printing/renderer/print_render_frame_helper.cc
-index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8bdd9963fa 100644
+index e0ecf8f3f09dafe44a5220117281a08e38a61bef..edbaa28ec4ffd22b6afa332365c5dc51c33de31e 100644
 --- a/components/printing/renderer/print_render_frame_helper.cc
 +++ b/components/printing/renderer/print_render_frame_helper.cc
-@@ -40,6 +40,7 @@
+@@ -41,6 +41,7 @@
  #include "printing/metafile_skia.h"
  #include "printing/mojom/print.mojom.h"
  #include "printing/print_job_constants.h"
@@ -580,26 +587,26 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
  #include "printing/units.h"
  #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
  #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
-@@ -1264,7 +1265,8 @@ void PrintRenderFrameHelper::ScriptedPrint(bool user_initiated) {
+@@ -1276,7 +1277,8 @@ void PrintRenderFrameHelper::ScriptedPrint(bool user_initiated) {
      if (!weak_this)
        return;
  
 -    Print(web_frame, blink::WebNode(), PrintRequestType::kScripted);
 +    Print(web_frame, blink::WebNode(), PrintRequestType::kScripted,
-+          false /* silent */, base::DictionaryValue() /* new_settings */);
++          false /* silent */, base::Value::Dict() /* new_settings */);
      if (!weak_this)
        return;
  
-@@ -1295,7 +1297,7 @@ void PrintRenderFrameHelper::BindPrintRenderFrameReceiver(
+@@ -1307,7 +1309,7 @@ void PrintRenderFrameHelper::BindPrintRenderFrameReceiver(
    receivers_.Add(this, std::move(receiver));
  }
  
 -void PrintRenderFrameHelper::PrintRequestedPages() {
-+void PrintRenderFrameHelper::PrintRequestedPages(bool silent, base::Value settings) {
++void PrintRenderFrameHelper::PrintRequestedPages(bool silent, base::Value::Dict settings) {
    ScopedIPC scoped_ipc(weak_ptr_factory_.GetWeakPtr());
    if (ipc_nesting_level_ > kAllowedIpcDepthForPrint)
      return;
-@@ -1310,7 +1312,7 @@ void PrintRenderFrameHelper::PrintRequestedPages() {
+@@ -1322,7 +1324,7 @@ void PrintRenderFrameHelper::PrintRequestedPages() {
    // plugin node and print that instead.
    auto plugin = delegate_->GetPdfElement(frame);
  
@@ -608,17 +615,17 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
  
    if (!render_frame_gone_)
      frame->DispatchAfterPrintEvent();
-@@ -1341,7 +1343,8 @@ void PrintRenderFrameHelper::PrintForSystemDialog() {
+@@ -1353,7 +1355,8 @@ void PrintRenderFrameHelper::PrintForSystemDialog() {
    }
  
    Print(frame, print_preview_context_.source_node(),
 -        PrintRequestType::kRegular);
 +        PrintRequestType::kRegular, false,
-+        base::DictionaryValue());
++        base::Value::Dict());
    if (!render_frame_gone_)
      print_preview_context_.DispatchAfterPrintEvent();
    // WARNING: |this| may be gone at this point. Do not do any more work here and
-@@ -1390,6 +1393,8 @@ void PrintRenderFrameHelper::PrintPreview(base::Value settings) {
+@@ -1402,6 +1405,8 @@ void PrintRenderFrameHelper::PrintPreview(base::Value settings) {
    if (ipc_nesting_level_ > kAllowedIpcDepthForPrint)
      return;
  
@@ -627,37 +634,37 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
    print_preview_context_.OnPrintPreview();
  
  #if BUILDFLAG(IS_CHROMEOS_ASH)
-@@ -1942,7 +1947,8 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
+@@ -2008,7 +2013,8 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
        return;
  
      Print(duplicate_node.GetDocument().GetFrame(), duplicate_node,
 -          PrintRequestType::kRegular);
 +          PrintRequestType::kRegular, false /* silent */,
-+          base::DictionaryValue() /* new_settings */);
++          base::Value::Dict() /* new_settings */);
      // Check if |this| is still valid.
      if (!weak_this)
        return;
-@@ -1957,7 +1963,9 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
+@@ -2023,7 +2029,9 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
  
  void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
                                     const blink::WebNode& node,
 -                                   PrintRequestType print_request_type) {
 +                                   PrintRequestType print_request_type,
 +                                   bool silent,
-+                                   base::Value settings) {
++                                   base::Value::Dict settings) {
    // If still not finished with earlier print request simply ignore.
    if (prep_frame_view_)
      return;
-@@ -1965,7 +1973,7 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
+@@ -2031,7 +2039,7 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
    FrameReference frame_ref(frame);
  
    uint32_t expected_page_count = 0;
 -  if (!CalculateNumberOfPages(frame, node, &expected_page_count)) {
-+  if (!CalculateNumberOfPages(frame, node, &expected_page_count, base::Value::AsDictionaryValue(settings))) {
++  if (!CalculateNumberOfPages(frame, node, &expected_page_count, std::move(settings))) {
      DidFinishPrinting(FAIL_PRINT_INIT);
      return;  // Failed to init print page settings.
    }
-@@ -1984,8 +1992,15 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
+@@ -2050,8 +2058,15 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
          print_pages_params_->params->print_scaling_option;
  
      auto self = weak_ptr_factory_.GetWeakPtr();
@@ -674,7 +681,7 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
      // Check if |this| is still valid.
      if (!self)
        return;
-@@ -2233,36 +2248,51 @@ void PrintRenderFrameHelper::IPCProcessed() {
+@@ -2300,36 +2315,52 @@ void PrintRenderFrameHelper::IPCProcessed() {
    }
  }
  
@@ -684,10 +691,10 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
 -  GetPrintManagerHost()->GetDefaultPrintSettings(&settings.params);
 +bool PrintRenderFrameHelper::InitPrintSettings(
 +    bool fit_to_paper_size,
-+    const base::DictionaryValue& new_settings) {
++    base::Value::Dict new_settings) {
 +  mojom::PrintPagesParamsPtr settings;
 +
-+  if (new_settings.DictEmpty()) {
++  if (new_settings.empty()) {
 +    settings = mojom::PrintPagesParams::New();
 +    settings->params = mojom::PrintParams::New();
 +    GetPrintManagerHost()->GetDefaultPrintSettings(&settings->params);
@@ -695,7 +702,8 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
 +    bool canceled = false;
 +    int cookie =
 +      print_pages_params_ ? print_pages_params_->params->document_cookie : 0;
-+    GetPrintManagerHost()->UpdatePrintSettings(cookie, new_settings.Clone(), &settings, &canceled);
++    GetPrintManagerHost()->UpdatePrintSettings(
++      cookie, std::move(new_settings), &settings, &canceled);
 +    if (canceled)
 +      return false;
 +  }
@@ -730,15 +738,15 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
 +    blink::WebLocalFrame* frame,
 +    const blink::WebNode& node,
 +    uint32_t* number_of_pages,
-+    const base::DictionaryValue& settings) {
++    base::Value::Dict settings) {
    DCHECK(frame);
    bool fit_to_paper_size = !IsPrintingPdfFrame(frame, node);
 -  if (!InitPrintSettings(fit_to_paper_size)) {
-+  if (!InitPrintSettings(fit_to_paper_size, settings)) {
++  if (!InitPrintSettings(fit_to_paper_size, std::move(settings))) {
      notify_browser_of_print_failure_ = false;
      GetPrintManagerHost()->ShowInvalidPrinterSettingsError();
      return false;
-@@ -2406,7 +2436,7 @@ mojom::PrintPagesParamsPtr PrintRenderFrameHelper::GetPrintSettingsFromUser(
+@@ -2454,7 +2485,7 @@ mojom::PrintPagesParamsPtr PrintRenderFrameHelper::GetPrintSettingsFromUser(
        std::move(params),
        base::BindOnce(
            [](base::OnceClosure quit_closure, mojom::PrintPagesParamsPtr* output,
@@ -747,7 +755,7 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
              *output = std::move(input);
              std::move(quit_closure).Run();
            },
-@@ -2657,18 +2687,7 @@ void PrintRenderFrameHelper::RequestPrintPreview(PrintPreviewRequestType type,
+@@ -2705,18 +2736,7 @@ void PrintRenderFrameHelper::RequestPrintPreview(PrintPreviewRequestType type,
  }
  
  bool PrintRenderFrameHelper::CheckForCancel() {
@@ -768,60 +776,60 @@ index 36852ff8edee8da4ca43cf84c316f1f0eaff9fe0..7be102bae492701cddefc1623af4fe8b
  
  bool PrintRenderFrameHelper::PreviewPageRendered(
 diff --git a/components/printing/renderer/print_render_frame_helper.h b/components/printing/renderer/print_render_frame_helper.h
-index cd26f9ecf888c2a321890edd378ee0f8843a7f6c..958794f95fe8830b7e494340fbd53b0e92a498e3 100644
+index 15c367bd66706c915fdb95faf483429a8b31eb4c..ba2d5decbad2195c63efa4a5e23c60df7de69441 100644
 --- a/components/printing/renderer/print_render_frame_helper.h
 +++ b/components/printing/renderer/print_render_frame_helper.h
-@@ -257,7 +257,7 @@ class PrintRenderFrameHelper
+@@ -254,7 +254,7 @@ class PrintRenderFrameHelper
        mojo::PendingAssociatedReceiver<mojom::PrintRenderFrame> receiver);
  
    // printing::mojom::PrintRenderFrame:
 -  void PrintRequestedPages() override;
-+  void PrintRequestedPages(bool silent, base::Value settings) override;
++  void PrintRequestedPages(bool silent, base::Value::Dict settings) override;
  #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
    void PrintForSystemDialog() override;
    void SetPrintPreviewUI(
-@@ -324,7 +324,9 @@ class PrintRenderFrameHelper
+@@ -325,7 +325,9 @@ class PrintRenderFrameHelper
    // WARNING: |this| may be gone after this method returns.
    void Print(blink::WebLocalFrame* frame,
               const blink::WebNode& node,
 -             PrintRequestType print_request_type);
 +             PrintRequestType print_request_type,
 +             bool silent,
-+             base::Value settings);
++             base::Value::Dict settings);
  
    // Notification when printing is done - signal tear-down/free resources.
    void DidFinishPrinting(PrintingResult result);
-@@ -333,12 +335,14 @@ class PrintRenderFrameHelper
+@@ -334,12 +336,14 @@ class PrintRenderFrameHelper
  
    // Initialize print page settings with default settings.
    // Used only for native printing workflow.
 -  bool InitPrintSettings(bool fit_to_paper_size);
 +  bool InitPrintSettings(bool fit_to_paper_size,
-+                         const base::DictionaryValue& settings);
++                         base::Value::Dict new_settings);
  
    // Calculate number of pages in source document.
    bool CalculateNumberOfPages(blink::WebLocalFrame* frame,
                                const blink::WebNode& node,
 -                              uint32_t* number_of_pages);
 +                              uint32_t* number_of_pages,
-+                              const base::DictionaryValue& settings);
++                              base::Value::Dict settings);
  
  #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
    // Set options for print preset from source PDF document.
 diff --git a/printing/printing_context.cc b/printing/printing_context.cc
-index d0ef2181c649afe110c3c466a565a01cf6ae63a9..2daf9f02d41e04930fc4dad6d36ccbf3006dc175 100644
+index 8a8fcefa9da92a044f5bdf6a2f242048b325d442..6dae33514675d6843736b2c9a767a4b72cb103fa 100644
 --- a/printing/printing_context.cc
 +++ b/printing/printing_context.cc
-@@ -119,7 +119,6 @@ mojom::ResultCode PrintingContext::UsePdfSettings() {
+@@ -117,7 +117,6 @@ mojom::ResultCode PrintingContext::UsePdfSettings() {
  
  mojom::ResultCode PrintingContext::UpdatePrintSettings(
-     base::Value job_settings) {
+     base::Value::Dict job_settings) {
 -  ResetSettings();
    {
      std::unique_ptr<PrintSettings> settings =
-         PrintSettingsFromJobSettings(job_settings.GetDict());
+         PrintSettingsFromJobSettings(job_settings);
 diff --git a/printing/printing_context.h b/printing/printing_context.h
-index 3f36303105b7979a1a771bf26b42596abe5b3cce..52f740bb832db4a8d76431d9bc77cab10bb7e0c7 100644
+index 2c8ef23f7cb75a743fa18e3c613f7c719988028c..265005d6d51f861aa7ccd7e0eba7809b3c652dae 100644
 --- a/printing/printing_context.h
 +++ b/printing/printing_context.h
 @@ -170,6 +170,9 @@ class COMPONENT_EXPORT(PRINTING) PrintingContext {

patches/chromium/refactor_expose_cursor_changes_to_the_webcontentsobserver.patch

@@ -43,10 +43,10 @@ index 7cda66952e0d3a67c32791ad3c7d7de8df03f876..8cb3a596593c52e776d546d25fb07800
  
  void RenderWidgetHostImpl::ShowContextMenuAtPoint(
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index df03de0a810bbce796d5bc421b92000e02dbd449..b9309e1cbc4a8b701534aa8be2827c40d98d6678 100644
+index faa795be3a6cbc7ae13d9a42a1bdbd01ac0406a9..add5ba98f4409460b93aa2f8c49eb49a1f59470a 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -4519,6 +4519,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {
+@@ -4523,6 +4523,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {
    return text_input_manager_.get();
  }
  
@@ -59,7 +59,7 @@ index df03de0a810bbce796d5bc421b92000e02dbd449..b9309e1cbc4a8b701534aa8be2827c40
      RenderWidgetHostImpl* render_widget_host) {
    return render_widget_host == GetMainFrame()->GetRenderWidgetHost();
 diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
-index 80aeacf4ad593a7d40dae6c9096ab0c700ab22d8..07355cb194bd429a693e587072d11432d6c0888a 100644
+index 7ad2648933434282c5bdd3fd5d9187d86e142b60..2a29af8d9aa67768ec521e87190174397a25b722 100644
 --- a/content/browser/web_contents/web_contents_impl.h
 +++ b/content/browser/web_contents/web_contents_impl.h
 @@ -962,6 +962,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,