Bump v18.3.5

Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

.circleci/config/base.yml

@@ -24,7 +24,7 @@ parameters:
   linux-publish-arch-limit:
     type: enum
     default: all
-    enum: ["all", "arm", "arm64", "x64"]
+    enum: ["all", "arm", "arm64", "x64", "ia32"]
 
   run-macos-publish:
     type: boolean
@@ -55,9 +55,9 @@ executors:
         enum: ["macos.x86.medium.gen2", "large"]
       xcode:
         description: "xcode version"
-        default: 13.3.0
+        default: 13.2.1
         type: enum
-        enum: ["12.4.0", "13.3.0"]
+        enum: ["12.4.0", "13.2.1"]
 
     macos:
       xcode: << parameters.xcode >>
@@ -113,6 +113,12 @@ env-unittests: &env-unittests
   BUILD_TARGET: electron/spec:chromium_unittests
   TESTS_CONFIG: src/electron/spec/configs/unittests.yml
 
+# Build targets options.
+env-ia32: &env-ia32
+  GN_EXTRA_ARGS: 'target_cpu = "x86"'
+  NPM_CONFIG_ARCH: ia32
+  TARGET_ARCH: ia32
+
 env-arm: &env-arm
   GN_EXTRA_ARGS: 'target_cpu = "arm"'
   MKSNAPSHOT_TOOLCHAIN: //build/toolchain/linux:clang_arm
@@ -238,20 +244,11 @@ step-depot-tools-get: &step-depot-tools-get
     name: Get depot tools
     command: |
       git clone --depth=1 https://chromium.googlesource.com/chromium/tools/depot_tools.git
+      # remove ninjalog_uploader_wrapper.py from autoninja since we don't use it and it causes problems
       if [ "`uname`" == "Darwin" ]; then
-        # remove ninjalog_uploader_wrapper.py from autoninja since we don't use it and it causes problems
         sed -i '' '/ninjalog_uploader_wrapper.py/d' ./depot_tools/autoninja
       else
         sed -i '/ninjalog_uploader_wrapper.py/d' ./depot_tools/autoninja
-        # Remove swift-format dep from cipd on macOS until we send a patch upstream.
-        cd depot_tools
-        patch gclient.py -R \<<'EOF'
-      676,677c676
-      <         packages = dep_value.get('packages', [])
-      <         for package in (x for x in packages if "infra/3pp/tools/swift-format" not in x.get('package')):
-      ---
-      >         for package in dep_value.get('packages', []):
-      EOF
       fi
 
 step-depot-tools-add-to-path: &step-depot-tools-add-to-path
@@ -357,14 +354,14 @@ step-restore-brew-cache: &step-restore-brew-cache
       - /usr/local/Cellar/gnu-tar
       - /usr/local/bin/gtar
     keys:
-      - v5-brew-cache-{{ arch }}
+      - v4-brew-cache-{{ arch }}
 
 step-save-brew-cache: &step-save-brew-cache
   save_cache:
     paths:
       - /usr/local/Cellar/gnu-tar
       - /usr/local/bin/gtar
-    key: v5-brew-cache-{{ arch }}
+    key: v4-brew-cache-{{ arch }}
     name: Persisting brew cache
 
 step-get-more-space-on-mac: &step-get-more-space-on-mac
@@ -373,7 +370,6 @@ step-get-more-space-on-mac: &step-get-more-space-on-mac
     command: |
       if [ "`uname`" == "Darwin" ]; then
         sudo mkdir -p $TMPDIR/del-target
-
         tmpify() {
           if [ -d "$1" ]; then
             sudo mv "$1" $TMPDIR/del-target/$(echo $1|shasum -a 256|head -n1|cut -d " " -f1)
@@ -445,11 +441,9 @@ step-get-more-space-on-mac: &step-get-more-space-on-mac
     background: true
 
 # On macOS delete all .git directories under src/ expect for
-# third_party/angle/ and third_party/dawn/ because of build time generation of files
+# third_party/angle/ because of build time generation of file
 # gen/angle/commit.h depends on third_party/angle/.git/HEAD
 # https://chromium-review.googlesource.com/c/angle/angle/+/2074924
-# and dawn/common/Version_autogen.h depends on  third_party/dawn/.git/HEAD
-# https://dawn-review.googlesource.com/c/dawn/+/83901
 # TODO: maybe better to always leave out */.git/HEAD file for all targets ?
 step-delete-git-directories: &step-delete-git-directories
   run:
@@ -457,7 +451,7 @@ step-delete-git-directories: &step-delete-git-directories
     command: |
       if [ "`uname`" == "Darwin" ]; then
         cd src
-        ( find . -type d -name ".git" -not -path "./third_party/angle/*" -not -path "./third_party/dawn/*" ) | xargs rm -rf
+        ( find . -type d -name ".git" -not -path "./third_party/angle/*" ) | xargs rm -rf
       fi
 
 # On macOS the yarn install command during gclient sync was run on a linux
@@ -520,15 +514,6 @@ step-install-gnutar-on-mac: &step-install-gnutar-on-mac
         ln -fs /usr/local/bin/gtar /usr/local/bin/tar
       fi
 
-step-install-python2-on-mac: &step-install-python2-on-mac
-  run:
-    name: Install python2 on macos
-    command: |
-      if [ "`uname`" == "Darwin" ]; then
-        curl -O https://www.python.org/ftp/python/2.7.18/python-2.7.18-macosx10.9.pkg
-        sudo installer -pkg python-2.7.18-macosx10.9.pkg -target /
-      fi
-
 step-gn-gen-default: &step-gn-gen-default
   run:
     name: Default GN gen
@@ -592,6 +577,8 @@ step-maybe-electron-dist-strip: &step-maybe-electron-dist-strip
       if [ "$STRIP_BINARIES" == "true" ] && [ "`uname`" == "Linux" ]; then
         if [ x"$TARGET_ARCH" == x ]; then
           target_cpu=x64
+        elif [ "$TARGET_ARCH" == "ia32" ]; then
+          target_cpu=x86
         else
           target_cpu="$TARGET_ARCH"
         fi
@@ -914,7 +901,7 @@ step-restore-out-cache: &step-restore-out-cache
     paths:
       - ./src/out/Default
     keys:
-      - v10-out-cache-{{ checksum "src/electron/.depshash" }}-{{ checksum "src/electron/.depshash-target" }}
+      - v9-out-cache-{{ checksum "src/electron/.depshash" }}-{{ checksum "src/electron/.depshash-target" }}
     name: Restoring out cache
 
 step-set-git-cache-path: &step-set-git-cache-path
@@ -938,7 +925,7 @@ step-save-out-cache: &step-save-out-cache
   save_cache:
     paths:
       - ./src/out/Default
-    key: v10-out-cache-{{ checksum "src/electron/.depshash" }}-{{ checksum "src/electron/.depshash-target" }}
+    key: v9-out-cache-{{ checksum "src/electron/.depshash" }}-{{ checksum "src/electron/.depshash-target" }}
     name: Persisting out cache
 
 step-run-electron-only-hooks: &step-run-electron-only-hooks
@@ -1010,7 +997,6 @@ steps-electron-gn-check: &steps-electron-gn-check
     - *step-checkout-electron
     - *step-depot-tools-get
     - *step-depot-tools-add-to-path
-    - *step-install-python2-on-mac
     - *step-setup-env-for-build
     - *step-setup-goma-for-build
     - *step-generate-deps-hash
@@ -1028,7 +1014,6 @@ steps-electron-ts-compile-for-doc-change: &steps-electron-ts-compile-for-doc-cha
     - *step-depot-tools-add-to-path
     - *step-restore-brew-cache
     - *step-install-gnutar-on-mac
-    - *step-install-python2-on-mac
     - *step-get-more-space-on-mac
     - *step-setup-goma-for-build
     - *step-generate-deps-hash
@@ -1064,7 +1049,6 @@ steps-native-tests: &steps-native-tests
     - attach_workspace:
         at: .
     - *step-depot-tools-add-to-path
-    - *step-install-python2-on-mac
     - *step-setup-env-for-build
     - *step-setup-goma-for-build
     - *step-wait-for-goma
@@ -1261,7 +1245,6 @@ commands:
             mv_if_exist src/out/Default/hunspell_dictionaries.zip
             mv_if_exist src/cross-arch-snapshots
             mv_if_exist src/out/electron_ninja_log
-            mv_if_exist src/out/Default/.ninja_log
           when: always
       - store_artifacts:
           path: generated_artifacts
@@ -1317,6 +1300,8 @@ commands:
                   target_os=linux
                   if [ x"$TARGET_ARCH" == x ]; then
                     target_cpu=x64
+                  elif [ "$TARGET_ARCH" == "ia32" ]; then
+                    target_cpu=x86
                   else
                     target_cpu="$TARGET_ARCH"
                   fi
@@ -1372,7 +1357,6 @@ commands:
             - run: rm -rf src/electron
       - *step-restore-brew-cache
       - *step-install-gnutar-on-mac
-      - *step-install-python2-on-mac
       - *step-save-brew-cache
       - when:
           condition: << parameters.build >>
@@ -1564,7 +1548,6 @@ commands:
             - *step-depot-tools-get
       - *step-depot-tools-add-to-path
       - *step-restore-brew-cache
-      - *step-install-python2-on-mac
       - *step-get-more-space-on-mac
       - when:
           condition: << parameters.checkout >>
@@ -1624,7 +1607,7 @@ jobs:
       name: linux-docker
       size: medium
     environment:
-      <<: *env-linux-2xlarge
+      <<: *env-linux-medium
       <<: *env-testing-build
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     <<: *steps-electron-ts-compile-for-doc-change
@@ -1761,6 +1744,44 @@ jobs:
                 attach: false
                 checkout: true
 
+  linux-ia32-testing:
+    executor:
+      name: linux-docker
+      size: xlarge
+    environment:
+      <<: *env-global
+      <<: *env-ia32
+      <<: *env-testing-build
+      <<: *env-ninja-status
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
+    steps:
+      - electron-build:
+          persist: true
+          checkout: true
+          use-out-cache: false
+
+  linux-ia32-publish:
+    executor:
+      name: linux-docker
+      size: 2xlarge
+    environment:
+      <<: *env-linux-2xlarge-release
+      <<: *env-ia32
+      <<: *env-release-build
+      <<: *env-32bit-release
+      UPLOAD_TO_STORAGE: << pipeline.parameters.upload-to-storage >>
+      <<: *env-ninja-status
+    steps:
+      - run: echo running
+      - when:
+          condition:
+            or:
+              - equal: ["all", << pipeline.parameters.linux-publish-arch-limit >>]
+              - equal: ["ia32", << pipeline.parameters.linux-publish-arch-limit >>]
+          steps:
+            - electron-publish:
+                attach: false
+                checkout: true
 
   linux-arm-testing:
     executor:
@@ -2093,6 +2114,51 @@ jobs:
       <<: *env-send-slack-notifications
     <<: *steps-verify-ffmpeg
 
+  linux-ia32-testing-tests:
+    executor:
+      name: linux-docker
+      size: medium
+    environment:
+      <<: *env-linux-medium
+      <<: *env-ia32
+      <<: *env-headless-testing
+      <<: *env-stack-dumping
+    parallelism: 3
+    <<: *steps-tests
+
+  linux-ia32-testing-nan:
+    executor:
+      name: linux-docker
+      size: medium
+    environment:
+      <<: *env-linux-medium
+      <<: *env-ia32
+      <<: *env-headless-testing
+      <<: *env-stack-dumping
+    <<: *steps-test-nan
+
+  linux-ia32-testing-node:
+    executor:
+      name: linux-docker
+      size: xlarge
+    environment:
+      <<: *env-linux-medium
+      <<: *env-ia32
+      <<: *env-headless-testing
+      <<: *env-stack-dumping
+    <<: *steps-test-node
+
+  linux-ia32-verify-ffmpeg:
+    executor:
+      name: linux-docker
+      size: medium
+    environment:
+      <<: *env-linux-medium
+      <<: *env-ia32
+      <<: *env-headless-testing
+      <<: *env-send-slack-notifications
+    <<: *steps-verify-ffmpeg
+
   linux-arm-testing-tests:
     executor: linux-arm
     environment:
@@ -2176,6 +2242,8 @@ workflows:
     jobs:
     - linux-x64-publish:
         context: release-env
+    - linux-ia32-publish:
+        context: release-env
     - linux-arm-publish:
         context: release-env
     - linux-arm64-publish:
@@ -2234,6 +2302,18 @@ workflows:
       - linux-x64-testing-node:
           requires:
             - linux-x64-testing
+      - linux-ia32-testing:
+          requires:
+            - linux-make-src-cache
+      - linux-ia32-testing-tests:
+          requires:
+            - linux-ia32-testing
+      - linux-ia32-testing-nan:
+          requires:
+            - linux-ia32-testing
+      - linux-ia32-testing-node:
+          requires:
+            - linux-ia32-testing
       - linux-arm-testing:
           requires:
             - linux-make-src-cache

.eslintrc.json

@@ -1,5 +1,4 @@
 {
-  "root": true,
   "extends": "standard",
   "parser": "@typescript-eslint/parser",
   "plugins": ["@typescript-eslint"],

.git-blame-ignore-revs

@@ -1,5 +0,0 @@
-# Atom --> Electron rename
-d9321f4df751fa32813fab1b6387bbd61bd681d0
-34c4c8d5088fa183f56baea28809de6f2a427e02
-# Enable JS Semicolons
-5d657dece4102e5e5304d42e8004b6ad64c0fcda

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -17,11 +17,8 @@ body:
 - type: input
   attributes:
     label: Electron Version
-    description: |
-      What version of Electron are you using?
-      
-      Note: Please only report issues for [currently supported versions of Electron](https://www.electronjs.org/docs/latest/tutorial/support#currently-supported-versions).
-    placeholder: 17.0.0
+    description: What version of Electron are you using?
+    placeholder: 12.0.0
   validations:
     required: true
 - type: dropdown
@@ -56,7 +53,7 @@ body:
   attributes:
     label: Last Known Working Electron version
     description: What is the last version of Electron this worked in, if applicable?
-    placeholder: 16.0.0
+    placeholder: 11.0.0
 - type: textarea
   attributes:
     label: Expected Behavior

BUILD.gn

@@ -80,7 +80,10 @@ if (is_linux) {
   }
 
   generate_stubs("electron_gtk_stubs") {
-    sigs = [ "shell/browser/ui/electron_gtk.sigs" ]
+    sigs = [
+      "shell/browser/ui/electron_gdk_pixbuf.sigs",
+      "shell/browser/ui/electron_gtk.sigs",
+    ]
     extra_header = "shell/browser/ui/electron_gtk.fragment"
     output_name = "electron_gtk_stubs"
     public_deps = [ "//ui/gtk:gtk_config" ]
@@ -510,8 +513,6 @@ source_set("electron_lib") {
       "StoreKit.framework",
     ]
 
-    weak_frameworks = [ "QuickLookThumbnailing.framework" ]
-
     sources += [
       "shell/browser/ui/views/autofill_popup_view.cc",
       "shell/browser/ui/views/autofill_popup_view.h",
@@ -708,7 +709,7 @@ source_set("electron_lib") {
       "//components/pdf/browser:interceptors",
       "//components/pdf/common",
       "//components/pdf/renderer",
-      "//pdf",
+      "//pdf:pdf_ppapi",
     ]
     sources += [
       "shell/browser/electron_pdf_web_contents_helper_client.cc",
@@ -810,11 +811,16 @@ if (is_mac) {
     # Add the SwiftShader .dylibs in the Libraries directory of the Framework.
     bundle_data("electron_swiftshader_binaries") {
       sources = [
+        "$root_out_dir/egl_intermediates/libswiftshader_libEGL.dylib",
+        "$root_out_dir/egl_intermediates/libswiftshader_libGLESv2.dylib",
         "$root_out_dir/vk_intermediates/libvk_swiftshader.dylib",
         "$root_out_dir/vk_intermediates/vk_swiftshader_icd.json",
       ]
       outputs = [ "{{bundle_contents_dir}}/Libraries/{{source_file_part}}" ]
-      public_deps = [ "//ui/gl:swiftshader_vk_library_copy" ]
+      public_deps = [
+        "//ui/gl:swiftshader_egl_library_copy",
+        "//ui/gl:swiftshader_vk_library_copy",
+      ]
     }
   }
   group("electron_angle_library") {
@@ -1011,14 +1017,14 @@ if (is_mac) {
   action("electron_app_lproj_dirs") {
     outputs = []
 
-    foreach(locale, locales_as_apple_outputs) {
+    foreach(locale, locales_as_mac_outputs) {
       outputs += [ "$target_gen_dir/app_infoplist_strings/$locale.lproj" ]
     }
     script = "build/mac/make_locale_dirs.py"
     args = rebase_path(outputs)
   }
 
-  foreach(locale, locales_as_apple_outputs) {
+  foreach(locale, locales_as_mac_outputs) {
     bundle_data("electron_app_strings_${locale}_bundle_data") {
       sources = [ "$target_gen_dir/app_infoplist_strings/$locale.lproj" ]
       outputs = [ "{{bundle_resources_dir}}/$locale.lproj" ]
@@ -1027,7 +1033,7 @@ if (is_mac) {
   }
   group("electron_app_strings_bundle_data") {
     public_deps = []
-    foreach(locale, locales_as_apple_outputs) {
+    foreach(locale, locales_as_mac_outputs) {
       public_deps += [ ":electron_app_strings_${locale}_bundle_data" ]
     }
   }
@@ -1106,18 +1112,21 @@ if (is_mac) {
       deps = [ ":electron_app" ]
     }
 
-    extract_symbols("egl_syms") {
-      binary = "$root_out_dir/libEGL.dylib"
+    extract_symbols("swiftshader_egl_syms") {
+      binary = "$root_out_dir/libswiftshader_libEGL.dylib"
       symbol_dir = "$root_out_dir/breakpad_symbols"
-      dsym_file = "$root_out_dir/libEGL.dylib.dSYM/Contents/Resources/DWARF/libEGL.dylib"
-      deps = [ "//third_party/angle:libEGL" ]
+      dsym_file = "$root_out_dir/libswiftshader_libEGL.dylib.dSYM/Contents/Resources/DWARF/libswiftshader_libEGL.dylib"
+      deps =
+          [ "//third_party/swiftshader/src/OpenGL/libEGL:swiftshader_libEGL" ]
     }
 
-    extract_symbols("gles_syms") {
-      binary = "$root_out_dir/libGLESv2.dylib"
+    extract_symbols("swiftshader_gles_syms") {
+      binary = "$root_out_dir/libswiftshader_libGLESv2.dylib"
       symbol_dir = "$root_out_dir/breakpad_symbols"
-      dsym_file = "$root_out_dir/libGLESv2.dylib.dSYM/Contents/Resources/DWARF/libGLESv2.dylib"
-      deps = [ "//third_party/angle:libGLESv2" ]
+      dsym_file = "$root_out_dir/libswiftshader_libGLESv2.dylib.dSYM/Contents/Resources/DWARF/libswiftshader_libGLESv2.dylib"
+      deps = [
+        "//third_party/swiftshader/src/OpenGL/libGLESv2:swiftshader_libGLESv2",
+      ]
     }
 
     extract_symbols("crashpad_handler_syms") {
@@ -1129,10 +1138,10 @@ if (is_mac) {
 
     group("electron_symbols") {
       deps = [
-        ":egl_syms",
         ":electron_app_syms",
         ":electron_framework_syms",
-        ":gles_syms",
+        ":swiftshader_egl_syms",
+        ":swiftshader_gles_syms",
       ]
 
       if (!is_mas_build) {
@@ -1291,23 +1300,27 @@ if (is_mac) {
       deps = [ ":electron_app" ]
     }
 
-    extract_symbols("egl_symbols") {
-      binary = "$root_out_dir/libEGL$_target_shared_library_suffix"
+    extract_symbols("swiftshader_egl_symbols") {
+      binary = "$root_out_dir/swiftshader/libEGL$_target_shared_library_suffix"
       symbol_dir = "$root_out_dir/breakpad_symbols"
-      deps = [ "//third_party/angle:libEGL" ]
+      deps =
+          [ "//third_party/swiftshader/src/OpenGL/libEGL:swiftshader_libEGL" ]
     }
 
-    extract_symbols("gles_symbols") {
-      binary = "$root_out_dir/libGLESv2$_target_shared_library_suffix"
+    extract_symbols("swiftshader_gles_symbols") {
+      binary =
+          "$root_out_dir/swiftshader/libGLESv2$_target_shared_library_suffix"
       symbol_dir = "$root_out_dir/breakpad_symbols"
-      deps = [ "//third_party/angle:libGLESv2" ]
+      deps = [
+        "//third_party/swiftshader/src/OpenGL/libGLESv2:swiftshader_libGLESv2",
+      ]
     }
 
     group("electron_symbols") {
       deps = [
-        ":egl_symbols",
         ":electron_app_symbols",
-        ":gles_symbols",
+        ":swiftshader_egl_symbols",
+        ":swiftshader_gles_symbols",
       ]
     }
   }

DEPS

@@ -1,10 +1,23 @@
-gclient_gn_args_from = 'src'
+gclient_gn_args_file = 'src/build/config/gclient_args.gni'
+gclient_gn_args = [
+  'build_with_chromium',
+  'checkout_android',
+  'checkout_android_native_support',
+  'checkout_libaom',
+  'checkout_nacl',
+  'checkout_pgo_profiles',
+  'checkout_oculus_sdk',
+  'checkout_openxr',
+  'checkout_google_benchmark',
+  'mac_xcode_version',
+  'generate_location_tags',
+]
 
 vars = {
   'chromium_version':
-    '102.0.5005.40',
+    '100.0.4896.160',
   'node_version':
-    'v16.14.2',
+    'v16.13.2',
   'nan_version':
     # The following commit hash of NAN is v2.14.2 with *only* changes to the
     # test suite. This should be updated to a specific tag when one becomes

ELECTRON_VERSION

@@ -1 +1 @@
-19.0.0-beta.6
+18.3.5

README.md

@@ -34,17 +34,6 @@ For more installation options and troubleshooting tips, see
 [installation](docs/tutorial/installation.md). For info on how to manage Electron versions in your apps, see
 [Electron versioning](docs/tutorial/electron-versioning.md).
 
-## Platform support
-
-Each Electron release provides binaries for macOS, Windows, and Linux.
-
-* macOS (El Capitan and up): Electron provides 64-bit Intel and ARM binaries for macOS. Apple Silicon support was added in Electron 11.
-* Windows (Windows 7 and up): Electron provides `ia32` (`x86`), `x64` (`amd64`), and `arm64` binaries for Windows. Windows on ARM support was added in Electron 5.0.8.
-* Linux: The prebuilt binaries of Electron are built on Ubuntu 20.04. They have also been verified to work on:
-  * Ubuntu 14.04 and newer
-  * Fedora 24 and newer
-  * Debian 8 and newer
-
 ## Quick start & Electron Fiddle
 
 Use [`Electron Fiddle`](https://github.com/electron/fiddle)
@@ -65,10 +54,12 @@ npm start
 
 ## Resources for learning Electron
 
-* [electronjs.org/docs](https://electronjs.org/docs) - All of Electron's documentation
-* [electron/fiddle](https://github.com/electron/fiddle) - A tool to build, run, and package small Electron experiments
-* [electron/electron-quick-start](https://github.com/electron/electron-quick-start) - A very basic starter Electron app
-* [electronjs.org/community#boilerplates](https://electronjs.org/community#boilerplates) - Sample starter apps created by the community
+- [electronjs.org/docs](https://electronjs.org/docs) - All of Electron's documentation
+- [electron/fiddle](https://github.com/electron/fiddle) - A tool to build, run, and package small Electron experiments
+- [electron/electron-quick-start](https://github.com/electron/electron-quick-start) - A very basic starter Electron app
+- [electronjs.org/community#boilerplates](https://electronjs.org/community#boilerplates) - Sample starter apps created by the community
+- [electron/simple-samples](https://github.com/electron/simple-samples) - Small applications with ideas for taking them further
+- [electron/electron-api-demos](https://github.com/electron/electron-api-demos) - An Electron app that teaches you how to use Electron
 
 ## Programmatic usage
 
@@ -89,15 +80,11 @@ const child = proc.spawn(electron)
 
 ### Mirrors
 
-* [China](https://npmmirror.com/mirrors/electron/)
+- [China](https://npmmirror.com/mirrors/electron)
 
-See the [Advanced Installation Instructions](https://www.electronjs.org/docs/latest/tutorial/installation#mirror) to learn how to use a custom mirror.
+## Documentation Translations
 
-## Documentation translations
-
-We crowdsource translations for our documentation via [Crowdin](https://crowdin.com/project/electron).
-We currently accept translations for Chinese (Simplified), French, German, Japanese, Portuguese,
-Russian, and Spanish.
+Find documentation translations in [electron/i18n](https://github.com/electron/i18n).
 
 ## Contributing
 
@@ -106,10 +93,10 @@ If you are interested in reporting/fixing issues and contributing directly to th
 ## Community
 
 Info on reporting bugs, getting help, finding third-party tools and sample apps,
-and more can be found on the [Community page](https://www.electronjs.org/community).
+and more can be found in the [support document](docs/tutorial/support.md#finding-support).
 
 ## License
 
 [MIT](https://github.com/electron/electron/blob/main/LICENSE)
 
-When using Electron logos, make sure to follow [OpenJS Foundation Trademark Policy](https://openjsf.org/wp-content/uploads/sites/84/2021/01/OpenJS-Foundation-Trademark-Policy-2021-01-12.docx.pdf).
+When using the Electron or other GitHub logos, be sure to follow the [GitHub logo guidelines](https://github.com/logos).

appveyor.yml

@@ -29,7 +29,7 @@
 
 version: 1.0.{build}
 build_cloud: electron-16-core
-image: vs2019bt-16.16.11
+image: vs2019bt-16.6.2
 environment:
   GIT_CACHE_PATH: C:\Users\electron\libcc_cache
   ELECTRON_OUT_DIR: Default
@@ -154,12 +154,6 @@ build_script:
         if ($LASTEXITCODE -ne 0) {
           Write-warning "Failed to add third_party\angle\.git; continuing anyway"
         }
-        # build time generation of file dawn/common/Version_autogen.h depends on third_party/dawn/.git/HEAD
-        # https://dawn-review.googlesource.com/c/dawn/+/83901        
-        $(7z a $zipfile src\third_party\dawn\.git)
-        if ($LASTEXITCODE -ne 0) {
-          Write-warning "Failed to add third_party\dawn\.git; continuing anyway"
-        }
       }
   - cd src
   - set BUILD_CONFIG_PATH=//electron/build/args/%GN_CONFIG%.gn 
@@ -182,7 +176,7 @@ build_script:
   - ninja -C out/Default electron:electron_chromedriver_zip
   - ninja -C out/Default third_party/electron_node:headers
   - python %LOCAL_GOMA_DIR%\goma_ctl.py stat
-  - python3 electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
+  - python electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
   - appveyor PushArtifact out/Default/windows_toolchain_profile.json
   - appveyor PushArtifact out/Default/dist.zip
   - appveyor PushArtifact out/Default/shell_browser_ui_unittests.exe

build/args/all.gn

@@ -2,7 +2,7 @@ is_electron_build = true
 root_extra_deps = [ "//electron" ]
 
 # Registry of NMVs --> https://github.com/nodejs/node/blob/master/doc/abi_version_registry.json
-node_module_version = 106
+node_module_version = 103
 
 v8_promise_internal_field_count = 1
 v8_embedder_string = "-electron.0"
@@ -21,9 +21,15 @@ proprietary_codecs = true
 ffmpeg_branding = "Chrome"
 
 enable_basic_printing = true
+
+# Removes DLLs from the build, which are only meant to be used for Chromium development.
+# See https://github.com/electron/electron/pull/17985
 angle_enable_vulkan_validation_layers = false
 dawn_enable_vulkan_validation_layers = false
 
+# This breaks native node modules
+libcxx_abi_unstable = false
+
 # These are disabled because they cause the zip manifest to differ between
 # testing and release builds.
 # See https://chromium-review.googlesource.com/c/chromium/src/+/2774898.

chromium_src/BUILD.gn

@@ -69,7 +69,6 @@ static_library("chrome") {
     "//chrome/browser/ui/exclusive_access/keyboard_lock_controller.h",
     "//chrome/browser/ui/exclusive_access/mouse_lock_controller.cc",
     "//chrome/browser/ui/exclusive_access/mouse_lock_controller.h",
-    "//chrome/browser/ui/native_window_tracker.h",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper.cc",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper.h",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper_view.cc",
@@ -120,8 +119,6 @@ static_library("chrome") {
   if (use_aura) {
     sources += [
       "//chrome/browser/platform_util_aura.cc",
-      "//chrome/browser/ui/aura/native_window_tracker_aura.cc",
-      "//chrome/browser/ui/aura/native_window_tracker_aura.h",
       "//chrome/browser/ui/views/eye_dropper/eye_dropper_view_aura.cc",
     ]
   }
@@ -309,6 +306,8 @@ static_library("chrome") {
         "//chrome/browser/pdf/pdf_frame_util.h",
         "//chrome/browser/plugins/pdf_iframe_navigation_throttle.cc",
         "//chrome/browser/plugins/pdf_iframe_navigation_throttle.h",
+        "//chrome/renderer/pepper/chrome_pdf_print_client.cc",
+        "//chrome/renderer/pepper/chrome_pdf_print_client.h",
       ]
       deps += [
         "//components/pdf/browser",
@@ -346,6 +345,8 @@ source_set("plugins") {
   sources += [
     "//chrome/renderer/pepper/chrome_renderer_pepper_host_factory.cc",
     "//chrome/renderer/pepper/chrome_renderer_pepper_host_factory.h",
+    "//chrome/renderer/pepper/pepper_flash_font_file_host.cc",
+    "//chrome/renderer/pepper/pepper_flash_font_file_host.h",
     "//chrome/renderer/pepper/pepper_shared_memory_message_filter.cc",
     "//chrome/renderer/pepper/pepper_shared_memory_message_filter.h",
   ]

docs/README.md

@@ -64,6 +64,7 @@ an issue:
   * [Automated Testing](tutorial/automated-testing.md)
   * [REPL](tutorial/repl.md)
 * [Distribution](tutorial/application-distribution.md)
+  * [Supported Platforms](tutorial/support.md#supported-platforms)
   * [Code Signing](tutorial/code-signing.md)
   * [Mac App Store](tutorial/mac-app-store-submission-guide.md)
   * [Windows Store](tutorial/windows-store-guide.md)

docs/api/app.md

@@ -484,7 +484,6 @@ Returns:
 * `argv` string[] - An array of the second instance's command line arguments
 * `workingDirectory` string - The second instance's working directory
 * `additionalData` unknown - A JSON object of additional data passed from the second instance
-* `ackCallback` unknown - A function that can be used to send data back to the second instance
 
 This event will be emitted inside the primary instance of your application
 when a second instance has been executed and calls `app.requestSingleInstanceLock()`.
@@ -496,35 +495,12 @@ non-minimized.
 
 **Note:** If the second instance is started by a different user than the first, the `argv` array will not include the arguments.
 
-**Note:** `ackCallback` allows the user to send data back to the
-second instance during the `app.requestSingleInstanceLock()` flow.
-This callback can be used for cases where the second instance
-needs to obtain additional information from the first instance
-before quitting.
-
-Currently, the limit on the message size is kMaxMessageLength,
-or around 32kB. To be safe, keep the amount of data passed to 31kB at most.
-
-In order to call the callback, `event.preventDefault()` must be called, first.
-If the callback is not called in either case, `null` will be sent back.
-If `event.preventDefault()` is not called, but `ackCallback` is called
-by the user in the event, then the behaviour is undefined.
-
 This event is guaranteed to be emitted after the `ready` event of `app`
 gets emitted.
 
 **Note:** Extra command line arguments might be added by Chromium,
 such as `--original-process-start-time`.
 
-### Event: 'first-instance-ack'
-
-Returns:
-
-* `event` Event
-* `additionalData` unknown - A JSON object of additional data passed from the first instance, in response to the first instance's `second-instance` event.
-
-This event will be emitted within the second instance during the call to `app.requestSingleInstanceLock()`, when the first instance calls the `ackCallback` provided by the `second-instance` event handler.
-
 ## Methods
 
 The `app` object has the following methods:
@@ -714,7 +690,7 @@ Overrides the current application's name.
 ### `app.getLocale()`
 
 Returns `string` - The current application locale, fetched using Chromium's `l10n_util` library.
-Possible return values are documented [here](https://source.chromium.org/chromium/chromium/src/+/main:ui/base/l10n/l10n_util.cc).
+Possible return values are documented [here](https://source.chromium.org/chromium/chromium/src/+/master:ui/base/l10n/l10n_util.cc).
 
 To set the locale, you'll want to use a command line switch at app startup, which may be found [here](command-line-switches.md).
 
@@ -985,33 +961,21 @@ starts:
 const { app } = require('electron')
 let myWindow = null
 
-app.on('first-instance-ack', (event, additionalData) => {
-  // Print out the ack received from the first instance.
-  // Note this event handler must come before the requestSingleInstanceLock call.
-  // Expected output: '{"myAckKey":"myAckValue"}'
-  console.log(JSON.stringify(additionalData))
-})
-
 const additionalData = { myKey: 'myValue' }
 const gotTheLock = app.requestSingleInstanceLock(additionalData)
 
 if (!gotTheLock) {
   app.quit()
 } else {
-  app.on('second-instance', (event, commandLine, workingDirectory, additionalData, ackCallback) => {
-    // We must call preventDefault if we're sending back data.
-    event.preventDefault()
+  app.on('second-instance', (event, commandLine, workingDirectory, additionalData) => {
     // Print out data received from the second instance.
-    // Expected output: '{"myKey":"myValue"}'
-    console.log(JSON.stringify(additionalData))
+    console.log(additionalData)
 
     // Someone tried to run a second instance, we should focus our window.
     if (myWindow) {
       if (myWindow.isMinimized()) myWindow.restore()
       myWindow.focus()
     }
-    const ackData = { myAckKey: 'myAckValue' }
-    ackCallback(ackData)
   })
 
   // Create myWindow, load the rest of the app, etc...
@@ -1095,7 +1059,7 @@ Activation policy types:
 
 Imports the certificate in pkcs12 format into the platform certificate store.
 `callback` is called with the `result` of import operation, a value of `0`
-indicates success while any other value indicates failure according to Chromium [net_error_list](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h).
+indicates success while any other value indicates failure according to Chromium [net_error_list](https://source.chromium.org/chromium/chromium/src/+/master:net/base/net_error_list.h).
 
 ### `app.configureHostResolver(options)`
 

docs/api/browser-window.md

@@ -64,7 +64,7 @@ win.loadURL('https://github.com')
 ```
 
 Note that even for apps that use `ready-to-show` event, it is still recommended
-to set `backgroundColor` to make the app feel more native.
+to set `backgroundColor` to make app feel more native.
 
 Some examples of valid `backgroundColor` values include:
 
@@ -158,20 +158,20 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
   * `useContentSize` boolean (optional) - The `width` and `height` would be used as web
     page's size, which means the actual window's size will include window
     frame's size and be slightly larger. Default is `false`.
-  * `center` boolean (optional) - Show window in the center of the screen. Default is `false`.
+  * `center` boolean (optional) - Show window in the center of the screen.
   * `minWidth` Integer (optional) - Window's minimum width. Default is `0`.
   * `minHeight` Integer (optional) - Window's minimum height. Default is `0`.
   * `maxWidth` Integer (optional) - Window's maximum width. Default is no limit.
   * `maxHeight` Integer (optional) - Window's maximum height. Default is no limit.
   * `resizable` boolean (optional) - Whether window is resizable. Default is `true`.
-  * `movable` boolean (optional) _macOS_ _Windows_ - Whether window is
-    movable. This is not implemented on Linux. Default is `true`.
-  * `minimizable` boolean (optional) _macOS_ _Windows_ - Whether window is
-    minimizable. This is not implemented on Linux. Default is `true`.
-  * `maximizable` boolean (optional) _macOS_ _Windows_ - Whether window is
-    maximizable. This is not implemented on Linux. Default is `true`.
-  * `closable` boolean (optional) _macOS_ _Windows_ - Whether window is
-    closable. This is not implemented on Linux. Default is `true`.
+  * `movable` boolean (optional) - Whether window is movable. This is not implemented
+    on Linux. Default is `true`.
+  * `minimizable` boolean (optional) - Whether window is minimizable. This is not
+    implemented on Linux. Default is `true`.
+  * `maximizable` boolean (optional) - Whether window is maximizable. This is not
+    implemented on Linux. Default is `true`.
+  * `closable` boolean (optional) - Whether window is closable. This is not implemented
+    on Linux. Default is `true`.
   * `focusable` boolean (optional) - Whether the window can be focused. Default is
     `true`. On Windows setting `focusable: false` also implies setting
     `skipTaskbar: true`. On Linux setting `focusable: false` makes the window
@@ -185,10 +185,9 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
   * `fullscreenable` boolean (optional) - Whether the window can be put into fullscreen
     mode. On macOS, also whether the maximize/zoom button should toggle full
     screen mode or maximize window. Default is `true`.
-  * `simpleFullscreen` boolean (optional) _macOS_ - Use pre-Lion fullscreen on
-    macOS. Default is `false`.
-  * `skipTaskbar` boolean (optional) _macOS_ _Windows_ - Whether to show the window in taskbar.
-    Default is `false`.
+  * `simpleFullscreen` boolean (optional) - Use pre-Lion fullscreen on macOS. Default is `false`.
+  * `skipTaskbar` boolean (optional) - Whether to show the window in taskbar. Default is
+    `false`.
   * `kiosk` boolean (optional) - Whether the window is in kiosk mode. Default is `false`.
   * `title` string (optional) - Default window title. Default is `"Electron"`. If the HTML tag `<title>` is defined in the HTML file loaded by `loadURL()`, this property will be ignored.
   * `icon` ([NativeImage](native-image.md) | string) (optional) - The window icon. On Windows it is
@@ -202,30 +201,27 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
   * `parent` BrowserWindow (optional) - Specify parent window. Default is `null`.
   * `modal` boolean (optional) - Whether this is a modal window. This only works when the
     window is a child window. Default is `false`.
-  * `acceptFirstMouse` boolean (optional) _macOS_ - Whether clicking an
-    inactive window will also click through to the web contents. Default is
-    `false` on macOS. This option is not configurable on other platforms.
+  * `acceptFirstMouse` boolean (optional) - Whether clicking an inactive window will also
+  click through to the web contents. Default is `false` on macOS. This option is not
+  configurable on other platforms.
   * `disableAutoHideCursor` boolean (optional) - Whether to hide cursor when typing.
     Default is `false`.
   * `autoHideMenuBar` boolean (optional) - Auto hide the menu bar unless the `Alt`
     key is pressed. Default is `false`.
-  * `enableLargerThanScreen` boolean (optional) _macOS_ - Enable the window to
-    be resized larger than screen. Only relevant for macOS, as other OSes
-    allow larger-than-screen windows by default. Default is `false`.
+  * `enableLargerThanScreen` boolean (optional) - Enable the window to be resized larger
+    than screen. Only relevant for macOS, as other OSes allow
+    larger-than-screen windows by default. Default is `false`.
   * `backgroundColor` string (optional) - The window's background color in Hex, RGB, RGBA, HSL, HSLA or named CSS color format. Alpha in #AARRGGBB format is supported if `transparent` is set to `true`. Default is `#FFF` (white). See [win.setBackgroundColor](browser-window.md#winsetbackgroundcolorbackgroundcolor) for more information.
   * `hasShadow` boolean (optional) - Whether window should have a shadow. Default is `true`.
-  * `opacity` number (optional) _macOS_ _Windows_ - Set the initial opacity of
-    the window, between 0.0 (fully transparent) and 1.0 (fully opaque). This
-    is only implemented on Windows and macOS.
+  * `opacity` number (optional) - Set the initial opacity of the window, between 0.0 (fully
+    transparent) and 1.0 (fully opaque). This is only implemented on Windows and macOS.
   * `darkTheme` boolean (optional) - Forces using dark theme for the window, only works on
     some GTK+3 desktop environments. Default is `false`.
   * `transparent` boolean (optional) - Makes the window [transparent](../tutorial/window-customization.md#create-transparent-windows).
     Default is `false`. On Windows, does not work unless the window is frameless.
   * `type` string (optional) - The type of window, default is normal window. See more about
     this below.
-  * `visualEffectState` string (optional) _macOS_ - Specify how the material
-    appearance should reflect window activity state on macOS. Must be used
-    with the `vibrancy` property. Possible values are:
+  * `visualEffectState` string (optional) - Specify how the material appearance should reflect window activity state on macOS. Must be used with the `vibrancy` property. Possible values are:
     * `followWindow` - The backdrop should automatically appear active when the window is active, and inactive when it is not. This is the default.
     * `active` - The backdrop should always appear active.
     * `inactive` - The backdrop should always appear inactive.
@@ -233,41 +229,36 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
     Default is `default`. Possible values are:
     * `default` - Results in the standard title bar for macOS or Windows respectively.
     * `hidden` - Results in a hidden title bar and a full size content window. On macOS, the window still has the standard window controls (“traffic lights”) in the top left. On Windows, when combined with `titleBarOverlay: true` it will activate the Window Controls Overlay (see `titleBarOverlay` for more information), otherwise no window controls will be shown.
-    * `hiddenInset` _macOS_ - Only on macOS, results in a hidden title bar
-      with an alternative look where the traffic light buttons are slightly
-      more inset from the window edge.
-    * `customButtonsOnHover` _macOS_ - Only on macOS, results in a hidden
-      title bar and a full size content window, the traffic light buttons will
-      display when being hovered over in the top left of the window.
-      **Note:** This option is currently experimental.
-  * `trafficLightPosition` [Point](structures/point.md) (optional) _macOS_ -
-    Set a custom position for the traffic light buttons in frameless windows.
-  * `roundedCorners` boolean (optional) _macOS_ - Whether frameless window
-    should have rounded corners on macOS. Default is `true`.
-  * `fullscreenWindowTitle` boolean (optional) _macOS_ _Deprecated_ - Shows
-    the title in the title bar in full screen mode on macOS for `hiddenInset`
-    titleBarStyle. Default is `false`.
+    * `hiddenInset` - Only on macOS, results in a hidden title bar with an alternative look
+      where the traffic light buttons are slightly more inset from the window edge.
+    * `customButtonsOnHover` - Only on macOS, results in a hidden title bar and a full size
+      content window, the traffic light buttons will display when being hovered
+      over in the top left of the window.  **Note:** This option is currently
+      experimental.
+  * `trafficLightPosition` [Point](structures/point.md) (optional) - Set a
+    custom position for the traffic light buttons in frameless windows.
+  * `roundedCorners` boolean (optional) - Whether frameless window should have
+    rounded corners on macOS. Default is `true`.
+  * `fullscreenWindowTitle` boolean (optional) _Deprecated_ - Shows the title in
+    the title bar in full screen mode on macOS for `hiddenInset` titleBarStyle.
+    Default is `false`.
   * `thickFrame` boolean (optional) - Use `WS_THICKFRAME` style for frameless windows on
     Windows, which adds standard window frame. Setting it to `false` will remove
     window shadow and window animations. Default is `true`.
-  * `vibrancy` string (optional) _macOS_ - Add a type of vibrancy effect to
-    the window, only on macOS. Can be `appearance-based`, `light`, `dark`,
-    `titlebar`, `selection`, `menu`, `popover`, `sidebar`, `medium-light`,
-    `ultra-dark`, `header`, `sheet`, `window`, `hud`, `fullscreen-ui`,
-    `tooltip`, `content`, `under-window`, or `under-page`. Please note that
-    `appearance-based`, `light`, `dark`, `medium-light`, and `ultra-dark` are
-    deprecated and have been removed in macOS Catalina (10.15).
-  * `zoomToPageWidth` boolean (optional) _macOS_ - Controls the behavior on
-    macOS when option-clicking the green stoplight button on the toolbar or by
-    clicking the Window > Zoom menu item. If `true`, the window will grow to
-    the preferred width of the web page when zoomed, `false` will cause it to
-    zoom to the width of the screen. This will also affect the behavior when
-    calling `maximize()` directly. Default is `false`.
-  * `tabbingIdentifier` string (optional) _macOS_ - Tab group name, allows
-    opening the window as a native tab on macOS 10.12+. Windows with the same
-    tabbing identifier will be grouped together. This also adds a native new
-    tab button to your window's tab bar and allows your `app` and window to
-    receive the `new-window-for-tab` event.
+  * `vibrancy` string (optional) - Add a type of vibrancy effect to the window, only on
+    macOS. Can be `appearance-based`, `light`, `dark`, `titlebar`, `selection`,
+    `menu`, `popover`, `sidebar`, `medium-light`, `ultra-dark`, `header`, `sheet`, `window`, `hud`, `fullscreen-ui`, `tooltip`, `content`, `under-window`, or `under-page`. Please note that `appearance-based`, `light`, `dark`, `medium-light`, and `ultra-dark` are deprecated and have been removed in macOS Catalina (10.15).
+  * `zoomToPageWidth` boolean (optional) - Controls the behavior on macOS when
+    option-clicking the green stoplight button on the toolbar or by clicking the
+    Window > Zoom menu item. If `true`, the window will grow to the preferred
+    width of the web page when zoomed, `false` will cause it to zoom to the
+    width of the screen. This will also affect the behavior when calling
+    `maximize()` directly. Default is `false`.
+  * `tabbingIdentifier` string (optional) - Tab group name, allows opening the
+    window as a native tab on macOS 10.12+. Windows with the same tabbing
+    identifier will be grouped together. This also adds a native new tab button
+    to your window's tab bar and allows your `app` and window to receive the
+    `new-window-for-tab` event.
   * `webPreferences` Object (optional) - Settings of web page's features.
     * `devTools` boolean (optional) - Whether to enable DevTools. If it is set to `false`, can not use `BrowserWindow.webContents.openDevTools()` to open DevTools. Default is `true`.
     * `nodeIntegration` boolean (optional) - Whether node integration is enabled.
@@ -319,8 +310,8 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
     * `plugins` boolean (optional) - Whether plugins should be enabled. Default is `false`.
     * `experimentalFeatures` boolean (optional) - Enables Chromium's experimental features.
       Default is `false`.
-    * `scrollBounce` boolean (optional) _macOS_ - Enables scroll bounce
-      (rubber banding) effect on macOS. Default is `false`.
+    * `scrollBounce` boolean (optional) - Enables scroll bounce (rubber banding) effect on
+      macOS. Default is `false`.
     * `enableBlinkFeatures` string (optional) - A list of feature strings separated by `,`, like
       `CSSVariables,KeyboardEventKey` to enable. The full list of supported feature
       strings can be found in the [RuntimeEnabledFeatures.json5][runtime-enabled-features]
@@ -783,7 +774,7 @@ A `boolean` property that determines whether the window is in fullscreen mode.
 
 A `boolean` property that determines whether the window is focusable.
 
-#### `win.visibleOnAllWorkspaces` _macOS_ _Linux_
+#### `win.visibleOnAllWorkspaces`
 
 A `boolean` property that determines whether the window is visible on all workspaces.
 
@@ -820,13 +811,13 @@ A `string` property that determines the title of the native window.
 
 **Note:** The title of the web page can be different from the title of the native window.
 
-#### `win.minimizable` _macOS_ _Windows_
+#### `win.minimizable`
 
 A `boolean` property that determines whether the window can be manually minimized by user.
 
 On Linux the setter is a no-op, although the getter returns `true`.
 
-#### `win.maximizable` _macOS_ _Windows_
+#### `win.maximizable`
 
 A `boolean` property that determines whether the window can be manually maximized by user.
 
@@ -841,13 +832,13 @@ maximizes the window.
 
 A `boolean` property that determines whether the window can be manually resized by user.
 
-#### `win.closable` _macOS_ _Windows_
+#### `win.closable`
 
 A `boolean` property that determines whether the window can be manually closed by user.
 
 On Linux the setter is a no-op, although the getter returns `true`.
 
-#### `win.movable` _macOS_ _Windows_
+#### `win.movable`
 
 A `boolean` property that determines Whether the window can be moved by user.
 
@@ -1644,7 +1635,7 @@ Changes window icon.
 
 Sets whether the window traffic light buttons should be visible.
 
-#### `win.setAutoHideMenuBar(hide)` _Windows_ _Linux_
+#### `win.setAutoHideMenuBar(hide)`
 
 * `hide` boolean
 
@@ -1653,7 +1644,7 @@ menu bar will only show when users press the single `Alt` key.
 
 If the menu bar is already visible, calling `setAutoHideMenuBar(true)` won't hide it immediately.
 
-#### `win.isMenuBarAutoHide()` _Windows_ _Linux_
+#### `win.isMenuBarAutoHide()`
 
 Returns `boolean` - Whether menu bar automatically hides itself.
 
@@ -1663,11 +1654,11 @@ Returns `boolean` - Whether menu bar automatically hides itself.
 
 Sets whether the menu bar should be visible. If the menu bar is auto-hide, users can still bring up the menu bar by pressing the single `Alt` key.
 
-#### `win.isMenuBarVisible()` _Windows_ _Linux_
+#### `win.isMenuBarVisible()`
 
 Returns `boolean` - Whether the menu bar is visible.
 
-#### `win.setVisibleOnAllWorkspaces(visible[, options])` _macOS_ _Linux_
+#### `win.setVisibleOnAllWorkspaces(visible[, options])`
 
 * `visible` boolean
 * `options` Object (optional)
@@ -1685,7 +1676,7 @@ Sets whether the window should be visible on all workspaces.
 
 **Note:** This API does nothing on Windows.
 
-#### `win.isVisibleOnAllWorkspaces()` _macOS_ _Linux_
+#### `win.isVisibleOnAllWorkspaces()`
 
 Returns `boolean` - Whether the window is visible on all workspaces.
 

docs/api/client-request.md

@@ -185,7 +185,7 @@ the first write will throw an error. If the passed value is not a `string`, its
 
 Certain headers are restricted from being set by apps. These headers are
 listed below. More information on restricted headers can be found in
-[Chromium's header utils](https://source.chromium.org/chromium/chromium/src/+/main:services/network/public/cpp/header_util.cc;drc=1562cab3f1eda927938f8f4a5a91991fefde66d3;bpv=1;bpt=1;l=22).
+[Chromium's header utils](https://source.chromium.org/chromium/chromium/src/+/master:services/network/public/cpp/header_util.cc;drc=1562cab3f1eda927938f8f4a5a91991fefde66d3;bpv=1;bpt=1;l=22).
 
 * `Content-Length`
 * `Host`

docs/api/command-line-switches.md

@@ -274,8 +274,8 @@ By default inspector websocket url is available in stderr and under /json/list e
 [ready]: app.md#event-ready
 [play-silent-audio]: https://github.com/atom/atom/pull/9485/files
 [debugging-main-process]: ../tutorial/debugging-main-process.md
-[logging]: https://source.chromium.org/chromium/chromium/src/+/main:base/logging.h
+[logging]: https://source.chromium.org/chromium/chromium/src/+/master:base/logging.h
 [node-cli]: https://nodejs.org/api/cli.html
 [play-silent-audio]: https://github.com/atom/atom/pull/9485/files
 [ready]: app.md#event-ready
-[severities]: https://source.chromium.org/chromium/chromium/src/+/main:base/logging.h?q=logging::LogSeverity&ss=chromium
+[severities]: https://source.chromium.org/chromium/chromium/src/+/master:base/logging.h?q=logging::LogSeverity&ss=chromium

docs/api/content-tracing.md

@@ -36,7 +36,7 @@ Returns `Promise<string[]>` - resolves with an array of category groups once all
 
 Get a set of category groups. The category groups can change as new code paths
 are reached. See also the [list of built-in tracing
-categories](https://chromium.googlesource.com/chromium/src/+/main/base/trace_event/builtin_categories.h).
+categories](https://chromium.googlesource.com/chromium/src/+/master/base/trace_event/builtin_categories.h).
 
 > **NOTE:** Electron adds a non-default tracing category called `"electron"`.
 > This category can be used to capture Electron-specific tracing events.

docs/api/ipc-main.md

@@ -1,10 +1,3 @@
----
-title: "ipcMain"
-description: "Communicate asynchronously from the main process to renderer processes."
-slug: ipc-main
-hide_title: false
----
-
 # ipcMain
 
 > Communicate asynchronously from the main process to renderer processes.
@@ -16,9 +9,7 @@ process, it handles asynchronous and synchronous messages sent from a renderer
 process (web page). Messages sent from a renderer will be emitted to this
 module.
 
-For usage examples, check out the [IPC tutorial].
-
-## Sending messages
+## Sending Messages
 
 It is also possible to send messages from the main process to the renderer
 process, see [webContents.send][web-contents-send] for more information.
@@ -30,6 +21,36 @@ process, see [webContents.send][web-contents-send] for more information.
   coming from frames that aren't the main frame (e.g. iframes) whereas
   `event.sender.send(...)` will always send to the main frame.
 
+An example of sending and handling messages between the render and main
+processes:
+
+```javascript
+// In main process.
+const { ipcMain } = require('electron')
+ipcMain.on('asynchronous-message', (event, arg) => {
+  console.log(arg) // prints "ping"
+  event.reply('asynchronous-reply', 'pong')
+})
+
+ipcMain.on('synchronous-message', (event, arg) => {
+  console.log(arg) // prints "ping"
+  event.returnValue = 'pong'
+})
+```
+
+```javascript
+// In renderer process (web page).
+// NB. Electron APIs are only accessible from preload, unless contextIsolation is disabled.
+// See https://www.electronjs.org/docs/tutorial/process-model#preload-scripts for more details.
+const { ipcRenderer } = require('electron')
+console.log(ipcRenderer.sendSync('synchronous-message', 'ping')) // prints "pong"
+
+ipcRenderer.on('asynchronous-reply', (event, arg) => {
+  console.log(arg) // prints "pong"
+})
+ipcRenderer.send('asynchronous-message', 'ping')
+```
+
 ## Methods
 
 The `ipcMain` module has the following method to listen for events:
@@ -38,7 +59,7 @@ The `ipcMain` module has the following method to listen for events:
 
 * `channel` string
 * `listener` Function
-  * `event` [IpcMainEvent][ipc-main-event]
+  * `event` IpcMainEvent
   * `...args` any[]
 
 Listens to `channel`, when a new message arrives `listener` would be called with
@@ -48,7 +69,7 @@ Listens to `channel`, when a new message arrives `listener` would be called with
 
 * `channel` string
 * `listener` Function
-  * `event` [IpcMainEvent][ipc-main-event]
+  * `event` IpcMainEvent
   * `...args` any[]
 
 Adds a one time `listener` function for the event. This `listener` is invoked
@@ -72,8 +93,8 @@ Removes listeners of the specified `channel`.
 ### `ipcMain.handle(channel, listener)`
 
 * `channel` string
-* `listener` Function<Promise\<void&#62; | any&#62;
-  * `event` [IpcMainInvokeEvent][ipc-main-invoke-event]
+* `listener` Function<Promise\<void> | any>
+  * `event` IpcMainInvokeEvent
   * `...args` any[]
 
 Adds a handler for an `invoke`able IPC. This handler will be called whenever a
@@ -83,14 +104,14 @@ If `listener` returns a Promise, the eventual result of the promise will be
 returned as a reply to the remote caller. Otherwise, the return value of the
 listener will be used as the value of the reply.
 
-```js title='Main Process'
+```js
+// Main process
 ipcMain.handle('my-invokable-ipc', async (event, ...args) => {
   const result = await somePromise(...args)
   return result
 })
-```
 
-```js title='Renderer Process'
+// Renderer process
 async () => {
   const result = await ipcRenderer.invoke('my-invokable-ipc', arg1, arg2)
   // ...
@@ -109,7 +130,7 @@ provided to the renderer process. Please refer to
 ### `ipcMain.handleOnce(channel, listener)`
 
 * `channel` string
-* `listener` Function<Promise\<void&#62; | any&#62;
+* `listener` Function<Promise\<void> | any>
   * `event` IpcMainInvokeEvent
   * `...args` any[]
 
@@ -125,16 +146,13 @@ Removes any handler for `channel`, if present.
 ## IpcMainEvent object
 
 The documentation for the `event` object passed to the `callback` can be found
-in the [`ipc-main-event`][ipc-main-event] structure docs.
+in the [`ipc-main-event`](structures/ipc-main-event.md) structure docs.
 
 ## IpcMainInvokeEvent object
 
 The documentation for the `event` object passed to `handle` callbacks can be
-found in the [`ipc-main-invoke-event`][ipc-main-invoke-event]
+found in the [`ipc-main-invoke-event`](structures/ipc-main-invoke-event.md)
 structure docs.
 
-[IPC tutorial]: ../tutorial/ipc.md
 [event-emitter]: https://nodejs.org/api/events.html#events_class_eventemitter
-[web-contents-send]: ../api/web-contents.md#contentssendchannel-args
-[ipc-main-event]:../api/structures/ipc-main-event.md
-[ipc-main-invoke-event]:../api/structures/ipc-main-invoke-event.md
+[web-contents-send]: web-contents.md#contentssendchannel-args

docs/api/ipc-renderer.md

@@ -1,10 +1,3 @@
----
-title: "ipcRenderer"
-description: "Communicate asynchronously from a renderer process to the main process."
-slug: ipc-renderer
-hide_title: false
----
-
 # ipcRenderer
 
 > Communicate asynchronously from a renderer process to the main process.
@@ -16,7 +9,7 @@ methods so you can send synchronous and asynchronous messages from the render
 process (web page) to the main process. You can also receive replies from the
 main process.
 
-See [IPC tutorial](../tutorial/ipc.md) for code examples.
+See [ipcMain](ipc-main.md) for code examples.
 
 ## Methods
 
@@ -77,7 +70,7 @@ throw an exception.
 > them. Attempting to send such objects over IPC will result in an error.
 
 The main process handles it by listening for `channel` with the
-[`ipcMain`](./ipc-main.md) module.
+[`ipcMain`](ipc-main.md) module.
 
 If you need to transfer a [`MessagePort`][] to the main process, use [`ipcRenderer.postMessage`](#ipcrendererpostmessagechannel-message-transfer).
 
@@ -105,7 +98,7 @@ throw an exception.
 > them. Attempting to send such objects over IPC will result in an error.
 
 The main process should listen for `channel` with
-[`ipcMain.handle()`](./ipc-main.md#ipcmainhandlechannel-listener).
+[`ipcMain.handle()`](ipc-main.md#ipcmainhandlechannel-listener).
 
 For example:
 
@@ -131,11 +124,11 @@ If you do not need a response to the message, consider using [`ipcRenderer.send`
 * `channel` string
 * `...args` any[]
 
-Returns `any` - The value sent back by the [`ipcMain`](./ipc-main.md) handler.
+Returns `any` - The value sent back by the [`ipcMain`](ipc-main.md) handler.
 
 Send a message to the main process via `channel` and expect a result
 synchronously. Arguments will be serialized with the [Structured Clone
-Algorithm][SCA], just like [`window.postMessage`], so prototype chains will not be
+Algorithm][SCA], just like [`window.postMessage`][], so prototype chains will not be
 included. Sending Functions, Promises, Symbols, WeakMaps, or WeakSets will
 throw an exception.
 
@@ -147,13 +140,13 @@ throw an exception.
 > Electron's IPC to the main process, as the main process would have no way to decode
 > them. Attempting to send such objects over IPC will result in an error.
 
-The main process handles it by listening for `channel` with [`ipcMain`](./ipc-main.md) module,
+The main process handles it by listening for `channel` with [`ipcMain`](ipc-main.md) module,
 and replies by setting `event.returnValue`.
 
 > :warning: **WARNING**: Sending a synchronous message will block the whole
 > renderer process until the reply is received, so use this method only as a
 > last resort. It's much better to use the asynchronous version,
-> [`invoke()`](./ipc-renderer.md#ipcrendererinvokechannel-args).
+> [`invoke()`](ipc-renderer.md#ipcrendererinvokechannel-args).
 
 ### `ipcRenderer.postMessage(channel, message, [transfer])`
 
@@ -165,7 +158,7 @@ Send a message to the main process, optionally transferring ownership of zero
 or more [`MessagePort`][] objects.
 
 The transferred `MessagePort` objects will be available in the main process as
-[`MessagePortMain`](./message-port-main.md) objects by accessing the `ports`
+[`MessagePortMain`](message-port-main.md) objects by accessing the `ports`
 property of the emitted event.
 
 For example:
@@ -204,7 +197,7 @@ the host page instead of the main process.
 ## Event object
 
 The documentation for the `event` object passed to the `callback` can be found
-in the [`ipc-renderer-event`](./structures/ipc-renderer-event.md) structure docs.
+in the [`ipc-renderer-event`](structures/ipc-renderer-event.md) structure docs.
 
 [event-emitter]: https://nodejs.org/api/events.html#events_class_eventemitter
 [SCA]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm

docs/api/session.md

@@ -567,7 +567,7 @@ the original network configuration.
     * `errorCode` Integer - Error code.
   * `callback` Function
     * `verificationResult` Integer - Value can be one of certificate error codes
-    from [here](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h).
+    from [here](https://source.chromium.org/chromium/chromium/src/+/master:net/base/net_error_list.h).
     Apart from the certificate error codes, the following special codes can be used.
       * `0` - Indicates success and disables Certificate Transparency verification.
       * `-2` - Indicates failure.

docs/api/structures/protocol-response.md

@@ -31,4 +31,4 @@
 * `uploadData` [ProtocolResponseUploadData](protocol-response-upload-data.md) (optional) - The data used as upload data. This is only
   used for URL responses when `method` is `"POST"`.
 
-[net-error]: https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h
+[net-error]: https://source.chromium.org/chromium/chromium/src/+/master:net/base/net_error_list.h

docs/api/structures/trace-config.md

@@ -8,7 +8,7 @@
 * `enable_argument_filter` boolean (optional) - if true, filter event data
   according to a specific list of events that have been manually vetted to not
   include any PII. See [the implementation in
-  Chromium][trace_event_args_allowlist.cc] for specifics.
+  Chromium][trace_event_args_whitelist.cc] for specifics.
 * `included_categories` string[] (optional) - a list of tracing categories to
   include. Can include glob-like patterns using `*` at the end of the category
   name. See [tracing categories][] for the list of categories.
@@ -45,7 +45,7 @@ An example TraceConfig that roughly matches what Chrome DevTools records:
 }
 ```
 
-[tracing categories]: https://chromium.googlesource.com/chromium/src/+/main/base/trace_event/builtin_categories.h
-[memory-infra docs]: https://chromium.googlesource.com/chromium/src/+/main/docs/memory-infra/memory_infra_startup_tracing.md#the-advanced-way
-[trace_event_args_allowlist.cc]: https://chromium.googlesource.com/chromium/src/+/main/services/tracing/public/cpp/trace_event_args_allowlist.cc
+[tracing categories]: https://chromium.googlesource.com/chromium/src/+/master/base/trace_event/builtin_categories.h
+[memory-infra docs]: https://chromium.googlesource.com/chromium/src/+/master/docs/memory-infra/memory_infra_startup_tracing.md#the-advanced-way
+[trace_event_args_whitelist.cc]: https://chromium.googlesource.com/chromium/src/+/master/services/tracing/public/cpp/trace_event_args_whitelist.cc
 [histogram]: https://chromium.googlesource.com/chromium/src.git/+/HEAD/tools/metrics/histograms/README.md

docs/api/system-preferences.md

@@ -183,11 +183,11 @@ Some popular `key` and `type`s are:
 * `NSPreferredWebServices`: `dictionary`
 * `NSUserDictionaryReplacementItems`: `array`
 
-### `systemPreferences.setUserDefault<Type extends keyof UserDefaultTypes>(key, type, value)` _macOS_
+### `systemPreferences.setUserDefault(key, type, value)` _macOS_
 
 * `key` string
-* `type` Type - Can be `string`, `boolean`, `integer`, `float`, `double`, `url`, `array` or `dictionary`.
-* `value` UserDefaultTypes[Type]
+* `type` string - Can be `string`, `boolean`, `integer`, `float`, `double`, `url`, `array` or `dictionary`.
+* `value` string
 
 Set the value of `key` in `NSUserDefaults`.
 

docs/api/web-contents.md

@@ -35,7 +35,7 @@ for all windows, webviews, opened devtools, and devtools extension background pa
 
 ### `webContents.getFocusedWebContents()`
 
-Returns `WebContents` | null - The web contents that is focused in this application, otherwise
+Returns `WebContents` - The web contents that is focused in this application, otherwise
 returns `null`.
 
 ### `webContents.fromId(id)`
@@ -92,7 +92,7 @@ Returns:
 * `frameRoutingId` Integer
 
 This event is like `did-finish-load` but emitted when the load failed.
-The full list of error codes and their meaning is available [here](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h).
+The full list of error codes and their meaning is available [here](https://source.chromium.org/chromium/chromium/src/+/master:net/base/net_error_list.h).
 
 #### Event: 'did-fail-provisional-load'
 
@@ -820,6 +820,9 @@ This event can be used to configure `webPreferences` for the `webContents`
 of a `<webview>` before it's loaded, and provides the ability to set settings
 that can't be set via `<webview>` attributes.
 
+**Note:** The specified `preload` script option will appear as `preloadURL`
+(not `preload`) in the `webPreferences` object emitted with this event.
+
 #### Event: 'did-attach-webview'
 
 Returns:

docs/api/web-frame-main.md

@@ -16,7 +16,7 @@ win.loadURL('https://twitter.com')
 
 win.webContents.on(
   'did-frame-navigate',
-  (event, url, isMainFrame, frameProcessId, frameRoutingId) => {
+  (event, url, httpResponseCode, httpStatusText, isMainFrame, frameProcessId, frameRoutingId) => {
     const frame = webFrameMain.fromId(frameProcessId, frameRoutingId)
     if (frame) {
       const code = 'document.body.innerHTML = document.body.innerHTML.replaceAll("heck", "h*ck")'
@@ -195,6 +195,3 @@ have the same `routingId`.
 A `string` representing the [visibility state](https://developer.mozilla.org/en-US/docs/Web/API/Document/visibilityState) of the frame.
 
 See also how the [Page Visibility API](browser-window.md#page-visibility) is affected by other Electron APIs.
-
-[SCA]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm
-[`postMessage`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage

docs/api/web-frame.md

@@ -110,7 +110,7 @@ webFrame.setSpellCheckProvider('en-US', {
 })
 ```
 
-### `webFrame.insertCSS(css[, options])`
+#### `webFrame.insertCSS(css[, options])`
 
 * `css` string
 * `options` Object (optional)

docs/api/webview-tag.md

@@ -158,6 +158,9 @@ When the guest page doesn't have node integration this script will still have
 access to all Node APIs, but global objects injected by Node will be deleted
 after this script has finished executing.
 
+**Note:** This option will appear as `preloadURL` (not `preload`) in
+the `webPreferences` specified to the `will-attach-webview` event.
+
 ### `httpreferrer`
 
 ```html

docs/api/window-open.md

@@ -73,11 +73,6 @@ creating the window. Note that this is more powerful than passing options
 through the feature string, as the renderer has more limited privileges in
 deciding security preferences than the main process.
 
-In addition to passing in `action` and `overrideBrowserWindowOptions`,
-`outlivesOpener` can be passed like: `{ action: 'allow', outlivesOpener: true,
-overrideBrowserWindowOptions: { ... } }`. If set to `true`, the newly created
-window will not close when the opener window closes. The default value is `false`.
-
 ### Native `Window` example
 
 ```javascript

docs/breaking-changes.md

@@ -36,7 +36,7 @@ requires unsafe mode), so Electron is unable to support this feature on Linux.
 
 ## Planned Breaking API Changes (19.0)
 
-None
+*None (yet)*
 
 ## Planned Breaking API Changes (18.0)
 

docs/development/build-instructions-gn.md

@@ -196,12 +196,12 @@ If you test other combinations and find them to work, please update this documen
 See the GN reference for allowable values of [`target_os`][target_os values]
 and [`target_cpu`][target_cpu values].
 
-[target_os values]: https://gn.googlesource.com/gn/+/main/docs/reference.md#built_in-predefined-variables-target_os_the-desired-operating-system-for-the-build-possible-values
-[target_cpu values]: https://gn.googlesource.com/gn/+/main/docs/reference.md#built_in-predefined-variables-target_cpu_the-desired-cpu-architecture-for-the-build-possible-values
+[target_os values]: https://gn.googlesource.com/gn/+/master/docs/reference.md#built_in-predefined-variables-target_os_the-desired-operating-system-for-the-build-possible-values
+[target_cpu values]: https://gn.googlesource.com/gn/+/master/docs/reference.md#built_in-predefined-variables-target_cpu_the-desired-cpu-architecture-for-the-build-possible-values
 
 #### Windows on Arm (experimental)
 
-To cross-compile for Windows on Arm, [follow Chromium's guide](https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/windows_build_instructions.md#Visual-Studio) to get the necessary dependencies, SDK and libraries, then build with `ELECTRON_BUILDING_WOA=1` in your environment before running `gclient sync`.
+To cross-compile for Windows on Arm, [follow Chromium's guide](https://chromium.googlesource.com/chromium/src/+/refs/heads/master/docs/windows_build_instructions.md#Visual-Studio) to get the necessary dependencies, SDK and libraries, then build with `ELECTRON_BUILDING_WOA=1` in your environment before running `gclient sync`.
 
 ```bat
 set ELECTRON_BUILDING_WOA=1

docs/development/build-instructions-linux.md

@@ -82,7 +82,7 @@ $ sudo apt-get install libc6-dev-arm64-cross linux-libc-dev-arm64-cross \
                        g++-aarch64-linux-gnu
 ```
 
-And to cross-compile for `arm` or targets, you should pass the
+And to cross-compile for `arm` or `ia32` targets, you should pass the
 `target_cpu` parameter to `gn gen`:
 
 ```sh

docs/development/build-instructions-windows.md

@@ -9,12 +9,14 @@ Follow the guidelines below for building **Electron itself** on Windows, for the
 * Windows 10 / Server 2012 R2 or higher
 * Visual Studio 2017 15.7.2 or higher - [download VS 2019 Community Edition for
   free](https://www.visualstudio.com/vs/)
-  * See [the Chromium build documentation](https://chromium.googlesource.com/chromium/src/+/main/docs/windows_build_instructions.md#visual-studio) for more details on which Visual Studio
+  * See [the Chromium build documentation](https://chromium.googlesource.com/chromium/src/+/master/docs/windows_build_instructions.md#visual-studio) for more details on which Visual Studio
   components are required.
   * If your Visual Studio is installed in a directory other than the default, you'll need to
   set a few environment variables to point the toolchains to your installation path.
     * `vs2019_install = DRIVE:\path\to\Microsoft Visual Studio\2019\Community`, replacing `2019` and `Community` with your installed versions and replacing `DRIVE:` with the drive that Visual Studio is on. Often, this will be `C:`.
     * `WINDOWSSDKDIR = DRIVE:\path\to\Windows Kits\10`, replacing `DRIVE:` with the drive that Windows Kits is on. Often, this will be `C:`.
+  * [Python for Windows (pywin32) Extensions](https://pypi.org/project/pywin32/#files)
+  is also needed in order to run the build process.
 * [Node.js](https://nodejs.org/download/)
 * [Git](https://git-scm.com)
 * Debugging Tools for Windows of Windows SDK 10.0.15063.468 if you plan on

docs/development/issues.md

@@ -24,7 +24,7 @@ contribute:
 
 ## Asking for General Help
 
-[The Electron website](https://electronjs.org/community) has a
+["Finding Support"](../tutorial/support.md#finding-support) has a
 list of resources for getting programming help, reporting security issues,
 contributing, and more. Please use the issue tracker for bugs only!
 

docs/fiddles/communication/two-processes/asynchronous-messages/index.html

@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8">
+  </head>
+  <body>
+    <div>
+      <div>
+        <h1>Asynchronous messages</h1>
+        <i>Supports: Win, macOS, Linux <span>|</span> Process: Both</i>
+        <div>
+          <div>
+            <button id="async-msg">Ping</button>
+            <span id="async-reply"></span>
+          </div>
+          <p>Using <code>ipc</code> to send messages between processes asynchronously is the preferred method since it will return when finished without blocking other operations in the same process.</p>
+
+          <p>This example sends a "ping" from this process (renderer) to the main process. The main process then replies with "pong".</p>
+        </div>
+      </div>
+    </div>
+    <script>
+      // You can also require other files to run in this process
+      require('./renderer.js')
+    </script>
+  </body>
+</html>

docs/fiddles/communication/two-processes/asynchronous-messages/main.js

@@ -0,0 +1,29 @@
+const { app, BrowserWindow, ipcMain } = require('electron')
+
+let mainWindow = null
+
+function createWindow () {
+  const windowOptions = {
+    width: 600,
+    height: 400,
+    title: 'Asynchronous messages',
+    webPreferences: {
+      nodeIntegration: true
+    }
+  }
+
+  mainWindow = new BrowserWindow(windowOptions)
+  mainWindow.loadFile('index.html')
+
+  mainWindow.on('closed', () => {
+    mainWindow = null
+  })
+}
+
+app.whenReady().then(() => {
+  createWindow()
+})
+
+ipcMain.on('asynchronous-message', (event, arg) => {
+  event.sender.send('asynchronous-reply', 'pong')
+})

docs/fiddles/communication/two-processes/asynchronous-messages/renderer.js

@@ -0,0 +1,12 @@
+const { ipcRenderer } = require('electron')
+
+const asyncMsgBtn = document.getElementById('async-msg')
+
+asyncMsgBtn.addEventListener('click', () => {
+  ipcRenderer.send('asynchronous-message', 'ping')
+})
+
+ipcRenderer.on('asynchronous-reply', (event, arg) => {
+  const message = `Asynchronous message reply: ${arg}`
+  document.getElementById('async-reply').innerHTML = message
+})

docs/fiddles/communication/two-processes/synchronous-messages/index.html

@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8">
+  </head>
+  <body>
+    <div>
+      <div>
+        <h1>Synchronous messages</h1>
+        <i>Supports: Win, macOS, Linux <span>|</span> Process: Both</i>
+        <div>
+          <div>
+            <button id="sync-msg">Ping</button>
+            <span id="sync-reply"></span>
+          </div>
+          <p>You can use the <code>ipc</code> module to send synchronous messages between processes as well, but note that the synchronous nature of this method means that it <b>will block</b> other operations while completing its task.</p>
+          
+          <p>This example sends a synchronous message, "ping", from this process (renderer) to the main process. The main process then replies with "pong".</p>
+        </div>
+      </div>
+    </div>
+    <script>
+      // You can also require other files to run in this process
+      require('./renderer.js')
+    </script>
+  </body>
+</html> 

docs/fiddles/communication/two-processes/synchronous-messages/main.js

@@ -0,0 +1,29 @@
+const { app, BrowserWindow, ipcMain } = require('electron')
+
+let mainWindow = null
+
+function createWindow () {
+  const windowOptions = {
+    width: 600,
+    height: 400,
+    title: 'Synchronous Messages',
+    webPreferences: {
+      nodeIntegration: true
+    }
+  }
+
+  mainWindow = new BrowserWindow(windowOptions)
+  mainWindow.loadFile('index.html')
+
+  mainWindow.on('closed', () => {
+    mainWindow = null
+  })
+}
+
+app.whenReady().then(() => {
+  createWindow()
+})
+
+ipcMain.on('synchronous-message', (event, arg) => {
+    event.returnValue = 'pong'
+})

docs/fiddles/communication/two-processes/synchronous-messages/renderer.js

@@ -0,0 +1,9 @@
+const { ipcRenderer } = require('electron')
+
+const syncMsgBtn = document.getElementById('sync-msg')
+
+syncMsgBtn.addEventListener('click', () => {
+    const reply = ipcRenderer.sendSync('synchronous-message', 'ping')
+    const message = `Synchronous message reply: ${reply}`
+    document.getElementById('sync-reply').innerHTML = message
+})

docs/glossary.md

@@ -91,7 +91,7 @@ An IPC system for communicating intra- or inter-process, and that's important
 because Chrome is keen on being able to split its work into separate processes
 or not, depending on memory pressures etc.
 
-See https://chromium.googlesource.com/chromium/src/+/main/mojo/README.md
+See https://chromium.googlesource.com/chromium/src/+/master/mojo/README.md
 
 See also: [IPC](#ipc)
 

docs/images/tutorial-release-schedule.svg

@@ -0,0 +1,97 @@
+<?xml version="1.0" standalone="yes"?>
+<svg width="520" height="220" version="1.1" xmlns="http://www.w3.org/2000/svg">
+  <marker id="arrow" viewBox="-1 0 12 10" refX="10.5" refY="5" markerWidth="8" markerHeight="8" orient="auto">
+    <path d="M 0 0 L 10 5 L 0 10"/>
+  </marker>
+  <g transform="translate(0,40)">
+    <!-- master -->
+    <text x="60" y="30" text-anchor="end" alignment-baseline="middle">master</text>
+    <path d="M70 30 H 500" stroke-width="2" stroke="black"/>
+    <!-- v2.0 -->
+    <g>
+      <path d="M100 30 l 20 30 H 200" stroke-width="2" stroke="black" fill="transparent"/>
+      <text x="110" y="60" text-anchor="end" alignment-baseline="middle">2.0</text>
+      <circle cx="120" cy="60" r="5"/>
+      <text x="110" y="60" text-anchor="end" alignment-baseline="middle" transform="rotate(-60 120,60)">v2.0.0-beta0</text>
+      <circle cx="200" cy="60" r="5"/>
+      <text x="190" y="60" text-anchor="end" alignment-baseline="middle" transform="rotate(-60 200,60)">v2.0.0</text>
+    </g>
+    <!-- v2.1 -->
+    <g transform="translate(130,0)">
+      <path d="M100 30 l 20 30 H 200" stroke-width="2" stroke="black" fill="transparent"/>
+      <text x="110" y="60" text-anchor="end" alignment-baseline="middle">2.1</text>
+      <circle cx="120" cy="60" r="5"/>
+      <text x="110" y="60" text-anchor="end" alignment-baseline="middle" transform="rotate(-60 120,60)">v2.1.0-beta0</text>
+      <circle cx="160" cy="60" r="5"/>
+      <text x="150" y="60" text-anchor="end" alignment-baseline="middle" transform="rotate(-60 160,60)">v2.1.0-beta1</text>
+      <circle cx="200" cy="60" r="5"/>
+      <text x="190" y="60" text-anchor="end" alignment-baseline="middle" transform="rotate(-60 200,60)">v2.1.0</text>
+    </g>
+    <!-- v3.0 -->
+    <g transform="translate(260,0)">
+      <path d="M100 30 l 20 30 H 200" stroke-width="2" stroke="black" fill="transparent"/>
+      <text x="110" y="60" text-anchor="end" alignment-baseline="middle">3.0</text>
+      <circle cx="120" cy="60" r="5"/>
+      <text x="110" y="60" text-anchor="end" alignment-baseline="middle" transform="rotate(-60 120,60)">v3.0.0-beta0</text>
+      <circle cx="200" cy="60" r="5"/>
+      <text x="190" y="60" text-anchor="end" alignment-baseline="middle" transform="rotate(-60 200,60)">v3.0.0</text>
+    </g>
+    <!-- Bug fixes -->
+    <g transform="translate(160,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">bug fix</text>
+      <path d="M0 0 l0,30" marker-end="url(#arrow)" stroke-dasharray="2,2" stroke="#000"/>
+    </g>
+    <g transform="translate(260,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">bug fix</text>
+      <path d="M0 0 l0,30" marker-end="url(#arrow)" stroke-dasharray="2,2" stroke="#000"/>
+    </g>
+    <g transform="translate(280,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">bug fix</text>
+      <path d="M0 0 l0,30" marker-end="url(#arrow)" stroke-dasharray="2,2" stroke="#000"/>
+    </g>
+    <g transform="translate(400,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">bug fix</text>
+      <path d="M0 0 l0,30" marker-end="url(#arrow)" stroke-dasharray="2,2" stroke="#000"/>
+    </g>
+    <g transform="translate(430,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">bug fix</text>
+      <path d="M0 0 l0,30" marker-end="url(#arrow)" stroke-dasharray="2,2" stroke="#000"/>
+    </g>
+    <!-- Features -->
+    <g transform="translate(130,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">feature</text>
+    </g>
+    <g transform="translate(200,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">feature</text>
+    </g>
+    <g transform="translate(340,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)">feature</text>
+    </g>
+    <!-- Chromium update -->
+    <g transform="translate(310,30)">
+      <circle cx="0" cy="0" r="3"/>
+      <text x="10" y="0" text-anchor="start" alignment-baseline="middle" transform="rotate(-60 0,0)"><tspan>chromium</tspan><tspan dy="10" x="10">update</tspan></text>
+    </g>
+    <!-- Timeline -->
+    <g transform="translate(100,160)">
+      <text x="50" y="0" text-anchor="middle" alignment-baseline="text-after-edge">~1 week</text>
+      <path d="M0 0 l0 10 l0 -5 H100l0 -5l0 10" stroke-width="2" stroke="black" fill="transparent"/>
+    </g>
+    <g transform="translate(230,160)">
+      <text x="50" y="0" text-anchor="middle" alignment-baseline="text-after-edge">~1 week</text>
+      <path d="M0 0 l0 10 l0 -5 H100l0 -5l0 10" stroke-width="2" stroke="black" fill="transparent"/>
+    </g>
+    <g transform="translate(360,160)">
+      <text x="50" y="0" text-anchor="middle" alignment-baseline="text-after-edge">~1 week</text>
+      <path d="M0 0 l0 10 l0 -5 H100l0 -5l0 10" stroke-width="2" stroke="black" fill="transparent"/>
+    </g>
+  </g>
+</svg>

docs/tutorial/electron-timelines.md

@@ -1,100 +1,30 @@
-# Electron Releases
+# Electron Release Timelines
 
-Electron frequently releases major versions alongside every other Chromium release.
-This document focuses on the release cadence and version support policy.
-For a more in-depth guide on our git branches and how Electron uses semantic versions,
-check out our [Electron Versioning](./electron-versioning.md) doc.
+Special notes:
 
-## Timeline
-
-| Electron | Alpha | Beta | Stable | Chrome | Node | Supported |
-| ------- | ----- | ------- | ------ | ------ | ---- | ---- |
-| 2.0.0 | -- | 2018-Feb-21 | 2018-May-01 | M61 | v8.9 | 🚫 |
-| 3.0.0 | -- | 2018-Jun-21 | 2018-Sep-18 | M66 | v10.2 | 🚫 |
-| 4.0.0 | -- | 2018-Oct-11 | 2018-Dec-20 | M69 | v10.11 | 🚫 |
-| 5.0.0 | -- | 2019-Jan-22 | 2019-Apr-24 | M73 | v12.0 | 🚫 |
-| 6.0.0 | -- | 2019-May-01 | 2019-Jul-30 | M76 | v12.4 | 🚫 |
-| 7.0.0 | -- | 2019-Aug-01 | 2019-Oct-22 | M78 | v12.8 | 🚫 |
-| 8.0.0 | -- | 2019-Oct-24 | 2020-Feb-04 | M80 | v12.13 | 🚫 |
-| 9.0.0 | -- | 2020-Feb-06 | 2020-May-19 | M83 | v12.14 | 🚫 |
-| 10.0.0 | -- | 2020-May-21 | 2020-Aug-25 | M85 | v12.16 | 🚫 |
-| 11.0.0 | -- | 2020-Aug-27 | 2020-Nov-17 | M87 | v12.18 | 🚫 |
-| 12.0.0 | -- | 2020-Nov-19 | 2021-Mar-02 | M89 | v14.16 | 🚫 |
-| 13.0.0 | -- | 2021-Mar-04 | 2021-May-25 | M91 | v14.16 | 🚫 |
-| 14.0.0 | -- | 2021-May-27 | 2021-Aug-31 | M93 | v14.17 | 🚫 |
-| 15.0.0 | 2021-Jul-20 | 2021-Sep-01 | 2021-Sep-21 | M94 | v16.5 | ✅ |
-| 16.0.0 | 2021-Sep-23 | 2021-Oct-20 | 2021-Nov-16 | M96 | v16.9 | ✅ |
-| 17.0.0 | 2021-Nov-18 | 2022-Jan-06 | 2022-Feb-01 | M98 | v16.13 | ✅ |
-| 18.0.0 | 2022-Feb-03 | 2022-Mar-03 | 2022-Mar-29 | M100 | v16.13 | ✅ |
-| 19.0.0 | 2022-Mar-31 | 2022-Apr-26 | 2022-May-24 | M102 | TBD | ✅ |
-
-**Notes:**
-
-* The `-alpha.1`, `-beta.1`, and `stable` dates are our solid release dates.
-* We strive for weekly alpha/beta releases, but we often release more than scheduled.
+* The `-beta.1` and `stable` dates are our solid release dates.
+* We strive for weekly beta releases, however we often release more betas than scheduled.
 * All dates are our goals but there may be reasons for adjusting the stable deadline, such as security bugs.
+* Take a look at the [5.0.0 Timeline blog post](https://electronjs.org/blog/electron-5-0-timeline) for info about publicizing our release dates.
+* Since Electron 6.0, we've been targeting every other Chromium version and releasing our stable on the same day as Chrome stable. You can reference Chromium's release schedule [here](https://chromiumdash.appspot.com/schedule). See [Electron's new release cadence blog post](https://www.electronjs.org/blog/12-week-cadence) for more details on our release schedule.
+* Starting in Electron 16.0, we will release on an 8-week cadence. See [Electron's new 8-week cadence blog post](https://www.electronjs.org/blog/8-week-cadence) for more details.
 
-**Historical changes:**
-
-* Since Electron 5, Electron has been publicizing its release dates ([see blog post](https://electronjs.org/blog/electron-5-0-timeline)).
-* Since Electron 6, Electron major versions have been targeting every other Chromium major version. Each Electron stable should happen on the same day as Chrome stable ([see blog post](https://www.electronjs.org/blog/12-week-cadence)).
-* Since Electron 16, Electron has been releasing major versions on an 8-week cadence in accordance to Chrome's change to a 4-week release cadence ([see blog post](https://www.electronjs.org/blog/8-week-cadence)).
-
-:::info Chrome release dates
-
-Chromium has the own public release schedule [here](https://chromiumdash.appspot.com/schedule).
-
-:::
-
-## Version support policy
-
-:::info
-
-Beginning in September 2021 (Electron 15), the Electron team
-will temporarily support the latest **four** stable major versions. This
-extended support is intended to help Electron developers transition to
-the [new 8-week release cadence](https://electronjs.org/blog/8-week-cadence),
-and will continue until the release of Electron 19. At that time,
-the Electron team will drop support back to the latest three stable major versions.
-
-:::
-
-The latest three *stable* major versions are supported by the Electron team.
-For example, if the latest release is 6.1.x, then the 5.0.x as well
-as the 4.2.x series are supported. We only support the latest minor release
-for each stable release series. This means that in the case of a security fix,
-6.1.x will receive the fix, but we will not release a new version of 6.0.x.
-
-The latest stable release unilaterally receives all fixes from `main`,
-and the version prior to that receives the vast majority of those fixes
-as time and bandwidth warrants. The oldest supported release line will receive
-only security fixes directly.
-
-### Breaking API changes
-
-When an API is changed or removed in a way that breaks existing functionality, the
-previous functionality will be supported for a minimum of two major versions when
-possible before being removed. For example, if a function takes three arguments,
-and that number is reduced to two in major version 10, the three-argument version would
-continue to work until, at minimum, major version 12. Past the minimum two-version
-threshold, we will attempt to support backwards compatibility beyond two versions
-until the maintainers feel the maintenance burden is too high to continue doing so.
-
-### End-of-life
-
-When a release branch reaches the end of its support cycle, the series
-will be deprecated in NPM and a final end-of-support release will be
-made. This release will add a warning to inform that an unsupported
-version of Electron is in use.
-
-These steps are to help app developers learn when a branch they're
-using becomes unsupported, but without being excessively intrusive
-to end users.
-
-If an application has exceptional circumstances and needs to stay
-on an unsupported series of Electron, developers can silence the
-end-of-support warning by omitting the final release from the app's
-`package.json` `devDependencies`. For example, since the 1-6-x series
-ended with an end-of-support 1.6.18 release, developers could choose
-to stay in the 1-6-x series without warnings with `devDependency` of
-`"electron": 1.6.0 - 1.6.17`.
+| Electron | Alpha | Beta | Stable | Chrome | Node |
+| ------- | ----- | ------- | ------ | ------ | ---- |
+| 2.0.0 | -- | 2018-Feb-21 | 2018-May-01 | M61 | v8.9 |
+| 3.0.0 | -- | 2018-Jun-21 | 2018-Sep-18 | M66 | v10.2 |
+| 4.0.0 | -- | 2018-Oct-11 | 2018-Dec-20 | M69 | v10.11 |
+| 5.0.0 | -- | 2019-Jan-22 | 2019-Apr-24 | M73 | v12.0 |
+| 6.0.0 | -- | 2019-May-01 | 2019-Jul-30 | M76 | v12.4 |
+| 7.0.0 | -- | 2019-Aug-01 | 2019-Oct-22 | M78 | v12.8 |
+| 8.0.0 | -- | 2019-Oct-24 | 2020-Feb-04 | M80 | v12.13 |
+| 9.0.0 | -- | 2020-Feb-06 | 2020-May-19 | M83 | v12.14 |
+| 10.0.0 | -- | 2020-May-21 | 2020-Aug-25 | M85 | v12.16 |
+| 11.0.0 | -- | 2020-Aug-27 | 2020-Nov-17 | M87 | v12.18 |
+| 12.0.0 | -- | 2020-Nov-19 | 2021-Mar-02 | M89 | v14.16 |
+| 13.0.0 | -- | 2021-Mar-04 | 2021-May-25 | M91 | v14.16 |
+| 14.0.0 | -- | 2021-May-27 | 2021-Aug-31 | M93 | v14.17 |
+| 15.0.0 | 2021-Jul-20 | 2021-Sep-01 | 2021-Sep-21 | M94 | v16.5 |
+| 16.0.0 | 2021-Sep-23 | 2021-Oct-20 | 2021-Nov-16 | M96 | v16.9 |
+| 17.0.0 | 2021-Nov-18 | 2022-Jan-06 | 2022-Feb-01 | M98 | v16.13 |
+| 18.0.0 | 2022-Feb-03 | 2022-Mar-03 | 2022-Mar-29 | M100 | TBD |

docs/tutorial/electron-versioning.md

@@ -48,7 +48,7 @@ Stabilization branches are branches that run parallel to `main`, taking in only
 
 Since Electron 8, stabilization branches are always **major** version lines, and named against the following template `$MAJOR-x-y` e.g. `8-x-y`.  Prior to that we used **minor** version lines and named them as `$MAJOR-$MINOR-x` e.g. `2-0-x`.
 
-We allow for multiple stabilization branches to exist simultaneously, one for each supported version. For more details on which versions are supported, see our [Electron Releases](./electron-timelines.md) doc.
+We allow for multiple stabilization branches to exist simultaneously, one for each supported version. For more details on which versions are supported, see our [Electron Release Timelines](./electron-timelines.md) doc.
 
 ![Multiple Stability Branches](../images/versioning-sketch-2.png)
 
@@ -107,15 +107,6 @@ A few examples of how various SemVer ranges will pick up new releases:
 
 ![Semvers and Releases](../images/versioning-sketch-7.png)
 
-### Backport request process
-
-All supported release lines will accept external pull requests to backport
-fixes previously merged to `main`, though this may be on a case-by-case
-basis for some older supported lines. All contested decisions around release
-line backports will be resolved by the
-[Releases Working Group](https://github.com/electron/governance/tree/main/wg-releases)
-as an agenda item at their weekly meeting the week the backport PR is raised.
-
 ## Feature flags
 
 Feature flags are a common practice in Chromium, and are well-established in the web-development ecosystem. In the context of Electron, a feature flag or **soft branch** must have the following properties:

docs/tutorial/process-model.md

@@ -40,7 +40,7 @@ to `require` modules and use all of Node.js APIs.
 
 ### Window management
 
-The primary purpose of the main process is to create and manage application windows with the
+The main process' primary purpose is to create and manage application windows with the
 [`BrowserWindow`][browser-window] module.
 
 Each instance of the `BrowserWindow` class creates an application window that loads

docs/tutorial/quick-start.md

@@ -66,7 +66,7 @@ Your `package.json` file should look something like this:
 Then, install the `electron` package into your app's `devDependencies`.
 
 ```sh npm2yarn
-npm install --save-dev electron
+$ npm install --save-dev electron
 ```
 
 > Note: If you're encountering any issues with installing Electron, please
@@ -131,7 +131,6 @@ folder of your project:
     <meta charset="UTF-8">
     <!-- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -->
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">
-    <meta http-equiv="X-Content-Security-Policy" content="default-src 'self'; script-src 'self'">
     <title>Hello World!</title>
   </head>
   <body>
@@ -427,7 +426,6 @@ window.addEventListener('DOMContentLoaded', () => {
     <meta charset="UTF-8">
     <!-- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -->
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">
-    <meta http-equiv="X-Content-Security-Policy" content="default-src 'self'; script-src 'self'">
     <title>Hello World!</title>
   </head>
   <body>

docs/tutorial/sandbox.md

@@ -157,7 +157,7 @@ versions of Electron, we do not make a guarantee that every fix will be
 backported. Your best chance at staying secure is to be on the latest stable
 version of Electron.
 
-[sandbox]: https://chromium.googlesource.com/chromium/src/+/main/docs/design/sandbox.md
+[sandbox]: https://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md
 [issue-28466]: https://github.com/electron/electron/issues/28466
 [browser-window]: ../api/browser-window.md
 [enable-sandbox]: ../api/app.md#appenablesandbox

docs/tutorial/security.md

@@ -279,12 +279,11 @@ security-conscious developers might want to assume the very opposite.
 
 ```js title='main.js (Main Process)'
 const { session } = require('electron')
-const URL = require('url').URL
 
 session
   .fromPartition('some-partition')
   .setPermissionRequestHandler((webContents, permission, callback) => {
-    const parsedUrl = new URL(webContents.getURL())
+    const url = webContents.getURL()
 
     if (permission === 'notifications') {
       // Approves the permissions request
@@ -292,7 +291,7 @@ session
     }
 
     // Verify URL
-    if (parsedUrl.protocol !== 'https:' || parsedUrl.host !== 'example.com') {
+    if (!url.startsWith('https://example.com/')) {
       // Denies the permissions request
       return callback(false)
     }
@@ -563,6 +562,7 @@ app.on('web-contents-created', (event, contents) => {
   contents.on('will-attach-webview', (event, webPreferences, params) => {
     // Strip away preload scripts if unused or verify their location is legitimate
     delete webPreferences.preload
+    delete webPreferences.preloadURL
 
     // Disable Node.js integration
     webPreferences.nodeIntegration = false
@@ -724,41 +724,6 @@ Migrate your app one major version at a time, while referring to Electron's
 [Breaking Changes][breaking-changes] document to see if any code needs to
 be updated.
 
-### 17. Validate the `sender` of all IPC messages
-
-You should always validate incoming IPC messages `sender` property to ensure you
-aren't performing actions or sending information to untrusted renderers.
-
-#### Why?
-
-All Web Frames can in theory send IPC messages to the main process, including
-iframes and child windows in some scenarios.  If you have an IPC message that returns
-user data to the sender via `event.reply` or performs privileged actions that the renderer
-can't natively, you should ensure you aren't listening to third party web frames.
-
-You should be validating the `sender` of **all** IPC messages by default.
-
-#### How?
-
-```js title='main.js (Main Process)'
-// Bad
-ipcMain.handle('get-secrets', () => {
-  return getSecrets();
-});
-
-// Good
-ipcMain.handle('get-secrets', (e) => {
-  if (!validateSender(e.senderFrame)) return null;
-  return getSecrets();
-});
-
-function validateSender(frame) {
-  // Value the host of the URL using an actual URL parser and an allowlist
-  if ((new URL(frame.url)).host === 'electronjs.org') return true;
-  return false;
-}
-```
-
 [breaking-changes]: ../breaking-changes.md
 [browser-window]: ../api/browser-window.md
 [browser-view]: ../api/browser-view.md

docs/tutorial/support.md

@@ -1,5 +1,128 @@
-# This doc has moved!
+# Electron Support
 
-* For information on supported releases, see the [Electron Releases](./electron-timelines.md) doc.
-* For community support on Electron, see the [Community page](https://www.electronjs.org/community).
-* For platform support info, see the [README](https://github.com/electron/electron/blob/main/README.md).
+## Finding Support
+
+If you have a security concern,
+please see the [security document](https://github.com/electron/electron/tree/main/SECURITY.md).
+
+If you're looking for programming help,
+for answers to questions,
+or to join in discussion with other developers who use Electron,
+you can interact with the community in these locations:
+
+* [Electron's Discord server](https://discord.com/invite/APGC3k5yaH) has channels for:
+  * Getting help
+  * Ecosystem apps like [Electron Forge](https://github.com/electron-userland/electron-forge) and [Electron Fiddle](https://github.com/electron/fiddle)
+  * Sharing ideas with other Electron app developers
+  * And more!
+* [`electron`](https://discuss.atom.io/c/electron) category on the Atom forums
+* `#electron` channel on [Atom's Slack](https://discuss.atom.io/t/join-us-on-slack/16638?source_topic_id=25406)
+* [`electron-ru`](https://telegram.me/electron_ru) *(Russian)*
+* [`electron-br`](https://electron-br.slack.com) *(Brazilian Portuguese)*
+* [`electron-kr`](https://electron-kr.github.io/electron-kr) *(Korean)*
+* [`electron-jp`](https://electron-jp.slack.com) *(Japanese)*
+* [`electron-tr`](https://electron-tr.herokuapp.com) *(Turkish)*
+* [`electron-id`](https://electron-id.slack.com) *(Indonesia)*
+* [`electron-pl`](https://electronpl.github.io) *(Poland)*
+
+If you'd like to contribute to Electron,
+see the [contributing document](https://github.com/electron/electron/blob/main/CONTRIBUTING.md).
+
+If you've found a bug in a [supported version](#supported-versions) of Electron,
+please report it with the [issue tracker](../development/issues.md).
+
+[awesome-electron](https://github.com/sindresorhus/awesome-electron)
+is a community-maintained list of useful example apps,
+tools and resources.
+
+## Supported Versions
+
+_**Note:** Beginning in September 2021 with Electron 15, the Electron team
+will temporarily support the latest **four** stable major versions. This
+extended support is intended to help Electron developers transition to
+the [new eight week release cadence](https://electronjs.org/blog/8-week-cadence), and will continue until May 2022, with
+the release of Electron 19. At that time, the Electron team will drop support
+back to the latest three stable major versions._
+
+The latest three *stable* major versions are supported by the Electron team.
+For example, if the latest release is 6.1.x, then the 5.0.x as well
+as the 4.2.x series are supported.  We only support the latest minor release
+for each stable release series.  This means that in the case of a security fix
+6.1.x will receive the fix, but we will not release a new version of 6.0.x.
+
+The latest stable release unilaterally receives all fixes from `main`,
+and the version prior to that receives the vast majority of those fixes
+as time and bandwidth warrants. The oldest supported release line will receive
+only security fixes directly.
+
+All supported release lines will accept external pull requests to backport
+fixes previously merged to `main`, though this may be on a case-by-case
+basis for some older supported lines. All contested decisions around release
+line backports will be resolved by the [Releases Working Group](https://github.com/electron/governance/tree/main/wg-releases) as an agenda item at their weekly meeting the week the backport PR is raised.
+
+When an API is changed or removed in a way that breaks existing functionality, the
+previous functionality will be supported for a minimum of two major versions when
+possible before being removed. For example, if a function takes three arguments,
+and that number is reduced to two in major version 10, the three-argument version would
+continue to work until, at minimum, major version 12. Past the minimum two-version
+threshold, we will attempt to support backwards compatibility beyond two versions
+until the maintainers feel the maintenance burden is too high to continue doing so.
+
+### Currently supported versions
+
+* 18.x.y
+* 17.x.y
+* 16.x.y
+* 15.x.y
+
+### End-of-life
+
+When a release branch reaches the end of its support cycle, the series
+will be deprecated in NPM and a final end-of-support release will be
+made. This release will add a warning to inform that an unsupported
+version of Electron is in use.
+
+These steps are to help app developers learn when a branch they're
+using becomes unsupported, but without being excessively intrusive
+to end users.
+
+If an application has exceptional circumstances and needs to stay
+on an unsupported series of Electron, developers can silence the
+end-of-support warning by omitting the final release from the app's
+`package.json` `devDependencies`. For example, since the 1-6-x series
+ended with an end-of-support 1.6.18 release, developers could choose
+to stay in the 1-6-x series without warnings with `devDependency` of
+`"electron": 1.6.0 - 1.6.17`.
+
+## Supported Platforms
+
+Following platforms are supported by Electron:
+
+### macOS
+
+Only 64bit binaries are provided for macOS, and the minimum macOS version
+supported is macOS 10.11 (El Capitan).
+
+Native support for Apple Silicon (`arm64`) devices was added in Electron 11.0.0.
+
+### Windows
+
+Windows 7 and later are supported, older operating systems are not supported
+(and do not work).
+
+Both `ia32` (`x86`) and `x64` (`amd64`) binaries are provided for Windows.
+[Native support for Windows on Arm (`arm64`) devices was added in Electron 6.0.8.](windows-arm.md).
+Running apps packaged with previous versions is possible using the ia32 binary.
+
+### Linux
+
+The prebuilt binaries of Electron are built on Ubuntu 18.04.
+
+Whether the prebuilt binary can run on a distribution depends on whether the
+distribution includes the libraries that Electron is linked to on the building
+platform, so only Ubuntu 18.04 is guaranteed to work, but following platforms
+are also verified to be able to run the prebuilt binaries of Electron:
+
+* Ubuntu 14.04 and newer
+* Fedora 24 and newer
+* Debian 8 and newer

electron_paks.gni

@@ -65,6 +65,7 @@ template("electron_extra_paks") {
       "$root_gen_dir/net/net_resources.pak",
       "$root_gen_dir/third_party/blink/public/resources/blink_resources.pak",
       "$root_gen_dir/third_party/blink/public/resources/inspector_overlay_resources.pak",
+      "$root_gen_dir/ui/resources/webui_resources.pak",
       "$target_gen_dir/electron_resources.pak",
     ]
     deps = [
@@ -177,6 +178,7 @@ template("electron_paks") {
       "${root_gen_dir}/third_party/blink/public/strings/blink_accessibility_strings_",
       "${root_gen_dir}/third_party/blink/public/strings/blink_strings_",
       "${root_gen_dir}/device/bluetooth/strings/bluetooth_strings_",
+      "${root_gen_dir}/extensions/strings/extensions_strings_",
       "${root_gen_dir}/services/strings/services_strings_",
       "${root_gen_dir}/ui/strings/app_locale_settings_",
       "${root_gen_dir}/ui/strings/ax_strings_",
@@ -186,6 +188,7 @@ template("electron_paks") {
       "//chrome/app/resources:platform_locale_settings",
       "//components/strings:components_strings",
       "//device/bluetooth/strings",
+      "//extensions/strings",
       "//services/strings",
       "//third_party/blink/public/strings",
       "//third_party/blink/public/strings:accessibility_strings",
@@ -198,7 +201,7 @@ template("electron_paks") {
     output_dir = "${invoker.output_dir}/locales"
 
     if (is_mac) {
-      output_locales = locales_as_apple_outputs
+      output_locales = locales_as_mac_outputs
     } else {
       output_locales = platform_pak_locales
     }

filenames.hunspell.gni

@@ -7,16 +7,11 @@ hunspell_dictionaries = [
   "//third_party/hunspell_dictionaries/da-DK-3-0.bdic",
   "//third_party/hunspell_dictionaries/de-DE-3-0.bdic",
   "//third_party/hunspell_dictionaries/el-GR-3-0.bdic",
-  "//third_party/hunspell_dictionaries/en-AU-10-0.bdic",
-  "//third_party/hunspell_dictionaries/en-AU-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-CA-10-0.bdic",
-  "//third_party/hunspell_dictionaries/en-CA-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-GB-10-0.bdic",
-  "//third_party/hunspell_dictionaries/en-GB-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-GB-oxendict-10-0.bdic",
-  "//third_party/hunspell_dictionaries/en-GB-oxendict-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-US-10-0.bdic",
-  "//third_party/hunspell_dictionaries/en-US-10-1.bdic",
+  "//third_party/hunspell_dictionaries/en-AU-9-0.bdic",
+  "//third_party/hunspell_dictionaries/en-CA-9-0.bdic",
+  "//third_party/hunspell_dictionaries/en-GB-9-0.bdic",
+  "//third_party/hunspell_dictionaries/en-GB-oxendict-9-0.bdic",
+  "//third_party/hunspell_dictionaries/en-US-9-0.bdic",
   "//third_party/hunspell_dictionaries/es-ES-3-0.bdic",
   "//third_party/hunspell_dictionaries/et-EE-3-0.bdic",
   "//third_party/hunspell_dictionaries/fa-IR-9-0.bdic",
@@ -51,7 +46,6 @@ hunspell_dictionaries = [
   "//third_party/hunspell_dictionaries/tg-TG-5-0.bdic",
   "//third_party/hunspell_dictionaries/tr-TR-4-0.bdic",
   "//third_party/hunspell_dictionaries/uk-UA-4-0.bdic",
-  "//third_party/hunspell_dictionaries/uk-UA-5-0.bdic",
   "//third_party/hunspell_dictionaries/vi-VN-3-0.bdic",
   "//third_party/hunspell_dictionaries/xx-XX-3-0.bdic",
 ]

filenames.libcxxabi.gni

@@ -1,5 +1,4 @@
 libcxxabi_headers = [
-  "//buildtools/third_party/libc++abi/trunk/include/CMakeLists.txt",
   "//buildtools/third_party/libc++abi/trunk/include/__cxxabi_config.h",
   "//buildtools/third_party/libc++abi/trunk/include/cxxabi.h",
 ]

lib/browser/api/app.ts

@@ -1,6 +1,6 @@
 import * as fs from 'fs';
 
-import { Menu, deprecate } from 'electron/main';
+import { Menu } from 'electron/main';
 
 const bindings = process._linkedBinding('electron_browser_app');
 const commandLine = process._linkedBinding('electron_common_command_line');
@@ -111,7 +111,3 @@ for (const name of events) {
     webContents.emit(name, event, ...args);
   });
 }
-
-// Deprecation.
-deprecate.event(app, 'gpu-process-crashed', 'child-process-gone');
-deprecate.event(app, 'renderer-process-crashed', 'render-process-gone');

lib/browser/api/net.ts

@@ -198,7 +198,7 @@ class ChunkedBodyStream extends Writable {
     this._downstream = pipe;
     if (this._pendingChunk) {
       const doneWriting = (maybeError: Error | void) => {
-        // If the underlying request has been aborted, we honestly don't care about the error
+        // If the underlying request has been aborted, we honeslty don't care about the error
         // all work should cease as soon as we abort anyway, this error is probably a
         // "mojo pipe disconnected" error (code=9)
         if (this._clientRequest._aborted) return;

lib/browser/api/web-contents.ts

@@ -492,51 +492,42 @@ WebContents.prototype.loadURL = function (url, options) {
   return p;
 };
 
-WebContents.prototype.setWindowOpenHandler = function (handler: (details: Electron.HandlerDetails) => ({action: 'deny'} | {action: 'allow', overrideBrowserWindowOptions?: BrowserWindowConstructorOptions, outlivesOpener?: boolean})) {
+WebContents.prototype.setWindowOpenHandler = function (handler: (details: Electron.HandlerDetails) => ({action: 'allow'} | {action: 'deny', overrideBrowserWindowOptions?: BrowserWindowConstructorOptions})) {
   this._windowOpenHandler = handler;
 };
 
-WebContents.prototype._callWindowOpenHandler = function (event: Electron.Event, details: Electron.HandlerDetails): {browserWindowConstructorOptions: BrowserWindowConstructorOptions | null, outlivesOpener: boolean} {
-  const defaultResponse = {
-    browserWindowConstructorOptions: null,
-    outlivesOpener: false
-  };
+WebContents.prototype._callWindowOpenHandler = function (event: Electron.Event, details: Electron.HandlerDetails): BrowserWindowConstructorOptions | null {
   if (!this._windowOpenHandler) {
-    return defaultResponse;
+    return null;
   }
+
   const response = this._windowOpenHandler(details);
 
   if (typeof response !== 'object') {
     event.preventDefault();
     console.error(`The window open handler response must be an object, but was instead of type '${typeof response}'.`);
-    return defaultResponse;
+    return null;
   }
 
   if (response === null) {
     event.preventDefault();
     console.error('The window open handler response must be an object, but was instead null.');
-    return defaultResponse;
+    return null;
   }
 
   if (response.action === 'deny') {
     event.preventDefault();
-    return defaultResponse;
+    return null;
   } else if (response.action === 'allow') {
     if (typeof response.overrideBrowserWindowOptions === 'object' && response.overrideBrowserWindowOptions !== null) {
-      return {
-        browserWindowConstructorOptions: response.overrideBrowserWindowOptions,
-        outlivesOpener: typeof response.outlivesOpener === 'boolean' ? response.outlivesOpener : false
-      };
+      return response.overrideBrowserWindowOptions;
     } else {
-      return {
-        browserWindowConstructorOptions: {},
-        outlivesOpener: typeof response.outlivesOpener === 'boolean' ? response.outlivesOpener : false
-      };
+      return {};
     }
   } else {
     event.preventDefault();
     console.error('The window open handler response must be an object with an \'action\' property of \'allow\' or \'deny\'.');
-    return defaultResponse;
+    return null;
   }
 };
 
@@ -571,7 +562,7 @@ const loggingEnabled = () => {
 // Add JavaScript wrappers for WebContents class.
 WebContents.prototype._init = function () {
   const prefs = this.getLastWebPreferences() || {};
-  if (!prefs.nodeIntegration && prefs.preload != null && prefs.sandbox == null) {
+  if (!prefs.nodeIntegration && (prefs.preload != null || prefs.preloadURL != null) && prefs.sandbox == null) {
     deprecate.log('The default sandbox option for windows without nodeIntegration is changing. Presently, by default, when a window has a preload script, it defaults to being unsandboxed. In Electron 20, this default will be changing, and all windows that have nodeIntegration: false (which is the default) will be sandboxed by default. If your preload script doesn\'t use Node, no action is needed. If your preload script does use Node, either refactor it to move Node usage to the main process, or specify sandbox: false in your WebPreferences.');
   }
   // Read off the ID at construction time, so that it's accessible even after
@@ -666,8 +657,15 @@ WebContents.prototype._init = function () {
         postBody,
         disposition
       };
-      const result = this._callWindowOpenHandler(event, details);
-      const options = result.browserWindowConstructorOptions;
+
+      let options: ReturnType<typeof this._callWindowOpenHandler>;
+      try {
+        options = this._callWindowOpenHandler(event, details);
+      } catch (err) {
+        event.preventDefault();
+        throw err;
+      }
+
       if (!event.defaultPrevented) {
         openGuestWindow({
           event,
@@ -676,14 +674,12 @@ WebContents.prototype._init = function () {
           referrer,
           postData,
           overrideBrowserWindowOptions: options || {},
-          windowOpenArgs: details,
-          outlivesOpener: result.outlivesOpener
+          windowOpenArgs: details
         });
       }
     });
 
     let windowOpenOverriddenOptions: BrowserWindowConstructorOptions | null = null;
-    let windowOpenOutlivesOpenerOption: boolean = false;
     this.on('-will-add-new-contents' as any, (event: ElectronInternal.Event, url: string, frameName: string, rawFeatures: string, disposition: Electron.HandlerDetails['disposition'], referrer: Electron.Referrer, postData: PostData) => {
       const postBody = postData ? {
         data: postData,
@@ -697,9 +693,16 @@ WebContents.prototype._init = function () {
         referrer,
         postBody
       };
-      const result = this._callWindowOpenHandler(event, details);
-      windowOpenOutlivesOpenerOption = result.outlivesOpener;
-      windowOpenOverriddenOptions = result.browserWindowConstructorOptions;
+
+      let result: ReturnType<typeof this._callWindowOpenHandler>;
+      try {
+        result = this._callWindowOpenHandler(event, details);
+      } catch (err) {
+        event.preventDefault();
+        throw err;
+      }
+
+      windowOpenOverriddenOptions = result;
       if (!event.defaultPrevented) {
         const secureOverrideWebPreferences = windowOpenOverriddenOptions ? {
           // Allow setting of backgroundColor as a webPreference even though
@@ -730,10 +733,7 @@ WebContents.prototype._init = function () {
       _userGesture: boolean, _left: number, _top: number, _width: number, _height: number, url: string, frameName: string,
       referrer: Electron.Referrer, rawFeatures: string, postData: PostData) => {
       const overriddenOptions = windowOpenOverriddenOptions || undefined;
-      const outlivesOpener = windowOpenOutlivesOpenerOption;
       windowOpenOverriddenOptions = null;
-      // false is the default
-      windowOpenOutlivesOpenerOption = false;
 
       if ((disposition !== 'foreground-tab' && disposition !== 'new-window' &&
            disposition !== 'background-tab')) {
@@ -753,8 +753,7 @@ WebContents.prototype._init = function () {
           url,
           frameName,
           features: rawFeatures
-        },
-        outlivesOpener
+        }
       });
     });
   }

lib/browser/guest-view-manager.ts

@@ -15,7 +15,6 @@ interface GuestInstance {
 
 const webViewManager = process._linkedBinding('electron_browser_web_view_manager');
 const eventBinding = process._linkedBinding('electron_browser_event');
-const netBinding = process._linkedBinding('electron_browser_net');
 
 const supportedWebViewEvents = Object.keys(webViewEvents);
 
@@ -50,7 +49,7 @@ function makeWebPreferences (embedder: Electron.WebContents, params: Record<stri
   };
 
   if (params.preload) {
-    webPreferences.preload = netBinding.fileURLToFilePath(params.preload);
+    webPreferences.preloadURL = params.preload;
   }
 
   // Security options that guest will always inherit from embedder

lib/browser/guest-window-manager.ts

@@ -29,7 +29,7 @@ const getGuestWindowByFrameName = (name: string) => frameNamesToWindow.get(name)
  * user to preventDefault() on the passed event (which ends up calling
  * DestroyWebContents).
  */
-export function openGuestWindow ({ event, embedder, guest, referrer, disposition, postData, overrideBrowserWindowOptions, windowOpenArgs, outlivesOpener }: {
+export function openGuestWindow ({ event, embedder, guest, referrer, disposition, postData, overrideBrowserWindowOptions, windowOpenArgs }: {
   event: { sender: WebContents, defaultPrevented: boolean },
   embedder: WebContents,
   guest?: WebContents,
@@ -38,7 +38,6 @@ export function openGuestWindow ({ event, embedder, guest, referrer, disposition
   postData?: PostData,
   overrideBrowserWindowOptions?: BrowserWindowConstructorOptions,
   windowOpenArgs: WindowOpenArgs,
-  outlivesOpener: boolean,
 }): BrowserWindow | undefined {
   const { url, frameName, features } = windowOpenArgs;
   const { options: browserWindowOptions } = makeBrowserWindowOptions({
@@ -78,7 +77,7 @@ export function openGuestWindow ({ event, embedder, guest, referrer, disposition
     ...browserWindowOptions
   });
 
-  handleWindowLifecycleEvents({ embedder, frameName, guest: window, outlivesOpener });
+  handleWindowLifecycleEvents({ embedder, frameName, guest: window });
 
   embedder.emit('did-create-window', window, { url, frameName, options: browserWindowOptions, disposition, referrer, postData });
 
@@ -91,11 +90,10 @@ export function openGuestWindow ({ event, embedder, guest, referrer, disposition
  * too is the guest destroyed; this is Electron convention and isn't based in
  * browser behavior.
  */
-const handleWindowLifecycleEvents = function ({ embedder, guest, frameName, outlivesOpener }: {
+const handleWindowLifecycleEvents = function ({ embedder, guest, frameName }: {
   embedder: WebContents,
   guest: BrowserWindow,
-  frameName: string,
-  outlivesOpener: boolean
+  frameName: string
 }) {
   const closedByEmbedder = function () {
     guest.removeListener('closed', closedByUser);
@@ -103,14 +101,9 @@ const handleWindowLifecycleEvents = function ({ embedder, guest, frameName, outl
   };
 
   const closedByUser = function () {
-    // Embedder might have been closed
-    if (!embedder.isDestroyed() && !outlivesOpener) {
-      embedder.removeListener('current-render-view-deleted' as any, closedByEmbedder);
-    }
+    embedder.removeListener('current-render-view-deleted' as any, closedByEmbedder);
   };
-  if (!outlivesOpener) {
-    embedder.once('current-render-view-deleted' as any, closedByEmbedder);
-  }
+  embedder.once('current-render-view-deleted' as any, closedByEmbedder);
   guest.once('closed', closedByUser);
 
   if (frameName) {
@@ -170,8 +163,7 @@ function emitDeprecatedNewWindowEvent ({ event, embedder, guest, windowOpenArgs,
       handleWindowLifecycleEvents({
         embedder: event.sender,
         guest: newGuest,
-        frameName,
-        outlivesOpener: false
+        frameName
       });
     }
     return true;

npm/package.json

@@ -8,7 +8,7 @@
     "postinstall": "node install.js"
   },
   "dependencies": {
-    "@electron/get": "^1.14.1",
+    "@electron/get": "^1.13.0",
     "@types/node": "^16.11.26",
     "extract-zip": "^1.0.3"
   },

package.json

@@ -1,11 +1,11 @@
 {
   "name": "electron",
-  "version": "19.0.0-beta.6",
+  "version": "18.3.5",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
     "@azure/storage-blob": "^12.9.0",
-    "@electron/docs-parser": "^0.12.4",
+    "@electron/docs-parser": "^0.12.3",
     "@electron/typescript-definitions": "^8.9.5",
     "@octokit/auth-app": "^2.10.0",
     "@octokit/rest": "^18.0.3",
@@ -54,7 +54,7 @@
     "lint-staged": "^10.2.11",
     "markdownlint": "^0.21.1",
     "markdownlint-cli": "^0.25.0",
-    "minimist": "^1.2.6",
+    "minimist": "^1.2.5",
     "null-loader": "^4.0.0",
     "pre-flight": "^1.1.0",
     "remark-cli": "^10.0.0",

patches/angle/.patches

@@ -0,0 +1,4 @@
+cherry-pick-9768648fffc9.patch
+cherry-pick-801b904aea7d.patch
+cherry-pick-03aa5ae75c29.patch
+cherry-pick-6661eb4900da.patch

patches/angle/cherry-pick-03aa5ae75c29.patch

@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Geoff Lang <geofflang@google.com>
+Date: Wed, 1 Jun 2022 11:22:42 -0400
+Subject: M102: Ignore eglBind/ReleaseTexImage calls for lost contexts.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+eglBindTexImage and eglReleaseTexImage no-op when no context is
+current. Extend this to lost contexts to match the behaviour of making
+a GL call on a lost context.
+
+This avoids potential unexpected bad accesses in the backends.
+
+Bug: chromium:1316578
+Change-Id: I7b309c297e0c803019720733dee2950abb4c4b5f
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3683869
+Reviewed-by: Jamie Madill <jmadill@chromium.org>
+Reviewed-by: Alexis Hétu <sugoi@google.com>
+Reviewed-by: Alexis Hétu <sugoi@chromium.org>
+Commit-Queue: Geoff Lang <geofflang@chromium.org>
+(cherry picked from commit bfab7e60a15dc6f72e34406d3f2a3996cd8d0be2)
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3691180
+
+diff --git a/src/libANGLE/validationEGL.cpp b/src/libANGLE/validationEGL.cpp
+index 7e4b3adb8db7ea32c98228155e0a702796f0da4c..4309fd84e74fbb4a21edfb9b90bfc1fcda5a9d4a 100644
+--- a/src/libANGLE/validationEGL.cpp
++++ b/src/libANGLE/validationEGL.cpp
+@@ -4863,7 +4863,7 @@ bool ValidateBindTexImage(const ValidationContext *val,
+     }
+ 
+     gl::Context *context = val->eglThread->getContext();
+-    if (context)
++    if (context && !context->isContextLost())
+     {
+         gl::TextureType type = egl_gl::EGLTextureTargetToTextureType(surface->getTextureTarget());
+         gl::Texture *textureObject = context->getTextureByType(type);
+diff --git a/src/libGLESv2/egl_stubs.cpp b/src/libGLESv2/egl_stubs.cpp
+index 0554b7f40c65d6a2690380fe7483818886e20533..645f53ba038e3a5ad580eead0d9135cd274c57f8 100644
+--- a/src/libGLESv2/egl_stubs.cpp
++++ b/src/libGLESv2/egl_stubs.cpp
+@@ -61,7 +61,7 @@ EGLBoolean BindTexImage(Thread *thread, Display *display, Surface *eglSurface, E
+                          GetDisplayIfValid(display), EGL_FALSE);
+ 
+     gl::Context *context = thread->getContext();
+-    if (context)
++    if (context && !context->isContextLost())
+     {
+         gl::TextureType type =
+             egl_gl::EGLTextureTargetToTextureType(eglSurface->getTextureTarget());
+@@ -573,15 +573,18 @@ EGLBoolean ReleaseTexImage(Thread *thread, Display *display, Surface *eglSurface
+ {
+     ANGLE_EGL_TRY_RETURN(thread, display->prepareForCall(), "eglReleaseTexImage",
+                          GetDisplayIfValid(display), EGL_FALSE);
+-    gl::Texture *texture = eglSurface->getBoundTexture();
+-
+-    if (texture)
++    gl::Context *context = thread->getContext();
++    if (context && !context->isContextLost())
+     {
+-        ANGLE_EGL_TRY_RETURN(thread, eglSurface->releaseTexImage(thread->getContext(), buffer),
+-                             "eglReleaseTexImage", GetSurfaceIfValid(display, eglSurface),
+-                             EGL_FALSE);
+-    }
++        gl::Texture *texture = eglSurface->getBoundTexture();
+ 
++        if (texture)
++        {
++            ANGLE_EGL_TRY_RETURN(thread, eglSurface->releaseTexImage(thread->getContext(), buffer),
++                                 "eglReleaseTexImage", GetSurfaceIfValid(display, eglSurface),
++                                 EGL_FALSE);
++        }
++    }
+     thread->setSuccess();
+     return EGL_TRUE;
+ }

patches/angle/cherry-pick-6661eb4900da.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jamie Madill <jmadill@chromium.org>
+Date: Mon, 2 May 2022 15:42:23 -0400
+Subject: Fix validation cache when deleting a Transform Feedback.
+
+Bug: chromium:1320024
+Change-Id: I76ef85a3c65c663c138d8caebd4ef2c0da53cd4f
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3621780
+Commit-Queue: Jamie Madill <jmadill@chromium.org>
+Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
+Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
+(cherry picked from commit 84e42c3b04da9e2c9d93d35bb6f2b1830fef22f4)
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3650697
+Reviewed-by: Geoff Lang <geofflang@chromium.org>
+
+diff --git a/src/libANGLE/Context.cpp b/src/libANGLE/Context.cpp
+index 390f7bc6790abe5d84b05f97160966eca46fee05..86da3fd82fff38c911e8678a1f6c415583b38381 100755
+--- a/src/libANGLE/Context.cpp
++++ b/src/libANGLE/Context.cpp
+@@ -3075,6 +3075,7 @@ void Context::detachTransformFeedback(TransformFeedbackID transformFeedback)
+     if (mState.removeTransformFeedbackBinding(this, transformFeedback))
+     {
+         bindTransformFeedback(GL_TRANSFORM_FEEDBACK, {0});
++        mStateCache.onActiveTransformFeedbackChange(this);
+     }
+ }
+ 

patches/angle/cherry-pick-801b904aea7d.patch

@@ -0,0 +1,238 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jamie Madill <jmadill@chromium.org>
+Date: Fri, 20 May 2022 10:26:15 -0400
+Subject: D3D: Fix race condition with parallel shader compile.
+
+Bug: chromium:1317673
+Change-Id: I0fb7c9a66248852e41e8700e80c295393ef941e8
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3651153
+Reviewed-by: Jie A Chen <jie.a.chen@intel.com>
+Reviewed-by: Lingfeng Yang <lfy@google.com>
+Commit-Queue: Jamie Madill <jmadill@chromium.org>
+(cherry picked from commit 4a20c9143abbf29c649cf643182735e8952089e3)
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3691050
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+
+diff --git a/src/libANGLE/renderer/d3d/ProgramD3D.cpp b/src/libANGLE/renderer/d3d/ProgramD3D.cpp
+index 59fe34fc46a1bfbc7b4be1aad6ad84b6da303b5b..3256357a80d69739661ec1fd32220d3037145875 100644
+--- a/src/libANGLE/renderer/d3d/ProgramD3D.cpp
++++ b/src/libANGLE/renderer/d3d/ProgramD3D.cpp
+@@ -1687,12 +1687,6 @@ class ProgramD3D::GetVertexExecutableTask : public ProgramD3D::GetExecutableTask
+     angle::Result run() override
+     {
+         ANGLE_TRACE_EVENT0("gpu.angle", "ProgramD3D::GetVertexExecutableTask::run");
+-        if (!mProgram->mState.getAttachedShader(gl::ShaderType::Vertex))
+-        {
+-            return angle::Result::Continue;
+-        }
+-
+-        mProgram->updateCachedInputLayoutFromShader();
+ 
+         ANGLE_TRY(mProgram->getVertexExecutableForCachedInputLayout(this, &mExecutable, &mInfoLog));
+ 
+@@ -2147,6 +2141,11 @@ std::unique_ptr<LinkEvent> ProgramD3D::link(const gl::Context *context,
+ 
+         linkResources(resources);
+ 
++        if (mState.getAttachedShader(gl::ShaderType::Vertex))
++        {
++            updateCachedInputLayoutFromShader();
++        }
++
+         return compileProgramExecutables(context, infoLog);
+     }
+ }
+diff --git a/src/tests/gl_tests/ParallelShaderCompileTest.cpp b/src/tests/gl_tests/ParallelShaderCompileTest.cpp
+index bcd88ef01308759085c8244ad2058efe68686f2b..a98aff540c642617bba366b2e238519942d7e349 100644
+--- a/src/tests/gl_tests/ParallelShaderCompileTest.cpp
++++ b/src/tests/gl_tests/ParallelShaderCompileTest.cpp
+@@ -58,9 +58,10 @@ class ParallelShaderCompileTest : public ANGLETest
+         Task(int id) : mID(id) {}
+         virtual ~Task() {}
+ 
+-        virtual bool compile()                                     = 0;
+-        virtual bool isCompileCompleted()                          = 0;
+-        virtual bool link()                                        = 0;
++        virtual bool compile()            = 0;
++        virtual bool isCompileCompleted() = 0;
++        virtual bool link()               = 0;
++        virtual void postLink() {}
+         virtual void runAndVerify(ParallelShaderCompileTest *test) = 0;
+ 
+         bool isLinkCompleted()
+@@ -71,7 +72,7 @@ class ParallelShaderCompileTest : public ANGLETest
+         }
+ 
+       protected:
+-        std::string insertRandomString(const std::string &source)
++        static std::string InsertRandomString(const std::string &source)
+         {
+             RNG rng;
+             std::ostringstream ostream;
+@@ -80,7 +81,7 @@ class ParallelShaderCompileTest : public ANGLETest
+             return ostream.str();
+         }
+ 
+-        GLuint CompileShader(GLenum type, const std::string &source)
++        static GLuint CompileShader(GLenum type, const std::string &source)
+         {
+             GLuint shader = glCreateShader(type);
+ 
+@@ -90,7 +91,14 @@ class ParallelShaderCompileTest : public ANGLETest
+             return shader;
+         }
+ 
+-        bool checkShader(GLuint shader)
++        static void RecompileShader(GLuint shader, const std::string &source)
++        {
++            const char *sourceArray[1] = {source.c_str()};
++            glShaderSource(shader, 1, sourceArray, nullptr);
++            glCompileShader(shader);
++        }
++
++        static bool CheckShader(GLuint shader)
+         {
+             GLint compileResult;
+             glGetShaderiv(shader, GL_COMPILE_STATUS, &compileResult);
+@@ -129,7 +137,7 @@ class ParallelShaderCompileTest : public ANGLETest
+         TaskRunner() {}
+         ~TaskRunner() {}
+ 
+-        void run(ParallelShaderCompileTest *test)
++        void run(ParallelShaderCompileTest *test, unsigned int pollInterval)
+         {
+ 
+             std::vector<std::unique_ptr<T>> compileTasks;
+@@ -151,6 +159,7 @@ class ParallelShaderCompileTest : public ANGLETest
+                     if (task->isCompileCompleted())
+                     {
+                         bool isLinking = task->link();
++                        task->postLink();
+                         ASSERT_TRUE(isLinking);
+                         linkTasks.push_back(std::move(task));
+                         compileTasks.erase(compileTasks.begin() + i);
+@@ -158,7 +167,10 @@ class ParallelShaderCompileTest : public ANGLETest
+                     }
+                     ++i;
+                 }
+-                angle::Sleep(kPollInterval);
++                if (pollInterval != 0)
++                {
++                    angle::Sleep(pollInterval);
++                }
+             }
+ 
+             while (!linkTasks.empty())
+@@ -173,9 +185,16 @@ class ParallelShaderCompileTest : public ANGLETest
+                         linkTasks.erase(linkTasks.begin() + i);
+                         continue;
+                     }
++                    else
++                    {
++                        task->postLink();
++                    }
+                     ++i;
+                 }
+-                angle::Sleep(kPollInterval);
++                if (pollInterval != 0)
++                {
++                    angle::Sleep(pollInterval);
++                }
+             }
+         }
+     };
+@@ -192,9 +211,9 @@ class ParallelShaderCompileTest : public ANGLETest
+         bool compile() override
+         {
+             mVertexShader =
+-                CompileShader(GL_VERTEX_SHADER, insertRandomString(essl1_shaders::vs::Simple()));
++                CompileShader(GL_VERTEX_SHADER, InsertRandomString(essl1_shaders::vs::Simple()));
+             mFragmentShader = CompileShader(GL_FRAGMENT_SHADER,
+-                                            insertRandomString(essl1_shaders::fs::UniformColor()));
++                                            InsertRandomString(essl1_shaders::fs::UniformColor()));
+             return (mVertexShader != 0 && mFragmentShader != 0);
+         }
+ 
+@@ -213,7 +232,7 @@ class ParallelShaderCompileTest : public ANGLETest
+         bool link() override
+         {
+             mProgram = 0;
+-            if (checkShader(mVertexShader) && checkShader(mFragmentShader))
++            if (CheckShader(mVertexShader) && CheckShader(mFragmentShader))
+             {
+                 mProgram = glCreateProgram();
+                 glAttachShader(mProgram, mVertexShader);
+@@ -244,10 +263,25 @@ class ParallelShaderCompileTest : public ANGLETest
+             ASSERT_GL_NO_ERROR();
+         }
+ 
++      protected:
++        void recompile()
++        {
++            RecompileShader(mVertexShader, essl1_shaders::vs::Simple());
++            RecompileShader(mFragmentShader, essl1_shaders::fs::UniformColor());
++        }
++
+       private:
+-        GLColor mColor;
+         GLuint mVertexShader;
+         GLuint mFragmentShader;
++        GLColor mColor;
++    };
++
++    class ClearColorWithDrawRecompile : public ClearColorWithDraw
++    {
++      public:
++        ClearColorWithDrawRecompile(int taskID) : ClearColorWithDraw(taskID) {}
++
++        void postLink() override { recompile(); }
+     };
+ 
+     class ImageLoadStore : public Task
+@@ -268,7 +302,7 @@ void main()
+     imageStore(uImage_2, ivec2(gl_LocalInvocationID.xy), value);
+ })";
+ 
+-            mShader = CompileShader(GL_COMPUTE_SHADER, insertRandomString(kCSSource));
++            mShader = CompileShader(GL_COMPUTE_SHADER, InsertRandomString(kCSSource));
+             return mShader != 0;
+         }
+ 
+@@ -282,7 +316,7 @@ void main()
+         bool link() override
+         {
+             mProgram = 0;
+-            if (checkShader(mShader))
++            if (CheckShader(mShader))
+             {
+                 mProgram = glCreateProgram();
+                 glAttachShader(mProgram, mShader);
+@@ -370,7 +404,18 @@ TEST_P(ParallelShaderCompileTest, LinkAndDrawManyPrograms)
+     ANGLE_SKIP_TEST_IF(!ensureParallelShaderCompileExtensionAvailable());
+ 
+     TaskRunner<ClearColorWithDraw> runner;
+-    runner.run(this);
++    runner.run(this, kPollInterval);
++}
++
++// Tests no crash in case that the Shader starts another compile while the Program being attached
++// to is still linking.
++// crbug.com/1317673
++TEST_P(ParallelShaderCompileTest, LinkProgramAndRecompileShader)
++{
++    ANGLE_SKIP_TEST_IF(!ensureParallelShaderCompileExtensionAvailable());
++
++    TaskRunner<ClearColorWithDrawRecompile> runner;
++    runner.run(this, 0);
+ }
+ 
+ class ParallelShaderCompileTestES31 : public ParallelShaderCompileTest
+@@ -389,7 +434,7 @@ TEST_P(ParallelShaderCompileTestES31, LinkAndDispatchManyPrograms)
+     ANGLE_SKIP_TEST_IF(!ensureParallelShaderCompileExtensionAvailable());
+ 
+     TaskRunner<ImageLoadStore> runner;
+-    runner.run(this);
++    runner.run(this, kPollInterval);
+ }
+ 
+ ANGLE_INSTANTIATE_TEST_ES2(ParallelShaderCompileTest);

patches/angle/cherry-pick-9768648fffc9.patch

@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: SeongHwan Park <ggabu423@gmail.com>
+Date: Tue, 31 May 2022 02:41:32 +0900
+Subject: Fix to invalidate cache when binding Transform Feedback.
+
+Bug: chromium:1330379
+Change-Id: I091116286ac511c50f9abcffa4d3cf350be920b4
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3677115
+Commit-Queue: Jamie Madill <jmadill@chromium.org>
+Reviewed-by: Jamie Madill <jmadill@chromium.org>
+(cherry picked from commit d96cee6685099f6bcc392a4d20d28c8ec484673a)
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3691799
+Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
+
+diff --git a/src/libANGLE/Context.cpp b/src/libANGLE/Context.cpp
+index 685b235cc5962c4f55f539e387dda8c7edb023bc..390f7bc6790abe5d84b05f97160966eca46fee05 100755
+--- a/src/libANGLE/Context.cpp
++++ b/src/libANGLE/Context.cpp
+@@ -1323,6 +1323,7 @@ void Context::bindTransformFeedback(GLenum target, TransformFeedbackID transform
+     TransformFeedback *transformFeedback =
+         checkTransformFeedbackAllocation(transformFeedbackHandle);
+     mState.setTransformFeedbackBinding(this, transformFeedback);
++    mStateCache.onActiveTransformFeedbackChange(this);
+ }
+ 
+ void Context::bindProgramPipeline(ProgramPipelineID pipelineHandle)

patches/chromium/.patches

@@ -102,18 +102,30 @@ chore_do_not_use_chrome_windows_in_cryptotoken_webrequestsender.patch
 process_singleton.patch
 fix_expose_decrementcapturercount_in_web_contents_impl.patch
 add_ui_scopedcliboardwriter_writeunsaferawdata.patch
+feat_add_data_parameter_to_processsingleton.patch
 mas_gate_private_enterprise_APIs.patch
 load_v8_snapshot_in_browser_process.patch
-fix_patch_out_permissions_checks_in_exclusive_access.patch
+fix_adapt_exclusive_access_for_electron_needs.patch
 fix_aspect_ratio_with_max_size.patch
 fix_dont_delete_SerialPortManager_on_main_thread.patch
-feat_add_data_transfer_to_requestsingleinstancelock.patch
 fix_crash_when_saving_edited_pdf_files.patch
 port_autofill_colors_to_the_color_pipeline.patch
 build_disable_partition_alloc_on_mac.patch
 fix_non-client_mouse_tracking_and_message_bubbling_on_windows.patch
-build_make_libcxx_abi_unstable_false_for_electron.patch
+remove_incorrect_width_height_adjustments.patch
 introduce_ozoneplatform_electron_can_call_x11_property.patch
 make_gtk_getlibgtk_public.patch
-build_disable_print_content_analysis.patch
-feat_move_firstpartysets_to_content_browser_client.patch
+cherry-pick-cf64617c1cc5.patch
+cherry-pick-e2b8856012e0.patch
+cherry-pick-6b66a45021a0.patch
+fix_xkb_keysym_reverse_look_up_for_lacros.patch
+custom_protocols_plzserviceworker.patch
+pa_support_16kb_pagesize_on_linux_arm64.patch
+cherry-pick-f1504440487f.patch
+cherry-pick-21139756239b.patch
+cherry-pick-2782c7bc5bbe.patch
+cherry-pick-f3d01ff794dc.patch
+cherry-pick-919b1ffe1fe7.patch
+cherry-pick-f1dd785e021e.patch
+cherry-pick-b03797bdb1df.patch
+posix_replace_doubleforkandexec_with_forkandspawn.patch

patches/chromium/add_contentgpuclient_precreatemessageloop_callback.patch

@@ -10,10 +10,10 @@ Allows Electron to restore WER when ELECTRON_DEFAULT_ERROR_MODE is set.
 This should be upstreamed.
 
 diff --git a/content/gpu/gpu_main.cc b/content/gpu/gpu_main.cc
-index 660c5f35c6095b23cc483c8eb1c119c215dc681d..961c0d7f7a9fe5f9e130998aeb0c872c571b710e 100644
+index 9f840287967b50ec1db3a9d27973429ab231a486..731a279e395a8762a25a115665bff99be428de3d 100644
 --- a/content/gpu/gpu_main.cc
 +++ b/content/gpu/gpu_main.cc
-@@ -240,6 +240,10 @@ int GpuMain(MainFunctionParams parameters) {
+@@ -239,6 +239,10 @@ int GpuMain(MainFunctionParams parameters) {
    // to the GpuProcessHost once the GpuServiceImpl has started.
    viz::GpuServiceImpl::InstallPreInitializeLogHandler();
  
@@ -24,7 +24,7 @@ index 660c5f35c6095b23cc483c8eb1c119c215dc681d..961c0d7f7a9fe5f9e130998aeb0c872c
    // We are experiencing what appear to be memory-stomp issues in the GPU
    // process. These issues seem to be impacting the task executor and listeners
    // registered to it. Create the task executor on the heap to guard against
-@@ -346,7 +350,6 @@ int GpuMain(MainFunctionParams parameters) {
+@@ -345,7 +349,6 @@ int GpuMain(MainFunctionParams parameters) {
    GpuProcess gpu_process(io_thread_priority);
  #endif
  

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -10,10 +10,10 @@ DidCreateScriptContext is called, not all JS APIs are available in the
 context, which can cause some preload scripts to trip.
 
 diff --git a/content/public/renderer/render_frame_observer.h b/content/public/renderer/render_frame_observer.h
-index eb6f4c87c4479d5f4fb8e3f85a231fb9cc744a63..11298b413021b4d438195482db253a93356b2862 100644
+index a92e09dc651a5f1a9bbae2572fad32233afcd46c..f99b652dda817b62615d2b3f00b4ae4b438ec44d 100644
 --- a/content/public/renderer/render_frame_observer.h
 +++ b/content/public/renderer/render_frame_observer.h
-@@ -132,6 +132,8 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
+@@ -129,6 +129,8 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
    virtual void DidHandleOnloadEvents() {}
    virtual void DidCreateScriptContext(v8::Local<v8::Context> context,
                                        int32_t world_id) {}
@@ -23,10 +23,10 @@ index eb6f4c87c4479d5f4fb8e3f85a231fb9cc744a63..11298b413021b4d438195482db253a93
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index f217de19126feeeafee01b2be31ced936696ce20..95966ce7f0eeb0a7f2822bef69b540ac6bfe298d 100644
+index 4473c5e812a4a598f3e2f2bb06f78def5791af24..44c0ec9815aafd61182fd18a9d125e185d7196bc 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4489,6 +4489,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4455,6 +4455,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  
@@ -40,11 +40,11 @@ index f217de19126feeeafee01b2be31ced936696ce20..95966ce7f0eeb0a7f2822bef69b540ac
                                                 int world_id) {
    for (auto& observer : observers_)
 diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
-index d8ffccc148622d4eb0388e03c78ff1def4290701..5a3162cc88e5a48b04fbbb74a5c2ba4b7dd8a5d3 100644
+index 21b90bbb8fe8ddc03eb20538be423a5396d18eb3..f9c735038f733d990783dd66ffe8c74f824c78f2 100644
 --- a/content/renderer/render_frame_impl.h
 +++ b/content/renderer/render_frame_impl.h
-@@ -599,6 +599,8 @@ class CONTENT_EXPORT RenderFrameImpl
-                           uint32_t ng_call_count) override;
+@@ -597,6 +597,8 @@ class CONTENT_EXPORT RenderFrameImpl
+       blink::WebLocalFrameClient::LazyLoadBehavior lazy_load_behavior) override;
    void DidCreateScriptContext(v8::Local<v8::Context> context,
                                int world_id) override;
 +  void DidInstallConditionalFeatures(v8::Local<v8::Context> context,
@@ -53,10 +53,10 @@ index d8ffccc148622d4eb0388e03c78ff1def4290701..5a3162cc88e5a48b04fbbb74a5c2ba4b
                                  int world_id) override;
    void DidChangeScrollOffset() override;
 diff --git a/third_party/blink/public/web/web_local_frame_client.h b/third_party/blink/public/web/web_local_frame_client.h
-index 5adee94f81c0e98db976ac1c6c55fb5eab8c2e65..9d3e43f4394ad9a4377b47a001c4baf4027cbe7c 100644
+index 3d6e0c0395ff7c92d8908c5151b467beec3a7516..2fadd6d9b2e3747eacea08973d8d3c7aa9c15f26 100644
 --- a/third_party/blink/public/web/web_local_frame_client.h
 +++ b/third_party/blink/public/web/web_local_frame_client.h
-@@ -584,6 +584,9 @@ class BLINK_EXPORT WebLocalFrameClient {
+@@ -599,6 +599,9 @@ class BLINK_EXPORT WebLocalFrameClient {
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) {}
  
@@ -67,10 +67,10 @@ index 5adee94f81c0e98db976ac1c6c55fb5eab8c2e65..9d3e43f4394ad9a4377b47a001c4baf4
    virtual void WillReleaseScriptContext(v8::Local<v8::Context>,
                                          int32_t world_id) {}
 diff --git a/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc b/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
-index a6ba8411384855c82712960375bc949c5c2bd522..fc86ca807c9c1bda9236160580b094153778e18b 100644
+index aa4b510137d60e6fb924f4f1a6554fe06c19ad75..816b6260020a6cbb6880b0eed197743ccd9002f5 100644
 --- a/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
 +++ b/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
-@@ -207,6 +207,7 @@ void LocalWindowProxy::Initialize() {
+@@ -205,6 +205,7 @@ void LocalWindowProxy::Initialize() {
    }
  
    InstallConditionalFeatures();
@@ -79,10 +79,10 @@ index a6ba8411384855c82712960375bc949c5c2bd522..fc86ca807c9c1bda9236160580b09415
    if (World().IsMainWorld()) {
      GetFrame()->Loader().DispatchDidClearWindowObjectInMainWorld();
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client.h b/third_party/blink/renderer/core/frame/local_frame_client.h
-index f36d04ff77481bd30e0de3f6d45c54dfece4067c..d30f569cd68716b9e963cf0fb5da3f7e65cc215a 100644
+index 0dda1f7cd77c47f7e61ba48dd20429c13679b543..2f73aacda1bafe07775213e232eda56c4b33325b 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client.h
-@@ -303,6 +303,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
+@@ -308,6 +308,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
  
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) = 0;
@@ -92,10 +92,10 @@ index f36d04ff77481bd30e0de3f6d45c54dfece4067c..d30f569cd68716b9e963cf0fb5da3f7e
                                          int32_t world_id) = 0;
    virtual bool AllowScriptExtensions() = 0;
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-index 5a83dcdf50acc27da2b1fbb3e515cb4316305a3a..86f31acc40a2dd296c34f3ecf5ef6ccd97cbc18c 100644
+index 5297ad63f1c76240d57a64cc5ea64cbf8c7e1b95..006da6072db12da1632f9d45ecb5710136573641 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-@@ -275,6 +275,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
+@@ -274,6 +274,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
      web_frame_->Client()->DidCreateScriptContext(context, world_id);
  }
  
@@ -110,10 +110,10 @@ index 5a83dcdf50acc27da2b1fbb3e515cb4316305a3a..86f31acc40a2dd296c34f3ecf5ef6ccd
      v8::Local<v8::Context> context,
      int32_t world_id) {
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.h b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
-index ac81fdc1ac99ca02458a10c0d258b846a8a9955e..ed838db2474790437ff4b57e23a1e289afce4d47 100644
+index 708414fca139eb8328e425d909a48ca97038e442..48b2a0e129ec166ebd4c9bbd32330b0cc43dbeb2 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
-@@ -80,6 +80,8 @@ class CORE_EXPORT LocalFrameClientImpl final : public LocalFrameClient {
+@@ -78,6 +78,8 @@ class CORE_EXPORT LocalFrameClientImpl final : public LocalFrameClient {
  
    void DidCreateScriptContext(v8::Local<v8::Context>,
                                int32_t world_id) override;
@@ -123,10 +123,10 @@ index ac81fdc1ac99ca02458a10c0d258b846a8a9955e..ed838db2474790437ff4b57e23a1e289
                                  int32_t world_id) override;
  
 diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
-index aab6a77b18f83adeac065083f83b94b7ff251282..0d0e272a162be8d1bee9e0122e3e7a59b0ad32a3 100644
+index 4b639069d5d9173f0c35fe7656356031ba424a61..3da6699b40bf4f91e6d76a37e5fa8f680f7a7850 100644
 --- a/third_party/blink/renderer/core/loader/empty_clients.h
 +++ b/third_party/blink/renderer/core/loader/empty_clients.h
-@@ -359,6 +359,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
+@@ -357,6 +357,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
  
    void DidCreateScriptContext(v8::Local<v8::Context>,
                                int32_t world_id) override {}

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -6,10 +6,10 @@ Subject: allow disabling blink scheduler throttling per RenderView
 This allows us to disable throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
-index a9267b633e126f057e914b895f280ed658ff279d..179b5449f53c2d7b9024fb08fe1b1f6c03c6d5b0 100644
+index 56c08919ab626a8a7b3bcb892ee94cdee2a106fc..b85bdf4ed574a149a6502e8d21e54f2ee80777a5 100644
 --- a/content/browser/renderer_host/render_view_host_impl.cc
 +++ b/content/browser/renderer_host/render_view_host_impl.cc
-@@ -665,6 +665,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
+@@ -647,6 +647,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
    GetWidget()->GetAssociatedFrameWidget()->SetBackgroundOpaque(opaque);
  }
  
@@ -22,24 +22,24 @@ index a9267b633e126f057e914b895f280ed658ff279d..179b5449f53c2d7b9024fb08fe1b1f6c
    return is_active();
  }
 diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
-index 3f0df3df3dd74ced71869ce01abf7b159387b8f4..85b169530a21bcfc016d1439a71d35378077774d 100644
+index 9e32df9f5fd765895c8470c3922a62f754e7d409..9bac2321d65d9e54ce88fffafd72a74803ed2c87 100644
 --- a/content/browser/renderer_host/render_view_host_impl.h
 +++ b/content/browser/renderer_host/render_view_host_impl.h
-@@ -137,6 +137,7 @@ class CONTENT_EXPORT RenderViewHostImpl
-   bool IsRenderViewLiveForTesting() const override;
-   void WriteIntoTrace(perfetto::TracedProto<TraceProto> context) const override;
+@@ -135,6 +135,7 @@ class CONTENT_EXPORT RenderViewHostImpl
+   bool IsRenderViewLive() override;
+   void WriteIntoTrace(perfetto::TracedValue context) override;
  
 +  void SetSchedulerThrottling(bool allowed) override;
    void SendWebPreferencesToRenderer();
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/public/browser/render_view_host.h b/content/public/browser/render_view_host.h
-index 3b01b3419c4361d5d75ad1c37e5baa3a1967bd09..35c82d931242a1180091267c18e0255840acc5ce 100644
+index 787077d71c04d571aa825bec0a549c5fad2b8574..4b05b80802ba97a46eed60e509b503fc8375016b 100644
 --- a/content/public/browser/render_view_host.h
 +++ b/content/public/browser/render_view_host.h
-@@ -80,6 +80,9 @@ class CONTENT_EXPORT RenderViewHost {
-   virtual void WriteIntoTrace(
-       perfetto::TracedProto<TraceProto> context) const = 0;
+@@ -74,6 +74,9 @@ class CONTENT_EXPORT RenderViewHost {
+   // Write a representation of this object into a trace.
+   virtual void WriteIntoTrace(perfetto::TracedValue context) = 0;
  
 +  // Disable/Enable scheduler throttling.
 +  virtual void SetSchedulerThrottling(bool allowed) = 0;
@@ -48,10 +48,10 @@ index 3b01b3419c4361d5d75ad1c37e5baa3a1967bd09..35c82d931242a1180091267c18e02558
    // This interface should only be implemented inside content.
    friend class RenderViewHostImpl;
 diff --git a/content/renderer/render_view_impl.h b/content/renderer/render_view_impl.h
-index fd145f0aa562d6b63fb1d3a8a9241ae1aa1ce7a0..54d30fb9db8b48b94abdb815c487f618f9bb6525 100644
+index 4e8d36420d6edc1725a840e1b9f123041d21abe4..dd198cb7bf02e509833c6b4c7d8e5d65d20d46dc 100644
 --- a/content/renderer/render_view_impl.h
 +++ b/content/renderer/render_view_impl.h
-@@ -151,6 +151,8 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
+@@ -152,6 +152,8 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
    static WindowOpenDisposition NavigationPolicyToDisposition(
        blink::WebNavigationPolicy policy);
  
@@ -61,10 +61,10 @@ index fd145f0aa562d6b63fb1d3a8a9241ae1aa1ce7a0..54d30fb9db8b48b94abdb815c487f618
    // ADDING NEW FUNCTIONS? Please keep private functions alphabetized and put
    // it in the same order in the .cc file as it was in the header.
 diff --git a/third_party/blink/public/mojom/page/page.mojom b/third_party/blink/public/mojom/page/page.mojom
-index 39bfc2200e924d0c589cfd07f085f182ef6853a6..bddff6d5ad3f6d08c4dc48e66ebc5319b1a5ec28 100644
+index befd736a9cf362514b9a2ee475dc4a814c85a87b..24b2617f56673a3075697802cf5b574b0c766610 100644
 --- a/third_party/blink/public/mojom/page/page.mojom
 +++ b/third_party/blink/public/mojom/page/page.mojom
-@@ -108,4 +108,7 @@ interface PageBroadcast {
+@@ -97,4 +97,7 @@ interface PageBroadcast {
  
    // Sent to whole page, but should only be used by the main frame.
    SetPageBaseBackgroundColor(skia.mojom.SkColor? color);
@@ -73,10 +73,10 @@ index 39bfc2200e924d0c589cfd07f085f182ef6853a6..bddff6d5ad3f6d08c4dc48e66ebc5319
 +  SetSchedulerThrottling(bool allowed);
  };
 diff --git a/third_party/blink/public/web/web_view.h b/third_party/blink/public/web/web_view.h
-index 5e4032ccf916f969cd669af7d983becddb57c72b..a858c9f2fa609ae756a2e70d0362f2de372dd5be 100644
+index 14d4a00293ab0b11e733676844ce483992d6cd8e..c6c2dbb9dddd1eaa21e8c7b276d871a3898463fa 100644
 --- a/third_party/blink/public/web/web_view.h
 +++ b/third_party/blink/public/web/web_view.h
-@@ -364,6 +364,7 @@ class WebView {
+@@ -368,6 +368,7 @@ class WebView {
    // Scheduling -----------------------------------------------------------
  
    virtual PageScheduler* Scheduler() const = 0;
@@ -85,10 +85,10 @@ index 5e4032ccf916f969cd669af7d983becddb57c72b..a858c9f2fa609ae756a2e70d0362f2de
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 6504c73f614bebad7b899c8b76c4b3034b7dab7a..f76a0ee0778d7b4e4df69a4c43b4a6bfdc89294d 100644
+index b9d5a13bcdf981064f9970fdb8017fed5f93b35e..182f70b2b3bd9cbc6548d4c17caad797e5dad0ce 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -3689,6 +3689,13 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -3668,6 +3668,13 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  
@@ -102,7 +102,7 @@ index 6504c73f614bebad7b899c8b76c4b3034b7dab7a..f76a0ee0778d7b4e4df69a4c43b4a6bf
  void WebViewImpl::SetVisibilityState(
      mojom::blink::PageVisibilityState visibility_state,
      bool is_initial_state) {
-@@ -3700,7 +3707,8 @@ void WebViewImpl::SetVisibilityState(
+@@ -3679,7 +3686,8 @@ void WebViewImpl::SetVisibilityState(
    }
    GetPage()->SetVisibilityState(visibility_state, is_initial_state);
    GetPage()->GetPageScheduler()->SetPageVisible(
@@ -113,7 +113,7 @@ index 6504c73f614bebad7b899c8b76c4b3034b7dab7a..f76a0ee0778d7b4e4df69a4c43b4a6bf
  
  mojom::blink::PageVisibilityState WebViewImpl::GetVisibilityState() {
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index 5c9609a6a8d1e18981ac14ad5321fa82c3eb38e0..0a2564a8e45210ba58438e95caa70d01fac22aee 100644
+index 5107ef421138e136b20b25b7bbcc1f0bb246bb66..043266205142e59f88c4c2f2ae6b58bb009f2d9c 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
 @@ -420,6 +420,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
@@ -124,7 +124,7 @@ index 5c9609a6a8d1e18981ac14ad5321fa82c3eb38e0..0a2564a8e45210ba58438e95caa70d01
    void SetVisibilityState(mojom::blink::PageVisibilityState visibility_state,
                            bool is_initial_state) override;
    mojom::blink::PageVisibilityState GetVisibilityState() override;
-@@ -855,6 +856,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -857,6 +858,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    // If true, we send IPC messages when |preferred_size_| changes.
    bool send_preferred_size_changes_ = false;
  

patches/chromium/allow_in-process_windows_to_have_different_web_prefs.patch

@@ -8,10 +8,10 @@ WebPreferences of in-process child windows, rather than relying on
 process-level command line switches, as before.
 
 diff --git a/third_party/blink/common/web_preferences/web_preferences.cc b/third_party/blink/common/web_preferences/web_preferences.cc
-index 4e51622d725ad0ee448ea1794c209aae7f78e09a..df6e9ed6fda9e6fa695fa3ab717847735dc63b17 100644
+index 30e237f886b41bdf528b2a0e81054d15fb323f1f..43f7920cf6ff12d8a48ddef5440814a42266e8c5 100644
 --- a/third_party/blink/common/web_preferences/web_preferences.cc
 +++ b/third_party/blink/common/web_preferences/web_preferences.cc
-@@ -140,6 +140,20 @@ WebPreferences::WebPreferences()
+@@ -145,6 +145,20 @@ WebPreferences::WebPreferences()
        fake_no_alloc_direct_call_for_testing_enabled(false),
        v8_cache_options(blink::mojom::V8CacheOptions::kDefault),
        record_whole_document(false),
@@ -33,7 +33,7 @@ index 4e51622d725ad0ee448ea1794c209aae7f78e09a..df6e9ed6fda9e6fa695fa3ab71784773
        accelerated_video_decode_enabled(false),
        animation_policy(
 diff --git a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
-index 16e7501cf2da98d0046d65102e634af31c1f6c39..53fbfdb4837fe444c3564523068faadcc12afd1a 100644
+index d278453a261fe2dd3bacce433e35d50879b555a7..140f8d6273d944bfe36831d27aef757d89240b56 100644
 --- a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
 +++ b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
 @@ -22,6 +22,10 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
@@ -47,7 +47,7 @@ index 16e7501cf2da98d0046d65102e634af31c1f6c39..53fbfdb4837fe444c3564523068faadc
        !data.ReadLazyFrameLoadingDistanceThresholdsPx(
            &out->lazy_frame_loading_distance_thresholds_px) ||
        !data.ReadLazyImageLoadingDistanceThresholdsPx(
-@@ -145,6 +149,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -151,6 +155,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
        data.fake_no_alloc_direct_call_for_testing_enabled();
    out->v8_cache_options = data.v8_cache_options();
    out->record_whole_document = data.record_whole_document();
@@ -68,7 +68,7 @@ index 16e7501cf2da98d0046d65102e634af31c1f6c39..53fbfdb4837fe444c3564523068faadc
    out->accelerated_video_decode_enabled =
        data.accelerated_video_decode_enabled();
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences.h b/third_party/blink/public/common/web_preferences/web_preferences.h
-index b2b3be2019209d3810bb0dc570e2a1ebcf702ad8..0ff23de6bd73d6d0ba82402ec39d2f0812c41aab 100644
+index 8509f720c5afb816c6cbb2313dd566a24236a790..b9f0f79d96c58a7769939610bb72f8b2bcd3be94 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences.h
 @@ -10,6 +10,7 @@
@@ -79,7 +79,7 @@ index b2b3be2019209d3810bb0dc570e2a1ebcf702ad8..0ff23de6bd73d6d0ba82402ec39d2f08
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
  #include "third_party/blink/public/mojom/css/preferred_color_scheme.mojom-shared.h"
-@@ -152,6 +153,22 @@ struct BLINK_COMMON_EXPORT WebPreferences {
+@@ -160,6 +161,22 @@ struct BLINK_COMMON_EXPORT WebPreferences {
    blink::mojom::V8CacheOptions v8_cache_options;
    bool record_whole_document;
  
@@ -103,7 +103,7 @@ index b2b3be2019209d3810bb0dc570e2a1ebcf702ad8..0ff23de6bd73d6d0ba82402ec39d2f08
    // only controls whether or not the "document.cookie" field is properly
    // connected to the backing store, for instance if you wanted to be able to
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
-index 30fd01c6e804d05091ff6147ac570901a8d998b9..4acd2df36ab6928947b5defe8691eccaf3cd7b19 100644
+index a6291be3e953ceaee1d996e4b30a6ae78916bc7a..c3baf95c5d9b6a6ace56bcde9e1dc8179f18eaa0 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 @@ -6,6 +6,7 @@
@@ -114,7 +114,7 @@ index 30fd01c6e804d05091ff6147ac570901a8d998b9..4acd2df36ab6928947b5defe8691ecca
  #include "mojo/public/cpp/bindings/struct_traits.h"
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
-@@ -418,6 +419,60 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -441,6 +442,60 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
      return r.record_whole_document;
    }
  
@@ -176,7 +176,7 @@ index 30fd01c6e804d05091ff6147ac570901a8d998b9..4acd2df36ab6928947b5defe8691ecca
      return r.cookie_enabled;
    }
 diff --git a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
-index d10d1b4c0b16ac9e863077cf60feca35fa2da329..1a49fb1a11f75aa3c79cd3cc1796957d0b9a5549 100644
+index 96dd9fd56e44e66c5ea24d9df7c6cbff25409d6c..e0d113b4dee6a72f350b8494448f516be01d0468 100644
 --- a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
 +++ b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
 @@ -10,6 +10,7 @@ import "third_party/blink/public/mojom/v8_cache_options.mojom";
@@ -187,7 +187,7 @@ index d10d1b4c0b16ac9e863077cf60feca35fa2da329..1a49fb1a11f75aa3c79cd3cc1796957d
  
  enum PointerType {
    kPointerNone                              = 1,             // 1 << 0
-@@ -204,6 +205,22 @@ struct WebPreferences {
+@@ -212,6 +213,22 @@ struct WebPreferences {
    V8CacheOptions v8_cache_options;
    bool record_whole_document;
  

patches/chromium/allow_setting_secondary_label_via_simplemenumodel.patch

@@ -6,7 +6,7 @@ Subject: Allow setting secondary label via SimpleMenuModel
 Builds on https://chromium-review.googlesource.com/c/chromium/src/+/2208976
 
 diff --git a/ui/base/models/simple_menu_model.cc b/ui/base/models/simple_menu_model.cc
-index a787411f89e2d95e2fa636a7cc6723bdd227e563..f8c67d10957c26fbcd21fa1fe05507efd78f1c29 100644
+index 746dffb1defec9d776f681d41325a65b02cbdd0f..05a7f20f10e3ff514aa3b3b5386980ddfcc586eb 100644
 --- a/ui/base/models/simple_menu_model.cc
 +++ b/ui/base/models/simple_menu_model.cc
 @@ -53,6 +53,11 @@ std::u16string SimpleMenuModel::Delegate::GetLabelForCommandId(

patches/chromium/blink_local_frame.patch

@@ -15,10 +15,10 @@ Refs changes in:
 This patch reverts the changes to fix associated crashes in Electron.
 
 diff --git a/third_party/blink/renderer/core/frame/frame.cc b/third_party/blink/renderer/core/frame/frame.cc
-index a519c49a01987feab4dadbc4ba48b73e943fa404..c8d2a65cb428e85c33675668cc106f0af124dfee 100644
+index 09e6436422169ac05d5f0561f12984c86dc7af5e..7b2263f4c7fa2dffbaf5b630f4d5a83d9b68f9a5 100644
 --- a/third_party/blink/renderer/core/frame/frame.cc
 +++ b/third_party/blink/renderer/core/frame/frame.cc
-@@ -123,14 +123,6 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -122,14 +122,6 @@ bool Frame::Detach(FrameDetachType type) {
  
    DCHECK(!IsDetached());
  
@@ -33,7 +33,7 @@ index a519c49a01987feab4dadbc4ba48b73e943fa404..c8d2a65cb428e85c33675668cc106f0a
    if (type == FrameDetachType::kRemove) {
      if (provisional_frame_) {
        provisional_frame_->Detach(FrameDetachType::kRemove);
-@@ -154,6 +146,14 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -153,6 +145,14 @@ bool Frame::Detach(FrameDetachType type) {
      GetWindowProxyManager()->ClearForSwap();
    }
  
@@ -49,10 +49,10 @@ index a519c49a01987feab4dadbc4ba48b73e943fa404..c8d2a65cb428e85c33675668cc106f0a
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 3efc0a04ae3fa60dce4aeb9a296c8dd1bb43320a..5dac7c18f39abefcc318ba2a7b8fad449189d0b6 100644
+index db69148e0756ed36bcf3a04f1ace69cc166261a6..bcf072a6d8bc46e5c71d9ef3f248b6af69693ac9 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -543,10 +543,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -538,10 +538,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    }
    DCHECK(!view_ || !view_->IsAttached());
  
@@ -63,7 +63,7 @@ index 3efc0a04ae3fa60dce4aeb9a296c8dd1bb43320a..5dac7c18f39abefcc318ba2a7b8fad44
    if (!Client())
      return false;
  
-@@ -592,6 +588,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -587,6 +583,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    DCHECK(!view_->IsAttached());
    Client()->WillBeDetached();
  

patches/chromium/build_add_electron_tracing_category.patch

@@ -8,10 +8,10 @@ categories in use are known / declared.  This patch is required for us
 to introduce a new Electron category for Electron-specific tracing.
 
 diff --git a/base/trace_event/builtin_categories.h b/base/trace_event/builtin_categories.h
-index 0736e7021761e6019e1b52448d21ffdb73b964fc..571b553e9aaa98739851d0ff312eefe9f6a75596 100644
+index 107516329273ee4a6cc49433b69f307b1264362b..0c9555a04233d07a186e34ada8b7615095854950 100644
 --- a/base/trace_event/builtin_categories.h
 +++ b/base/trace_event/builtin_categories.h
-@@ -80,6 +80,7 @@
+@@ -78,6 +78,7 @@
    X("drmcursor")                                                         \
    X("dwrite")                                                            \
    X("DXVA_Decoding")                                                     \

patches/chromium/build_disable_partition_alloc_on_mac.patch

@@ -9,7 +9,7 @@ and can be removed when the crash in fork is resolved.
 Related issue: https://github.com/electron/electron/issues/32718
 
 diff --git a/base/allocator/allocator.gni b/base/allocator/allocator.gni
-index 97a57dfb1626ae9a781736dd8b0b55bf201162c1..5c97441faad781b459255cb1f7d0652ec86e40c8 100644
+index 8fa0c36007a0ae0e4553709d27a8231efb08459b..3c4f93fc98b5002572adc78cb9a21b3e78c9f3e0 100644
 --- a/base/allocator/allocator.gni
 +++ b/base/allocator/allocator.gni
 @@ -20,7 +20,7 @@ _disable_partition_alloc = is_component_build || (is_win && is_debug)

patches/chromium/build_disable_print_content_analysis.patch

@@ -1,28 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: VerteDinde <vertedinde@electronjs.org>
-Date: Sun, 1 May 2022 18:01:42 -0700
-Subject: build: disable print_content_analysis
-
-Print Content Analysis enables enterprise users to scan to-be-printed
-pages and documents for sensitive data if the OnPrintEnterpriseConnector
-policy is enabled. A conversation with the Chromium team confirmed
-this feature was intended for enterprise Chrome users and not embedders,
-so we're disabling it to prevent build issues/additional unneeded files.
-
-This patch can be removed when enable_print_content_analysis can be more
-easily enabled or disabled by default with buildflags.
-
-diff --git a/printing/buildflags/buildflags.gni b/printing/buildflags/buildflags.gni
-index 559ac76d4e4b9d9c1824c4da186a6b0f7619fcca..72855e0c5fadb286b67144b34ff71f45e1434c73 100644
---- a/printing/buildflags/buildflags.gni
-+++ b/printing/buildflags/buildflags.gni
-@@ -36,8 +36,7 @@ declare_args() {
- 
-   # Enable snapshotting a page when printing for its content to be analyzed for
-   # sensitive content by enterprise users.
--  enable_print_content_analysis =
--      is_chromeos_ash || is_chromeos_lacros || is_win || is_linux || is_mac
-+  enable_print_content_analysis = is_chromeos_ash || is_chromeos_lacros
- }
- 
- declare_args() {

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -11,7 +11,7 @@ if we ever align our .pak file generation with Chrome we can remove this
 patch.
 
 diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
-index 3c40d999a9545051e91a9f0ad3bf7ca2a95d80c4..b5a20be5e22238e7e1969bdaf52c0b05e84bb846 100644
+index f2c4feac76e96575de3627b7e8f2373b4fb30411..f5fa6b21594c97a08d1aefd790a4846d9b3e1a45 100644
 --- a/chrome/BUILD.gn
 +++ b/chrome/BUILD.gn
 @@ -171,11 +171,16 @@ if (!is_android && !is_mac) {
@@ -33,10 +33,10 @@ index 3c40d999a9545051e91a9f0ad3bf7ca2a95d80c4..b5a20be5e22238e7e1969bdaf52c0b05
          "//base",
          "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 1d80724ace438fb9d2c20ff78d87a93053cf7420..840548c9685c2e3bd584ea8f48d02d21ac541c1b 100644
+index 492cd8e11e28e0b427aca227665295a3052af765..760d2171c5083820fbbf66ce5d7d3c80930b9e88 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4559,7 +4559,7 @@ static_library("browser") {
+@@ -4501,7 +4501,7 @@ static_library("browser") {
  
      # On Windows, the hashes are embedded in //chrome:chrome_initial rather
      # than here in :chrome_dll.
@@ -46,10 +46,10 @@ index 1d80724ace438fb9d2c20ff78d87a93053cf7420..840548c9685c2e3bd584ea8f48d02d21
        sources += [ "certificate_viewer_stub.cc" ]
      }
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 641f52eb7952858738a6623b480f767261e5d009..6d0c624ea62a9125ef7e5579da197de2327a12ff 100644
+index 028d269850e66db444591cda7005a0f8434193e9..cc0d14cd9798c6bbee80581c95eb8281ce7fb6ba 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -6002,7 +6002,6 @@ test("unit_tests") {
+@@ -5722,7 +5722,6 @@ test("unit_tests") {
  
      deps += [
        "//chrome:other_version",
@@ -57,7 +57,7 @@ index 641f52eb7952858738a6623b480f767261e5d009..6d0c624ea62a9125ef7e5579da197de2
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/browser:chrome_process_finder",
-@@ -6025,6 +6024,10 @@ test("unit_tests") {
+@@ -5745,6 +5744,10 @@ test("unit_tests") {
        "//ui/resources",
      ]
  
@@ -68,7 +68,7 @@ index 641f52eb7952858738a6623b480f767261e5d009..6d0c624ea62a9125ef7e5579da197de2
      ldflags = [
        "/DELAYLOAD:api-ms-win-core-winrt-error-l1-1-0.dll",
        "/DELAYLOAD:api-ms-win-core-winrt-l1-1-0.dll",
-@@ -6712,7 +6715,6 @@ test("unit_tests") {
+@@ -6438,7 +6441,6 @@ test("unit_tests") {
      }
  
      deps += [
@@ -76,10 +76,10 @@ index 641f52eb7952858738a6623b480f767261e5d009..6d0c624ea62a9125ef7e5579da197de2
        "//chrome/browser:cart_db_content_proto",
        "//chrome/browser:coupon_db_content_proto",
        "//chrome/browser/media/router:test_support",
-@@ -6760,6 +6762,11 @@ test("unit_tests") {
-     if (is_chromeos) {
-       deps += [ "//ui/chromeos" ]
-     }
+@@ -6483,6 +6485,11 @@ test("unit_tests") {
+       "//ui/native_theme:test_support",
+       "//ui/webui/resources/js/browser_command:mojo_bindings",
+     ]
 +
 +    if (!is_electron_build) {
 +      deps += [ "//chrome:packed_resources_integrity_hash" ]

patches/chromium/build_gn.patch

@@ -14,7 +14,7 @@ tradeoff is that switching from MAS_BUILD to !MAS_BUILD or vice-versa will
 rebuild the entire tree.
 
 diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
-index d960648941d8b959b25f87b364a594ec44760348..74a14a2373305e2e62b974b34a28ea9a62c6a911 100644
+index fcc7e12834733fa0927c35708de9665db4c59eba..faac97db5a2c86f1fcc89c3c045ef74b7b2b878a 100644
 --- a/build/config/BUILDCONFIG.gn
 +++ b/build/config/BUILDCONFIG.gn
 @@ -123,6 +123,9 @@ if (current_os == "") {
@@ -27,7 +27,7 @@ index d960648941d8b959b25f87b364a594ec44760348..74a14a2373305e2e62b974b34a28ea9a
    # Set to enable the official build level of optimization. This has nothing
    # to do with branding, but enables an additional level of optimization above
    # release (!is_debug). This might be better expressed as a tri-state
-@@ -349,6 +352,7 @@ default_compiler_configs = [
+@@ -346,6 +349,7 @@ default_compiler_configs = [
    "//build/config/compiler/pgo:default_pgo_flags",
    "//build/config/coverage:default_coverage",
    "//build/config/sanitizers:default_sanitizer_flags",

patches/chromium/build_libc_as_static_library.patch

@@ -7,7 +7,7 @@ Build libc++ as static library to compile and pass
 nan tests
 
 diff --git a/buildtools/third_party/libc++/BUILD.gn b/buildtools/third_party/libc++/BUILD.gn
-index a53cc9066a3485ff6829e3c410eb523de7d074d6..9697e2dc2d0892fc7f1007d62488c2f2f24ec92f 100644
+index 7915346430db72d18474d7a011b8dc7637c3f281..cd736d988f9c5e37dc24c724268fe115e00914d9 100644
 --- a/buildtools/third_party/libc++/BUILD.gn
 +++ b/buildtools/third_party/libc++/BUILD.gn
 @@ -44,7 +44,11 @@ config("winver") {
@@ -30,7 +30,7 @@ index a53cc9066a3485ff6829e3c410eb523de7d074d6..9697e2dc2d0892fc7f1007d62488c2f2
 +    "//electron:libcxx_objects_zip",
      "//third_party/catapult/devil:devil",
    ]
-   if (is_linux) {
+   if (is_linux && !is_chromeos) {
 diff --git a/buildtools/third_party/libc++abi/BUILD.gn b/buildtools/third_party/libc++abi/BUILD.gn
 index 40f1285f14c0843405e0ee51879b8742285a006d..5be895d3e36df53a5960006a1513f1322400fd23 100644
 --- a/buildtools/third_party/libc++abi/BUILD.gn

patches/chromium/build_make_libcxx_abi_unstable_false_for_electron.patch

@@ -1,23 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Charles Kerr <charles@charleskerr.com>
-Date: Tue, 22 Mar 2022 16:24:44 -0500
-Subject: build: make libcxx_abi_unstable false for electron
-
-https://nornagon.medium.com/a-libc-odyssey-973e51649063
-
-diff --git a/build/config/c++/BUILD.gn b/build/config/c++/BUILD.gn
-index 046792ac275853bf109537589b911cfada44ed24..e43daeaa8f8c8e23eea99b3f8f5f48f92012bbc1 100644
---- a/build/config/c++/BUILD.gn
-+++ b/build/config/c++/BUILD.gn
-@@ -8,6 +8,11 @@ assert(use_custom_libcxx, "should only be used if use_custom_libcxx is set")
- 
- libcxx_abi_unstable = true
- 
-+if (is_electron_build) {
-+  # This breaks native node modules
-+  libcxx_abi_unstable = false
-+}
-+
- # TODO(xiaohuic): https://crbug/917533 Crashes on internal ChromeOS build.
- # Do unconditionally once the underlying problem is fixed.
- if (is_chromeos_ash && is_chrome_branded) {

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index ec886101b6e5347bdd832684a5c3b2cc3179c657..0287e414f4020147ddee297f7c1447c32a118905 100644
+index 36a8fa8d3e981707e6688379813560ba94209ab3..e36a19c847912b007a94464321bb83b15bdcdafd 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -6943,6 +6943,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -6706,6 +6706,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index ec886101b6e5347bdd832684a5c3b2cc3179c657..0287e414f4020147ddee297f7c1447c3
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 335e70179a03ee379082525bb4c7d596983bd633..faa795be3a6cbc7ae13d9a42a1bdbd01ac0406a9 100644
+index 2b2d267bcaac7eaaf63055d2108e03835f94ea3d..b406cd71133062618258a7d56e69b5e258687e12 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -3947,6 +3947,14 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3934,6 +3934,14 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    }
    auto* new_contents_impl = new_contents.get();
  
@@ -39,7 +39,7 @@ index 335e70179a03ee379082525bb4c7d596983bd633..faa795be3a6cbc7ae13d9a42a1bdbd01
    new_contents_impl->GetController().SetSessionStorageNamespace(
        partition_config, session_storage_namespace);
  
-@@ -3991,12 +3999,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3976,12 +3984,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -53,10 +53,10 @@ index 335e70179a03ee379082525bb4c7d596983bd633..faa795be3a6cbc7ae13d9a42a1bdbd01
                               new_contents_impl, opener, params.target_url,
                               params.referrer.To<Referrer>(), params.disposition,
 diff --git a/content/common/frame.mojom b/content/common/frame.mojom
-index a7f36529608011013dab96a803ad3187c940fc81..2bbcea3efede2fda4ff2c5b270e1db0135c54290 100644
+index ace032dc2ffac27fbdddee5a4b13c3c3e36ba5ae..80f7dd56fdaa94a9880995b2b5393af0414eef29 100644
 --- a/content/common/frame.mojom
 +++ b/content/common/frame.mojom
-@@ -569,6 +569,10 @@ struct CreateNewWindowParams {
+@@ -550,6 +550,10 @@ struct CreateNewWindowParams {
  
    // Governs how downloads are handled if `target_url` results in a download.
    blink.mojom.NavigationDownloadPolicy download_policy;
@@ -68,10 +68,10 @@ index a7f36529608011013dab96a803ad3187c940fc81..2bbcea3efede2fda4ff2c5b270e1db01
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index ffa24d4b6779226ea3b94afdf176939ea7e42e34..16fb4946cb3ea2d097e8ed05bb340cc3f0782ed6 100644
+index a0a9f51b7e62b13f62467f14e3e9245cb6fc8d84..329cbc6f8c822c6f6deac4f341baec41228dca7b 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -579,6 +579,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -577,6 +577,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -81,10 +81,10 @@ index ffa24d4b6779226ea3b94afdf176939ea7e42e34..16fb4946cb3ea2d097e8ed05bb340cc3
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index ae3dda4b9b40bb0d4c1a10eaedda9270d3543a8b..9b988bb631ab759739ae01c918efb1d563d5aafc 100644
+index 3bbb6a39eeb719b94d0e212ea8da5051ff55d441..ceb2bb900e122840505aa8d3911923cffc9a907e 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
-@@ -165,6 +165,7 @@ class NetworkService;
+@@ -169,6 +169,7 @@ class NetworkService;
  class TrustedURLLoaderHeaderClient;
  }  // namespace mojom
  struct ResourceRequest;
@@ -92,7 +92,7 @@ index ae3dda4b9b40bb0d4c1a10eaedda9270d3543a8b..9b988bb631ab759739ae01c918efb1d5
  }  // namespace network
  
  namespace sandbox {
-@@ -954,6 +955,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -960,6 +961,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -102,7 +102,7 @@ index ae3dda4b9b40bb0d4c1a10eaedda9270d3543a8b..9b988bb631ab759739ae01c918efb1d5
        bool opener_suppressed,
        bool* no_javascript_access);
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index 9bbc7cf6d9542a3f013313e0c497839da2beb9d1..c01e06b08b1cca7a663e30476a551904ce9c6db8 100644
+index f132199113778f6b50972419b61a187e6272300c..7bb1680553c405a9016cfd67eca5fa3c6439b692 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
 @@ -26,6 +26,17 @@ namespace content {
@@ -124,7 +124,7 @@ index 9bbc7cf6d9542a3f013313e0c497839da2beb9d1..c01e06b08b1cca7a663e30476a551904
                                                   const OpenURLParams& params) {
    return nullptr;
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 04aa4d993b331396ee20464f6e1d2da10c91c834..2556c044b6e28501a5fac9b0040e623b8f35f497 100644
+index f889d0bf33cf218a68bf5a9422aecaed23fa260a..3330876f623e5b2cb600b1ce1fd10b3375568613 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
 @@ -16,6 +16,7 @@
@@ -135,7 +135,7 @@ index 04aa4d993b331396ee20464f6e1d2da10c91c834..2556c044b6e28501a5fac9b0040e623b
  #include "content/public/browser/eye_dropper.h"
  #include "content/public/browser/invalidate_type.h"
  #include "content/public/browser/media_stream_request.h"
-@@ -338,6 +339,13 @@ class CONTENT_EXPORT WebContentsDelegate {
+@@ -339,6 +340,13 @@ class CONTENT_EXPORT WebContentsDelegate {
        const StoragePartitionConfig& partition_config,
        SessionStorageNamespace* session_storage_namespace);
  
@@ -150,10 +150,10 @@ index 04aa4d993b331396ee20464f6e1d2da10c91c834..2556c044b6e28501a5fac9b0040e623b
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
-index 89b07508aef80680a847c106fea0e2fa58ff964b..6630af3583a6bac6135d46644280d6444fe981b8 100644
+index 83517883144a77a0c775ce2d146b4e85ef79ea97..aa65517a568aa0b324b2c8cca8f60bb532ba085a 100644
 --- a/content/renderer/render_view_impl.cc
 +++ b/content/renderer/render_view_impl.cc
-@@ -33,6 +33,7 @@
+@@ -32,6 +32,7 @@
  #include "third_party/blink/public/platform/impression_conversions.h"
  #include "third_party/blink/public/platform/modules/video_capture/web_video_capture_impl_manager.h"
  #include "third_party/blink/public/platform/url_conversion.h"
@@ -161,7 +161,7 @@ index 89b07508aef80680a847c106fea0e2fa58ff964b..6630af3583a6bac6135d46644280d644
  #include "third_party/blink/public/web/modules/mediastream/web_media_stream_device_observer.h"
  #include "third_party/blink/public/web/web_frame_widget.h"
  #include "third_party/blink/public/web/web_local_frame.h"
-@@ -295,6 +296,10 @@ WebView* RenderViewImpl::CreateView(
+@@ -291,6 +292,10 @@ WebView* RenderViewImpl::CreateView(
      params->impression = blink::ConvertWebImpressionToImpression(*impression);
    }
  
@@ -173,10 +173,10 @@ index 89b07508aef80680a847c106fea0e2fa58ff964b..6630af3583a6bac6135d46644280d644
        /*is_opener_navigation=*/false, request.HasUserGesture(),
        // `openee_can_access_opener_origin` only matters for opener navigations,
 diff --git a/content/web_test/browser/web_test_content_browser_client.cc b/content/web_test/browser/web_test_content_browser_client.cc
-index 4379497806bf7c85ade2f4e4554d6a60c4ec966c..fa860bbcf0c12df33dae69d25b01587676a1b79e 100644
+index 54b62065d148ab860a49dc03daaf7680ff00d778..3008d3efe89585a562ae55734938b10ef8b0074e 100644
 --- a/content/web_test/browser/web_test_content_browser_client.cc
 +++ b/content/web_test/browser/web_test_content_browser_client.cc
-@@ -438,6 +438,8 @@ bool WebTestContentBrowserClient::CanCreateWindow(
+@@ -440,6 +440,8 @@ bool WebTestContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -220,14 +220,14 @@ index 84d32491a56528a84b4395fba1d54cdbb38d522b..09998a83c449ef8cd9f360fbcdcf7edc
  
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
-index 2e2ba228a7f179b7cf9c43434bd20ca20b1f1af6..de9f95426ad2dcc99bc4961a0e57539d287408e4 100644
+index 030cc373443766b6485a888f5627885f535e06fc..7bc60b17a0f1aeb208f6d7d85cd6fa537c44c54a 100644
 --- a/third_party/blink/renderer/core/frame/local_dom_window.cc
 +++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
-@@ -2074,6 +2074,7 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
+@@ -2050,6 +2050,7 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
  
    WebWindowFeatures window_features =
        GetWindowFeaturesFromString(features, incumbent_window);
 +  window_features.raw_features = features;
  
-   // In fenced frames, we should always use `noopener`.
-   if (GetFrame()->IsInFencedFrameTree()) {
+   FrameLoadRequest frame_request(incumbent_window,
+                                  ResourceRequest(completed_url));

patches/chromium/cherry-pick-21139756239b.patch

@@ -0,0 +1,114 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ari Chivukula <arichiv@chromium.org>
+Date: Tue, 17 May 2022 18:17:07 +0000
+Subject: {M102 PICK} [IndexedDB] Use-After-Free Fix
+
+We can't guarantee order in the task the constructor dispatches the same
+way we could before due to all the async changes. Let's be sure all the
+objects exist before using them now. Long term, we need to address
+ownership of the idb context.
+
+Bug: 1324864, 1218100
+Change-Id: Id5753297a4c966432028a1e7e063c5f1bed6f619
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3646994
+Reviewed-by: Ayu Ishii <ayui@chromium.org>
+Commit-Queue: Srinivas Sista <srinivassista@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5005@{#812}
+Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738}
+
+diff --git a/content/browser/indexed_db/indexed_db_context_impl.cc b/content/browser/indexed_db/indexed_db_context_impl.cc
+index 9472e762729312bf68073c95056ce09e324148da..219904d80798f71f0be23ee9ffeb5c58d030fb55 100644
+--- a/content/browser/indexed_db/indexed_db_context_impl.cc
++++ b/content/browser/indexed_db/indexed_db_context_impl.cc
+@@ -167,38 +167,32 @@ IndexedDBContextImpl::IndexedDBContextImpl(
+       std::move(quota_client_remote),
+       storage::QuotaClientType::kIndexedDatabase,
+       {blink::mojom::StorageType::kTemporary});
++  IDBTaskRunner()->PostTask(
++      FROM_HERE, base::BindOnce(&IndexedDBContextImpl::BindPipesOnIDBSequence,
++                                weak_factory_.GetWeakPtr(),
++                                std::move(quota_client_receiver),
++                                std::move(blob_storage_context),
++                                std::move(file_system_access_context)));
++}
+ 
+-  // This is safe because the IndexedDBContextImpl must be destructed on the
+-  // IDBTaskRunner, and this task will always happen before that.
+-  idb_task_runner_->PostTask(
+-      FROM_HERE,
+-      base::BindOnce(
+-          [](mojo::Remote<storage::mojom::BlobStorageContext>*
+-                 blob_storage_context,
+-             mojo::Remote<storage::mojom::FileSystemAccessContext>*
+-                 file_system_access_context,
+-             mojo::Receiver<storage::mojom::QuotaClient>* quota_client_receiver,
+-             mojo::PendingRemote<storage::mojom::BlobStorageContext>
+-                 pending_blob_storage_context,
+-             mojo::PendingRemote<storage::mojom::FileSystemAccessContext>
+-                 pending_file_system_access_context,
+-             mojo::PendingReceiver<storage::mojom::QuotaClient>
+-                 quota_client_pending_receiver) {
+-            quota_client_receiver->Bind(
+-                std::move(quota_client_pending_receiver));
+-            if (pending_blob_storage_context) {
+-              blob_storage_context->Bind(
+-                  std::move(pending_blob_storage_context));
+-            }
+-            if (pending_file_system_access_context) {
+-              file_system_access_context->Bind(
+-                  std::move(pending_file_system_access_context));
+-            }
+-          },
+-          &blob_storage_context_, &file_system_access_context_,
+-          &quota_client_receiver_, std::move(blob_storage_context),
+-          std::move(file_system_access_context),
+-          std::move(quota_client_receiver)));
++void IndexedDBContextImpl::BindPipesOnIDBSequence(
++    mojo::PendingReceiver<storage::mojom::QuotaClient>
++        pending_quota_client_receiver,
++    mojo::PendingRemote<storage::mojom::BlobStorageContext>
++        pending_blob_storage_context,
++    mojo::PendingRemote<storage::mojom::FileSystemAccessContext>
++        pending_file_system_access_context) {
++  DCHECK(IDBTaskRunner()->RunsTasksInCurrentSequence());
++  if (pending_quota_client_receiver) {
++    quota_client_receiver_.Bind(std::move(pending_quota_client_receiver));
++  }
++  if (pending_blob_storage_context) {
++    blob_storage_context_.Bind(std::move(pending_blob_storage_context));
++  }
++  if (pending_file_system_access_context) {
++    file_system_access_context_.Bind(
++        std::move(pending_file_system_access_context));
++  }
+ }
+ 
+ void IndexedDBContextImpl::Bind(
+diff --git a/content/browser/indexed_db/indexed_db_context_impl.h b/content/browser/indexed_db/indexed_db_context_impl.h
+index 4b874b244778d831e0fa8ca3bbfd7e751897923e..ad2f984e130ece867c0f0dc7ca9ae52b8ec12ae9 100644
+--- a/content/browser/indexed_db/indexed_db_context_impl.h
++++ b/content/browser/indexed_db/indexed_db_context_impl.h
+@@ -224,6 +224,14 @@ class CONTENT_EXPORT IndexedDBContextImpl
+ 
+   ~IndexedDBContextImpl() override;
+ 
++  void BindPipesOnIDBSequence(
++      mojo::PendingReceiver<storage::mojom::QuotaClient>
++          pending_quota_client_receiver,
++      mojo::PendingRemote<storage::mojom::BlobStorageContext>
++          pending_blob_storage_context,
++      mojo::PendingRemote<storage::mojom::FileSystemAccessContext>
++          pending_file_system_access_context);
++
+   // Binds receiver on bucket retrieval to ensure that a bucket always exists
+   // for a storage key.
+   void BindIndexedDBWithBucket(
+@@ -282,6 +290,8 @@ class CONTENT_EXPORT IndexedDBContextImpl
+   mojo::Receiver<storage::mojom::QuotaClient> quota_client_receiver_;
+   const std::unique_ptr<storage::FilesystemProxy> filesystem_proxy_;
+ 
++  // weak_factory_->GetWeakPtr() may be used on any thread, but the resulting
++  // pointer must only be checked/used on idb_task_runner_.
+   base::WeakPtrFactory<IndexedDBContextImpl> weak_factory_{this};
+ };
+ 

patches/chromium/cherry-pick-2782c7bc5bbe.patch

@@ -0,0 +1,139 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marijn Kruisselbrink <mek@chromium.org>
+Date: Wed, 27 Apr 2022 20:51:50 +0000
+Subject: Reland "Close a MessagePort if it is created in a destroyed context."
+
+This is a reland of commit 068f13cc5aa5f7a6e9faf28d8731275e64cb657b
+
+This reland changes the timeout in the test from 3 to 2 seconds, because
+two 3 second timeouts is too long for chrome's default overall test
+timeout of 6 seconds on non-dcheck release builds.
+
+Original change's description:
+> Close a MessagePort if it is created in a destroyed context.
+>
+> MessagePort assumes it is only destroyed either after ContextDestroyed,
+> or after the port has been closed explicitly. As it turns out ports that
+> were created in an already detached iframe would violate this invariant,
+> causing issues.
+>
+> Bug: 1228661
+> Change-Id: Ib1abce15f1d1d15f044de19fe0534767db488af0
+> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3561845
+> Reviewed-by: Jeremy Roman <jbroman@chromium.org>
+> Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
+> Cr-Commit-Position: refs/heads/main@{#988859}
+
+Bug: 1228661
+Change-Id: Ifc5ec866678667b0d81438e2a2c8e5ada6e19d8c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3609249
+Commit-Queue: Jeremy Roman <jbroman@chromium.org>
+Reviewed-by: Jeremy Roman <jbroman@chromium.org>
+Auto-Submit: Marijn Kruisselbrink <mek@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#996880}
+
+diff --git a/third_party/blink/renderer/core/messaging/message_port.cc b/third_party/blink/renderer/core/messaging/message_port.cc
+index 6f67b21803fcdc2498ef207878d1541e04822fca..7f3df8ea567f91cd063122aab63a5c5424ab7919 100644
+--- a/third_party/blink/renderer/core/messaging/message_port.cc
++++ b/third_party/blink/renderer/core/messaging/message_port.cc
+@@ -55,7 +55,11 @@
+ namespace blink {
+ 
+ MessagePort::MessagePort(ExecutionContext& execution_context)
+-    : ExecutionContextLifecycleObserver(&execution_context),
++    : ExecutionContextLifecycleObserver(execution_context.IsContextDestroyed()
++                                            ? nullptr
++                                            : &execution_context),
++      // Ports in a destroyed context start out in a closed state.
++      closed_(execution_context.IsContextDestroyed()),
+       task_runner_(execution_context.GetTaskRunner(TaskType::kPostedMessage)) {}
+ 
+ MessagePort::~MessagePort() {
+@@ -168,10 +172,21 @@ void MessagePort::Entangle(MessagePortDescriptor port) {
+   DCHECK(port.IsValid());
+   DCHECK(!connector_);
+ 
++  // If the context was already destroyed, there is no reason to actually
++  // entangle the port and create a Connector. No messages will ever be able to
++  // be sent or received anyway, as StartReceiving will never be called.
++  if (!GetExecutionContext())
++    return;
++
+   port_ = std::move(port);
+   connector_ = std::make_unique<mojo::Connector>(
+       port_.TakeHandleToEntangle(GetExecutionContext()),
+       mojo::Connector::SINGLE_THREADED_SEND);
++  // The raw `this` is safe despite `this` being a garbage collected object
++  // because we make sure that:
++  // 1. This object will not be garbage collected while it is connected and
++  //    the execution context is not destroyed, and
++  // 2. when the execution context is destroyed, the connector_ is reset.
+   connector_->set_incoming_receiver(this);
+   connector_->set_connection_error_handler(
+       WTF::Bind(&MessagePort::close, WrapWeakPersistent(this)));
+diff --git a/third_party/blink/renderer/core/messaging/message_port.h b/third_party/blink/renderer/core/messaging/message_port.h
+index 83d7901d99ad01ba039ea1ffa3dbee2595fc31ff..f9baba3c6d13992508da48a13c97bb10c8ec56e0 100644
+--- a/third_party/blink/renderer/core/messaging/message_port.h
++++ b/third_party/blink/renderer/core/messaging/message_port.h
+@@ -148,7 +148,7 @@ class CORE_EXPORT MessagePort : public EventTargetWithInlineData,
+   std::unique_ptr<mojo::Connector> connector_;
+ 
+   bool started_ = false;
+-  bool closed_ = false;
++  bool closed_;
+ 
+   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+ 
+diff --git a/third_party/blink/web_tests/external/wpt/webmessaging/message-channels/detached-iframe.window.js b/third_party/blink/web_tests/external/wpt/webmessaging/message-channels/detached-iframe.window.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..c1effaf141b7246320883e293b58dabbc3572123
+--- /dev/null
++++ b/third_party/blink/web_tests/external/wpt/webmessaging/message-channels/detached-iframe.window.js
+@@ -0,0 +1,47 @@
++// META: title=MessageChannel in a detached iframe test
++// META: script=/service-workers/service-worker/resources/test-helpers.sub.js
++// Pull in the with_iframe helper function from the service worker tests
++
++
++const IframeAction = {
++  REMOVE_BEFORE_CREATION: 'remove-before-creation',
++  REMOVE_AFTER_CREATION: 'remove-after-creation',
++};
++
++async function detached_frame_test(t, action) {
++  const iframe = await with_iframe('about:blank');
++  const iframe_MessageChannel = iframe.contentWindow.MessageChannel;
++
++  if (action === IframeAction.REMOVE_BEFORE_CREATION) {
++    iframe.remove();
++  }
++
++  (() => {
++    const mc = new iframe_MessageChannel();
++    mc.port1.postMessage("boo");
++    mc.port2.onmessage = t.unreached_func("message event received");
++    mc.port2.onmessageerror = t.unreached_func("message event received");
++  })();
++
++  if (action === IframeAction.REMOVE_AFTER_CREATION) {
++    iframe.remove();
++  }
++
++  // TODO(https://github.com/web-platform-tests/wpt/issues/7899): Change to
++  // some sort of cross-browser GC trigger.
++  if (self.gc) self.gc();
++
++  // We are testing that neither of the above two events fire. We assume that a 2 second timeout
++  // is good enough. We can't use any other API for an end condition because each MessagePort has
++  // its own independent port message queue, which has no ordering guarantees relative to other
++  // APIs.
++  await new Promise(resolve => t.step_timeout(resolve, 2000));
++}
++
++promise_test(async (t) => {
++  return detached_frame_test(t, IframeAction.REMOVE_AFTER_CREATION);
++}, 'MessageChannel created from a detached iframe should not send messages (remove after create)');
++
++promise_test(async (t) => {
++  return detached_frame_test(t, IframeAction.REMOVE_BEFORE_CREATION);
++}, 'MessageChannel created from a detached iframe should not send messages (remove before create)');

patches/chromium/cherry-pick-6b66a45021a0.patch

@@ -0,0 +1,259 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Garrett Tanzer <gtanzer@chromium.org>
+Date: Wed, 2 Mar 2022 18:33:42 +0000
+Subject: Reland "Fix noopener case for user activation consumption"
+
+This is a reland of e9828a82b5c182dc9a7fb0ae7226c35ba1726e7d
+
+The MSAN error is from checking status before err in
+content/renderer/render_view_impl.cc .
+https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/b8821495655905086193/overview
+
+The fix is to split the check for err and kIgnore into two checks,
+and put the err check before kBlocked.
+
+It is probably possible for the browser to consume user activation
+but then eventually mojo returns an error and the renderer doesn't
+consume activation, but that seems pretty marginal.
+
+Original change's description:
+> Fix noopener case for user activation consumption
+>
+>
+> The flow for user activation consumption in window.open was as follows:
+>
+> Renderer: ask the browser to create a new window
+> Browser: consume transient user activation (in the browser, and via RPC
+> to remote frames only)
+> Browser: return success for opener, return ignore for noopener
+> Renderer: consume transient user activation upon success
+>
+> So in the noopener case, the renderer with the local frame where the
+> window.open originated didn't have its transient user activation
+> consumed.
+>
+>
+> The new behavior is to consume user activation in the calling renderer
+> whenever it is consumed in the browser. We accomplish this by returning
+> a distinct value kBlocked to represent failure before the browser
+> consumes user activation.
+>
+> Bug: 1264543, 1291210
+> Change-Id: Iffb6e3fd772bef625d3d28e600e6fb73d70ab29f
+> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3468171
+> Reviewed-by: Dominic Farolino <dom@chromium.org>
+> Reviewed-by: Ken Buchanan <kenrb@chromium.org>
+> Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
+> Reviewed-by: Charles Reis <creis@chromium.org>
+> Reviewed-by: Jonathan Ross <jonross@chromium.org>
+> Reviewed-by: Daniel Cheng <dcheng@chromium.org>
+> Commit-Queue: Garrett Tanzer <gtanzer@chromium.org>
+> Cr-Commit-Position: refs/heads/main@{#973876}
+
+Bug: 1264543, 1291210
+Change-Id: Ie27c4d68db34dfd98adee7cc5c743953dad59834
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3481666
+Reviewed-by: Jonathan Ross <jonross@chromium.org>
+Reviewed-by: Daniel Cheng <dcheng@chromium.org>
+Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
+Reviewed-by: Ken Buchanan <kenrb@chromium.org>
+Reviewed-by: Charles Reis <creis@chromium.org>
+Commit-Queue: Garrett Tanzer <gtanzer@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#976745}
+
+diff --git a/chrome/browser/site_isolation/chrome_site_per_process_browsertest.cc b/chrome/browser/site_isolation/chrome_site_per_process_browsertest.cc
+index 4c7d9a3fc2d90b751b8b6dd109f223132eb27fe6..2c6ec16e1700882a0ea30c022e1bb0b5eb3a88f8 100644
+--- a/chrome/browser/site_isolation/chrome_site_per_process_browsertest.cc
++++ b/chrome/browser/site_isolation/chrome_site_per_process_browsertest.cc
+@@ -1187,6 +1187,52 @@ IN_PROC_BROWSER_TEST_F(ChromeSitePerProcessTest,
+   EXPECT_FALSE(frame_c_popup_opened);
+ }
+ 
++// Test that opening a window with `noopener` consumes user activation.
++// crbug.com/1264543, crbug.com/1291210
++IN_PROC_BROWSER_TEST_F(ChromeSitePerProcessTest,
++                       UserActivationConsumptionNoopener) {
++  // Start on a page a.com.
++  GURL main_url(embedded_test_server()->GetURL(
++      "a.com", "/cross_site_iframe_factory.html?a"));
++  ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), main_url));
++  content::WebContents* web_contents =
++      browser()->tab_strip_model()->GetActiveWebContents();
++
++  // Activate the frame by executing a dummy script.
++  const std::string no_op_script = "// No-op script";
++  EXPECT_TRUE(ExecuteScript(web_contents, no_op_script));
++
++  // Add a popup observer.
++  content::TestNavigationObserver popup_observer(nullptr);
++  popup_observer.StartWatchingNewWebContents();
++
++  // Open a popup from the frame, with `noopener`. This should consume
++  // transient user activation.
++  GURL popup_url(embedded_test_server()->GetURL("popup.com", "/"));
++  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(
++      web_contents,
++      base::StringPrintf(
++          "window.w = window.open('%s'+'title1.html', '_blank', 'noopener');",
++          popup_url.spec().c_str())));
++
++  // Try to open another popup.
++  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(
++      web_contents,
++      base::StringPrintf(
++          "window.w = window.open('%s'+'title2.html', '_blank', 'noopener');",
++          popup_url.spec().c_str())));
++
++  // Wait and check that only one popup was opened.
++  popup_observer.Wait();
++  EXPECT_EQ(2, browser()->tab_strip_model()->count());
++
++  content::WebContents* popup =
++      browser()->tab_strip_model()->GetActiveWebContents();
++  EXPECT_EQ(embedded_test_server()->GetURL("popup.com", "/title1.html"),
++            popup->GetLastCommittedURL());
++  EXPECT_NE(popup, web_contents);
++}
++
+ // TODO(crbug.com/1021895): Flaky.
+ // Tests that a cross-site iframe runs its beforeunload handler when closing a
+ // tab.  See https://crbug.com/853021.
+diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
+index afd175d35096b0a50ccee3f2b14c632adbfec58a..b346e9adcb73d80c260e4095b140acd319f69e89 100644
+--- a/content/browser/renderer_host/render_frame_host_impl.cc
++++ b/content/browser/renderer_host/render_frame_host_impl.cc
+@@ -6719,17 +6719,22 @@ void RenderFrameHostImpl::CreateNewWindow(
+           effective_transient_activation_state, params->opener_suppressed,
+           &no_javascript_access);
+ 
+-  bool was_consumed = false;
+-  if (can_create_window) {
+-    // Consume activation even w/o User Activation v2, to sync other renderers
+-    // with calling renderer.
+-    was_consumed = frame_tree_node_->UpdateUserActivationState(
+-        blink::mojom::UserActivationUpdateType::kConsumeTransientActivation,
+-        blink::mojom::UserActivationNotificationType::kNone);
+-  } else {
+-    std::move(callback).Run(mojom::CreateNewWindowStatus::kIgnore, nullptr);
+-    return;
+-  }
++  // If this frame isn't allowed to create a window, return early (before we
++  // consume transient user activation).
++  if (!can_create_window) {
++    std::move(callback).Run(mojom::CreateNewWindowStatus::kBlocked, nullptr);
++    return;
++  }
++
++  // Otherwise, consume user activation before we proceed. In particular, it is
++  // important to do this before we return from the |opener_suppressed| case
++  // below.
++  // NB: This call will consume activations in the browser and the remote frame
++  // proxies for this frame. The initiating renderer will consume its view of
++  // the activations after we return.
++  bool was_consumed = frame_tree_node_->UpdateUserActivationState(
++      blink::mojom::UserActivationUpdateType::kConsumeTransientActivation,
++      blink::mojom::UserActivationNotificationType::kNone);
+ 
+   // For Android WebView, we support a pop-up like behavior for window.open()
+   // even if the embedding app doesn't support multiple windows. In this case,
+diff --git a/content/common/frame.mojom b/content/common/frame.mojom
+index 80f7dd56fdaa94a9880995b2b5393af0414eef29..f3d13fc719324e064f70077deb5d95cb9e467820 100644
+--- a/content/common/frame.mojom
++++ b/content/common/frame.mojom
+@@ -558,8 +558,10 @@ struct CreateNewWindowParams {
+ 
+ // Operation result when the renderer asks the browser to create a new window.
+ enum CreateNewWindowStatus {
+-  // Ignore creation of the new window. This can happen because creation is
+-  // blocked or because the new window should have no opener relationship.
++  // Creation of the new window was blocked, e.g. because the source frame
++  // doesn't have user activation.
++  kBlocked,
++  // Ignore creation of the new window, e.g. because noopener is in effect.
+   kIgnore,
+   // Reuse the current window rather than creating a new window.
+   kReuse,
+diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
+index aa65517a568aa0b324b2c8cca8f60bb532ba085a..11815bca2741002dd8595af026ef402bc2af999e 100644
+--- a/content/renderer/render_view_impl.cc
++++ b/content/renderer/render_view_impl.cc
+@@ -311,8 +311,27 @@ WebView* RenderViewImpl::CreateView(
+   mojom::CreateNewWindowStatus status;
+   mojom::CreateNewWindowReplyPtr reply;
+   auto* frame_host = creator_frame->GetFrameHost();
+-  bool err = !frame_host->CreateNewWindow(std::move(params), &status, &reply);
+-  if (err || status == mojom::CreateNewWindowStatus::kIgnore)
++  if (!frame_host->CreateNewWindow(std::move(params), &status, &reply)) {
++    // The sync IPC failed, e.g. maybe the render process is in the middle of
++    // shutting down. Can't create a new window without the browser process,
++    // so just bail out.
++    return nullptr;
++  }
++
++  // If creation of the window was blocked (e.g. because this frame doesn't
++  // have user activation), return before consuming user activation. A frame
++  // that isn't allowed to open a window  shouldn't be able to consume the
++  // activation for the rest of the frame tree.
++  if (status == mojom::CreateNewWindowStatus::kBlocked)
++    return nullptr;
++
++  // Consume the transient user activation in the current renderer.
++  consumed_user_gesture = creator->ConsumeTransientUserActivation(
++      blink::UserActivationUpdateSource::kBrowser);
++
++  // If we should ignore the new window (e.g. because of `noopener`), return
++  // now that user activation was consumed.
++  if (status == mojom::CreateNewWindowStatus::kIgnore)
+     return nullptr;
+ 
+   // For Android WebView, we support a pop-up like behavior for window.open()
+@@ -332,11 +351,6 @@ WebView* RenderViewImpl::CreateView(
+   DCHECK_NE(MSG_ROUTING_NONE, reply->main_frame_route_id);
+   DCHECK_NE(MSG_ROUTING_NONE, reply->widget_params->routing_id);
+ 
+-  // The browser allowed creation of a new window and consumed the user
+-  // activation.
+-  consumed_user_gesture = creator->ConsumeTransientUserActivation(
+-      blink::UserActivationUpdateSource::kBrowser);
+-
+   // While this view may be a background extension page, it can spawn a visible
+   // render view. So we just assume that the new one is not another background
+   // page instead of passing on our own value.
+diff --git a/third_party/blink/web_tests/wpt_internal/fenced_frame/consume-user-activation.https.html b/third_party/blink/web_tests/wpt_internal/fenced_frame/consume-user-activation.https.html
+index d78d08e18a803f66d5136b193abfa26fd7ab087a..e4ad20d17b7fdcec69f25e652dab967f9b52cf65 100644
+--- a/third_party/blink/web_tests/wpt_internal/fenced_frame/consume-user-activation.https.html
++++ b/third_party/blink/web_tests/wpt_internal/fenced_frame/consume-user-activation.https.html
+@@ -88,11 +88,7 @@ promise_test(async () => {
+ 
+   // Check that B's transient user activation was consumed.
+   assert_activations(true, true, "A");
+-  // TODO(crbug.com/1291210): B should be inactive after consuming the
+-  // transient user activation, but due to a preexisting bug it isn't.
+-  // Replace with this once fixed:
+-  // await B.execute(assert_activations, [true, false, "B"]);
+-  await B.execute(assert_activations, [true, true, "B"]);
++  await B.execute(assert_activations, [true, false, "B"]);
+ 
+ }, 'user-activation');
+ </script>
+diff --git a/third_party/blink/web_tests/wpt_internal/fenced_frame/restrict-size.https.html b/third_party/blink/web_tests/wpt_internal/fenced_frame/restrict-size.https.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..5668407d7e1e6ac7840fc47b76869787cb3f3d63
+--- /dev/null
++++ b/third_party/blink/web_tests/wpt_internal/fenced_frame/restrict-size.https.html
+@@ -0,0 +1,15 @@
++<!DOCTYPE html>
++<title>Test fencedframe size restrictions in opaque ads mode.</title>
++<script src="/resources/testharness.js"></script>
++<script src="/resources/testharnessreport.js"></script>
++<script src="/common/utils.js"></script>
++<script src="/common/dispatcher/dispatcher.js"></script>
++<script src="resources/utils.js"></script>
++
++<body>
++<script>
++promise_test(async () => {
++  const frame = attachFencedFrameContext();
++}, 'restrict fencedframe size');
++</script>
++</body>

patches/chromium/cherry-pick-919b1ffe1fe7.patch

@@ -0,0 +1,393 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alex Rudenko <alexrudenko@chromium.org>
+Date: Tue, 26 Apr 2022 05:53:56 +0000
+Subject: DevTools: store weak references to nodes in inspect_tools
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This CL changes how the configuration for persistent overlays is stored.
+Instead of trying to save a strong reference to a DOM node, we can
+store weak references instead. This requires using a HeapHashMap as
+vectors don't support weak reference elements.
+
+(cherry picked from commit 2e0a0b83e1340e948a27cdc319bea8f32849d414)
+
+Fixed: 1314310
+Change-Id: I27ce12730d7598bc84d01adf421923af9a53dc67
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3593092
+Reviewed-by: Danil Somsikov <dsv@chromium.org>
+Reviewed-by: Changhao Han <changhaohan@chromium.org>
+Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
+Commit-Queue: Alex Rudenko <alexrudenko@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#994866}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3604262
+Auto-Submit: Alex Rudenko <alexrudenko@chromium.org>
+Reviewed-by: Simon Zünd <szuend@chromium.org>
+Commit-Queue: Simon Zünd <szuend@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5005@{#163}
+Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738}
+
+diff --git a/third_party/blink/renderer/core/inspector/inspect_tools.cc b/third_party/blink/renderer/core/inspector/inspect_tools.cc
+index b3c08bd77e792481ee7ce5754e48a0d429ef0595..6a43cc041e1adefcfca56dac86eb138c0b118127 100644
+--- a/third_party/blink/renderer/core/inspector/inspect_tools.cc
++++ b/third_party/blink/renderer/core/inspector/inspect_tools.cc
+@@ -477,14 +477,14 @@ bool PersistentTool::HideOnMouseMove() {
+ void PersistentTool::Draw(float scale) {
+   for (auto& entry : grid_node_highlights_) {
+     std::unique_ptr<protocol::Value> highlight =
+-        InspectorGridHighlight(entry.first.Get(), *(entry.second));
++        InspectorGridHighlight(entry.key, *(entry.value));
+     if (!highlight)
+       continue;
+     overlay_->EvaluateInOverlay("drawGridHighlight", std::move(highlight));
+   }
+   for (auto& entry : flex_container_configs_) {
+     std::unique_ptr<protocol::Value> highlight =
+-        InspectorFlexContainerHighlight(entry.first.Get(), *(entry.second));
++        InspectorFlexContainerHighlight(entry.key, *(entry.value));
+     if (!highlight)
+       continue;
+     overlay_->EvaluateInOverlay("drawFlexContainerHighlight",
+@@ -492,7 +492,7 @@ void PersistentTool::Draw(float scale) {
+   }
+   for (auto& entry : scroll_snap_configs_) {
+     std::unique_ptr<protocol::Value> highlight =
+-        InspectorScrollSnapHighlight(entry.first.Get(), *(entry.second));
++        InspectorScrollSnapHighlight(entry.key, *(entry.value));
+     if (!highlight)
+       continue;
+     overlay_->EvaluateInOverlay("drawScrollSnapHighlight",
+@@ -500,17 +500,15 @@ void PersistentTool::Draw(float scale) {
+   }
+   for (auto& entry : container_query_configs_) {
+     std::unique_ptr<protocol::Value> highlight =
+-        InspectorContainerQueryHighlight(entry.first.Get(), *(entry.second));
++        InspectorContainerQueryHighlight(entry.key, *(entry.value));
+     if (!highlight)
+       continue;
+     overlay_->EvaluateInOverlay("drawContainerQueryHighlight",
+                                 std::move(highlight));
+   }
+-  for (wtf_size_t i = 0; i < isolated_element_configs_.size(); ++i) {
+-    auto& entry = isolated_element_configs_.at(i);
++  for (auto& entry : isolated_element_configs_) {
+     std::unique_ptr<protocol::Value> highlight =
+-        InspectorIsolatedElementHighlight(entry.first.Get(), *(entry.second),
+-                                          i);
++        InspectorIsolatedElementHighlight(entry.key, *(entry.value));
+     if (!highlight)
+       continue;
+     overlay_->EvaluateInOverlay("drawIsolatedElementHighlight",
+@@ -548,9 +546,11 @@ void PersistentTool::Dispatch(const ScriptValue& message,
+ 
+   Element* element = nullptr;
+   if (highlight_type == "isolatedElement") {
+-    if (index < static_cast<int>(isolated_element_configs_.size()) &&
+-        index >= 0) {
+-      element = isolated_element_configs_.at(index).first.Get();
++    for (auto& entry : isolated_element_configs_) {
++      if (entry.value->highlight_index == index) {
++        element = entry.key;
++        break;
++      }
+     }
+   }
+ 
+@@ -571,7 +571,7 @@ PersistentTool::GetGridInspectorHighlightsAsJson() const {
+       protocol::ListValue::create();
+   for (auto& entry : grid_node_highlights_) {
+     std::unique_ptr<protocol::Value> highlight =
+-        InspectorGridHighlight(entry.first.Get(), *(entry.second));
++        InspectorGridHighlight(entry.key, *(entry.value));
+     if (!highlight)
+       continue;
+     highlights->pushValue(std::move(highlight));
+@@ -584,6 +584,15 @@ PersistentTool::GetGridInspectorHighlightsAsJson() const {
+   return result;
+ }
+ 
++void PersistentTool::Trace(Visitor* visitor) const {
++  InspectTool::Trace(visitor);
++  visitor->Trace(grid_node_highlights_);
++  visitor->Trace(flex_container_configs_);
++  visitor->Trace(scroll_snap_configs_);
++  visitor->Trace(container_query_configs_);
++  visitor->Trace(isolated_element_configs_);
++}
++
+ // SourceOrderTool -----------------------------------------------------------
+ 
+ SourceOrderTool::SourceOrderTool(
+diff --git a/third_party/blink/renderer/core/inspector/inspect_tools.h b/third_party/blink/renderer/core/inspector/inspect_tools.h
+index dd55eacf154da0895e04b6113d28e52085dcff6d..92abdca382bd8edd95714be6194eddc84bee7e06 100644
+--- a/third_party/blink/renderer/core/inspector/inspect_tools.h
++++ b/third_party/blink/renderer/core/inspector/inspect_tools.h
+@@ -145,23 +145,20 @@ class SourceOrderTool : public InspectTool {
+ };
+ 
+ // -----------------------------------------------------------------------------
+-
+-using GridConfigs = Vector<
+-    std::pair<Member<Node>, std::unique_ptr<InspectorGridHighlightConfig>>>;
++using GridConfigs = HeapHashMap<WeakMember<Node>,
++                                std::unique_ptr<InspectorGridHighlightConfig>>;
+ using FlexContainerConfigs =
+-    Vector<std::pair<Member<Node>,
+-                     std::unique_ptr<InspectorFlexContainerHighlightConfig>>>;
+-using ScrollSnapConfigs = Vector<
+-    std::pair<Member<Node>,
+-              std::unique_ptr<InspectorScrollSnapContainerHighlightConfig>>>;
+-
+-using ContainerQueryConfigs = Vector<std::pair<
+-    Member<Node>,
+-    std::unique_ptr<InspectorContainerQueryContainerHighlightConfig>>>;
+-
++    HeapHashMap<WeakMember<Node>,
++                std::unique_ptr<InspectorFlexContainerHighlightConfig>>;
++using ScrollSnapConfigs =
++    HeapHashMap<WeakMember<Node>,
++                std::unique_ptr<InspectorScrollSnapContainerHighlightConfig>>;
++using ContainerQueryConfigs = HeapHashMap<
++    WeakMember<Node>,
++    std::unique_ptr<InspectorContainerQueryContainerHighlightConfig>>;
+ using IsolatedElementConfigs =
+-    Vector<std::pair<Member<Element>,
+-                     std::unique_ptr<InspectorIsolationModeHighlightConfig>>>;
++    HeapHashMap<WeakMember<Element>,
++                std::unique_ptr<InspectorIsolationModeHighlightConfig>>;
+ 
+ class PersistentTool : public InspectTool {
+   using InspectTool::InspectTool;
+@@ -181,6 +178,8 @@ class PersistentTool : public InspectTool {
+   std::unique_ptr<protocol::DictionaryValue> GetGridInspectorHighlightsAsJson()
+       const;
+ 
++  void Trace(Visitor* visitor) const override;
++
+  private:
+   bool ForwardEventsToOverlay() override;
+   bool HideOnMouseMove() override;
+diff --git a/third_party/blink/renderer/core/inspector/inspector_highlight.cc b/third_party/blink/renderer/core/inspector/inspector_highlight.cc
+index 3ad3081f4f6143c1b38fa1ffc5892eb810344d93..1abb20541977adcece43f7e61db8d34f5170e6c6 100644
+--- a/third_party/blink/renderer/core/inspector/inspector_highlight.cc
++++ b/third_party/blink/renderer/core/inspector/inspector_highlight.cc
+@@ -2415,8 +2415,7 @@ std::unique_ptr<protocol::DictionaryValue> InspectorContainerQueryHighlight(
+ 
+ std::unique_ptr<protocol::DictionaryValue> InspectorIsolatedElementHighlight(
+     Element* element,
+-    const InspectorIsolationModeHighlightConfig& config,
+-    int highlight_index) {
++    const InspectorIsolationModeHighlightConfig& config) {
+   LocalFrameView* frame_view = element->GetDocument().View();
+   if (!frame_view)
+     return nullptr;
+@@ -2428,7 +2427,7 @@ std::unique_ptr<protocol::DictionaryValue> InspectorIsolatedElementHighlight(
+   if (!isolated_element_info)
+     return nullptr;
+ 
+-  isolated_element_info->setInteger("highlightIndex", highlight_index);
++  isolated_element_info->setInteger("highlightIndex", config.highlight_index);
+   return isolated_element_info;
+ }
+ 
+diff --git a/third_party/blink/renderer/core/inspector/inspector_highlight.h b/third_party/blink/renderer/core/inspector/inspector_highlight.h
+index ba4e3f9487b05140aef0068bbafc209a2047235b..4c6423063a4f3ee4ace988fd4e45b41592308c03 100644
+--- a/third_party/blink/renderer/core/inspector/inspector_highlight.h
++++ b/third_party/blink/renderer/core/inspector/inspector_highlight.h
+@@ -145,6 +145,7 @@ struct CORE_EXPORT InspectorIsolationModeHighlightConfig {
+   Color resizer_color;
+   Color resizer_handle_color;
+   Color mask_color;
++  int highlight_index = 0;
+ };
+ 
+ struct CORE_EXPORT InspectorHighlightConfig {
+@@ -300,8 +301,7 @@ std::unique_ptr<protocol::DictionaryValue> InspectorContainerQueryHighlight(
+ 
+ std::unique_ptr<protocol::DictionaryValue> InspectorIsolatedElementHighlight(
+     Element* element,
+-    const InspectorIsolationModeHighlightConfig& config,
+-    int highlight_index);
++    const InspectorIsolationModeHighlightConfig& config);
+ 
+ // CORE_EXPORT is required to make these functions available for unit tests.
+ std::unique_ptr<protocol::DictionaryValue> CORE_EXPORT
+diff --git a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
+index 6bdf410f2d7606ebc946dba903ed6094d8c7cfb4..17ba8a9fc32d6d8d4573aec0d352889dce8fe15e 100644
+--- a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
++++ b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
+@@ -707,7 +707,7 @@ Response InspectorOverlayAgent::setShowGridOverlays(
+         MakeGarbageCollected<PersistentTool>(this, GetFrontend());
+   }
+ 
+-  Vector<std::pair<Member<Node>, std::unique_ptr<InspectorGridHighlightConfig>>>
++  HeapHashMap<WeakMember<Node>, std::unique_ptr<InspectorGridHighlightConfig>>
+       configs;
+   for (std::unique_ptr<protocol::Overlay::GridNodeHighlightConfig>& config :
+        *grid_node_highlight_configs) {
+@@ -715,9 +715,8 @@ Response InspectorOverlayAgent::setShowGridOverlays(
+     Response response = dom_agent_->AssertNode(config->getNodeId(), node);
+     if (!response.IsSuccess())
+       return response;
+-    configs.push_back(
+-        std::make_pair(node, InspectorOverlayAgent::ToGridHighlightConfig(
+-                                 config->getGridHighlightConfig())));
++    configs.insert(node, InspectorOverlayAgent::ToGridHighlightConfig(
++                             config->getGridHighlightConfig()));
+   }
+ 
+   persistent_tool_->SetGridConfigs(std::move(configs));
+@@ -735,8 +734,8 @@ Response InspectorOverlayAgent::setShowFlexOverlays(
+         MakeGarbageCollected<PersistentTool>(this, GetFrontend());
+   }
+ 
+-  Vector<std::pair<Member<Node>,
+-                   std::unique_ptr<InspectorFlexContainerHighlightConfig>>>
++  HeapHashMap<WeakMember<Node>,
++              std::unique_ptr<InspectorFlexContainerHighlightConfig>>
+       configs;
+ 
+   for (std::unique_ptr<protocol::Overlay::FlexNodeHighlightConfig>& config :
+@@ -745,9 +744,8 @@ Response InspectorOverlayAgent::setShowFlexOverlays(
+     Response response = dom_agent_->AssertNode(config->getNodeId(), node);
+     if (!response.IsSuccess())
+       return response;
+-    configs.push_back(std::make_pair(
+-        node, InspectorOverlayAgent::ToFlexContainerHighlightConfig(
+-                  config->getFlexContainerHighlightConfig())));
++    configs.insert(node, InspectorOverlayAgent::ToFlexContainerHighlightConfig(
++                             config->getFlexContainerHighlightConfig()));
+   }
+ 
+   persistent_tool_->SetFlexContainerConfigs(std::move(configs));
+@@ -766,9 +764,8 @@ Response InspectorOverlayAgent::setShowScrollSnapOverlays(
+         MakeGarbageCollected<PersistentTool>(this, GetFrontend());
+   }
+ 
+-  Vector<
+-      std::pair<Member<Node>,
+-                std::unique_ptr<InspectorScrollSnapContainerHighlightConfig>>>
++  HeapHashMap<WeakMember<Node>,
++              std::unique_ptr<InspectorScrollSnapContainerHighlightConfig>>
+       configs;
+ 
+   for (std::unique_ptr<protocol::Overlay::ScrollSnapHighlightConfig>& config :
+@@ -777,9 +774,9 @@ Response InspectorOverlayAgent::setShowScrollSnapOverlays(
+     Response response = dom_agent_->AssertNode(config->getNodeId(), node);
+     if (!response.IsSuccess())
+       return response;
+-    configs.push_back(std::make_pair(
+-        node, InspectorOverlayAgent::ToScrollSnapContainerHighlightConfig(
+-                  config->getScrollSnapContainerHighlightConfig())));
++    configs.insert(node,
++                   InspectorOverlayAgent::ToScrollSnapContainerHighlightConfig(
++                       config->getScrollSnapContainerHighlightConfig()));
+   }
+ 
+   persistent_tool_->SetScrollSnapConfigs(std::move(configs));
+@@ -798,9 +795,8 @@ Response InspectorOverlayAgent::setShowContainerQueryOverlays(
+         MakeGarbageCollected<PersistentTool>(this, GetFrontend());
+   }
+ 
+-  Vector<std::pair<
+-      Member<Node>,
+-      std::unique_ptr<InspectorContainerQueryContainerHighlightConfig>>>
++  HeapHashMap<WeakMember<Node>,
++              std::unique_ptr<InspectorContainerQueryContainerHighlightConfig>>
+       configs;
+ 
+   for (std::unique_ptr<protocol::Overlay::ContainerQueryHighlightConfig>&
+@@ -809,9 +805,9 @@ Response InspectorOverlayAgent::setShowContainerQueryOverlays(
+     Response response = dom_agent_->AssertNode(config->getNodeId(), node);
+     if (!response.IsSuccess())
+       return response;
+-    configs.push_back(std::make_pair(
++    configs.insert(
+         node, InspectorOverlayAgent::ToContainerQueryContainerHighlightConfig(
+-                  config->getContainerQueryContainerHighlightConfig())));
++                  config->getContainerQueryContainerHighlightConfig()));
+   }
+ 
+   persistent_tool_->SetContainerQueryConfigs(std::move(configs));
+@@ -830,10 +826,11 @@ Response InspectorOverlayAgent::setShowIsolatedElements(
+         MakeGarbageCollected<PersistentTool>(this, GetFrontend());
+   }
+ 
+-  Vector<std::pair<Member<Element>,
+-                   std::unique_ptr<InspectorIsolationModeHighlightConfig>>>
++  HeapHashMap<WeakMember<Element>,
++              std::unique_ptr<InspectorIsolationModeHighlightConfig>>
+       configs;
+ 
++  int idx = 0;
+   for (std::unique_ptr<protocol::Overlay::IsolatedElementHighlightConfig>&
+            config : *isolated_element_highlight_configs) {
+     Element* element = nullptr;
+@@ -841,9 +838,10 @@ Response InspectorOverlayAgent::setShowIsolatedElements(
+     Response response = dom_agent_->AssertElement(config->getNodeId(), element);
+     if (!response.IsSuccess())
+       return response;
+-    configs.push_back(std::make_pair(
+-        element, InspectorOverlayAgent::ToIsolationModeHighlightConfig(
+-                     config->getIsolationModeHighlightConfig())));
++    configs.insert(element,
++                   InspectorOverlayAgent::ToIsolationModeHighlightConfig(
++                       config->getIsolationModeHighlightConfig(), idx));
++    idx++;
+   }
+ 
+   persistent_tool_->SetIsolatedElementConfigs(std::move(configs));
+@@ -947,16 +945,16 @@ Response InspectorOverlayAgent::getGridHighlightObjectsForTest(
+     std::unique_ptr<protocol::Array<int>> node_ids,
+     std::unique_ptr<protocol::DictionaryValue>* highlights) {
+   PersistentTool persistent_tool(this, GetFrontend());
+-  Vector<std::pair<Member<Node>, std::unique_ptr<InspectorGridHighlightConfig>>>
++
++  HeapHashMap<WeakMember<Node>, std::unique_ptr<InspectorGridHighlightConfig>>
+       configs;
+   for (const int node_id : *node_ids) {
+     Node* node = nullptr;
+     Response response = dom_agent_->AssertNode(node_id, node);
+     if (!response.IsSuccess())
+       return response;
+-    configs.push_back(
+-        std::make_pair(node, std::make_unique<InspectorGridHighlightConfig>(
+-                                 InspectorHighlight::DefaultGridConfig())));
++    configs.insert(node, std::make_unique<InspectorGridHighlightConfig>(
++                             InspectorHighlight::DefaultGridConfig()));
+   }
+   persistent_tool.SetGridConfigs(std::move(configs));
+   *highlights = persistent_tool.GetGridInspectorHighlightsAsJson();
+@@ -1748,7 +1746,8 @@ InspectorOverlayAgent::ToFlexItemHighlightConfig(
+ // static
+ std::unique_ptr<InspectorIsolationModeHighlightConfig>
+ InspectorOverlayAgent::ToIsolationModeHighlightConfig(
+-    protocol::Overlay::IsolationModeHighlightConfig* config) {
++    protocol::Overlay::IsolationModeHighlightConfig* config,
++    int idx) {
+   if (!config) {
+     return nullptr;
+   }
+@@ -1760,6 +1759,7 @@ InspectorOverlayAgent::ToIsolationModeHighlightConfig(
+       InspectorDOMAgent::ParseColor(config->getResizerHandleColor(nullptr));
+   highlight_config->mask_color =
+       InspectorDOMAgent::ParseColor(config->getMaskColor(nullptr));
++  highlight_config->highlight_index = idx;
+ 
+   return highlight_config;
+ }
+diff --git a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.h b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.h
+index 00226ea419fbd6c8004635c5adf205e8e1bbbd4e..7cb62900eedcb7c6de9666a92b701a57ec31f52d 100644
+--- a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.h
++++ b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.h
+@@ -161,7 +161,8 @@ class CORE_EXPORT InspectorOverlayAgent final
+   ToFlexItemHighlightConfig(protocol::Overlay::FlexItemHighlightConfig*);
+   static std::unique_ptr<InspectorIsolationModeHighlightConfig>
+   ToIsolationModeHighlightConfig(
+-      protocol::Overlay::IsolationModeHighlightConfig*);
++      protocol::Overlay::IsolationModeHighlightConfig*,
++      int highlight_index);
+   static absl::optional<LineStyle> ToLineStyle(protocol::Overlay::LineStyle*);
+   static absl::optional<BoxStyle> ToBoxStyle(protocol::Overlay::BoxStyle*);
+   static std::unique_ptr<InspectorHighlightConfig> ToHighlightConfig(

patches/chromium/cherry-pick-b03797bdb1df.patch

@@ -0,0 +1,195 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xiaocheng Hu <xiaochengh@chromium.org>
+Date: Mon, 2 May 2022 23:43:40 +0000
+Subject: Markup sanitization should iterate until markup is stable
+
+There are cases where parsing a markup and then serializing it does not
+round trip, which can be used to inject XSS. Current sanitization code
+only does one round of parsing and serializing, which does not remove
+XSS injections that hide deeper.
+
+Hence this patch makes sanitization algorithm iterate until the markup
+is stable, or declares failure if it doesn't stabilize after many tries.
+
+(cherry picked from commit 19280353fb92d0ff7d048d7cec28d6a23befbce0)
+
+Fixed: 1315563
+Change-Id: I4a3ebe1fda6df0e04a24d863b2b48df2110af209
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3611826
+Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
+Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#997032}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3621618
+Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org>
+Reviewed-by: Joey Arhar <jarhar@chromium.org>
+Commit-Queue: Joey Arhar <jarhar@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5005@{#363}
+Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738}
+
+diff --git a/third_party/blink/renderer/core/editing/serializers/serialization.cc b/third_party/blink/renderer/core/editing/serializers/serialization.cc
+index 4ee332fa16a1bda54e6ba99c8063876fb046adaa..463fd9a37671b92c9af68ff5f3c0e8ddd5f1c62c 100644
+--- a/third_party/blink/renderer/core/editing/serializers/serialization.cc
++++ b/third_party/blink/renderer/core/editing/serializers/serialization.cc
+@@ -835,6 +835,12 @@ static bool StripSVGUseDataURLs(Node& node) {
+   return stripped;
+ }
+ 
++namespace {
++
++constexpr unsigned kMaxSanitizationIterations = 16;
++
++}  // namespace
++
+ DocumentFragment* CreateSanitizedFragmentFromMarkupWithContext(
+     Document& document,
+     const String& raw_markup,
+@@ -844,42 +850,56 @@ DocumentFragment* CreateSanitizedFragmentFromMarkupWithContext(
+   if (raw_markup.IsEmpty())
+     return nullptr;
+ 
+-  Document* staging_document = CreateStagingDocumentForMarkupSanitization(
+-      *document.GetFrame()->GetFrameScheduler()->GetAgentGroupScheduler());
+-  Element* body = staging_document->body();
+-
+-  DocumentFragment* fragment = CreateFragmentFromMarkupWithContext(
+-      *staging_document, raw_markup, fragment_start, fragment_end, KURL(),
+-      kDisallowScriptingAndPluginContent);
+-  if (!fragment) {
+-    staging_document->GetPage()->WillBeDestroyed();
+-    return nullptr;
+-  }
++  // Iterate on parsing, sanitization and serialization until the markup is
++  // stable, or if we have exceeded the maximum allowed number of iterations.
++  String last_markup;
++  String markup = raw_markup;
++  for (unsigned iteration = 0;
++       iteration < kMaxSanitizationIterations && last_markup != markup;
++       ++iteration) {
++    last_markup = markup;
++
++    Document* staging_document = CreateStagingDocumentForMarkupSanitization(
++        *document.GetFrame()->GetFrameScheduler()->GetAgentGroupScheduler());
++    Element* body = staging_document->body();
++
++    DocumentFragment* fragment = CreateFragmentFromMarkupWithContext(
++        *staging_document, last_markup, fragment_start, fragment_end, KURL(),
++        kDisallowScriptingAndPluginContent);
++    if (!fragment) {
++      staging_document->GetPage()->WillBeDestroyed();
++      return nullptr;
++    }
+ 
+-  bool needs_sanitization = false;
+-  if (ContainsStyleElements(*fragment))
+-    needs_sanitization = true;
+-  if (StripSVGUseDataURLs(*fragment))
+-    needs_sanitization = true;
++    bool needs_sanitization = false;
++    if (ContainsStyleElements(*fragment))
++      needs_sanitization = true;
++    if (StripSVGUseDataURLs(*fragment))
++      needs_sanitization = true;
+ 
+-  if (!needs_sanitization) {
++    if (!needs_sanitization) {
++      markup = CreateMarkup(fragment);
++    } else {
++      body->appendChild(fragment);
++      staging_document->UpdateStyleAndLayout(DocumentUpdateReason::kEditing);
++
++      // This sanitizes stylesheets in the markup into element inline styles
++      markup = CreateMarkup(Position::FirstPositionInNode(*body),
++                            Position::LastPositionInNode(*body),
++                            CreateMarkupOptions::Builder()
++                                .SetShouldAnnotateForInterchange(true)
++                                .SetIsForMarkupSanitization(true)
++                                .Build());
++    }
+     staging_document->GetPage()->WillBeDestroyed();
+-    return CreateFragmentFromMarkupWithContext(
+-        document, raw_markup, fragment_start, fragment_end, base_url,
+-        kDisallowScriptingAndPluginContent);
++
++    fragment_start = 0;
++    fragment_end = markup.length();
+   }
+ 
+-  body->appendChild(fragment);
+-  staging_document->UpdateStyleAndLayout(DocumentUpdateReason::kEditing);
+-
+-  // This sanitizes stylesheets in the markup into element inline styles
+-  String markup = CreateMarkup(Position::FirstPositionInNode(*body),
+-                               Position::LastPositionInNode(*body),
+-                               CreateMarkupOptions::Builder()
+-                                   .SetShouldAnnotateForInterchange(true)
+-                                   .SetIsForMarkupSanitization(true)
+-                                   .Build());
+-  staging_document->GetPage()->WillBeDestroyed();
++  // Sanitization failed because markup can't stabilize.
++  if (last_markup != markup)
++    return nullptr;
+ 
+   return CreateFragmentFromMarkup(document, markup, base_url,
+                                   kDisallowScriptingAndPluginContent);
+diff --git a/third_party/blink/web_tests/editing/pasteboard/paste-svg-use.html b/third_party/blink/web_tests/editing/pasteboard/paste-svg-use.html
+index c03ca90d492a5e2af883f68811baa7660ef1cdc2..1af77f8faa4501f577e28297f013e170775bc86a 100644
+--- a/third_party/blink/web_tests/editing/pasteboard/paste-svg-use.html
++++ b/third_party/blink/web_tests/editing/pasteboard/paste-svg-use.html
+@@ -32,6 +32,6 @@ selection_test(
+       <use href=data:application/xml;base64,PHN2ZyBpZD0neCcgeG1sbnM9J2h0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnJz4KPGEgaHJlZj0namF2YXNjcmlwdDphbGVydCgxMjMpJz4KICAgIDxyZWN0IHdpZHRoPScxMDAlJyBoZWlnaHQ9JzEwMCUnIGZpbGw9J2xpZ2h0Ymx1ZScgLz4KICAgICA8dGV4dCB4PScwJyB5PScwJyBmaWxsPSdibGFjayc+CiAgICAgICA8dHNwYW4geD0nMCcgZHk9JzEuMmVtJz5Pb3BzLCB0aGVyZSdzIHNvbWV0aGluZyB3cm9uZyB3aXRoIHRoZSBwYWdlITwvdHNwYW4+CiAgICAgPHRzcGFuIHg9JzAnIGR5PScxLjJlbSc+UGxlYXNlIGNsaWNrIGhlcmUgdG8gcmVsb2FkLjwvdHNwYW4+Cjwvc3ZnPg==#x>"></noscript>asdasd`);
+     selection.document.execCommand('paste');
+   },
+-  '<div contenteditable>|<noscript>&lt;u title="</noscript><div contenteditable="false"><svg></svg></div></div>',
++  '<div contenteditable><div><br></div><div>      <u title="</div><div>      </div><div>      ">asdasd|</div></div>',
+   'Paste blocks data URI in SVG use element injection via <noscript>');
+ </script>
+diff --git a/third_party/blink/web_tests/external/wpt/clipboard-apis/async-navigator-clipboard-read-sanitize.https.html b/third_party/blink/web_tests/external/wpt/clipboard-apis/async-navigator-clipboard-read-sanitize.https.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..9e0ab2ee740f85ea4e9de9d3f1d2ac43bee5a985
+--- /dev/null
++++ b/third_party/blink/web_tests/external/wpt/clipboard-apis/async-navigator-clipboard-read-sanitize.https.html
+@@ -0,0 +1,44 @@
++<!doctype html>
++<meta charset="utf-8">
++<title>Async Clipboard.read() should sanitize text/html</title>
++<link rel="help" href="https://w3c.github.io/clipboard-apis/#dom-clipboard-read">
++<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1315563">
++<script src="/resources/testharness.js"></script>
++<script src="/resources/testharnessreport.js"></script>
++<script src="/resources/testdriver.js"></script>
++<script src="/resources/testdriver-vendor.js"></script>
++
++<p><button id="button">Put payload in the clipboard</button></p>
++<div id="output"></div>
++
++<script>
++let testFailed = false;
++function fail() {
++  testFailed = true;
++}
++
++button.onclick = () => document.execCommand('copy');
++document.oncopy = ev => {
++  ev.preventDefault();
++  ev.clipboardData.setData(
++      'text/html',
++      `<form><math><mtext></form><form><mglyph><xmp></math><img src=invalid onerror=fail()></xmp>`);
++};
++
++promise_test(async test => {
++  await test_driver.set_permission({name: 'clipboard-read'}, 'granted');
++  await test_driver.click(button);
++
++  const items = await navigator.clipboard.read();
++  const htmlBlob = await items[0].getType("text/html");
++  const html = await htmlBlob.text();
++
++  // This inserts an image with `onerror` handler if `html` is not properly sanitized
++  output.innerHTML = html;
++
++  // Allow the 'error' event to be dispatched asynchronously
++  await new Promise(resolve => test.step_timeout(resolve, 100));
++
++  assert_false(testFailed);
++});
++</script>

patches/chromium/cherry-pick-cf64617c1cc5.patch

@@ -0,0 +1,404 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Austin Sullivan <asully@chromium.org>
+Date: Fri, 11 Mar 2022 10:08:55 +0000
+Subject: FSA: Pass File ownership to worker for async FSARFD file operations
+
+We cannot access the backing file as a member of the
+FileSystemAccessRegularFileDelegate since WrapCrossThreadPersistent
+does NOT cancel the task posted to the worker pool if delegate is
+destroyed. Passing ownership to the worker task ensures the file must
+be alive when used. After the operation, ownership of the file is
+passed back to the delegate.
+
+This pattern was already used for the SetLength operation on old Macs.
+
+Bug: 1299743
+Change-Id: Ie00c09e8f77dc353f280af726a68ed6c572b750b
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3498864
+Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
+Commit-Queue: Austin Sullivan <asully@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#980167}
+
+diff --git a/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.cc b/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.cc
+index 19516a1c3cca7b521c68a266389aa0544cf721d8..b25747a92f21e334e49846e59f03a3312605f2dc 100644
+--- a/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.cc
++++ b/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.cc
+@@ -19,6 +19,7 @@
+ #include "third_party/blink/renderer/platform/scheduler/public/worker_pool.h"
+ #include "third_party/blink/renderer/platform/wtf/cross_thread_functional.h"
+ #include "third_party/blink/renderer/platform/wtf/functional.h"
++#include "third_party/blink/renderer/platform/wtf/wtf.h"
+ 
+ #if BUILDFLAG(IS_MAC)
+ #include "base/mac/mac_util.h"
+@@ -65,6 +66,8 @@ FileSystemAccessRegularFileDelegate::FileSystemAccessRegularFileDelegate(
+ base::FileErrorOr<int> FileSystemAccessRegularFileDelegate::Read(
+     int64_t offset,
+     base::span<uint8_t> data) {
++  DCHECK_GE(offset, 0);
++
+   int size = base::checked_cast<int>(data.size());
+   int result =
+       backing_file_.Read(offset, reinterpret_cast<char*>(data.data()), size);
+@@ -75,13 +78,14 @@ base::FileErrorOr<int> FileSystemAccessRegularFileDelegate::Read(
+ }
+ 
+ base::FileErrorOr<int> FileSystemAccessRegularFileDelegate::Write(
+-    int64_t write_offset,
++    int64_t offset,
+     const base::span<uint8_t> data) {
++  DCHECK_GE(offset, 0);
++
+   int write_size = base::checked_cast<int>(data.size());
+ 
+   int64_t write_end_offset;
+-  if (!base::CheckAdd(write_offset, write_size)
+-           .AssignIfValid(&write_end_offset)) {
++  if (!base::CheckAdd(offset, write_size).AssignIfValid(&write_end_offset)) {
+     return base::File::FILE_ERROR_NO_SPACE;
+   }
+ 
+@@ -89,8 +93,8 @@ base::FileErrorOr<int> FileSystemAccessRegularFileDelegate::Write(
+     return base::File::FILE_ERROR_NO_SPACE;
+   }
+ 
+-  int result = backing_file_.Write(
+-      write_offset, reinterpret_cast<char*>(data.data()), write_size);
++  int result = backing_file_.Write(offset, reinterpret_cast<char*>(data.data()),
++                                   write_size);
+   if (write_size == result) {
+     capacity_tracker_->CommitFileSizeChange(write_end_offset);
+     return result;
+@@ -113,16 +117,19 @@ void FileSystemAccessRegularFileDelegate::GetLength(
+       FROM_HERE, {base::MayBlock()},
+       CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DoGetLength,
+                           WrapCrossThreadPersistent(this),
+-                          std::move(wrapped_callback), task_runner_));
++                          std::move(wrapped_callback), std::move(backing_file_),
++                          task_runner_));
+ }
+ 
+ // static
+ void FileSystemAccessRegularFileDelegate::DoGetLength(
+     CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-    WTF::CrossThreadOnceFunction<void(base::FileErrorOr<int64_t>)>
+-        wrapped_callback,
++    CrossThreadOnceFunction<void(base::FileErrorOr<int64_t>)> callback,
++    base::File file,
+     scoped_refptr<base::SequencedTaskRunner> task_runner) {
+-  int64_t length = delegate->backing_file_.GetLength();
++  DCHECK(!IsMainThread());
++
++  int64_t length = file.GetLength();
+ 
+   // If the length is negative, the file operation failed. Get the last error
+   // now before another file operation might run.
+@@ -131,7 +138,19 @@ void FileSystemAccessRegularFileDelegate::DoGetLength(
+ 
+   PostCrossThreadTask(
+       *task_runner, FROM_HERE,
+-      CrossThreadBindOnce(std::move(wrapped_callback), std::move(result)));
++      CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DidGetLength,
++                          std::move(delegate), std::move(callback),
++                          std::move(file), std::move(result)));
++}
++
++void FileSystemAccessRegularFileDelegate::DidGetLength(
++    CrossThreadOnceFunction<void(base::FileErrorOr<int64_t>)> callback,
++    base::File file,
++    base::FileErrorOr<int64_t> error_or_length) {
++  DCHECK(task_runner_->RunsTasksInCurrentSequence());
++  backing_file_ = std::move(file);
++
++  std::move(callback).Run(std::move(error_or_length));
+ }
+ 
+ void FileSystemAccessRegularFileDelegate::SetLength(
+@@ -162,6 +181,9 @@ void FileSystemAccessRegularFileDelegate::DidCheckSetLengthCapacity(
+     return;
+   }
+ 
++  auto wrapped_callback =
++      CrossThreadOnceFunction<void(bool)>(std::move(callback));
++
+ #if BUILDFLAG(IS_MAC)
+   // On macOS < 10.15, a sandboxing limitation causes failures in ftruncate()
+   // syscalls issued from renderers. For this reason, base::File::SetLength()
+@@ -174,81 +196,57 @@ void FileSystemAccessRegularFileDelegate::DidCheckSetLengthCapacity(
+     }
+     file_utilities_host_->SetLength(
+         std::move(backing_file_), new_length,
+-        WTF::Bind(&FileSystemAccessRegularFileDelegate::DidSetLengthIPC,
+-                  WrapPersistent(this), std::move(callback), new_length));
++        WTF::Bind(&FileSystemAccessRegularFileDelegate::DidSetLength,
++                  WrapPersistent(this), std::move(wrapped_callback),
++                  new_length));
+     return;
+   }
+ #endif  // BUILDFLAG(IS_MAC)
+ 
+-  auto wrapped_callback =
+-      CrossThreadOnceFunction<void(bool)>(std::move(callback));
+-
+   // Truncate file on a worker thread and reply back to this sequence.
+   worker_pool::PostTask(
+       FROM_HERE, {base::MayBlock()},
+       CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DoSetLength,
+                           WrapCrossThreadPersistent(this),
+-                          std::move(wrapped_callback), task_runner_,
+-                          new_length));
++                          std::move(wrapped_callback), std::move(backing_file_),
++                          task_runner_, new_length));
+ }
+ 
+ // static
+ void FileSystemAccessRegularFileDelegate::DoSetLength(
+     CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-    CrossThreadOnceFunction<void(bool)> wrapped_callback,
++    CrossThreadOnceFunction<void(bool)> callback,
++    base::File file,
+     scoped_refptr<base::SequencedTaskRunner> task_runner,
+     int64_t length) {
+-  bool result = delegate->backing_file_.SetLength(length);
+-
+-  if (!result) {
+-    // If the operation failed, the previously requested capacity is not
+-    // returned and no change in file size is recorded. This assumes that
+-    // setLength operations either succeed or do not change the file's length,
+-    // which is consistent with the way other file operations are implemented in
+-    // File System Access.
+-    PostCrossThreadTask(
+-        *task_runner, FROM_HERE,
+-        CrossThreadBindOnce(std::move(wrapped_callback), std::move(result)));
+-    return;
+-  }
++  DCHECK(!IsMainThread());
++
++  bool success = file.SetLength(length);
++
+   PostCrossThreadTask(
+       *task_runner, FROM_HERE,
+-      CrossThreadBindOnce(
+-          &FileSystemAccessRegularFileDelegate::DidSuccessfulSetLength,
+-          std::move(delegate), length, std::move(wrapped_callback)));
+-}
+-
+-void FileSystemAccessRegularFileDelegate::DidSuccessfulSetLength(
+-    int64_t new_length,
+-    CrossThreadOnceFunction<void(bool)> callback) {
+-  DCHECK(task_runner_->RunsTasksInCurrentSequence());
+-  capacity_tracker_->CommitFileSizeChange(new_length);
+-  std::move(callback).Run(true);
++      CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DidSetLength,
++                          std::move(delegate), std::move(callback), length,
++                          std::move(file), success));
+ }
+ 
+-#if BUILDFLAG(IS_MAC)
+-void FileSystemAccessRegularFileDelegate::DidSetLengthIPC(
+-    base::OnceCallback<void(bool)> callback,
++void FileSystemAccessRegularFileDelegate::DidSetLength(
++    CrossThreadOnceFunction<void(bool)> callback,
+     int64_t new_length,
+     base::File file,
+     bool success) {
+   DCHECK(task_runner_->RunsTasksInCurrentSequence());
+   backing_file_ = std::move(file);
+ 
+-  if (!success) {
+-    // If the operation failed, the previously requested capacity is not
+-    // returned and no change in file size is recorded. This assumes that
+-    // setLength operations either succeed or do not change the file's length,
+-    // which is consistent with the way other file operations are implemented in
+-    // File System Access.
+-    std::move(callback).Run(success);
+-    return;
+-  }
+-  auto wrapped_callback =
+-      CrossThreadOnceFunction<void(bool)>(std::move(callback));
+-  DidSuccessfulSetLength(new_length, std::move(wrapped_callback));
++  // If the operation failed, no change in file size is recorded. This assumes
++  // that setLength operations either succeed or do not change the file's
++  // length, which is consistent with the way other file operations are
++  // implemented in File System Access.
++  if (success)
++    capacity_tracker_->CommitFileSizeChange(new_length);
++
++  std::move(callback).Run(success);
+ }
+-#endif  // BUILDFLAG(IS_MAC)
+ 
+ void FileSystemAccessRegularFileDelegate::Flush(
+     base::OnceCallback<void(bool)> callback) {
+@@ -260,17 +258,34 @@ void FileSystemAccessRegularFileDelegate::Flush(
+       FROM_HERE, {base::MayBlock()},
+       CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DoFlush,
+                           WrapCrossThreadPersistent(this),
+-                          std::move(wrapped_callback), task_runner_));
++                          std::move(wrapped_callback), std::move(backing_file_),
++                          task_runner_));
+ }
+ 
+ // static
+ void FileSystemAccessRegularFileDelegate::DoFlush(
+     CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-    CrossThreadOnceFunction<void(bool)> wrapped_callback,
++    CrossThreadOnceFunction<void(bool)> callback,
++    base::File file,
+     scoped_refptr<base::SequencedTaskRunner> task_runner) {
+-  bool result = delegate->backing_file_.Flush();
+-  PostCrossThreadTask(*task_runner, FROM_HERE,
+-                      CrossThreadBindOnce(std::move(wrapped_callback), result));
++  DCHECK(!IsMainThread());
++
++  bool success = file.Flush();
++  PostCrossThreadTask(
++      *task_runner, FROM_HERE,
++      CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DidFlush,
++                          std::move(delegate), std::move(callback),
++                          std::move(file), success));
++}
++
++void FileSystemAccessRegularFileDelegate::DidFlush(
++    CrossThreadOnceFunction<void(bool)> callback,
++    base::File file,
++    bool success) {
++  DCHECK(task_runner_->RunsTasksInCurrentSequence());
++  backing_file_ = std::move(file);
++
++  std::move(callback).Run(success);
+ }
+ 
+ void FileSystemAccessRegularFileDelegate::Close(base::OnceClosure callback) {
+@@ -281,16 +296,33 @@ void FileSystemAccessRegularFileDelegate::Close(base::OnceClosure callback) {
+       FROM_HERE, {base::MayBlock()},
+       CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DoClose,
+                           WrapCrossThreadPersistent(this),
+-                          std::move(wrapped_callback), task_runner_));
++                          std::move(wrapped_callback), std::move(backing_file_),
++                          task_runner_));
+ }
+ 
+ // static
+ void FileSystemAccessRegularFileDelegate::DoClose(
+     CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-    CrossThreadOnceClosure wrapped_callback,
++    CrossThreadOnceClosure callback,
++    base::File file,
+     scoped_refptr<base::SequencedTaskRunner> task_runner) {
+-  delegate->backing_file_.Close();
+-  PostCrossThreadTask(*task_runner, FROM_HERE, std::move(wrapped_callback));
++  DCHECK(!IsMainThread());
++
++  file.Close();
++  PostCrossThreadTask(
++      *task_runner, FROM_HERE,
++      CrossThreadBindOnce(&FileSystemAccessRegularFileDelegate::DidClose,
++                          std::move(delegate), std::move(callback),
++                          std::move(file)));
++}
++
++void FileSystemAccessRegularFileDelegate::DidClose(
++    CrossThreadOnceClosure callback,
++    base::File file) {
++  DCHECK(task_runner_->RunsTasksInCurrentSequence());
++  backing_file_ = std::move(file);
++
++  std::move(callback).Run();
+ }
+ 
+ }  // namespace blink
+diff --git a/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.h b/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.h
+index dc894059a12f4bcb8a36a1b6f443265dee42789a..880d6880f855d98f8d4102270c06923e9b3dc738 100644
+--- a/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.h
++++ b/third_party/blink/renderer/modules/file_system_access/file_system_access_regular_file_delegate.h
+@@ -28,6 +28,11 @@ namespace blink {
+ 
+ // Non-incognito implementation of the FileSystemAccessFileDelegate. This class
+ // is a thin wrapper around an OS-level file descriptor.
++//
++// For async file operations, ownership of the file descriptor is passed to
++// `task_runner_` to ensure it stays alive while being used. Ownership is passed
++// back to the delegate once the operation completes. The delegate must not be
++// used while there is an in-progress operation.
+ class FileSystemAccessRegularFileDelegate final
+     : public FileSystemAccessFileDelegate {
+  public:
+@@ -71,24 +76,55 @@ class FileSystemAccessRegularFileDelegate final
+   bool IsValid() const override { return backing_file_.IsValid(); }
+ 
+  private:
++  // All async file operations perform I/O via a worker pool, off the main
++  // thread. To keep `backing_file_` from being garbage-collected, ownership is
++  // passed to the worker thread during the file operation. Concurrent file
++  // operations is NOT supported.
++
++  // Performs the file I/O part of getSize(), off the main thread.
+   static void DoGetLength(
+       CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-      CrossThreadOnceFunction<void(base::FileErrorOr<int64_t>)>
+-          wrapped_callback,
++      CrossThreadOnceFunction<void(base::FileErrorOr<int64_t>)> callback,
++      base::File file,
+       scoped_refptr<base::SequencedTaskRunner> file_task_runner);
++  // Performs the post file I/O part of getSize(), on the main thread.
++  void DidGetLength(
++      CrossThreadOnceFunction<void(base::FileErrorOr<int64_t>)> callback,
++      base::File file,
++      base::FileErrorOr<int64_t> error_or_length);
++
++  // Performs the file I/O part of truncate(), off the main thread.
+   static void DoSetLength(
+       CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-      CrossThreadOnceFunction<void(bool)> wrapped_callback,
++      CrossThreadOnceFunction<void(bool)> callback,
++      base::File file,
+       scoped_refptr<base::SequencedTaskRunner> task_runner,
+       int64_t length);
++  // Performs the post file I/O part of truncate(), on the main thread.
++  void DidSetLength(CrossThreadOnceFunction<void(bool)> callback,
++                    int64_t new_length,
++                    base::File file,
++                    bool success);
++
++  // Performs the file I/O part of flush(), off the main thread.
+   static void DoFlush(
+       CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-      CrossThreadOnceFunction<void(bool)> wrapped_callback,
++      CrossThreadOnceFunction<void(bool)> callback,
++      base::File file,
+       scoped_refptr<base::SequencedTaskRunner> task_runner);
++  // Performs the post file I/O part of flush(), on the main thread.
++  void DidFlush(CrossThreadOnceFunction<void(bool)> callback,
++                base::File file,
++                bool success);
++
++  // Performs the file I/O part of close(), off the main thread.
+   static void DoClose(
+       CrossThreadPersistent<FileSystemAccessRegularFileDelegate> delegate,
+-      CrossThreadOnceClosure wrapped_callback,
++      CrossThreadOnceClosure callback,
++      base::File file,
+       scoped_refptr<base::SequencedTaskRunner> task_runner);
++  // Performs the post file I/O part of close(), on the main thread.
++  void DidClose(CrossThreadOnceClosure callback, base::File file);
+ 
+   // Called after preconditions for SetLength, including the requesting
+   // additional capacity (if needed), have been performed.
+@@ -98,16 +134,7 @@ class FileSystemAccessRegularFileDelegate final
+                                  int64_t new_length,
+                                  bool request_capacity_result);
+ 
+-  // Called after SetLength was successfully performed.
+-  void DidSuccessfulSetLength(int64_t new_length,
+-                              CrossThreadOnceFunction<void(bool)> callback);
+-
+ #if BUILDFLAG(IS_MAC)
+-  void DidSetLengthIPC(base::OnceCallback<void(bool)> callback,
+-                       int64_t new_length,
+-                       base::File file,
+-                       bool result);
+-
+   // We need the FileUtilitiesHost only on Mac, where we have to execute
+   // base::File::SetLength on the browser process, see crbug.com/1084565.
+   // We need the context_ to create the instance of FileUtilitiesHost lazily.

patches/chromium/cherry-pick-e2b8856012e0.patch

@@ -0,0 +1,88 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xiaocheng Hu <xiaochengh@chromium.org>
+Date: Mon, 18 Apr 2022 01:14:45 +0000
+Subject: Sanitize DragData markup before inserting it into document
+
+(cherry picked from commit 5164a0fe3391283663e1196cf4576ec233985e89)
+
+Fixed: 1315040
+Change-Id: I8a0ddfb983d12c185f7e943d3d5277788199b011
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3579670
+Quick-Run: Xiaocheng Hu <xiaochengh@chromium.org>
+Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org>
+Reviewed-by: Kent Tamura <tkent@chromium.org>
+Commit-Queue: Kent Tamura <tkent@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#991324}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3588887
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Cr-Commit-Position: refs/branch-heads/4951@{#831}
+Cr-Branched-From: 27de6227ca357da0d57ae2c7b18da170c4651438-refs/heads/main@{#982481}
+
+diff --git a/third_party/blink/renderer/core/page/drag_data.cc b/third_party/blink/renderer/core/page/drag_data.cc
+index 2ce56b1fefe016ac34a1a3011a595fab342abfa5..4fb86bc645386ee806544ee3647b0a333cd8afc4 100644
+--- a/third_party/blink/renderer/core/page/drag_data.cc
++++ b/third_party/blink/renderer/core/page/drag_data.cc
+@@ -131,8 +131,8 @@ DocumentFragment* DragData::AsFragment(LocalFrame* frame) const {
+     platform_drag_data_->HtmlAndBaseURL(html, base_url);
+     DCHECK(frame->GetDocument());
+     if (DocumentFragment* fragment =
+-            CreateFragmentFromMarkup(*frame->GetDocument(), html, base_url,
+-                                     kDisallowScriptingAndPluginContent))
++            CreateSanitizedFragmentFromMarkupWithContext(
++                *frame->GetDocument(), html, 0, html.length(), base_url))
+       return fragment;
+   }
+ 
+diff --git a/third_party/blink/web_tests/editing/pasteboard/drag-and-drop-svg-use-sanitize.html b/third_party/blink/web_tests/editing/pasteboard/drag-and-drop-svg-use-sanitize.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..58551d28341d851dbd99322e2a5d3af68b3b0c72
+--- /dev/null
++++ b/third_party/blink/web_tests/editing/pasteboard/drag-and-drop-svg-use-sanitize.html
+@@ -0,0 +1,47 @@
++<!doctype html>
++<script src="../../resources/testharness.js"></script>
++<script src="../../resources/testharnessreport.js"></script>
++
++<div id="drag-from" draggable=true>Drag from</div>
++<div id="drag-to" contenteditable>Drag to</div>
++
++<script>
++function computePoint(element) {
++  return {
++     x: element.offsetLeft + element.offsetWidth / 2,
++     y: element.offsetTop + element.offsetHeight / 2
++  };
++}
++
++let dragged = false;
++let executed = false;
++const payload = `
++  <svg><use href="data:image/svg+xml,&lt;svg id='x' xmlns='http://www.w3.org/2000/svg'&gt;&lt;image href='fake' onerror='executed=true' /&gt;&lt;/svg&gt;#x" />
++`;
++
++const dragFrom = document.getElementById('drag-from');
++dragFrom.ondragstart = event => {
++  dragged = true;
++  event.dataTransfer.setData('text/html', payload);
++}
++
++const dragTo = document.getElementById('drag-to');
++
++promise_test(async test => {
++  assert_own_property(window, 'eventSender', 'This test requires eventSender to simulate drag and drop');
++
++  const fromPoint = computePoint(dragFrom);
++  eventSender.mouseMoveTo(fromPoint.x, fromPoint.y);
++  eventSender.mouseDown();
++
++  const toPoint = computePoint(dragTo);
++  eventSender.mouseMoveTo(toPoint.x, toPoint.y);
++  eventSender.mouseUp();
++
++  assert_true(dragged, 'Element should be dragged');
++
++  // The 'error' event is dispatched asynchronously.
++  await new Promise(resolve => test.step_timeout(resolve, 100));
++  assert_false(executed, 'Script should be blocked');
++}, 'Script in SVG use href should be sanitized');
++</script>

patches/chromium/cherry-pick-f1504440487f.patch

@@ -0,0 +1,68 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Justin Novosad <junov@chromium.org>
+Date: Thu, 2 Jun 2022 19:35:57 +0000
+Subject: PaintOpReader: Harden PaintImage deserialization
+
+This fix prevents the deserialization of PaintImage pixel data from
+reading data out of bounds when the block of serialized pixel data isn't
+large enough to cover the expected amount of data, given the size and
+format of the image.
+
+(cherry picked from commit e89ea1489429a9a9e49e70d5d4e8d018fbafb6ac)
+
+Bug: 1325298
+Change-Id: Icbeb405d2031d7d8ce4537836d7996ce7885f6d1
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3669596
+Commit-Queue: Justin Novosad <junov@chromium.org>
+Reviewed-by: Jonathan Ross <jonross@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1007804}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3687975
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Reviewed-by: Justin Novosad <junov@chromium.org>
+Auto-Submit: Srinivas Sista <srinivassista@chromium.org>
+Commit-Queue: Srinivas Sista <srinivassista@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5005@{#1093}
+Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738}
+
+diff --git a/cc/paint/paint_op_reader.cc b/cc/paint/paint_op_reader.cc
+index c56e2ea7a641d679feb348b808519dd17b861081..ecc736b61defabd7cea081b3017bbeda9aeaf0e9 100644
+--- a/cc/paint/paint_op_reader.cc
++++ b/cc/paint/paint_op_reader.cc
+@@ -329,6 +329,10 @@ void PaintOpReader::Read(PaintImage* image) {
+ 
+         SkImageInfo image_info =
+             SkImageInfo::Make(width, height, color_type, kPremul_SkAlphaType);
++        if (pixel_size < image_info.computeMinByteSize()) {
++          SetInvalid(DeserializationError::kInsufficientPixelData);
++          return;
++        }
+         const volatile void* pixel_data = ExtractReadableMemory(pixel_size);
+         if (!valid_)
+           return;
+diff --git a/cc/paint/paint_op_reader.h b/cc/paint/paint_op_reader.h
+index 201cdfde5eea3a07e31a3d6a50a5119485d5c1fc..af784145a9365ea2f776a1020145c0b83c63f16d 100644
+--- a/cc/paint/paint_op_reader.h
++++ b/cc/paint/paint_op_reader.h
+@@ -180,8 +180,9 @@ class CC_PAINT_EXPORT PaintOpReader {
+     kSharedImageProviderNoAccess = 50,
+     kSharedImageProviderSkImageCreationFailed = 51,
+     kZeroSkColorFilterBytes = 52,
++    kInsufficientPixelData = 53,
+ 
+-    kMaxValue = kZeroSkColorFilterBytes,
++    kMaxValue = kInsufficientPixelData
+   };
+ 
+   template <typename T>
+diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
+index 0a822d8a7d59debfb250b98f2a2079f256715b52..34569a0fcd539bca6b465e0555c8d44677f57447 100644
+--- a/tools/metrics/histograms/enums.xml
++++ b/tools/metrics/histograms/enums.xml
+@@ -68766,6 +68766,7 @@ Called by update_net_trust_anchors.py.-->
+   <int value="50" label="SharedImageProvider no access"/>
+   <int value="51" label="SharedImageProvider SkImage creation failed"/>
+   <int value="52" label="Zero SkColorFilter bytes"/>
++  <int value="53" label="Insufficient Pixel Data"/>
+ </enum>
+ 
+ <enum name="PaletteModeCancelType">

patches/chromium/cherry-pick-f1dd785e021e.patch

@@ -0,0 +1,230 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Austin Sullivan <asully@chromium.org>
+Date: Mon, 16 May 2022 18:20:27 +0000
+Subject: M102: FSA: Sanitize .scf files
+
+.scf files can be used to execute code without opening the file.
+Sanitize these files the same way we sanitize .lnk files.
+
+Also updates filename sanitization logic to be consistent in blocking
+.lnk and .local extensions on all OSes.
+
+(cherry picked from commit 988164c6c4a563c3d4c0dedba295d09472dfc15f)
+
+Bug: 1227995
+Change-Id: I4b018f1ba524c783547e18630db9addc9fb126e6
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3089422
+Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
+Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1002147}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3648322
+Auto-Submit: Austin Sullivan <asully@chromium.org>
+Commit-Queue: Austin Sullivan <asully@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5005@{#759}
+Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738}
+
+diff --git a/content/browser/file_system_access/file_system_access_directory_handle_impl.cc b/content/browser/file_system_access/file_system_access_directory_handle_impl.cc
+index 56863d50d543470de597e8df62e2f5b43b7b0fbe..df922b5a6cb917457570bb0f11a48d7a1710c627 100644
+--- a/content/browser/file_system_access/file_system_access_directory_handle_impl.cc
++++ b/content/browser/file_system_access/file_system_access_directory_handle_impl.cc
+@@ -438,10 +438,13 @@ namespace {
+ bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
+   base::FilePath::StringType extension_lower = base::ToLowerASCII(extension);
+ 
+-  // .lnk files may be used to execute arbitrary code (see
+-  // https://nvd.nist.gov/vuln/detail/CVE-2010-2568).
+-  if (extension_lower == FILE_PATH_LITERAL("lnk"))
++  // .lnk and .scf files may be used to execute arbitrary code (see
++  // https://nvd.nist.gov/vuln/detail/CVE-2010-2568 and
++  // https://crbug.com/1227995, respectively).
++  if (extension_lower == FILE_PATH_LITERAL("lnk") ||
++      extension_lower == FILE_PATH_LITERAL("scf")) {
+     return true;
++  }
+ 
+   // Setting a file's extension to a CLSID may conceal its actual file type on
+   // some Windows versions (see https://nvd.nist.gov/vuln/detail/CVE-2004-0420).
+diff --git a/content/browser/file_system_access/file_system_access_manager_impl.cc b/content/browser/file_system_access/file_system_access_manager_impl.cc
+index b265ba0f405cecc03cbcc1c0b217204d3e7b25f6..689f7fc7093b5483fa36af5fd7832a25adf9c23b 100644
+--- a/content/browser/file_system_access/file_system_access_manager_impl.cc
++++ b/content/browser/file_system_access/file_system_access_manager_impl.cc
+@@ -530,6 +530,16 @@ void FileSystemAccessManagerImpl::SetDefaultPathAndShowPicker(
+     suggested_name_path =
+         net::GenerateFileName(GURL(), std::string(), std::string(),
+                               suggested_name, std::string(), std::string());
++
++    auto suggested_extension = suggested_name_path.Extension();
++    // Our version of `IsShellIntegratedExtension()` is more stringent than
++    // the version used in `net::GenerateFileName()`. See
++    // `FileSystemChooser::IsShellIntegratedExtension()` for details.
++    if (FileSystemChooser::IsShellIntegratedExtension(suggested_extension)) {
++      suggested_extension = FILE_PATH_LITERAL("download");
++      suggested_name_path =
++          suggested_name_path.ReplaceExtension(suggested_extension);
++    }
+   }
+ 
+   FileSystemChooser::Options file_system_chooser_options(
+diff --git a/content/browser/file_system_access/file_system_chooser.cc b/content/browser/file_system_access/file_system_chooser.cc
+index 6f0acccd3458ed758dbe14c8a3008a52569d8055..86b9af148a86e64f9f4aedb6e39998bf83668745 100644
+--- a/content/browser/file_system_access/file_system_chooser.cc
++++ b/content/browser/file_system_access/file_system_chooser.cc
+@@ -71,33 +71,6 @@ base::FilePath::StringType GetLastExtension(
+              : extension;
+ }
+ 
+-// Returns whether the specified extension receives special handling by the
+-// Windows shell.
+-bool IsShellIntegratedExtension(const base::FilePath::StringType& extension) {
+-  // TODO(https://crbug.com/1154757): Figure out some way to unify this with
+-  // net::IsSafePortablePathComponent, with the result probably ending up in
+-  // base/i18n/file_util_icu.h.
+-  base::FilePath::StringType extension_lower = base::ToLowerASCII(extension);
+-
+-  // .lnk files may be used to execute arbitrary code (see
+-  // https://nvd.nist.gov/vuln/detail/CVE-2010-2568). .local files are used by
+-  // Windows to determine which DLLs to load for an application.
+-  if ((extension_lower == FILE_PATH_LITERAL("local")) ||
+-      (extension_lower == FILE_PATH_LITERAL("lnk"))) {
+-    return true;
+-  }
+-
+-  // Setting a file's extension to a CLSID may conceal its actual file type on
+-  // some Windows versions (see https://nvd.nist.gov/vuln/detail/CVE-2004-0420).
+-  if (!extension_lower.empty() &&
+-      (extension_lower.front() == FILE_PATH_LITERAL('{')) &&
+-      (extension_lower.back() == FILE_PATH_LITERAL('}'))) {
+-    return true;
+-  }
+-
+-  return false;
+-}
+-
+ // Extension validation primarily takes place in the renderer. This checks for a
+ // subset of invalid extensions in the event the renderer is compromised.
+ bool IsInvalidExtension(base::FilePath::StringType& extension) {
+@@ -105,7 +78,7 @@ bool IsInvalidExtension(base::FilePath::StringType& extension) {
+   auto extension16 = base::UTF8ToUTF16(component8);
+ 
+   return !base::i18n::IsFilenameLegal(extension16) ||
+-         IsShellIntegratedExtension(GetLastExtension(extension));
++         FileSystemChooser::IsShellIntegratedExtension(extension);
+ }
+ 
+ // Converts the accepted mime types and extensions from `option` into a list
+@@ -290,6 +263,40 @@ void FileSystemChooser::CreateAndShow(
+       /*params=*/nullptr);
+ }
+ 
++// static
++bool FileSystemChooser::IsShellIntegratedExtension(
++    const base::FilePath::StringType& extension) {
++  // TODO(https://crbug.com/1154757): Figure out some way to unify this with
++  // net::IsSafePortablePathComponent, with the result probably ending up in
++  // base/i18n/file_util_icu.h.
++  // - For the sake of consistency across platforms, we sanitize '.lnk' and
++  //   '.local' files on all platforms (not just Windows)
++  // - There are some extensions (i.e. '.scf') we would like to sanitize which
++  //   `net::GenerateFileName()` does not
++  base::FilePath::StringType extension_lower =
++      base::ToLowerASCII(GetLastExtension(extension));
++
++  // .lnk and .scf files may be used to execute arbitrary code (see
++  // https://nvd.nist.gov/vuln/detail/CVE-2010-2568 and
++  // https://crbug.com/1227995, respectively). .local files are used by Windows
++  // to determine which DLLs to load for an application.
++  if ((extension_lower == FILE_PATH_LITERAL("lnk")) ||
++      (extension_lower == FILE_PATH_LITERAL("local")) ||
++      (extension_lower == FILE_PATH_LITERAL("scf"))) {
++    return true;
++  }
++
++  // Setting a file's extension to a CLSID may conceal its actual file type on
++  // some Windows versions (see https://nvd.nist.gov/vuln/detail/CVE-2004-0420).
++  if (!extension_lower.empty() &&
++      (extension_lower.front() == FILE_PATH_LITERAL('{')) &&
++      (extension_lower.back() == FILE_PATH_LITERAL('}'))) {
++    return true;
++  }
++
++  return false;
++}
++
+ FileSystemChooser::FileSystemChooser(ui::SelectFileDialog::Type type,
+                                      ResultCallback callback,
+                                      base::ScopedClosureRunner fullscreen_block)
+diff --git a/content/browser/file_system_access/file_system_chooser.h b/content/browser/file_system_access/file_system_chooser.h
+index 07c8e7fda7d96496f58ed9a9e6cba6558c8c37df..925df7f5ef1d1bb94926afbe29beda248ae5aabc 100644
+--- a/content/browser/file_system_access/file_system_chooser.h
++++ b/content/browser/file_system_access/file_system_chooser.h
+@@ -68,6 +68,12 @@ class CONTENT_EXPORT FileSystemChooser : public ui::SelectFileDialog::Listener {
+                             ResultCallback callback,
+                             base::ScopedClosureRunner fullscreen_block);
+ 
++  // Returns whether the specified extension receives special handling by the
++  // Windows shell. These extensions should be sanitized before being shown in
++  // the "save as" file picker.
++  static bool IsShellIntegratedExtension(
++      const base::FilePath::StringType& extension);
++
+   FileSystemChooser(ui::SelectFileDialog::Type type,
+                     ResultCallback callback,
+                     base::ScopedClosureRunner fullscreen_block);
+diff --git a/content/browser/file_system_access/file_system_chooser_browsertest.cc b/content/browser/file_system_access/file_system_chooser_browsertest.cc
+index dc310d04fb29ed4fa9c9cdac7ab726d4ca9f9f37..9ea4db7807f6bbac799452fd138848b2a650d6fd 100644
+--- a/content/browser/file_system_access/file_system_chooser_browsertest.cc
++++ b/content/browser/file_system_access/file_system_chooser_browsertest.cc
+@@ -1556,22 +1556,28 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, SuggestedName) {
+   name_infos.push_back({"not_matching.jpg", ListValueOf(".txt"), false,
+                         "not_matching.jpg", false});
+ 
+-#if BUILDFLAG(IS_WIN)
+-  // ".local" and ".lnk" extensions should be sanitized on Windows.
++  // ".lnk", ".local", and ".scf" extensions should be sanitized.
+   name_infos.push_back({"dangerous_extension.local", ListValueOf(".local"),
+                         true, "dangerous_extension.download", false});
+   name_infos.push_back({"dangerous_extension.lnk", ListValueOf(".lnk"), true,
+                         "dangerous_extension.download", false});
+-#else
+-  // ".local" and ".lnk" extensions should be allowed on other OSes.
+-  // TODO(https://crbug.com/1154757): `expected_exclude_accept_all_option` is
+-  // false here because ".local" and ".lnk" extensions are not allowed in
+-  // `accepts`, but are only sanitized by net::GenerateSafeFileName on Windows.
+-  name_infos.push_back({"dangerous_extension.local", ListValueOf(".local"),
+-                        true, "dangerous_extension.local", false});
+-  name_infos.push_back({"dangerous_extension.lnk", ListValueOf(".lnk"), true,
+-                        "dangerous_extension.lnk", false});
+-#endif
++  name_infos.push_back({"dangerous_extension.scf", ListValueOf(".scf"), true,
++                        "dangerous_extension.download", false});
++  // Compound extensions ending in a dangerous extension should be sanitized.
++  name_infos.push_back({"dangerous_extension.png.local", ListValueOf(".local"),
++                        true, "dangerous_extension.png.download", false});
++  name_infos.push_back({"dangerous_extension.png.lnk", ListValueOf(".lnk"),
++                        true, "dangerous_extension.png.download", false});
++  name_infos.push_back({"dangerous_extension.png.scf", ListValueOf(".scf"),
++                        true, "dangerous_extension.png.download", false});
++  // Compound extensions not ending in a dangerous extension should not be
++  // sanitized.
++  name_infos.push_back({"dangerous_extension.local.png", ListValueOf(".png"),
++                        true, "dangerous_extension.local.png", true});
++  name_infos.push_back({"dangerous_extension.lnk.png", ListValueOf(".png"),
++                        true, "dangerous_extension.lnk.png", true});
++  name_infos.push_back({"dangerous_extension.scf.png", ListValueOf(".png"),
++                        true, "dangerous_extension.scf.png", true});
+   // Invalid characters should be sanitized.
+   name_infos.push_back({R"(inv*l:d\\ch%rבאמת!a<ters🤓.txt)",
+                         ListValueOf(".txt"), true,
+diff --git a/content/browser/file_system_access/file_system_chooser_unittest.cc b/content/browser/file_system_access/file_system_chooser_unittest.cc
+index 373de41cf5ddead27b5e036c1cc14448a731250a..9b27d6305bd00a19d94b5ec49f21a7ecff7ddc48 100644
+--- a/content/browser/file_system_access/file_system_chooser_unittest.cc
++++ b/content/browser/file_system_access/file_system_chooser_unittest.cc
+@@ -189,7 +189,7 @@ TEST_F(FileSystemChooserTest, IgnoreShellIntegratedExtensions) {
+   accepts.emplace_back(blink::mojom::ChooseFileSystemEntryAcceptsOption::New(
+       u"", std::vector<std::string>({}),
+       std::vector<std::string>(
+-          {"lnk", "foo.lnk", "foo.bar.local", "text", "local"})));
++          {"lnk", "foo.lnk", "foo.bar.local", "text", "local", "scf"})));
+   SyncShowDialog(std::move(accepts), /*include_accepts_all=*/false);
+ 
+   ASSERT_TRUE(dialog_params.file_types);

patches/chromium/cherry-pick-f3d01ff794dc.patch

@@ -0,0 +1,123 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alvin Ji <alvinji@chromium.org>
+Date: Thu, 28 Apr 2022 00:44:28 +0000
+Subject: Introduce isLowEnergyDevice() for safely downward static_cast from
+ BluetoothDeviceMac to BluetoothLowEnergyDeviceMac
+
+device/bluetooth/bluetooth_adapter_mac.mm has two non safely downward static_cast BluetoothDevice to BluetoothLowEnergyDeviceMac
+
+To avoid it, we introduce isLowEnergyDevice() to BluetoothDeviceMac so we could identify LE bluetooth device from classic bluetooth device then safely cast it downward.
+
+(cherry picked from commit 2582158fc555edee390a050a64c1b89994a6b349)
+
+Bug: 1318610
+Change-Id: Iaf082fc2c40270237bbc0b000b80faa7f94b1026
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3601727
+Reviewed-by: Reilly Grant <reillyg@chromium.org>
+Commit-Queue: Alvin Ji <alvinji@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#995419}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3606585
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Cr-Commit-Position: refs/branch-heads/5005@{#217}
+Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738}
+
+diff --git a/device/bluetooth/bluetooth_adapter_mac.mm b/device/bluetooth/bluetooth_adapter_mac.mm
+index 11d8419791f3e45d5242081422d452d4fc703833..012f9ce97d9ed6b00deb718a88f432e053cb3bd1 100644
+--- a/device/bluetooth/bluetooth_adapter_mac.mm
++++ b/device/bluetooth/bluetooth_adapter_mac.mm
+@@ -774,6 +774,11 @@ CBCentralManagerState GetCBManagerState(CBCentralManager* manager) {
+     DVLOG(1)
+         << "Central no longer powered on. Notifying of device disconnection.";
+     for (BluetoothDevice* device : GetDevices()) {
++      // GetDevices() returns instances of BluetoothClassicDeviceMac and
++      // BluetoothLowEnergyDeviceMac. The DidDisconnectPeripheral() method is
++      // only available on BluetoothLowEnergyDeviceMac.
++      if (!static_cast<BluetoothDeviceMac*>(device)->IsLowEnergyDevice())
++        continue;
+       BluetoothLowEnergyDeviceMac* device_mac =
+           static_cast<BluetoothLowEnergyDeviceMac*>(device);
+       if (device_mac->IsGattConnected()) {
+@@ -911,9 +916,16 @@ CBCentralManagerState GetCBManagerState(CBCentralManager* manager) {
+       BluetoothLowEnergyDeviceMac::GetPeripheralHashAddress(peripheral);
+   auto iter = devices_.find(device_address);
+   if (iter == devices_.end()) {
+-    return nil;
+-  }
+-  return static_cast<BluetoothLowEnergyDeviceMac*>(iter->second.get());
++    return nullptr;
++  }
++  // device_mac can be BluetoothClassicDeviceMac* or
++  // BluetoothLowEnergyDeviceMac* To return valid BluetoothLowEnergyDeviceMac*
++  // we need to first check with IsLowEnergyDevice()
++  BluetoothDeviceMac* device_mac =
++      static_cast<BluetoothDeviceMac*>(iter->second.get());
++  return device_mac->IsLowEnergyDevice()
++             ? static_cast<BluetoothLowEnergyDeviceMac*>(device_mac)
++             : nullptr;
+ }
+ 
+ bool BluetoothAdapterMac::DoesCollideWithKnownDevice(
+diff --git a/device/bluetooth/bluetooth_classic_device_mac.h b/device/bluetooth/bluetooth_classic_device_mac.h
+index b11dbbdec75ca276c6e9df50a00e4e3a97d5be8c..a7deb96690e2b64ed82ede5ade5591935ec0f308 100644
+--- a/device/bluetooth/bluetooth_classic_device_mac.h
++++ b/device/bluetooth/bluetooth_classic_device_mac.h
+@@ -82,6 +82,7 @@ class BluetoothClassicDeviceMac : public BluetoothDeviceMac {
+   // Returns the Bluetooth address for the |device|. The returned address has a
+   // normalized format (see below).
+   static std::string GetDeviceAddress(IOBluetoothDevice* device);
++  bool IsLowEnergyDevice() override;
+ 
+  protected:
+   // BluetoothDevice override
+diff --git a/device/bluetooth/bluetooth_classic_device_mac.mm b/device/bluetooth/bluetooth_classic_device_mac.mm
+index 210802eec420807c36f5cd95408bb00d9052ea1b..ceeeab4f102ceb1078e9a2b463170a04773404cf 100644
+--- a/device/bluetooth/bluetooth_classic_device_mac.mm
++++ b/device/bluetooth/bluetooth_classic_device_mac.mm
+@@ -305,4 +305,8 @@ BluetoothUUID ExtractUuid(IOBluetoothSDPDataElement* service_class_data) {
+       base::SysNSStringToUTF8([device addressString]));
+ }
+ 
++bool BluetoothClassicDeviceMac::IsLowEnergyDevice() {
++  return false;
++}
++
+ }  // namespace device
+diff --git a/device/bluetooth/bluetooth_device_mac.h b/device/bluetooth/bluetooth_device_mac.h
+index 10245db6516b08a8e50e6637011a3a960440625c..0213e20aee170aae0a4b73e93f47c418110ef289 100644
+--- a/device/bluetooth/bluetooth_device_mac.h
++++ b/device/bluetooth/bluetooth_device_mac.h
+@@ -30,6 +30,7 @@ class DEVICE_BLUETOOTH_EXPORT BluetoothDeviceMac : public BluetoothDevice {
+       BluetoothGattService::GattErrorCode error_code);
+   static BluetoothGattService::GattErrorCode GetGattErrorCodeFromNSError(
+       NSError* error);
++  virtual bool IsLowEnergyDevice() = 0;
+ 
+  protected:
+   BluetoothDeviceMac(BluetoothAdapterMac* adapter);
+diff --git a/device/bluetooth/bluetooth_low_energy_device_mac.h b/device/bluetooth/bluetooth_low_energy_device_mac.h
+index 6db4f57489d65f3363b716c49037c4fac1389f0c..1e5ce4777b37c6a65a64ba5f7d5bb630b2ebe687 100644
+--- a/device/bluetooth/bluetooth_low_energy_device_mac.h
++++ b/device/bluetooth/bluetooth_low_energy_device_mac.h
+@@ -83,6 +83,7 @@ class DEVICE_BLUETOOTH_EXPORT BluetoothLowEnergyDeviceMac
+       const device::BluetoothUUID& uuid,
+       ConnectToServiceCallback callback,
+       ConnectToServiceErrorCallback error_callback) override;
++  bool IsLowEnergyDevice() override;
+ 
+  protected:
+   // BluetoothDevice override.
+diff --git a/device/bluetooth/bluetooth_low_energy_device_mac.mm b/device/bluetooth/bluetooth_low_energy_device_mac.mm
+index 9a89728b0fc47cd7ca6e20d2ffbe7483010cbe39..73b1bee8e64664bdc98e45869accdf0ade2250b0 100644
+--- a/device/bluetooth/bluetooth_low_energy_device_mac.mm
++++ b/device/bluetooth/bluetooth_low_energy_device_mac.mm
+@@ -207,6 +207,10 @@ @interface CBPeripheral (HighSierraSDK)
+   NOTIMPLEMENTED();
+ }
+ 
++bool BluetoothLowEnergyDeviceMac::IsLowEnergyDevice() {
++  return true;
++}
++
+ void BluetoothLowEnergyDeviceMac::CreateGattConnectionImpl(
+     absl::optional<BluetoothUUID> serivce_uuid) {
+   if (!IsGattConnected()) {

patches/chromium/chore_do_not_use_chrome_windows_in_cryptotoken_webrequestsender.patch

@@ -10,10 +10,10 @@ In Electron that can be simplified to webContents.isFocused() which maps to "is
 This can't be upstreamed but the patch is minimal.
 
 diff --git a/chrome/browser/resources/cryptotoken/webrequestsender.js b/chrome/browser/resources/cryptotoken/webrequestsender.js
-index 8ea2d1c6d7269d25cd34a61d971d35c81b561670..8609defbb5de5c11614858586a9100974aed067c 100644
+index 67385e25a9233ce7a5077e69e9be1f457252ea5d..3e6864e6ea3374874598a0175746451126ddb165 100644
 --- a/chrome/browser/resources/cryptotoken/webrequestsender.js
 +++ b/chrome/browser/resources/cryptotoken/webrequestsender.js
-@@ -142,10 +142,11 @@ function tabInForeground(tabId) {
+@@ -141,10 +141,11 @@ function tabInForeground(tabId) {
        reject();
        return;
      }
@@ -29,7 +29,7 @@ index 8ea2d1c6d7269d25cd34a61d971d35c81b561670..8609defbb5de5c11614858586a910097
      chrome.tabs.get(tabId, function(tab) {
        if (chrome.runtime.lastError) {
          resolve(false);
-@@ -155,9 +156,13 @@ function tabInForeground(tabId) {
+@@ -154,9 +155,13 @@ function tabInForeground(tabId) {
          resolve(false);
          return;
        }

patches/chromium/chore_expose_v8_initialization_isolate_callbacks.patch

@@ -9,10 +9,10 @@ we're running with contextIsolation enabled, we should be falling back
 to Blink's logic. This will be upstreamed in some form.
 
 diff --git a/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc b/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
-index 90d3a635eec331130b738d0839cc9fdfa60ce451..9eb900ff4449f277f8c5ab3ccc29b0aa725be356 100644
+index 10f34d87d74d81de91cbd006665465cee6c0d21e..93f09cd74b225a8b0c2d2f5280636513e852e8ff 100644
 --- a/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
 +++ b/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
-@@ -448,8 +448,9 @@ CodeGenerationCheckCallbackInMainThread(v8::Local<v8::Context> context,
+@@ -446,8 +446,9 @@ CodeGenerationCheckCallbackInMainThread(v8::Local<v8::Context> context,
    return {true, std::move(stringified_source)};
  }
  

patches/chromium/chore_provide_iswebcontentscreationoverridden_with_full_params.patch

@@ -49,7 +49,7 @@ index 27452df45433e4aeb7b9008f8e5b91dd4b5f50db..5c6f9936e6d3d2647d7efbc70efda855
    // uses this to spawn new windows/tabs, which is also not allowed for
    // offscreen tabs.
 diff --git a/chrome/browser/media/offscreen_tab.h b/chrome/browser/media/offscreen_tab.h
-index faa684c429e8cd5817c043db48dcbea33c6c8782..8b5991bc8279585cc0749f6816aa8a03a2c4e558 100644
+index 88b68339823142f9b2b2d4730d6ebc1033ac86a3..e2d53e1b233adced355be667d006d5d2ba3d5110 100644
 --- a/chrome/browser/media/offscreen_tab.h
 +++ b/chrome/browser/media/offscreen_tab.h
 @@ -107,8 +107,7 @@ class OffscreenTab final : public ProfileObserver,
@@ -63,10 +63,10 @@ index faa684c429e8cd5817c043db48dcbea33c6c8782..8b5991bc8279585cc0749f6816aa8a03
        content::RenderFrameHost* requesting_frame,
        const blink::mojom::FullscreenOptions& options) final;
 diff --git a/chrome/browser/ui/ash/ash_web_view_impl.cc b/chrome/browser/ui/ash/ash_web_view_impl.cc
-index 46e5ec4d834e9478db523a5a078218104c161a57..e584921a6d575740fc0331a8bac05904558efc15 100644
+index 4df94c57d6be19d6e76430391386e84d2816d94a..f1c0c6e8bec7ef17292c2a5a3b33800f402c889b 100644
 --- a/chrome/browser/ui/ash/ash_web_view_impl.cc
 +++ b/chrome/browser/ui/ash/ash_web_view_impl.cc
-@@ -83,10 +83,9 @@ bool AshWebViewImpl::IsWebContentsCreationOverridden(
+@@ -77,10 +77,9 @@ bool AshWebViewImpl::IsWebContentsCreationOverridden(
      content::SiteInstance* source_site_instance,
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,
@@ -80,10 +80,10 @@ index 46e5ec4d834e9478db523a5a078218104c161a57..e584921a6d575740fc0331a8bac05904
                                  /*from_user_gesture=*/true);
      return true;
 diff --git a/chrome/browser/ui/ash/ash_web_view_impl.h b/chrome/browser/ui/ash/ash_web_view_impl.h
-index f0333177f885000fb22818ffa30a0c4ad520a161..03e82957f9d7bf009dcbf5fcd43718c9d2ac9bb8 100644
+index fd2bccf8f718683b55646ef200aaacc2df6ac485..b62b61fbcf4b8f1eff26546c5da020f88e4599fa 100644
 --- a/chrome/browser/ui/ash/ash_web_view_impl.h
 +++ b/chrome/browser/ui/ash/ash_web_view_impl.h
-@@ -47,8 +47,7 @@ class AshWebViewImpl : public ash::AshWebView,
+@@ -46,8 +46,7 @@ class AshWebViewImpl : public ash::AshWebView,
        content::SiteInstance* source_site_instance,
        content::mojom::WindowContainerType window_container_type,
        const GURL& opener_url,
@@ -108,10 +108,10 @@ index 6688ba8ba2fb7d930773144cdbc43f1f6fa2b685..22015c7b9b50e1264551ce226757f90e
    }
  
 diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
-index 7548e63c57dc8463cb59614122e32c574ae17437..a9e1c335e3fae4fa795059c9b28bd5d404184c2e 100644
+index 04e327d970b872f0a9c505a0b99c6273900930f9..5993b3cb0cbe76cd266dee074effd736efa8fc50 100644
 --- a/chrome/browser/ui/browser.cc
 +++ b/chrome/browser/ui/browser.cc
-@@ -1786,12 +1786,11 @@ bool Browser::IsWebContentsCreationOverridden(
+@@ -1767,12 +1767,11 @@ bool Browser::IsWebContentsCreationOverridden(
      content::SiteInstance* source_site_instance,
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,
@@ -127,7 +127,7 @@ index 7548e63c57dc8463cb59614122e32c574ae17437..a9e1c335e3fae4fa795059c9b28bd5d4
  
  WebContents* Browser::CreateCustomWebContents(
 diff --git a/chrome/browser/ui/browser.h b/chrome/browser/ui/browser.h
-index 5edda102ff59ccb30d2150a88e75e8fb65379fca..82aaa442bca9e7a5e57315ace0b1c62e40ec1d24 100644
+index a63ba24be314eb4372d7dda7206dee4b52730d1e..f9bcaa001bfed987edd0ebb001f5cda0e0aca4aa 100644
 --- a/chrome/browser/ui/browser.h
 +++ b/chrome/browser/ui/browser.h
 @@ -808,8 +808,7 @@ class Browser : public TabStripModelObserver,
@@ -183,7 +183,7 @@ index ed23267cd9f28f4e02d8374177f0bb697547cc2a..a979719f75ab4c9b49775ec3df5eff13
    }
    content::WebContents* CreateCustomWebContents(
 diff --git a/components/embedder_support/android/delegate/web_contents_delegate_android.cc b/components/embedder_support/android/delegate/web_contents_delegate_android.cc
-index 1a6bbeea689901e23717d660e67f8d1abb21f799..85f7b42e7aadce3abcae9f9596403f9856771993 100644
+index 1911b0558fad1d5834befa98e57a978e6e0b72da..cb85515f79617a32e2809ad6eb7f55e4ecc36b3f 100644
 --- a/components/embedder_support/android/delegate/web_contents_delegate_android.cc
 +++ b/components/embedder_support/android/delegate/web_contents_delegate_android.cc
 @@ -170,14 +170,13 @@ bool WebContentsDelegateAndroid::IsWebContentsCreationOverridden(
@@ -246,10 +246,10 @@ index c6bd5c19f8a7ceec17c9e32af5296a9617f3a619..02199b439fba7fdc617b7f7980d958b7
    void AddNewContents(content::WebContents* source,
                        std::unique_ptr<content::WebContents> new_contents,
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index add5ba98f4409460b93aa2f8c49eb49a1f59470a..4b77c71375a7375e168c9bee93a73c3af6fe1252 100644
+index 4e78c10d21e08fef2b25ef5a13987c13bc8c204a..d157b82514bc8eec76b9a06f67bb581c5bf24d56 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -3895,8 +3895,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3882,8 +3882,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
  
    if (delegate_ && delegate_->IsWebContentsCreationOverridden(
                         source_site_instance, params.window_container_type,
@@ -260,7 +260,7 @@ index add5ba98f4409460b93aa2f8c49eb49a1f59470a..4b77c71375a7375e168c9bee93a73c3a
          static_cast<WebContentsImpl*>(delegate_->CreateCustomWebContents(
              opener, source_site_instance, is_new_browsing_instance,
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index c01e06b08b1cca7a663e30476a551904ce9c6db8..9f50a8721560f734270308776f2f37ad49a8cb91 100644
+index 7bb1680553c405a9016cfd67eca5fa3c6439b692..3aa2cca04340098859e1072eaa80a46a8e0463b1 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
 @@ -134,8 +134,7 @@ bool WebContentsDelegate::IsWebContentsCreationOverridden(
@@ -274,10 +274,10 @@ index c01e06b08b1cca7a663e30476a551904ce9c6db8..9f50a8721560f734270308776f2f37ad
  }
  
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 2556c044b6e28501a5fac9b0040e623b8f35f497..4c6cd654551b2f5cfd59a5271a8d95a9e6862d3c 100644
+index 3330876f623e5b2cb600b1ce1fd10b3375568613..a9f48c6577afef8876cd8304ff5a66405b7d8343 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
-@@ -317,8 +317,7 @@ class CONTENT_EXPORT WebContentsDelegate {
+@@ -318,8 +318,7 @@ class CONTENT_EXPORT WebContentsDelegate {
        SiteInstance* source_site_instance,
        content::mojom::WindowContainerType window_container_type,
        const GURL& opener_url,
@@ -288,7 +288,7 @@ index 2556c044b6e28501a5fac9b0040e623b8f35f497..4c6cd654551b2f5cfd59a5271a8d95a9
    // Allow delegate to creates a custom WebContents when
    // WebContents::CreateNewWindow() is called. This function is only called
 diff --git a/extensions/browser/guest_view/extension_options/extension_options_guest.cc b/extensions/browser/guest_view/extension_options/extension_options_guest.cc
-index bddbd37ca73369adb82dad5bb8b25f0ab2a7f878..9bf28cd7f926f41041f40d4bc0a497c8b8730b86 100644
+index ce83daee0eb44d72caaf1e7e250ce0c3fadb827c..ed0b508a5d6cdd4433a8117ef2032ce8e1d99273 100644
 --- a/extensions/browser/guest_view/extension_options/extension_options_guest.cc
 +++ b/extensions/browser/guest_view/extension_options/extension_options_guest.cc
 @@ -213,8 +213,7 @@ bool ExtensionOptionsGuest::IsWebContentsCreationOverridden(
@@ -316,10 +316,10 @@ index 7350382146178f58960a9bf68cd959076d2d9790..a70a94d14bdfa993feab60b8e4f32e10
        content::RenderFrameHost* opener,
        content::SiteInstance* source_site_instance,
 diff --git a/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc b/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
-index b652f1f30ce7043a0c8434d05a3b1da653aee1fc..259c62c60f302abebf167709b4a1c68ad5607129 100644
+index 0b01120f6a6053ab03355c93216d703d0958aeab..a1c6c5a4b507bbf50668d7ed2febe97aca942c1d 100644
 --- a/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
 +++ b/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
-@@ -402,8 +402,7 @@ bool MimeHandlerViewGuest::IsWebContentsCreationOverridden(
+@@ -388,8 +388,7 @@ bool MimeHandlerViewGuest::IsWebContentsCreationOverridden(
      content::SiteInstance* source_site_instance,
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,
@@ -372,10 +372,10 @@ index f2054bca778784c223beb02de150cfeb31c52907..53bf6bc205e9c631597bfbda46f4a0b5
                            int opener_render_process_id,
                            int opener_render_frame_id,
 diff --git a/headless/lib/browser/headless_web_contents_impl.cc b/headless/lib/browser/headless_web_contents_impl.cc
-index 899b8beabdf1131a08583470ace5b468576eeab6..21ab4ae22c54846af78518e897dc23ebe4ce8317 100644
+index 2214ba7726f105e62bdc92bd0e6142ea9fa6ed72..2b9b804106317bfc914efacc7adfd282563e4c8b 100644
 --- a/headless/lib/browser/headless_web_contents_impl.cc
 +++ b/headless/lib/browser/headless_web_contents_impl.cc
-@@ -177,8 +177,7 @@ class HeadlessWebContentsImpl::Delegate : public content::WebContentsDelegate {
+@@ -176,8 +176,7 @@ class HeadlessWebContentsImpl::Delegate : public content::WebContentsDelegate {
        content::SiteInstance* source_site_instance,
        content::mojom::WindowContainerType window_container_type,
        const GURL& opener_url,
@@ -386,10 +386,10 @@ index 899b8beabdf1131a08583470ace5b468576eeab6..21ab4ae22c54846af78518e897dc23eb
          ->options()
          ->block_new_web_contents();
 diff --git a/ui/views/controls/webview/web_dialog_view.cc b/ui/views/controls/webview/web_dialog_view.cc
-index 749200efec166e0c29402a3d5e079f2e94460363..2cbc96e911291fb0b31c3f4a1444ded0be4521f5 100644
+index 1c3eebdc2cc3f5d8f110562eb3e18a1f45521c4f..11b7b0c6617c40c766d64cd0d4e60d22e569bfb1 100644
 --- a/ui/views/controls/webview/web_dialog_view.cc
 +++ b/ui/views/controls/webview/web_dialog_view.cc
-@@ -427,8 +427,7 @@ bool WebDialogView::IsWebContentsCreationOverridden(
+@@ -426,8 +426,7 @@ bool WebDialogView::IsWebContentsCreationOverridden(
      content::SiteInstance* source_site_instance,
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,

patches/chromium/chore_use_electron_resources_not_chrome_for_spellchecker.patch

@@ -7,10 +7,10 @@ spellchecker uses a few IDS_ resources.  We need to load these from
 Electrons grit header instead of Chromes
 
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 86bbdc45c6911c7249cb898f38d8e262fa1646c1..1d80724ace438fb9d2c20ff78d87a93053cf7420 100644
+index 9917fcf771ecbfceaba4c02164de620d2aaf0775..492cd8e11e28e0b427aca227665295a3052af765 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -7181,6 +7181,7 @@ static_library("browser") {
+@@ -7088,6 +7088,7 @@ static_library("browser") {
      deps += [
        "//components/spellcheck/browser",
        "//components/spellcheck/common",

patches/chromium/chrome_key_systems.patch

@@ -7,7 +7,7 @@ Disable persiste licence support check for widevine cdm,
 as its not supported in the current version of chrome.
 
 diff --git a/chrome/renderer/media/chrome_key_systems.cc b/chrome/renderer/media/chrome_key_systems.cc
-index ff769b9855810bfe3761079ddae286fc8aa5602f..1fea025e8fc1d4e2496f117780fa4d0eb2f2e983 100644
+index 0cdaa37db5a4c992c8051a6e4370f61b3e4559a3..58108239e1b5aad967eff63d8eed10a560726c6e 100644
 --- a/chrome/renderer/media/chrome_key_systems.cc
 +++ b/chrome/renderer/media/chrome_key_systems.cc
 @@ -17,7 +17,9 @@
@@ -20,7 +20,7 @@ index ff769b9855810bfe3761079ddae286fc8aa5602f..1fea025e8fc1d4e2496f117780fa4d0e
  #include "components/cdm/renderer/external_clear_key_key_system_properties.h"
  #include "components/cdm/renderer/widevine_key_system_properties.h"
  #include "content/public/renderer/render_thread.h"
-@@ -183,12 +185,14 @@ SupportedCodecs GetSupportedCodecs(const media::CdmCapability& capability) {
+@@ -230,12 +232,14 @@ SupportedCodecs GetSupportedCodecs(const media::CdmCapability& capability) {
  
  // Returns persistent-license session support.
  EmeSessionTypeSupport GetPersistentLicenseSupport(bool supported_by_the_cdm) {

patches/chromium/command-ismediakey.patch

@@ -87,10 +87,10 @@ index 0f344ee352a48497e77a72bb298146c61e7fcf2a..3bad4263ea552fc63445bf5613f8add7
    // Create an observer that registers a hot key for |accelerator|.
    std::unique_ptr<gfx::SingletonHwndHotKeyObserver> observer =
 diff --git a/content/browser/media/media_keys_listener_manager_impl.cc b/content/browser/media/media_keys_listener_manager_impl.cc
-index 3f37f08ccc06137317164e96e8934a0202fa5550..b954f8dde00d4f5257223c464e9145a6bef48900 100644
+index 4e9e4f4d21fbe650d8f32254a3b450074a038751..ac923f436cbdd6ded0629da4e4c659d94258e55b 100644
 --- a/content/browser/media/media_keys_listener_manager_impl.cc
 +++ b/content/browser/media/media_keys_listener_manager_impl.cc
-@@ -297,6 +297,11 @@ void MediaKeysListenerManagerImpl::UpdateSystemMediaControlsEnabledControls() {
+@@ -296,6 +296,11 @@ void MediaKeysListenerManagerImpl::UpdateSystemMediaControlsEnabledControls() {
        case ui::VKEY_MEDIA_STOP:
          system_media_controls_->SetIsStopEnabled(should_enable);
          break;
@@ -146,10 +146,10 @@ index ada705fb42e88d4bfa05b212c84111be9057a50e..a866b975687dd08ad88031a63f161b31
    }
  
 diff --git a/ui/base/x/x11_global_shortcut_listener.cc b/ui/base/x/x11_global_shortcut_listener.cc
-index 898e15a25c99ad25221c41594803521565ff4432..664337941023e800c9605f987d0e1d65bb0a444d 100644
+index a772666160a71e8e31242e25a8f3383ad9b914bf..7ed78ff875ccf9c38a480d0d59f4688ada1a3ad3 100644
 --- a/ui/base/x/x11_global_shortcut_listener.cc
 +++ b/ui/base/x/x11_global_shortcut_listener.cc
-@@ -31,11 +31,13 @@ const x11::ModMask kModifiersMasks[] = {
+@@ -32,11 +32,13 @@ const x11::ModMask kModifiersMasks[] = {
  
  x11::ModMask GetNativeModifiers(bool is_alt_down,
                                  bool is_ctrl_down,
@@ -165,7 +165,7 @@ index 898e15a25c99ad25221c41594803521565ff4432..664337941023e800c9605f987d0e1d65
  }
  
  }  // namespace
-@@ -81,8 +83,9 @@ uint32_t XGlobalShortcutListener::DispatchEvent(const PlatformEvent& event) {
+@@ -82,8 +84,9 @@ uint32_t XGlobalShortcutListener::DispatchEvent(const PlatformEvent& event) {
  bool XGlobalShortcutListener::RegisterAccelerator(KeyboardCode key_code,
                                                    bool is_alt_down,
                                                    bool is_ctrl_down,
@@ -177,7 +177,7 @@ index 898e15a25c99ad25221c41594803521565ff4432..664337941023e800c9605f987d0e1d65
    auto keysym = XKeysymForWindowsKeyCode(key_code, false);
    auto keycode = connection_->KeysymToKeycode(keysym);
  
-@@ -107,7 +110,7 @@ bool XGlobalShortcutListener::RegisterAccelerator(KeyboardCode key_code,
+@@ -108,7 +111,7 @@ bool XGlobalShortcutListener::RegisterAccelerator(KeyboardCode key_code,
    }
  
    registered_combinations_.insert(
@@ -186,7 +186,7 @@ index 898e15a25c99ad25221c41594803521565ff4432..664337941023e800c9605f987d0e1d65
  
    return true;
  }
-@@ -115,8 +118,9 @@ bool XGlobalShortcutListener::RegisterAccelerator(KeyboardCode key_code,
+@@ -116,8 +119,9 @@ bool XGlobalShortcutListener::RegisterAccelerator(KeyboardCode key_code,
  void XGlobalShortcutListener::UnregisterAccelerator(KeyboardCode key_code,
                                                      bool is_alt_down,
                                                      bool is_ctrl_down,
@@ -198,7 +198,7 @@ index 898e15a25c99ad25221c41594803521565ff4432..664337941023e800c9605f987d0e1d65
    auto keysym = XKeysymForWindowsKeyCode(key_code, false);
    auto keycode = connection_->KeysymToKeycode(keysym);
  
-@@ -124,7 +128,7 @@ void XGlobalShortcutListener::UnregisterAccelerator(KeyboardCode key_code,
+@@ -125,7 +129,7 @@ void XGlobalShortcutListener::UnregisterAccelerator(KeyboardCode key_code,
      connection_->UngrabKey({keycode, x_root_window_, modifiers | mask});
  
    registered_combinations_.erase(
@@ -207,7 +207,7 @@ index 898e15a25c99ad25221c41594803521565ff4432..664337941023e800c9605f987d0e1d65
  }
  
  void XGlobalShortcutListener::OnKeyPressEvent(const KeyEvent& event) {
-@@ -134,14 +138,15 @@ void XGlobalShortcutListener::OnKeyPressEvent(const KeyEvent& event) {
+@@ -135,14 +139,15 @@ void XGlobalShortcutListener::OnKeyPressEvent(const KeyEvent& event) {
    const bool is_alt_down = event.flags() & EF_ALT_DOWN;
    const bool is_ctrl_down = event.flags() & EF_CONTROL_DOWN;
    const bool is_shift_down = event.flags() & EF_SHIFT_DOWN;

patches/chromium/crash_allow_setting_more_options.patch

@@ -75,10 +75,10 @@ index 24e53fa62c2c4a11494ad3d43f0c5a806930fcdd..9b691baa6cc90cc3f9ada307c43f44c4
    // Used by WebView to sample crashes without generating the unwanted dumps. If
    // the returned value is less than 100, crash dumping will be sampled to that
 diff --git a/components/crash/core/app/crashpad_linux.cc b/components/crash/core/app/crashpad_linux.cc
-index 32e2038e15adae14aa218a353f074cd6654bdc16..72bec9c08d7ec50257a86b0ee7173864d879d7d9 100644
+index dc2b18b322350121768571b7997d632a10220ac9..3e3ee0f721a2316d324fb31e17ba97ff24d9e6d7 100644
 --- a/components/crash/core/app/crashpad_linux.cc
 +++ b/components/crash/core/app/crashpad_linux.cc
-@@ -170,6 +170,7 @@ bool PlatformCrashpadInitialization(
+@@ -180,6 +180,7 @@ bool PlatformCrashpadInitialization(
      // where crash_reporter provides it's own values for lsb-release.
      annotations["lsb-release"] = base::GetLinuxDistro();
  #endif
@@ -86,7 +86,7 @@ index 32e2038e15adae14aa218a353f074cd6654bdc16..72bec9c08d7ec50257a86b0ee7173864
  
      std::vector<std::string> arguments;
      if (crash_reporter_client->ShouldMonitorCrashHandlerExpensively()) {
-@@ -191,6 +192,13 @@ bool PlatformCrashpadInitialization(
+@@ -201,6 +202,13 @@ bool PlatformCrashpadInitialization(
      }
  #endif
  
@@ -128,10 +128,10 @@ index dc041c43371fd58e3121ef6bc423aadb644bb8d0..a1fa566775724b4a1662a939fda3f0a5
          arguments.push_back("--monitor-self");
        }
 diff --git a/components/crash/core/app/crashpad_win.cc b/components/crash/core/app/crashpad_win.cc
-index d2354b84f3a184ad53571518198055a0a91cbc25..c05529257dda2acf0fa588d49e2b902736d9b02f 100644
+index 1a8f42cb4e2ea493642d8b264d0be5c3da358793..e972272de54107aaed6143e3f3569ba56bd3cf3e 100644
 --- a/components/crash/core/app/crashpad_win.cc
 +++ b/components/crash/core/app/crashpad_win.cc
-@@ -88,6 +88,7 @@ bool PlatformCrashpadInitialization(
+@@ -89,6 +89,7 @@ bool PlatformCrashpadInitialization(
  
      std::map<std::string, std::string> process_annotations;
      GetPlatformCrashpadAnnotations(&process_annotations);
@@ -139,7 +139,7 @@ index d2354b84f3a184ad53571518198055a0a91cbc25..c05529257dda2acf0fa588d49e2b9027
  
      std::string url = crash_reporter_client->GetUploadUrl();
  
-@@ -126,6 +127,13 @@ bool PlatformCrashpadInitialization(
+@@ -127,6 +128,13 @@ bool PlatformCrashpadInitialization(
  
      std::vector<std::string> arguments(start_arguments);
  

patches/chromium/crashpad_pid_check.patch

@@ -16,7 +16,7 @@ https://github.com/electron/electron/pull/18483#discussion_r292703588
 https://github.com/electron/electron/pull/18483#issuecomment-501090683
 
 diff --git a/third_party/crashpad/crashpad/util/win/exception_handler_server.cc b/third_party/crashpad/crashpad/util/win/exception_handler_server.cc
-index 6890a01cc4b333927be6c36ff3392706020f57a3..36da005deed5893989585427216fd1e16d5e9f0c 100644
+index 92d5c5d47cfa5bd70300bb8bbc16ab944cd93509..87c14718221a83d531d15abf1f1d2d1bbc020e77 100644
 --- a/third_party/crashpad/crashpad/util/win/exception_handler_server.cc
 +++ b/third_party/crashpad/crashpad/util/win/exception_handler_server.cc
 @@ -446,9 +446,16 @@ bool ExceptionHandlerServer::ServiceClientConnection(

patches/chromium/custom_protocols_plzserviceworker.patch

@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: deepak1556 <hop2deep@gmail.com>
+Date: Fri, 20 May 2022 00:29:34 +0900
+Subject: custom_protocols_plzserviceworker.patch
+
+Allow registering custom protocols to handle service worker main script fetching with PlzServiceWorker.
+
+Refs https://bugs.chromium.org/p/chromium/issues/detail?id=996511
+
+diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
+index 4ce769314c6dddae41d915c7f05916f77f26a86e..d8f6882f2dee93fc127e7617abbcc7b71a65775d 100644
+--- a/content/browser/service_worker/service_worker_context_wrapper.cc
++++ b/content/browser/service_worker/service_worker_context_wrapper.cc
+@@ -1600,6 +1600,29 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+   std::unique_ptr<network::PendingSharedURLLoaderFactory>
+       loader_factory_bundle_info =
+           context()->loader_factory_bundle_for_update_check()->Clone();
++
++  // Give the embedder a chance to register custom schemes that can
++  // handle loading the service worker main script.
++  // Previous registration triggered by
++  // ServiceWorkerContextWrapper::CreateNonNetworkPendingURLLoaderFactoryBundleForUpdateCheck
++  // happens early on browser startup before the JS in the main process
++  // is run by the embedder.
++  auto* factory_bundle = static_cast<blink::PendingURLLoaderFactoryBundle*>(
++          loader_factory_bundle_info.get());
++  ContentBrowserClient::NonNetworkURLLoaderFactoryMap non_network_factories;
++  GetContentClient()
++      ->browser()
++      ->RegisterNonNetworkServiceWorkerUpdateURLLoaderFactories(
++          storage_partition_->browser_context(), &non_network_factories);
++  for (auto& pair : non_network_factories) {
++    const std::string& scheme = pair.first;
++    mojo::PendingRemote<network::mojom::URLLoaderFactory>& factory_remote =
++        pair.second;
++
++    factory_bundle->pending_scheme_specific_factories().emplace(
++        scheme, std::move(factory_remote));
++  }
++
+   static_cast<blink::PendingURLLoaderFactoryBundle*>(
+       loader_factory_bundle_info.get())
+       ->pending_default_factory() = std::move(remote);