Bump v19.0.17

* chore: cherry-pick 9b5207569882 from chromium

* chore: update patches

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>

.github/workflows/electron_woa_testing.yml

@@ -0,0 +1,178 @@
+name: Electron WOA Testing
+
+on:
+  push:    
+    branches: '**'
+  workflow_dispatch:
+    inputs:
+      appveyor_job_id:
+        description: 'Job Id of Appveyor WOA job to test'
+        type: text
+        required: true
+
+jobs:
+  electron-woa-init:
+    if: ${{ github.event_name == 'push' && github.repository == 'electron/electron' }}
+    runs-on: ubuntu-latest
+    steps:
+        - name: Dummy step for push event
+          run: |
+            echo "This job is a needed initialization step for Electron WOA testing.  Another test result will appear once the electron-woa-testing build is done."
+
+  electron-woa-testing:    
+    if: ${{ github.event_name == 'workflow_dispatch' && github.repository == 'electron/electron' }}    
+    runs-on: [self-hosted, woa]  
+    permissions:
+      checks: write
+      pull-requests: write
+    steps:
+    - uses: LouisBrunner/checks-action@v1.1.1
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        status: in_progress
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}    
+        output: |
+          {"summary":"Test In Progress","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}        
+    - name: Clean Workspace
+      run: |
+        Remove-Item * -Recurse -Force
+      shell: powershell
+    - name: Checkout
+      uses: actions/checkout@v3
+      with:
+        path: src\electron
+        fetch-depth: 0
+    - name: Yarn install
+      run: |
+        cd src\electron
+        node script/yarn.js install --frozen-lockfile
+    - name: Download and extract dist.zip for test
+      run: |
+        $localArtifactPath = "$pwd\dist.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/dist.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -osrc\out\Default -y $localArtifactPath
+      shell: powershell
+    - name: Download and extract native test executables for test
+      run: |
+        $localArtifactPath = "src\out\Default\shell_browser_ui_unittests.exe"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/shell_browser_ui_unittests.exe"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+      shell: powershell
+    - name: Download and extract ffmpeg.zip for test
+      run: |
+        $localArtifactPath = "$pwd\ffmpeg.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/ffmpeg.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -osrc\out\ffmpeg $localArtifactPath
+      shell: powershell
+    - name: Download node headers for test
+      run: |
+        $localArtifactPath = "src\node_headers.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/node_headers.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        cd src
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y node_headers.zip
+      shell: powershell
+    - name: Download electron.lib for test
+      run: |
+        $localArtifactPath = "src\out\Default\electron.lib"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/electron.lib"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+      shell: powershell
+    # Uncomment the following block if pdb files are needed to debug issues
+    # - name: Download pdb files for detailed stacktraces
+    #   if: ${{ github.event_name == 'workflow_dispatch' }}
+    #   run: |
+    #     try {
+    #       $localArtifactPath = "src\pdb.zip"
+    #       $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/pdb.zip"
+    #       Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+    #       cd src
+    #       & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y pdb.zip
+    #     } catch {
+    #       Write-Host "There was an exception encountered while downloading pdb files:" $_.Exception.Message
+    #     } finally {
+    #       $global:LASTEXITCODE = 0
+    #     }
+    #   shell: powershell
+    - name: Setup node headers
+      run: |
+        New-Item src\out\Default\gen\node_headers\Release -Type directory
+        Copy-Item -path src\out\Default\electron.lib -destination src\out\Default\gen\node_headers\Release\node.lib
+      shell: powershell
+    - name: Run Electron Main process tests
+      run: |
+        cd src
+        set npm_config_nodedir=%cd%\out\Default\gen\node_headers
+        set npm_config_arch=arm64
+        cd electron
+        node script/yarn test --runners=main --enable-logging --disable-features=CalculateNativeWinOcclusion  
+      env:
+        ELECTRON_ENABLE_STACK_DUMPING: true
+        ELECTRON_OUT_DIR: Default
+        IGNORE_YARN_INSTALL_ERROR: 1
+        ELECTRON_TEST_RESULTS_DIR: junit
+        MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
+        MOCHA_REPORTER: mocha-multi-reporters
+        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
+    - name: Run Electron Remote based tests
+      if: ${{ success() || failure() }}
+      run: |
+        cd src
+        set npm_config_nodedir=%cd%\out\Default\gen\node_headers
+        set npm_config_arch=arm64
+        cd electron
+        node script/yarn test --runners=remote --enable-logging --disable-features=CalculateNativeWinOcclusion
+      env:
+        ELECTRON_OUT_DIR: Default
+        IGNORE_YARN_INSTALL_ERROR: 1
+        ELECTRON_TEST_RESULTS_DIR: junit
+        MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
+        MOCHA_REPORTER: mocha-multi-reporters
+        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
+    - name: Verify ffmpeg
+      run: |
+        cd src
+        echo "Verifying non proprietary ffmpeg"
+        python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
+      shell: cmd
+    - name: Kill processes left running from last test run
+      if: ${{ always() }}
+      run: |
+        Get-Process | Where Name -Like "electron*" | Stop-Process
+        Get-Process | Where Name -Like "msedge*" | Stop-Process
+      shell: powershell
+    - name: Delete user app data directories
+      if: ${{ always() }}
+      run: |
+        Remove-Item -path $env:APPDATA/Electron* -Recurse -Force -ErrorAction Ignore
+      shell: powershell
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"${{ job.status }}","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"Job Succeeded","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}          
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ ! success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"Job Failed","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}                    

ELECTRON_VERSION

@@ -1 +1 @@
-19.0.10
+19.0.17

appveyor.yml

@@ -228,7 +228,7 @@ deploy_script:
           & python script\release\uploaders\upload.py --verbose
         }
       } elseif (Test-Path Env:\TEST_WOA) {
-        node script/release/ci-release-build.js --job=electron-woa-testing --ci=VSTS --armTest --appveyorJobId=$env:APPVEYOR_JOB_ID $env:APPVEYOR_REPO_BRANCH
+        node script/release/ci-release-build.js --job=electron-woa-testing --ci=GHA --appveyorJobId=$env:APPVEYOR_JOB_ID $env:APPVEYOR_REPO_BRANCH
       }
 on_finish:
   - cd ..

azure-pipelines-arm.yml

@@ -1,121 +0,0 @@
-steps:
-- task: CopyFiles@2
-  displayName: 'Copy Files to: src/electron'
-  inputs:
-    TargetFolder: src/electron
-
-- bash: |
-    cd src/electron
-    node script/yarn.js install --frozen-lockfile
-  displayName: 'Yarn install'
-
-- bash: |
-    export ZIP_DEST=$PWD/src/out/Default
-    echo "##vso[task.setvariable variable=ZIP_DEST]$ZIP_DEST"
-    mkdir -p $ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=dist.zip --dest=$ZIP_DEST
-    cd $ZIP_DEST
-    unzip -o dist.zip
-    xattr -cr Electron.app    
-  displayName: 'Download and unzip dist files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    export FFMPEG_ZIP_DEST=$PWD/src/out/ffmpeg
-    mkdir -p $FFMPEG_ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=ffmpeg.zip --dest=$FFMPEG_ZIP_DEST
-    cd $FFMPEG_ZIP_DEST
-    unzip -o ffmpeg.zip
-  displayName: 'Download and unzip ffmpeg for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export NODE_HEADERS_DEST=$PWD/src/out/Default/gen
-   mkdir -p $NODE_HEADERS_DEST
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=node_headers.tar.gz --dest=$NODE_HEADERS_DEST
-   cd $NODE_HEADERS_DEST
-   tar xzf node_headers.tar.gz
-  displayName: 'Download and untar node header files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export CROSS_ARCH_SNAPSHOTS=$PWD/src/out/Default/cross-arch-snapshots
-   mkdir -p $CROSS_ARCH_SNAPSHOTS
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/snapshot_blob.bin --dest=$CROSS_ARCH_SNAPSHOTS
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/v8_context_snapshot.arm64.bin --dest=$CROSS_ARCH_SNAPSHOTS
-  displayName: 'Download cross arch snapshot files'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    cd src
-    export ELECTRON_OUT_DIR=Default
-    export npm_config_arch=arm64
-    (cd electron && node script/yarn test --enable-logging --runners main)
-  displayName: 'Run Electron main tests'
-  timeoutInMinutes: 20
-  env:
-    ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-
-- bash: |
-    cd src
-    export ELECTRON_OUT_DIR=Default
-    export npm_config_arch=arm64
-    (cd electron && node script/yarn test --enable-logging --runners remote)
-  displayName: 'Run Electron remote tests'
-  timeoutInMinutes: 20
-  condition: succeededOrFailed()
-  env:
-    ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-
-- bash: |
-    cd src
-    python electron/script/verify-ffmpeg.py --source-root "$PWD" --build-dir out/Default --ffmpeg-path out/ffmpeg
-  displayName: Verify non proprietary ffmpeg
-  timeoutInMinutes: 5
-  condition: succeededOrFailed()
-  env:
-    TARGET_ARCH: arm64
-
-- bash: |
-    cd src
-    echo Verify cross arch snapshot
-    python electron/script/verify-mksnapshot.py --source-root "$PWD" --build-dir out/Default --snapshot-files-dir $PWD/out/Default/cross-arch-snapshots
-  displayName: Verify cross arch snapshot
-  timeoutInMinutes: 5
-  condition: succeededOrFailed()
-
-- task: PublishTestResults@2
-  displayName: 'Publish Test Results'
-  inputs:
-    testResultsFiles: '*.xml'
-
-    searchFolder: '$(System.DefaultWorkingDirectory)/src/junit/'
-
-  condition: succeededOrFailed()
-
-- bash: killall Electron || echo "No Electron processes left running"
-  displayName: 'Kill processes left running from last test run'
-  condition: always()
-
-- bash: |
-    rm -rf ~/Library/Application\ Support/Electron*
-    rm -rf ~/Library/Application\ Support/electron*
-  displayName: 'Delete user app data directories'
-  condition: always()
-
-- task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3
-  displayName: 'Clean Agent Directories'
-
-  condition: always()

azure-pipelines-woa.yml

@@ -1,130 +0,0 @@
-workspace:
-  clean: all
-
-steps:
-- checkout: self
-  path: src\electron
-
-- script: |
-    node script/yarn.js install --frozen-lockfile
-  displayName: 'Yarn install'
-
-- powershell: |
-    $localArtifactPath = "$pwd\dist.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/dist.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -o$(Pipeline.Workspace)\src\out\Default -y $localArtifactPath
-  displayName: 'Download and extract dist.zip for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\out\Default\shell_browser_ui_unittests.exe"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/shell_browser_ui_unittests.exe"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-  displayName: 'Download and extract native test executables for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$pwd\ffmpeg.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/ffmpeg.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -o$(Pipeline.Workspace)\src\out\ffmpeg $localArtifactPath
-  displayName: 'Download and extract ffmpeg.zip for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\node_headers.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/node_headers.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    cd $(Pipeline.Workspace)\src
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y node_headers.zip
-  displayName: 'Download node headers for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\out\Default\electron.lib"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/electron.lib"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-  displayName: 'Download electron.lib for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-# Uncomment the following block if pdb files are needed to debug issues
-# - powershell: |
-#     try {
-#       $localArtifactPath = "$(Pipeline.Workspace)\src\pdb.zip"
-#       $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/pdb.zip"
-#       Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-#       cd $(Pipeline.Workspace)\src
-#       & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y pdb.zip
-#     } catch {
-#       Write-Host "There was an exception encountered while downloading pdb files:" $_.Exception.Message
-#     } finally {
-#       $global:LASTEXITCODE = 0
-#     }
-#   displayName: 'Download pdb files for detailed stacktraces'
-#   env:
-#     APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    New-Item $(Pipeline.Workspace)\src\out\Default\gen\node_headers\Release -Type directory
-    Copy-Item -path $(Pipeline.Workspace)\src\out\Default\electron.lib -destination $(Pipeline.Workspace)\src\out\Default\gen\node_headers\Release\node.lib
-  displayName: 'Setup node headers'
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    set npm_config_nodedir=%cd%\out\Default\gen\node_headers
-    set npm_config_arch=arm64
-    cd electron
-    node script/yarn test --runners=main --enable-logging --disable-features=CalculateNativeWinOcclusion
-  displayName: 'Run Electron Main process tests'
-  env:
-    ELECTRON_ENABLE_STACK_DUMPING: true
-    ELECTRON_OUT_DIR: Default
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-    MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
-    MOCHA_REPORTER: mocha-multi-reporters
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    set npm_config_nodedir=%cd%\out\Default\gen\node_headers
-    set npm_config_arch=arm64
-    cd electron
-    node script/yarn test --runners=remote --enable-logging --disable-features=CalculateNativeWinOcclusion
-  displayName: 'Run Electron Remote based tests'
-  env:
-    ELECTRON_OUT_DIR: Default
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-    MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
-    MOCHA_REPORTER: mocha-multi-reporters
-  condition: succeededOrFailed()
-
-- task: PublishTestResults@2
-  displayName: 'Publish Test Results'
-  inputs:
-    testResultsFiles: '*.xml'
-    searchFolder: '$(Pipeline.Workspace)/src/junit/'
-  condition: always()
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    echo "Verifying non proprietary ffmpeg"
-    python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
-  displayName: 'Verify ffmpeg'
-
-- powershell: |
-    Get-Process | Where Name –Like "electron*" | Stop-Process
-    Get-Process | Where Name –Like "msedge*" | Stop-Process
-  displayName: 'Kill processes left running from last test run'
-  condition: always()
-
-- powershell: |
-    Remove-Item -path $env:APPDATA/Electron* -Recurse -Force -ErrorAction Ignore
-  displayName: 'Delete user app data directories'
-  condition: always()

chromium_src/BUILD.gn

@@ -55,6 +55,14 @@ static_library("chrome") {
     "//chrome/browser/process_singleton.h",
     "//chrome/browser/process_singleton_internal.cc",
     "//chrome/browser/process_singleton_internal.h",
+    "//chrome/browser/themes/browser_theme_pack.cc",
+    "//chrome/browser/themes/browser_theme_pack.h",
+    "//chrome/browser/themes/custom_theme_supplier.cc",
+    "//chrome/browser/themes/custom_theme_supplier.h",
+    "//chrome/browser/themes/theme_properties.cc",
+    "//chrome/browser/themes/theme_properties.h",
+    "//chrome/browser/ui/color/chrome_color_mixers.cc",
+    "//chrome/browser/ui/color/chrome_color_mixers.h",
     "//chrome/browser/ui/exclusive_access/exclusive_access_bubble_type.cc",
     "//chrome/browser/ui/exclusive_access/exclusive_access_bubble_type.h",
     "//chrome/browser/ui/exclusive_access/exclusive_access_controller_base.cc",
@@ -69,7 +77,11 @@ static_library("chrome") {
     "//chrome/browser/ui/exclusive_access/keyboard_lock_controller.h",
     "//chrome/browser/ui/exclusive_access/mouse_lock_controller.cc",
     "//chrome/browser/ui/exclusive_access/mouse_lock_controller.h",
+    "//chrome/browser/ui/frame/window_frame_util.cc",
+    "//chrome/browser/ui/frame/window_frame_util.h",
     "//chrome/browser/ui/native_window_tracker.h",
+    "//chrome/browser/ui/ui_features.cc",
+    "//chrome/browser/ui/ui_features.h",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper.cc",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper.h",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper_view.cc",
@@ -107,6 +119,8 @@ static_library("chrome") {
       "//chrome/browser/ui/view_ids.h",
       "//chrome/browser/win/chrome_process_finder.cc",
       "//chrome/browser/win/chrome_process_finder.h",
+      "//chrome/browser/win/titlebar_config.cc",
+      "//chrome/browser/win/titlebar_config.h",
       "//chrome/browser/win/titlebar_config.h",
       "//chrome/child/v8_crashpad_support_win.cc",
       "//chrome/child/v8_crashpad_support_win.h",
@@ -128,6 +142,7 @@ static_library("chrome") {
 
   public_deps = [
     "//chrome/browser:dev_ui_browser_resources",
+    "//chrome/browser/ui/color:mixers",
     "//chrome/common",
     "//chrome/common:version_header",
     "//components/keyed_service/content",

docs/api/browser-window.md

@@ -243,7 +243,8 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
   * `trafficLightPosition` [Point](structures/point.md) (optional) _macOS_ -
     Set a custom position for the traffic light buttons in frameless windows.
   * `roundedCorners` boolean (optional) _macOS_ - Whether frameless window
-    should have rounded corners on macOS. Default is `true`.
+    should have rounded corners on macOS. Default is `true`. Setting this property
+    to `false` will prevent the window from being fullscreenable.
   * `fullscreenWindowTitle` boolean (optional) _macOS_ _Deprecated_ - Shows
     the title in the title bar in full screen mode on macOS for `hiddenInset`
     titleBarStyle. Default is `false`.

docs/api/session.md

@@ -1025,7 +1025,7 @@ is emitted.
 
 #### `ses.getStoragePath()`
 
-A `string | null` indicating the absolute file system path where data for this
+Returns `string | null` - The absolute file system path where data for this
 session is persisted on disk.  For in memory sessions this returns `null`.
 
 ### Instance Properties

docs/api/tray.md

@@ -25,15 +25,20 @@ app.whenReady().then(() => {
 })
 ```
 
-__Platform limitations:__
+__Platform Considerations__
+
+If you want to keep exact same behaviors on all platforms, you should not
+rely on the `click` event; instead, always attach a context menu to the tray icon.
+
+__Linux__
 
-* On Linux the app indicator will be used if it is supported, otherwise
-  `GtkStatusIcon` will be used instead.
 * On Linux distributions that only have app indicator support, you have to
   install `libappindicator1` to make the tray icon work.
+* The app indicator will be used if it is supported, otherwise
+  `GtkStatusIcon` will be used instead.
 * App indicator will only be shown when it has a context menu.
-* When app indicator is used on Linux, the `click` event is ignored.
-* On Linux in order for changes made to individual `MenuItem`s to take effect,
+* The `click` event is ignored when using the app indicator.
+* In order for changes made to individual `MenuItem`s to take effect,
   you have to call `setContextMenu` again. For example:
 
 ```javascript
@@ -55,10 +60,16 @@ app.whenReady().then(() => {
 })
 ```
 
-* On Windows it is recommended to use `ICO` icons to get best visual effects.
+__MacOS__
 
-If you want to keep exact same behaviors on all platforms, you should not
-rely on the `click` event and always attach a context menu to the tray icon.
+* Icons passed to the Tray constructor should be [Template Images](native-image.md#template-image).
+* To make sure your icon isn't grainy on retina monitors, be sure your `@2x` image is 144dpi.
+* If you are bundling your application (e.g., with webpack for development), be sure that the file names are not being mangled or hashed. The filename needs to end in Template, and the `@2x` image needs to have the same filename as the standard image, or MacOS will not magically invert your image's colors or use the high density image.
+* 16x16 (72dpi) and 32x32@2x (144dpi) work well for most icons.
+
+__Windows__
+
+* It is recommended to use `ICO` icons to get best visual effects.
 
 ### `new Tray(image, [guid])`
 

docs/api/web-contents.md

@@ -1635,6 +1635,8 @@ Opens the devtools.
 When `contents` is a `<webview>` tag, the `mode` would be `detach` by default,
 explicitly passing an empty `mode` can force using last used dock state.
 
+On Windows, if Windows Control Overlay is enabled, Devtools will be opened with `mode: 'detach'`.
+
 #### `contents.closeDevTools()`
 
 Closes the devtools.

docs/faq.md

@@ -135,7 +135,7 @@ is only available in renderer processes.
 
 If [sub-pixel anti-aliasing](https://alienryderflex.com/sub_pixel/) is deactivated, then fonts on LCD screens can look blurry. Example:
 
-![subpixel rendering example]
+![Subpixel rendering example](images/subpixel-rendering-screenshot.gif)
 
 Sub-pixel anti-aliasing needs a non-transparent background of the layer containing the font glyphs. (See [this issue](https://github.com/electron/electron/issues/6344#issuecomment-420371918) for more info).
 
@@ -161,4 +161,3 @@ Notice that just setting the background in the CSS does not have the desired eff
 [indexed-db]: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API
 [message-port]: https://developer.mozilla.org/en-US/docs/Web/API/MessagePort
 [browser-window]: api/browser-window.md
-[subpixel rendering example]: images/subpixel-rendering-screenshot.gif

docs/fiddles/features/web-serial/main.js

@@ -28,12 +28,16 @@ function createWindow () {
     if (permission === 'serial' && details.securityOrigin === 'file:///') {
       return true
     }
+    
+    return false
   })
 
   mainWindow.webContents.session.setDevicePermissionHandler((details) => {
     if (details.deviceType === 'serial' && details.origin === 'file://') {
       return true
     }
+    
+    return false
   })
   
   mainWindow.loadFile('index.html')

docs/tutorial/introduction.md

@@ -44,14 +44,14 @@ are the different categories and what you can expect on each one:
   application.
 - **Processes in Electron**: In-depth reference on Electron processes and how to work with them.
 - **Best Practices**: Important checklists to keep in mind when developing an Electron app.
-- **How-To Examples**: Quick references to add features to your Electron app.
+- **Examples**: Quick references to add features to your Electron app.
 - **Development**: Miscellaneous development guides.
 - **Distribution**: Learn how to distribute your app to end users.
 - **Testing and debugging**: How to debug JavaScript, write tests, and other tools used
   to create quality Electron applications.
-- **Resources**: Useful links to better understand how the Electron project works
+- **References**: Useful links to better understand how the Electron project works
   and is organized.
-- **Contributing to Electron**: Compiling Electron and making contributions can be daunting.
+- **Contributing**: Compiling Electron and making contributions can be daunting.
   We try to make it easier in this section.
 
 ## Getting help

docs/tutorial/message-ports.md

@@ -8,8 +8,7 @@ your app.
 
 Here is a very brief example of what a MessagePort is and how it works:
 
-```js
-// renderer.js ///////////////////////////////////////////////////////////////
+```js title='renderer.js (Renderer Process)'
 // MessagePorts are created in pairs. A connected pair of message ports is
 // called a channel.
 const channel = new MessageChannel()
@@ -28,8 +27,7 @@ port2.postMessage({ answer: 42 })
 ipcRenderer.postMessage('port', null, [port1])
 ```
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 // In the main process, we receive the port.
 ipcMain.on('port', (event) => {
   // When we receive a MessagePort in the main process, it becomes a
@@ -84,14 +82,84 @@ process, you can listen for the `close` event by calling `port.on('close',
 
 ## Example use cases
 
+### Setting up a MessageChannel between two renderers
+
+In this example, the main process sets up a MessageChannel, then sends each port
+to a different renderer. This allows renderers to send messages to each other
+without needing to use the main process as an in-between.
+
+```js title='main.js (Main Process)'
+const { BrowserWindow, app, MessageChannelMain } = require('electron')
+
+app.whenReady().then(async () => {
+  // create the windows.
+  const mainWindow = new BrowserWindow({
+    show: false,
+    webPreferences: {
+      contextIsolation: false,
+      preload: 'preloadMain.js'
+    }
+  })
+
+  const secondaryWindow = BrowserWindow({
+    show: false,
+    webPreferences: {
+      contextIsolation: false,
+      preload: 'preloadSecondary.js'
+    }
+  })
+
+  // set up the channel.
+  const { port1, port2 } = new MessageChannelMain()
+
+  // once the webContents are ready, send a port to each webContents with postMessage.
+  mainWindow.once('ready-to-show', () => {
+    mainWindow.webContents.postMessage('port', null, [port1])
+  })
+
+  secondaryWindow.once('ready-to-show', () => {
+    secondaryWindow.webContents.postMessage('port', null, [port2])
+  })
+})
+```
+
+Then, in your preload scripts you receive the port through IPC and set up the
+listeners.
+
+```js title='preloadMain.js and preloadSecondary.js (Preload scripts)'
+const { ipcRenderer } = require('electron')
+
+ipcRenderer.on('port', e => {
+  // port received, make it globally available.
+  window.electronMessagePort = e.ports[0]
+
+  window.electronMessagePort.onmessage = messageEvent => {
+    // handle message
+  }
+})
+```
+
+In this example messagePort is bound to the `window` object directly. It is better
+to use `contextIsolation` and set up specific contextBridge calls for each of your
+expected messages, but for the simplicity of this example we don't. You can find an
+example of context isolation further down this page at [Communicating directly between the main process and the main world of a context-isolated page](#communicating-directly-between-the-main-process-and-the-main-world-of-a-context-isolated-page)
+
+That means window.messagePort is globally available and you can call
+`postMessage` on it from anywhere in your app to send a message to the other
+renderer.
+
+```js title='renderer.js (Renderer Process)'
+// elsewhere in your code to send a message to the other renderers message handler
+window.electronMessagePort.postmessage('ping')
+```
+
 ### Worker process
 
 In this example, your app has a worker process implemented as a hidden window.
 You want the app page to be able to communicate directly with the worker
 process, without the performance overhead of relaying via the main process.
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 const { BrowserWindow, app, ipcMain, MessageChannelMain } = require('electron')
 
 app.whenReady().then(async () => {
@@ -129,8 +197,7 @@ app.whenReady().then(async () => {
 })
 ```
 
-```html
-<!-- worker.html ------------------------------------------------------------>
+```html  title='worker.html'
 <script>
 const { ipcRenderer } = require('electron')
 
@@ -153,8 +220,7 @@ ipcRenderer.on('new-client', (event) => {
 </script>
 ```
 
-```html
-<!-- app.html --------------------------------------------------------------->
+```html  title='app.html'
 <script>
 const { ipcRenderer } = require('electron')
 
@@ -182,9 +248,7 @@ Electron's built-in IPC methods only support two modes: fire-and-forget
 can implement a "response stream", where a single request responds with a
 stream of data.
 
-```js
-// renderer.js ///////////////////////////////////////////////////////////////
-
+```js title='renderer.js (Renderer Process)'
 const makeStreamingRequest = (element, callback) => {
   // MessageChannels are lightweight--it's cheap to create a new one for each
   // request.
@@ -213,9 +277,7 @@ makeStreamingRequest(42, (data) => {
 // We will see "got response data: 42" 10 times.
 ```
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
-
+```js  title='main.js (Main Process)'
 ipcMain.on('give-me-a-stream', (event, msg) => {
   // The renderer has sent us a MessagePort that it wants us to send our
   // response over.
@@ -242,8 +304,7 @@ the renderer are delivered to the isolated world, rather than to the main
 world. Sometimes you want to deliver messages to the main world directly,
 without having to step through the isolated world.
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 const { BrowserWindow, app, MessageChannelMain } = require('electron')
 const path = require('path')
 
@@ -278,8 +339,7 @@ app.whenReady().then(async () => {
 })
 ```
 
-```js
-// preload.js ////////////////////////////////////////////////////////////////
+```js title='preload.js (Preload Script)'
 const { ipcRenderer } = require('electron')
 
 // We need to wait until the main world is ready to receive the message before
@@ -297,8 +357,7 @@ ipcRenderer.on('main-world-port', async (event) => {
 })
 ```
 
-```html
-<!-- index.html ------------------------------------------------------------->
+```html title='index.html'
 <script>
 window.onmessage = (event) => {
   // event.source === window means the message is coming from the preload

docs/tutorial/tutorial-2-first-app.md

@@ -350,7 +350,7 @@ app.whenReady().then(() => {
 
 ## Optional: Debugging from VS Code
 
-If you want to debug your application using VS Code, you have need attach VS Code to
+If you want to debug your application using VS Code, you need to attach VS Code to
 both the main and renderer processes. Here is a sample configuration for you to
 run. Create a launch.json configuration in a new `.vscode` folder in your project:
 

filenames.gni

@@ -86,6 +86,8 @@ filenames = {
     "shell/browser/ui/message_box_win.cc",
     "shell/browser/ui/tray_icon_win.cc",
     "shell/browser/ui/views/electron_views_delegate_win.cc",
+    "shell/browser/ui/views/win_icon_painter.cc",
+    "shell/browser/ui/views/win_icon_painter.h",
     "shell/browser/ui/views/win_frame_view.cc",
     "shell/browser/ui/views/win_frame_view.h",
     "shell/browser/ui/views/win_caption_button.cc",

lib/browser/api/browser-window.ts

@@ -72,9 +72,8 @@ BrowserWindow.getAllWindows = () => {
 
 BrowserWindow.getFocusedWindow = () => {
   for (const window of BrowserWindow.getAllWindows()) {
-    const hasWC = window.webContents && !window.webContents.isDestroyed();
-    if (!window.isDestroyed() && hasWC) {
-      if (window.isFocused() || window.isDevToolsFocused()) return window;
+    if (!window.isDestroyed() && window.webContents && !window.webContents.isDestroyed()) {
+      if (window.isFocused() || window.webContents.isDevToolsFocused()) return window;
     }
   }
   return null;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "19.0.10",
+  "version": "19.0.17",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {

patches/angle/.patches

@@ -0,0 +1,2 @@
+m104_vulkan_fix_garbage_collection_vs_outside-rp-only_flush.patch
+m104_vulkan_fix_xfb_buffer_redefine_to_smaller_size.patch

patches/angle/m104_vulkan_fix_garbage_collection_vs_outside-rp-only_flush.patch

@@ -0,0 +1,287 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shahbaz Youssefi <syoussefi@chromium.org>
+Date: Thu, 4 Aug 2022 12:28:12 -0400
+Subject: M104: Vulkan: Fix garbage collection vs outside-RP-only flush
+
+In https://chromium-review.googlesource.com/c/angle/angle/+/3379231, an
+optimization was implemented such that the excessive recorded texture
+uploads would get flushed early and submitted.  This caused a
+use-after-free bug in the following situation:
+
+* Draw with pipeline A
+* Delete A <--- this puts A in the Context garbage list
+* Upload a lot of data
+
+At this point, the flush threshold could pass and the commands recorded
+outside of the render pass up to this point would be submitted.
+Associated with this submission was the current garbage, including
+pipeline A.  However, the render pass that uses pipeline A is still not
+submitted.
+
+Now if after some time the render pass is still open, but the "completed
+commands" are checked (another set of uploads causing another
+submission, a query status check, etc), the garbage can be cleaned up.
+
+When the render pass closes next and is submitted, the implementation
+attempts to use the pipeline, which is already deleted.
+
+In this change, outside-render-pass-only submissions no longer reference
+the current garbage.  This has the side effect that the temporary
+buffers used for uploading texture data won't be released early.  A
+future optimization may want to separate the garbage list in ContextVk
+to render pass and outside render pass garbage.
+
+Bug: chromium:1337538
+Change-Id: Ibfc11f2b0d166b0c325fced725f23d6b9328ff98
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3821371
+Reviewed-by: Amirali Abdolrashidi <abdolrashidi@google.com>
+
+diff --git a/src/libANGLE/renderer/vulkan/ContextVk.cpp b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+index 90ecf42b2cc22cee5b74296d7a2f73b77f9a0f2c..41c06dc42810d6c55565686c87adf20367024f05 100644
+--- a/src/libANGLE/renderer/vulkan/ContextVk.cpp
++++ b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+@@ -2614,14 +2614,16 @@ void ContextVk::addOverlayUsedBuffersCount(vk::CommandBufferHelperCommon *comman
+     }
+ }
+ 
+-angle::Result ContextVk::submitFrame(const vk::Semaphore *signalSemaphore, Serial *submitSerialOut)
++angle::Result ContextVk::submitFrame(const vk::Semaphore *signalSemaphore,
++                                     Submit submission,
++                                     Serial *submitSerialOut)
+ {
+     getShareGroupVk()->acquireResourceUseList(
+         std::move(mOutsideRenderPassCommands->getResourceUseList()));
+     getShareGroupVk()->acquireResourceUseList(std::move(mResourceUseList));
+     getShareGroupVk()->acquireResourceUseList(std::move(mRenderPassCommands->getResourceUseList()));
+ 
+-    ANGLE_TRY(submitCommands(signalSemaphore, submitSerialOut));
++    ANGLE_TRY(submitCommands(signalSemaphore, submission, submitSerialOut));
+ 
+     onRenderPassFinished(RenderPassClosureReason::AlreadySpecifiedElsewhere);
+     return angle::Result::Continue;
+@@ -2633,10 +2635,11 @@ angle::Result ContextVk::submitFrameOutsideCommandBufferOnly(Serial *submitSeria
+     getShareGroupVk()->acquireResourceUseList(
+         std::move(mOutsideRenderPassCommands->getResourceUseList()));
+ 
+-    return submitCommands(nullptr, submitSerialOut);
++    return submitCommands(nullptr, Submit::OutsideRenderPassCommandsOnly, submitSerialOut);
+ }
+ 
+ angle::Result ContextVk::submitCommands(const vk::Semaphore *signalSemaphore,
++                                        Submit submission,
+                                         Serial *submitSerialOut)
+ {
+     if (mCurrentWindowSurface)
+@@ -2655,10 +2658,18 @@ angle::Result ContextVk::submitCommands(const vk::Semaphore *signalSemaphore,
+         dumpCommandStreamDiagnostics();
+     }
+ 
++    // Clean up garbage only when submitting all commands.  Otherwise there may be garbage
++    // associated with commands that are not yet flushed.
++    vk::GarbageList garbage;
++    if (submission == Submit::AllCommands)
++    {
++        garbage = std::move(mCurrentGarbage);
++    }
++
+     ANGLE_TRY(mRenderer->submitFrame(this, hasProtectedContent(), mContextPriority,
+                                      std::move(mWaitSemaphores),
+                                      std::move(mWaitSemaphoreStageMasks), signalSemaphore,
+-                                     std::move(mCurrentGarbage), &mCommandPools, submitSerialOut));
++                                     std::move(garbage), &mCommandPools, submitSerialOut));
+ 
+     getShareGroupVk()->releaseResourceUseLists(*submitSerialOut);
+     // Now that we have processed resourceUseList, some of pending garbage may no longer pending
+@@ -6128,7 +6139,7 @@ angle::Result ContextVk::flushAndGetSerial(const vk::Semaphore *signalSemaphore,
+         mHasInFlightStreamedVertexBuffers.reset();
+     }
+ 
+-    ANGLE_TRY(submitFrame(signalSemaphore, submitSerialOut));
++    ANGLE_TRY(submitFrame(signalSemaphore, Submit::AllCommands, submitSerialOut));
+ 
+     resetPerFramePerfCounters();
+ 
+diff --git a/src/libANGLE/renderer/vulkan/ContextVk.h b/src/libANGLE/renderer/vulkan/ContextVk.h
+index 6c6a3797c6e9a387abf13442613088bd5f4341ec..8ed00be4eb19fea01bb2ada65d2c05ad1d3284f4 100644
+--- a/src/libANGLE/renderer/vulkan/ContextVk.h
++++ b/src/libANGLE/renderer/vulkan/ContextVk.h
+@@ -1078,9 +1078,19 @@ class ContextVk : public ContextImpl, public vk::Context, public MultisampleText
+ 
+     void writeAtomicCounterBufferDriverUniformOffsets(uint32_t *offsetsOut, size_t offsetsSize);
+ 
+-    angle::Result submitFrame(const vk::Semaphore *signalSemaphore, Serial *submitSerialOut);
++    enum class Submit
++    {
++        OutsideRenderPassCommandsOnly,
++        AllCommands,
++    };
++
++    angle::Result submitFrame(const vk::Semaphore *signalSemaphore,
++                              Submit submission,
++                              Serial *submitSerialOut);
+     angle::Result submitFrameOutsideCommandBufferOnly(Serial *submitSerialOut);
+-    angle::Result submitCommands(const vk::Semaphore *signalSemaphore, Serial *submitSerialOut);
++    angle::Result submitCommands(const vk::Semaphore *signalSemaphore,
++                                 Submit submission,
++                                 Serial *submitSerialOut);
+ 
+     angle::Result synchronizeCpuGpuTime();
+     angle::Result traceGpuEventImpl(vk::OutsideRenderPassCommandBuffer *commandBuffer,
+diff --git a/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp b/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp
+index a5021e3248933815e3ac43cc0477671109befb1e..1a4e35592d0573991cc54136c80a9299714162a4 100644
+--- a/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp
++++ b/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp
+@@ -18,6 +18,7 @@
+ #include "test_utils/gl_raii.h"
+ #include "util/random_utils.h"
+ #include "util/shader_utils.h"
++#include "util/test_utils.h"
+ 
+ using namespace angle;
+ 
+@@ -561,22 +562,21 @@ TEST_P(VulkanPerformanceCounterTest, NewTextureDoesNotBreakRenderPass)
+ TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotBreakRenderPass)
+ {
+     initANGLEFeatures();
+-    // http://anglebug.com/6354
+ 
+-    size_t kMaxBufferToImageCopySize     = 1 << 28;
+-    uint32_t kNumSubmits                 = 2;
+-    uint32_t expectedRenderPassCount     = getPerfCounters().renderPasses + 1;
+-    uint32_t expectedSubmitCommandsCount = getPerfCounters().submittedCommands + kNumSubmits;
++    constexpr size_t kMaxBufferToImageCopySize     = 1 << 28;
++    constexpr uint32_t kNumSubmits                 = 2;
++    uint32_t expectedRenderPassCount               = getPerfCounters().renderPasses + 1;
++    uint32_t expectedSubmitCommandsCount           = getPerfCounters().submittedCommands + kNumSubmits;
+ 
+     // Step 1: Set up a simple 2D texture.
+     GLTexture texture;
+-    GLsizei texDim         = 256;
+-    uint32_t pixelSizeRGBA = 4;
+-    uint32_t textureSize   = texDim * texDim * pixelSizeRGBA;
+-    std::vector<GLColor> kInitialData(texDim * texDim, GLColor::green);
++    constexpr GLsizei kTexDim         = 256;
++    constexpr uint32_t kPixelSizeRGBA = 4;
++    constexpr uint32_t kTextureSize   = kTexDim * kTexDim * kPixelSizeRGBA;
++    std::vector<GLColor> kInitialData(kTexDim * kTexDim, GLColor::green);
+ 
+     glBindTexture(GL_TEXTURE_2D, texture);
+-    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, texDim, texDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                  kInitialData.data());
+     glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+     glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+@@ -603,13 +603,12 @@ TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotBreakR
+ 
+     // Step 2: Load a new 2D Texture multiple times with the same Program and Framebuffer. The total
+     // size of the loaded textures must exceed the threshold to submit the outside command buffer.
+-    auto maxLoadCount =
+-        static_cast<size_t>((kMaxBufferToImageCopySize / textureSize) * kNumSubmits + 1);
+-    for (size_t loadCount = 0; loadCount < maxLoadCount; loadCount++)
++    constexpr size_t kMaxLoadCount = kMaxBufferToImageCopySize / kTextureSize * kNumSubmits + 1;
++    for (size_t loadCount = 0; loadCount < kMaxLoadCount; loadCount++)
+     {
+         GLTexture newTexture;
+         glBindTexture(GL_TEXTURE_2D, newTexture);
+-        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, texDim, texDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                      kInitialData.data());
+         glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+         glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+@@ -623,6 +622,96 @@ TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotBreakR
+     EXPECT_EQ(getPerfCounters().submittedCommands, expectedSubmitCommandsCount);
+ }
+ 
++// Tests that submitting the outside command buffer due to texture upload size does not result in
++// garbage collection of render pass resources..
++TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotCollectRenderPassGarbage)
++{
++    ANGLE_SKIP_TEST_IF(!IsGLExtensionEnabled("GL_EXT_disjoint_timer_query"));
++
++    initANGLEFeatures();
++
++    uint64_t expectedRenderPassCount = getPerfCounters().renderPasses + 1;
++    uint64_t submitCommandsCount     = getPerfCounters().vkQueueSubmitCallsTotal;
++
++    // Set up a simple 2D texture.
++    GLTexture texture;
++    constexpr GLsizei kTexDim = 256;
++    std::vector<GLColor> kInitialData(kTexDim * kTexDim, GLColor::green);
++
++    glBindTexture(GL_TEXTURE_2D, texture);
++    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++                 kInitialData.data());
++    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
++    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
++
++    auto quadVerts = GetQuadVertices();
++
++    GLBuffer vertexBuffer;
++    glBindBuffer(GL_ARRAY_BUFFER, vertexBuffer);
++    glBufferData(GL_ARRAY_BUFFER, quadVerts.size() * sizeof(quadVerts[0]), quadVerts.data(),
++                 GL_STATIC_DRAW);
++
++    ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Texture2D(), essl1_shaders::fs::Texture2D());
++    glUseProgram(program);
++
++    GLint posLoc = glGetAttribLocation(program, essl1_shaders::PositionAttrib());
++    ASSERT_NE(-1, posLoc);
++
++    glVertexAttribPointer(posLoc, 3, GL_FLOAT, GL_FALSE, 0, nullptr);
++    glEnableVertexAttribArray(posLoc);
++    ASSERT_GL_NO_ERROR();
++
++    // Issue a timestamp query, just for the sake of using it as a means of knowing when a
++    // submission is finished.  In the Vulkan backend, querying the status of the query results in a
++    // check of completed submissions, at which point associated garbage is also destroyed.
++    GLQuery query;
++    glQueryCounterEXT(query, GL_TIMESTAMP_EXT);
++
++    // Issue a draw call, and delete the program
++    glDrawArrays(GL_TRIANGLES, 0, 6);
++    ASSERT_GL_NO_ERROR();
++    program.reset();
++
++    ANGLE_GL_PROGRAM(program2, essl1_shaders::vs::Texture2D(), essl1_shaders::fs::Texture2D());
++    glUseProgram(program2);
++    ASSERT_EQ(posLoc, glGetAttribLocation(program2, essl1_shaders::PositionAttrib()));
++
++    // Issue uploads until there's an implicit submission
++    while (getPerfCounters().vkQueueSubmitCallsTotal == submitCommandsCount)
++    {
++        GLTexture newTexture;
++        glBindTexture(GL_TEXTURE_2D, newTexture);
++        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++                     kInitialData.data());
++        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
++        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
++
++        glDrawArrays(GL_TRIANGLES, 0, 6);
++        ASSERT_GL_NO_ERROR();
++    }
++
++    ++submitCommandsCount;
++    EXPECT_EQ(getPerfCounters().vkQueueSubmitCallsTotal, submitCommandsCount);
++
++    // Busy wait until the query results are available.
++    GLuint ready = GL_FALSE;
++    while (ready == GL_FALSE)
++    {
++        angle::Sleep(0);
++        glGetQueryObjectuivEXT(query, GL_QUERY_RESULT_AVAILABLE_EXT, &ready);
++    }
++
++    // At this point, the render pass should still not be submitted, and the pipeline that is
++    // deleted should still not be garbage collected.  Submit the commands and ensure there is no
++    // crash.
++    EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
++    ++submitCommandsCount;
++
++    // Verify counters.
++    EXPECT_EQ(getPerfCounters().renderPasses, expectedRenderPassCount);
++    EXPECT_EQ(getPerfCounters().vkQueueSubmitCallsTotal, submitCommandsCount);
++}
++
+ // Tests that RGB texture should not break renderpass.
+ TEST_P(VulkanPerformanceCounterTest, SampleFromRGBTextureDoesNotBreakRenderPass)
+ {

patches/angle/m104_vulkan_fix_xfb_buffer_redefine_to_smaller_size.patch

@@ -0,0 +1,122 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shahbaz Youssefi <syoussefi@chromium.org>
+Date: Tue, 26 Jul 2022 21:07:04 -0400
+Subject: M104: Vulkan: Fix xfb buffer redefine to smaller size
+
+In 89e11878b275b15735eaf273ababfa6fd43a2e3d, a use-after-free bug was
+fixed where glBufferData redefined a buffer, leading to a change in
+storage.  This was only tested for the case where the new buffer was
+larger than the old buffer.
+
+When the new buffer is smaller however, another issue remains where the
+buffer size as cached by the transform feedback object used the old
+object's size.  This is worked around in this change, with a fix for the
+real issue (that the buffer state is updated after calling into the
+backend instead of before) coming up.
+
+Bug: chromium:1345042
+Change-Id: I7bafd51b6203a419e5ef123da26b9e1eaf079bf1
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3812556
+Reviewed-by: Ian Elliott <ianelliott@google.com>
+
+diff --git a/src/libANGLE/renderer/vulkan/BufferVk.cpp b/src/libANGLE/renderer/vulkan/BufferVk.cpp
+index 9c9cee78d890f5cc13d8762aa03de9dcf9c00abf..ceb065822984cf44bd4319fb97cb7e4dd49517b2 100644
+--- a/src/libANGLE/renderer/vulkan/BufferVk.cpp
++++ b/src/libANGLE/renderer/vulkan/BufferVk.cpp
+@@ -798,6 +798,7 @@ angle::Result BufferVk::updateBuffer(ContextVk *contextVk,
+     }
+     return angle::Result::Continue;
+ }
++
+ angle::Result BufferVk::directUpdate(ContextVk *contextVk,
+                                      const uint8_t *data,
+                                      size_t size,
+diff --git a/src/libANGLE/renderer/vulkan/ContextVk.cpp b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+index 41c06dc42810d6c55565686c87adf20367024f05..1319bf771339210dcb9a3e0ccd0936112c746582 100644
+--- a/src/libANGLE/renderer/vulkan/ContextVk.cpp
++++ b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+@@ -799,7 +799,8 @@ ContextVk::ContextVk(const gl::State &state, gl::ErrorSet *errorSet, RendererVk
+                                                    DIRTY_BIT_DRIVER_UNIFORMS_BINDING,
+                                                    DIRTY_BIT_VIEWPORT,
+                                                    DIRTY_BIT_SCISSOR};
+-    if (getFeatures().supportsTransformFeedbackExtension.enabled)
++    if (getFeatures().supportsTransformFeedbackExtension.enabled ||
++        getFeatures().emulateTransformFeedback.enabled)
+     {
+         mNewGraphicsCommandBufferDirtyBits.set(DIRTY_BIT_TRANSFORM_FEEDBACK_BUFFERS);
+     }
+diff --git a/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp b/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp
+index dbaa4eeedbf36c4a3f6cb818b50bdcac856766c2..f785fe5f7c36033163a77a7e29957ebca6edaf79 100644
+--- a/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp
++++ b/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp
+@@ -362,7 +362,8 @@ void TransformFeedbackVk::onSubjectStateChange(angle::SubjectIndex index,
+         ASSERT(bufferVk->isBufferValid());
+         mBufferHelpers[index] = &bufferVk->getBuffer();
+         mBufferOffsets[index] = binding.getOffset() + mBufferHelpers[index]->getOffset();
+-        mBufferSizes[index]   = gl::GetBoundBufferAvailableSize(binding);
++        mBufferSizes[index]   = std::min<VkDeviceSize>(gl::GetBoundBufferAvailableSize(binding),
++                                                     mBufferHelpers[index]->getSize());
+         mBufferObserverBindings[index].bind(bufferVk);
+ 
+         mXFBBuffersDesc.updateTransformFeedbackBuffer(
+diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
+index af74f258fb3d901dac8a738ca9be53511963137b..22230db0ecb77f16cb2cc494a74225731401a47d 100644
+--- a/src/tests/angle_end2end_tests_expectations.txt
++++ b/src/tests/angle_end2end_tests_expectations.txt
+@@ -161,6 +161,7 @@
+ 6738 MAC AMD OPENGL : Texture3DTestES3.PixelUnpackStateTex* = SKIP
+ 1296467 MAC OPENGL : VertexAttributeTestES3.emptyBuffer/* = SKIP
+ 7203 MAC INTEL OPENGL : CopyTextureTest.CopyToMipmap/* = SKIP
++7530 MAC NVIDIA OPENGL : TransformFeedbackTest.RenderOnceChangeXfbBufferRenderAgain/* = SKIP
+ 
+ // BlitFramebufferTest.ScissoredMultisampleStencil failures
+ 3496 MAC INTEL OPENGL : BlitFramebufferTest.ScissoredMultisampleStencil/* = SKIP
+diff --git a/src/tests/gl_tests/TransformFeedbackTest.cpp b/src/tests/gl_tests/TransformFeedbackTest.cpp
+index a4e4f86157232de46c6e06ee7b5a6dfa2b8a2261..dc944d4249e0a26708d01bd0bde7efc4d68db3e3 100644
+--- a/src/tests/gl_tests/TransformFeedbackTest.cpp
++++ b/src/tests/gl_tests/TransformFeedbackTest.cpp
+@@ -403,7 +403,6 @@ TEST_P(TransformFeedbackTest, RecordAndDraw)
+ // Test that transform feedback can cover multiple render passes.
+ TEST_P(TransformFeedbackTest, SpanMultipleRenderPasses)
+ {
+-
+     // TODO(anglebug.com/4533) This fails after the upgrade to the 26.20.100.7870 driver.
+     ANGLE_SKIP_TEST_IF(IsWindows() && IsIntel() && IsVulkan());
+ 
+@@ -4105,6 +4104,36 @@ TEST_P(TransformFeedbackTest, ResumingTransformFeedbackAfterDeletebuffer)
+     ASSERT_GL_ERROR(GL_INVALID_OPERATION);
+ }
+ 
++// Test that redefining the transform feedback buffer and starting a new render pass works.
++TEST_P(TransformFeedbackTest, RenderOnceChangeXfbBufferRenderAgain)
++{
++    std::vector<std::string> tfVaryings;
++    tfVaryings.push_back("gl_Position");
++    ANGLE_GL_PROGRAM_TRANSFORM_FEEDBACK(drawColor, essl3_shaders::vs::Simple(),
++                                        essl3_shaders::fs::Red(), tfVaryings,
++                                        GL_INTERLEAVED_ATTRIBS);
++
++    GLBuffer buffer;
++    glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, buffer);
++    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 10'000'000, nullptr, GL_DYNAMIC_READ);
++
++    glUseProgram(drawColor);
++    glBeginTransformFeedback(GL_TRIANGLES);
++
++    drawQuad(drawColor, essl3_shaders::PositionAttrib(), 0.5f);
++
++    // Break the render pass
++    EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
++
++    // Redefine the transform feedback buffer
++    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 40, nullptr, GL_DYNAMIC_READ);
++
++    // Start a new render pass
++    drawQuad(drawColor, essl3_shaders::PositionAttrib(), 0.5f);
++
++    glEndTransformFeedback();
++}
++
+ GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TransformFeedbackTest);
+ ANGLE_INSTANTIATE_TEST_ES3(TransformFeedbackTest);
+ 

patches/chromium/.patches

@@ -122,3 +122,19 @@ posix_replace_doubleforkandexec_with_forkandspawn.patch
 cherry-pick-22c61cfae5d1.patch
 remove_default_window_title.patch
 keep_handling_scroll_update_if_you_can.patch
+chore_add_electron_deps_to_gitignores.patch
+chore_allow_chromium_to_handle_synthetic_mouse_events_for_touch.patch
+disable_gpu_acceleration_on_vmware_on_linux.patch
+add_maximized_parameter_to_linuxui_getwindowframeprovider.patch
+cherry-pick-94a8bdafc8c6.patch
+fix_mac_build_with_enable_plugins_false.patch
+fix_windows_build_with_enable_plugins_false.patch
+cherry-pick-54e32332750c.patch
+cherry-pick-60d8559e150a.patch
+cherry-pick-54a7927b19f9.patch
+cherry-pick-bd9724c9fe63.patch
+cherry-pick-c643d18a078d.patch
+feat_add_set_can_resize_mutator.patch
+cherry-pick-2083e894852c.patch
+cherry-pick-079105b7ebba.patch
+cherry-pick-9b5207569882.patch

patches/chromium/add_maximized_parameter_to_linuxui_getwindowframeprovider.patch

@@ -0,0 +1,176 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: msizanoen1 <msizanoen@qtmlabs.xyz>
+Date: Tue, 19 Jul 2022 05:11:06 +0200
+Subject: Add maximized parameter to LinuxUI::GetWindowFrameProvider
+
+This allows ClientFrameViewLinux to instruct the toolkit to draw the window
+decorations in maximized mode where needed, preventing empty space caused
+by decoration shadows and rounded titlebars around the window while maximized.
+
+diff --git a/ui/gtk/gtk_ui.cc b/ui/gtk/gtk_ui.cc
+index c037fa8db6d4a5ebeb7257627db206e9bab57ecc..14eddfd043e748400a9ee81ce5346a53f10ea03c 100644
+--- a/ui/gtk/gtk_ui.cc
++++ b/ui/gtk/gtk_ui.cc
+@@ -757,13 +757,15 @@ std::unique_ptr<views::NavButtonProvider> GtkUi::CreateNavButtonProvider() {
+   return nullptr;
+ }
+ 
+-views::WindowFrameProvider* GtkUi::GetWindowFrameProvider(bool solid_frame) {
++views::WindowFrameProvider* GtkUi::GetWindowFrameProvider(bool solid_frame, bool maximized) {
+   if (!GtkCheckVersion(3, 14))
+     return nullptr;
+   auto& provider =
+-      solid_frame ? solid_frame_provider_ : transparent_frame_provider_;
++      maximized
++        ? (solid_frame ? solid_maximized_frame_provider_ : transparent_maximized_frame_provider_)
++        : (solid_frame ? solid_frame_provider_ : transparent_frame_provider_);
+   if (!provider)
+-    provider = std::make_unique<gtk::WindowFrameProviderGtk>(solid_frame);
++    provider = std::make_unique<gtk::WindowFrameProviderGtk>(solid_frame, maximized);
+   return provider.get();
+ }
+ 
+diff --git a/ui/gtk/gtk_ui.h b/ui/gtk/gtk_ui.h
+index 8e609b8311c6b69ef7b6753117542d9e60b2c8ab..a329822c3285599954d77dd5a8e33ccc10e5f626 100644
+--- a/ui/gtk/gtk_ui.h
++++ b/ui/gtk/gtk_ui.h
+@@ -107,7 +107,7 @@ class GtkUi : public views::LinuxUI {
+   bool PreferDarkTheme() const override;
+   bool AnimationsEnabled() const override;
+   std::unique_ptr<views::NavButtonProvider> CreateNavButtonProvider() override;
+-  views::WindowFrameProvider* GetWindowFrameProvider(bool solid_frame) override;
++  views::WindowFrameProvider* GetWindowFrameProvider(bool solid_frame, bool maximized) override;
+   base::flat_map<std::string, std::string> GetKeyboardLayoutMap() override;
+   std::string GetCursorThemeName() override;
+   int GetCursorThemeSize() override;
+@@ -218,6 +218,8 @@ class GtkUi : public views::LinuxUI {
+   // while Chrome is running.
+   std::unique_ptr<views::WindowFrameProvider> solid_frame_provider_;
+   std::unique_ptr<views::WindowFrameProvider> transparent_frame_provider_;
++  std::unique_ptr<views::WindowFrameProvider> solid_maximized_frame_provider_;
++  std::unique_ptr<views::WindowFrameProvider> transparent_maximized_frame_provider_;
+ };
+ 
+ }  // namespace gtk
+diff --git a/ui/gtk/window_frame_provider_gtk.cc b/ui/gtk/window_frame_provider_gtk.cc
+index e4dbdad327eb77994ffd7f068c67336a19897915..d3ae0636455489a7c7443df85cb769952c98aca2 100644
+--- a/ui/gtk/window_frame_provider_gtk.cc
++++ b/ui/gtk/window_frame_provider_gtk.cc
+@@ -38,16 +38,18 @@ std::string GetThemeName() {
+   return theme_string;
+ }
+ 
+-GtkCssContext WindowContext(bool solid_frame, bool focused) {
++GtkCssContext WindowContext(bool solid_frame, bool maximized, bool focused) {
+   std::string selector = "#window.background.";
+   selector += solid_frame ? "solid-csd" : "csd";
++  if (maximized)
++    selector += ".maximized";
+   if (!focused)
+     selector += ":inactive";
+   return AppendCssNodeToStyleContext({}, selector);
+ }
+ 
+-GtkCssContext DecorationContext(bool solid_frame, bool focused) {
+-  auto context = WindowContext(solid_frame, focused);
++GtkCssContext DecorationContext(bool solid_frame, bool maximized, bool focused) {
++  auto context = WindowContext(solid_frame, maximized, focused);
+   // GTK4 renders the decoration directly on the window.
+   if (!GtkCheckVersion(4))
+     context = AppendCssNodeToStyleContext(context, "#decoration");
+@@ -64,8 +66,8 @@ GtkCssContext DecorationContext(bool solid_frame, bool focused) {
+   return context;
+ }
+ 
+-GtkCssContext HeaderContext(bool solid_frame, bool focused) {
+-  auto context = WindowContext(solid_frame, focused);
++GtkCssContext HeaderContext(bool solid_frame, bool maximized, bool focused) {
++  auto context = WindowContext(solid_frame, maximized, focused);
+   context =
+       AppendCssNodeToStyleContext(context, "#headerbar.header-bar.titlebar");
+   if (!focused)
+@@ -110,8 +112,8 @@ int ComputeTopCornerRadius() {
+   // need to experimentally determine the corner radius by rendering a sample.
+   // Additionally, in GTK4, the headerbar corners get clipped by the window
+   // rather than the headerbar having its own rounded corners.
+-  auto context = GtkCheckVersion(4) ? DecorationContext(false, false)
+-                                    : HeaderContext(false, false);
++  auto context = GtkCheckVersion(4) ? DecorationContext(false, false, false)
++                                    : HeaderContext(false, false, false);
+   ApplyCssToContext(context, R"(window, headerbar {
+     background-image: none;
+     background-color: black;
+@@ -169,8 +171,8 @@ void WindowFrameProviderGtk::Asset::CloneFrom(
+   unfocused_bitmap = src.unfocused_bitmap;
+ }
+ 
+-WindowFrameProviderGtk::WindowFrameProviderGtk(bool solid_frame)
+-    : solid_frame_(solid_frame) {}
++WindowFrameProviderGtk::WindowFrameProviderGtk(bool solid_frame, bool maximized)
++    : solid_frame_(solid_frame), maximized_(maximized) {}
+ 
+ WindowFrameProviderGtk::~WindowFrameProviderGtk() = default;
+ 
+@@ -264,7 +266,7 @@ void WindowFrameProviderGtk::PaintWindowFrame(gfx::Canvas* canvas,
+       top_area_height_dip * scale - asset.frame_thickness_px.top();
+ 
+   auto header = PaintHeaderbar({client_bounds_px.width(), top_area_height_px},
+-                               HeaderContext(solid_frame_, focused), scale);
++                               HeaderContext(solid_frame_, maximized_, focused), scale);
+   image = gfx::ImageSkia::CreateFrom1xBitmap(header);
+   // In GTK4, the headerbar gets clipped by the window.
+   if (GtkCheckVersion(4)) {
+@@ -296,7 +298,7 @@ void WindowFrameProviderGtk::MaybeUpdateBitmaps(float scale) {
+ 
+   gfx::Rect frame_bounds_dip(kMaxFrameSizeDip, kMaxFrameSizeDip,
+                              2 * kMaxFrameSizeDip, 2 * kMaxFrameSizeDip);
+-  auto focused_context = DecorationContext(solid_frame_, true);
++  auto focused_context = DecorationContext(solid_frame_, maximized_, true);
+   frame_bounds_dip.Inset(-GtkStyleContextGetPadding(focused_context));
+   frame_bounds_dip.Inset(-GtkStyleContextGetBorder(focused_context));
+   gfx::Size bitmap_size(BitmapSizePx(asset), BitmapSizePx(asset));
+@@ -304,7 +306,7 @@ void WindowFrameProviderGtk::MaybeUpdateBitmaps(float scale) {
+       PaintBitmap(bitmap_size, frame_bounds_dip, focused_context, scale);
+   asset.unfocused_bitmap =
+       PaintBitmap(bitmap_size, frame_bounds_dip,
+-                  DecorationContext(solid_frame_, false), scale);
++                  DecorationContext(solid_frame_, maximized_, false), scale);
+ 
+   // In GTK4, there's no way to obtain the frame thickness from CSS values
+   // directly, so we must determine it experimentally based on the drawn
+diff --git a/ui/gtk/window_frame_provider_gtk.h b/ui/gtk/window_frame_provider_gtk.h
+index d3039d73161378197557947aece88d2710c1e486..f7d4605938210b0b75517bb7bcab28b588a16520 100644
+--- a/ui/gtk/window_frame_provider_gtk.h
++++ b/ui/gtk/window_frame_provider_gtk.h
+@@ -14,7 +14,7 @@ namespace gtk {
+ 
+ class WindowFrameProviderGtk : public views::WindowFrameProvider {
+  public:
+-  explicit WindowFrameProviderGtk(bool solid_frame);
++  explicit WindowFrameProviderGtk(bool solid_frame, bool maximized);
+ 
+   WindowFrameProviderGtk(const WindowFrameProviderGtk&) = delete;
+   WindowFrameProviderGtk& operator=(const WindowFrameProviderGtk&) = delete;
+@@ -69,6 +69,9 @@ class WindowFrameProviderGtk : public views::WindowFrameProvider {
+ 
+   // Cached bitmaps and metrics.  The scale is rounded to percent.
+   base::flat_map<int, Asset> assets_;
++
++  // Whether to draw the window decorations as maximized.
++  bool maximized_;
+ };
+ 
+ }  // namespace gtk
+diff --git a/ui/views/linux_ui/linux_ui.h b/ui/views/linux_ui/linux_ui.h
+index 5f312e01508c49033bf2d05b9dc083e524f37e5f..7590acd760ba4f36e5a77c1972afc5fc08e616ff 100644
+--- a/ui/views/linux_ui/linux_ui.h
++++ b/ui/views/linux_ui/linux_ui.h
+@@ -189,7 +189,7 @@ class VIEWS_EXPORT LinuxUI : public ui::LinuxInputMethodContextFactory,
+   // if transparency is unsupported and the frame should be rendered opaque.
+   // The returned object is not owned by the caller and will remain alive until
+   // the process ends.
+-  virtual WindowFrameProvider* GetWindowFrameProvider(bool solid_frame) = 0;
++  virtual WindowFrameProvider* GetWindowFrameProvider(bool solid_frame, bool maximized) = 0;
+ 
+   // Returns a map of KeyboardEvent code to KeyboardEvent key values.
+   virtual base::flat_map<std::string, std::string> GetKeyboardLayoutMap() = 0;

patches/chromium/cherry-pick-079105b7ebba.patch

@@ -0,0 +1,272 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Yuki Shiino <yukishiino@chromium.org>
+Date: Tue, 23 Aug 2022 09:18:50 +0000
+Subject: bindings: Add argument type checks to ObservableArray<T>
+
+Performs type checks for arguments of trap functions and throws
+a TypeError if a type is wrong.
+
+(cherry picked from commit 4d67bb1dbf55e2eddf513f29ac33e38e8e1d2fab)
+
+Bug: 1352549
+Change-Id: I66df3a9eeae5e4f44bdf714666a2c6304ebec0f5
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3835494
+Auto-Submit: Yuki Shiino <yukishiino@chromium.org>
+Reviewed-by: Kentaro Hara <haraken@chromium.org>
+Commit-Queue: Kentaro Hara <haraken@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1036005}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3849901
+Cr-Commit-Position: refs/branch-heads/5112@{#1514}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h
+index 1b31781f4b445b2dab7967b1137c28de50455623..4b17428992c66fad9f7eee1e2956f4218017fb8f 100644
+--- a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h
++++ b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h
+@@ -54,13 +54,17 @@ class ObservableArrayExoticObjectHandler {
+       const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
+-    v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    v8::Local<v8::Value> v8_desc_obj = info[2];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
+     ExceptionState exception_state(
+-        isolate, ExceptionContext::Context::kNamedPropertyDefine,
+-        backing_list.ObservableArrayNameInIDL());
++        isolate, ExceptionContext::Context::kOperationInvoke,
++        BackingListWrappable::ObservableArrayNameInIDL(), "defineProperty");
++    if (!(info[0]->IsArray() && info[1]->IsName() && info[2]->IsObject())) {
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
++    v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    v8::Local<v8::Object> v8_desc_obj = info[2].As<v8::Object>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     V8PropertyDescriptorBag desc_bag;
+     V8ObjectToPropertyDescriptor(isolate, v8_desc_obj, desc_bag,
+@@ -112,9 +116,7 @@ class ObservableArrayExoticObjectHandler {
+         desc.set_configurable(desc_bag.configurable);
+       if (desc_bag.has_enumerable)
+         desc.set_enumerable(desc_bag.enumerable);
+-      if (!v8_target
+-               ->DefineProperty(current_context, v8_property.As<v8::Name>(),
+-                                desc)
++      if (!v8_target->DefineProperty(current_context, v8_property, desc)
+                .To(&is_defined)) {
+         return;
+       }
+@@ -124,9 +126,7 @@ class ObservableArrayExoticObjectHandler {
+         desc.set_configurable(desc_bag.configurable);
+       if (desc_bag.has_enumerable)
+         desc.set_enumerable(desc_bag.enumerable);
+-      if (!v8_target
+-               ->DefineProperty(current_context, v8_property.As<v8::Name>(),
+-                                desc)
++      if (!v8_target->DefineProperty(current_context, v8_property, desc)
+                .To(&is_defined)) {
+         return;
+       }
+@@ -139,9 +139,16 @@ class ObservableArrayExoticObjectHandler {
+       const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "deleteProperty");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -154,7 +161,7 @@ class ObservableArrayExoticObjectHandler {
+         ScriptState* script_state = ScriptState::From(current_context);
+         ExceptionState exception_state(
+             isolate, ExceptionContext::Context::kIndexedPropertyDelete,
+-            backing_list.ObservableArrayNameInIDL());
++            BackingListWrappable::ObservableArrayNameInIDL());
+         if (!RunDeleteAlgorithm(script_state, backing_list, index,
+                                 exception_state)) {
+           return;
+@@ -181,9 +188,16 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapGet(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "get");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -221,9 +235,17 @@ class ObservableArrayExoticObjectHandler {
+       const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(),
++          "getOwnPropertyDescriptor");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -258,9 +280,7 @@ class ObservableArrayExoticObjectHandler {
+     }
+ 
+     v8::Local<v8::Value> v8_value;
+-    if (!v8_target
+-             ->GetOwnPropertyDescriptor(current_context,
+-                                        v8_property.As<v8::Name>())
++    if (!v8_target->GetOwnPropertyDescriptor(current_context, v8_property)
+              .ToLocal(&v8_value)) {
+       return;
+     }
+@@ -271,9 +291,16 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapHas(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "has");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -300,8 +327,15 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapOwnKeys(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!info[0]->IsArray()) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "ownKeys");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     // 2. Let length be handler.[[BackingList]]'s size.
+     // 3. Let keys be an empty list.
+@@ -357,17 +391,24 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapSet(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "set");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
+     v8::Local<v8::Value> v8_value = info[2];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+       if (v8_property->ToArrayIndex(current_context).ToLocal(&v8_index)) {
+         ExceptionState exception_state(
+             isolate, ExceptionContext::Context::kIndexedPropertySet,
+-            backing_list.ObservableArrayNameInIDL());
++            BackingListWrappable::ObservableArrayNameInIDL());
+         uint32_t index = v8_index->Value();
+         bool result =
+             DoSetTheIndexedValue(isolate, current_context, backing_list, index,
+@@ -380,7 +421,7 @@ class ObservableArrayExoticObjectHandler {
+               V8AtomicString(isolate, "length"))) {
+         ExceptionState exception_state(
+             isolate, ExceptionContext::Context::kAttributeSet,
+-            backing_list.ObservableArrayNameInIDL(), "length");
++            BackingListWrappable::ObservableArrayNameInIDL(), "length");
+         bool result = DoSetTheLength(isolate, current_context, backing_list,
+                                      v8_value, exception_state);
+         V8SetReturnValue(info, result);
+@@ -431,11 +472,11 @@ class ObservableArrayExoticObjectHandler {
+   }
+ 
+  private:
+-  static BackingListWrappable& ToWrappableUnsafe(v8::Isolate* isolate,
+-                                                 v8::Local<v8::Array> target) {
++  static BackingListWrappable& ToWrappableOrDie(v8::Isolate* isolate,
++                                                v8::Local<v8::Array> target) {
+     bindings::ObservableArrayBase* base =
+         bindings::ObservableArrayExoticObjectImpl::
+-            ProxyTargetToObservableArrayBase(isolate, target);
++            ProxyTargetToObservableArrayBaseOrDie(isolate, target);
+     return *static_cast<BackingListWrappable*>(base);
+   }
+ 
+diff --git a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc
+index 8672414aba480c4af3b7431e6db071a03d61569e..88c2adf501a3a3088c635c8d24215fbce787b3e5 100644
+--- a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc
++++ b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc
+@@ -42,7 +42,7 @@ const WrapperTypeInfo& ObservableArrayExoticObjectImpl::wrapper_type_info_ =
+ 
+ // static
+ bindings::ObservableArrayBase*
+-ObservableArrayExoticObjectImpl::ProxyTargetToObservableArrayBase(
++ObservableArrayExoticObjectImpl::ProxyTargetToObservableArrayBaseOrDie(
+     v8::Isolate* isolate,
+     v8::Local<v8::Array> v8_proxy_target) {
+   // See the implementation comment in ObservableArrayExoticObjectImpl::Wrap.
+@@ -50,6 +50,8 @@ ObservableArrayExoticObjectImpl::ProxyTargetToObservableArrayBase(
+       V8PrivateProperty::GetSymbol(isolate, kV8ProxyTargetToV8WrapperKey);
+   v8::Local<v8::Value> backing_list_wrapper =
+       private_property.GetOrUndefined(v8_proxy_target).ToLocalChecked();
++  // Crash when author script managed to pass something else other than the
++  // right proxy target object.
+   CHECK(backing_list_wrapper->IsObject());
+   return ToScriptWrappable(backing_list_wrapper.As<v8::Object>())
+       ->ToImpl<bindings::ObservableArrayBase>();
+diff --git a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h
+index 4d262a4981c1404d9b403b0fcf4ec9d71e109bea..8c56428c40e5b0d246b45c741f8bdcbfdcfb23ee 100644
+--- a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h
++++ b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h
+@@ -22,7 +22,7 @@ class CORE_EXPORT ObservableArrayExoticObjectImpl final
+  public:
+   // Returns the backing list object extracted from the proxy target object
+   // of type JS Array.
+-  static bindings::ObservableArrayBase* ProxyTargetToObservableArrayBase(
++  static bindings::ObservableArrayBase* ProxyTargetToObservableArrayBaseOrDie(
+       v8::Isolate* isolate,
+       v8::Local<v8::Array> v8_proxy_target);
+ 

patches/chromium/cherry-pick-2083e894852c.patch

@@ -0,0 +1,29 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Anton Bikineev <bikineev@chromium.org>
+Date: Sun, 10 Jul 2022 22:17:03 +0000
+Subject: Fix heap-overflow in blink::TableLayoutAlgorithmAuto::InsertSpanCell
+
+The CL fixes size confusion between Member<> and raw pointers.
+
+The bug was found (and the fix was proposed) by m.cooolie@gmail.com.
+
+Bug: 1341539
+Change-Id: I99d524fd65c2d6305693d09ad274c23178271269
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3751138
+Reviewed-by: Kentaro Hara <haraken@chromium.org>
+Commit-Queue: Anton Bikineev <bikineev@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1022529}
+
+diff --git a/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc b/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc
+index 1e1575cf47027584a9d06d7c5f6046fa15990b10..1a4a06a4761c52b8dd9ae9052b7c51b9236694a5 100644
+--- a/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc
++++ b/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc
+@@ -673,7 +673,7 @@ void TableLayoutAlgorithmAuto::InsertSpanCell(LayoutTableCell* cell) {
+          span > span_cells_[pos]->ColSpan())
+     pos++;
+   memmove(span_cells_.data() + pos + 1, span_cells_.data() + pos,
+-          (size - pos - 1) * sizeof(LayoutTableCell*));
++          (size - pos - 1) * sizeof(decltype(span_cells_)::value_type));
+   span_cells_[pos] = cell;
+ }
+ 

patches/chromium/cherry-pick-54a7927b19f9.patch

@@ -0,0 +1,276 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Aaron Leventhal <aleventhal@google.com>
+Date: Tue, 26 Jul 2022 17:36:04 +0000
+Subject: Merge 104: Speculative fix for IsValidCodePointInIndex() range crash
+
+(cherry picked from commit b4d1ce62d7783a9b31a0a2bec1b886a9a6519a40)
+
+Bug: 1333970
+Change-Id: I5a4c78e708357074fdec1f7a18fa928e39f9c51a
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3757922
+Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
+Reviewed-by: Nektarios Paisios <nektar@chromium.org>
+Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1025405}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3788215
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Cr-Commit-Position: refs/branch-heads/5112@{#1206}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/content/browser/accessibility/browser_accessibility_manager.cc b/content/browser/accessibility/browser_accessibility_manager.cc
+index 65213c9e3569d6a9f8d74eb655d48c1df5c9356b..d33fb5d5a3e6f741b03270f63aa34e5d58cac850 100644
+--- a/content/browser/accessibility/browser_accessibility_manager.cc
++++ b/content/browser/accessibility/browser_accessibility_manager.cc
+@@ -394,6 +394,10 @@ const ui::AXTreeData& BrowserAccessibilityManager::GetTreeData() const {
+   return ax_tree()->data();
+ }
+ 
++std::string BrowserAccessibilityManager::ToString() const {
++  return GetTreeData().ToString();
++}
++
+ void BrowserAccessibilityManager::OnWindowFocused() {
+   if (IsRootTree())
+     FireFocusEventsIfNeeded();
+diff --git a/content/browser/accessibility/browser_accessibility_manager.h b/content/browser/accessibility/browser_accessibility_manager.h
+index 92d62b5832d4fc87830b1c2bad7c7b972f1de74e..ca696fd855dcfe45e80e6c070546b19b19d42f69 100644
+--- a/content/browser/accessibility/browser_accessibility_manager.h
++++ b/content/browser/accessibility/browser_accessibility_manager.h
+@@ -225,6 +225,8 @@ class CONTENT_EXPORT BrowserAccessibilityManager
+   // Get the AXTreeData for this frame.
+   const ui::AXTreeData& GetTreeData() const;
+ 
++  std::string ToString() const override;
++
+   // Called to notify the accessibility manager that its associated native
+   // view got focused.
+   virtual void OnWindowFocused();
+diff --git a/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc b/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc
+index 93f59054158d089fd2754a8b99c0dc5407716e58..c50d65a55b4cadf8a5579ae7aca79f671088796f 100644
+--- a/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc
++++ b/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc
+@@ -4,6 +4,7 @@
+ 
+ #include "extensions/renderer/api/automation/automation_ax_tree_wrapper.h"
+ 
++#include "automation_ax_tree_wrapper.h"
+ #include "base/containers/contains.h"
+ #include "base/containers/cxx20_erase.h"
+ #include "base/no_destructor.h"
+@@ -573,4 +574,8 @@ ui::AXNode* AutomationAXTreeWrapper::GetParentNodeFromParentTreeAsAXNode()
+   return owner_->GetParent(tree_.root(), &wrapper);
+ }
+ 
++std::string AutomationAXTreeWrapper::ToString() const {
++  return "<AutomationAXTreeWrapper>";
++}
++
+ }  // namespace extensions
+diff --git a/extensions/renderer/api/automation/automation_ax_tree_wrapper.h b/extensions/renderer/api/automation/automation_ax_tree_wrapper.h
+index afb92e41edb824bf7c642fd2bb542daac653abf8..2c64b5eaac8d2521b0c9ff754b36c057f73f9e90 100644
+--- a/extensions/renderer/api/automation/automation_ax_tree_wrapper.h
++++ b/extensions/renderer/api/automation/automation_ax_tree_wrapper.h
+@@ -116,6 +116,7 @@ class AutomationAXTreeWrapper : public ui::AXTreeObserver,
+   ui::AXTreeID GetParentTreeID() const override;
+   ui::AXNode* GetRootAsAXNode() const override;
+   ui::AXNode* GetParentNodeFromParentTreeAsAXNode() const override;
++  std::string ToString() const override;
+ 
+  private:
+   // AXTreeObserver overrides.
+diff --git a/ui/accessibility/ax_node_position_unittest.cc b/ui/accessibility/ax_node_position_unittest.cc
+index b0f06a0912447e5fa9bad9e62b2523817490ea02..3081258496dacc4f26976dfd99ea005a70bcd210 100644
+--- a/ui/accessibility/ax_node_position_unittest.cc
++++ b/ui/accessibility/ax_node_position_unittest.cc
+@@ -9105,8 +9105,12 @@ TEST_F(AXPositionTest,
+   EXPECT_TRUE(test_position->IsNullPosition());
+ }
+ 
++// TODO(crbug.com/1333970) It is not legal to call
++// AsLeafTextPositionBeforeCharacter or AsLeafTextPositionAfterCharacter with
++// a text position using out-of-range offsets. It's necessary to call
++// AsValidPosition() first. Therefore, this test currently triggers a DCHECK.
+ TEST_F(AXPositionTest,
+-       AsLeafTextPositionBeforeAndAfterCharacterWithInvalidPosition) {
++       DISABLED_AsLeafTextPositionBeforeAndAfterCharacterWithInvalidPosition) {
+   AXNodeData root_data;
+   root_data.id = 1;
+   root_data.role = ax::mojom::Role::kRootWebArea;
+diff --git a/ui/accessibility/ax_position.h b/ui/accessibility/ax_position.h
+index 9eaf0df84b04e88d9f78e95523732d90ecd0fe22..d23bb61a0713a44e864e6b940c78433d81490776 100644
+--- a/ui/accessibility/ax_position.h
++++ b/ui/accessibility/ax_position.h
+@@ -26,6 +26,7 @@
+ #include "base/strings/string_util.h"
+ #include "base/strings/utf_string_conversions.h"
+ #include "third_party/abseil-cpp/absl/types/optional.h"
++#include "ui/accessibility/ax_common.h"
+ #include "ui/accessibility/ax_enum_util.h"
+ #include "ui/accessibility/ax_enums.mojom.h"
+ #include "ui/accessibility/ax_node.h"
+@@ -383,16 +384,33 @@ class AXPosition {
+     return str + " annotated_text=" + base::UTF16ToUTF8(annotated_text);
+   }
+ 
++  // Helper for logging the position, the AXTreeManager and the anchor node.
++  std::string ToDebugString() const {
++    if (IsNullPosition()) {
++      return "* Position: null";
++    }
++    DCHECK(GetAnchor());
++    DCHECK(GetManager());
++    std::ostringstream str;
++    str << "* Position: " << ToString()
++        << "\n* Manager: " << GetManager()->ToString()
++        << "\n* Anchor node: " << *GetAnchor();
++    return str.str();
++  }
++
+   AXPositionKind kind() const { return kind_; }
+   AXTreeID tree_id() const { return tree_id_; }
+   AXNodeID anchor_id() const { return anchor_id_; }
+ 
++  AXTreeManager* GetManager() const {
++    return AXTreeManagerMap::GetInstance().GetManager(tree_id());
++  }
++
+   AXNode* GetAnchor() const {
+     if (tree_id_ == AXTreeIDUnknown() || anchor_id_ == kInvalidAXNodeID)
+       return nullptr;
+ 
+-    const AXTreeManager* manager =
+-        AXTreeManagerMap::GetInstance().GetManager(tree_id());
++    const AXTreeManager* manager = GetManager();
+     if (manager)
+       return manager->GetNodeFromTree(anchor_id());
+ 
+@@ -2569,13 +2587,6 @@ class AXPosition {
+       return Clone();
+ 
+     AXPositionInstance text_position = AsTextPosition();
+-    // The following situation should not be possible but there are existing
+-    // crashes in the field.
+-    //
+-    // TODO(nektar): Remove this workaround as soon as the source of the bug
+-    // is identified.
+-    if (text_position->text_offset_ > text_position->MaxTextOffset())
+-      return CreateNullPosition();
+ 
+     // In case the input affinity is upstream, reset it to downstream.
+     //
+@@ -2593,6 +2604,16 @@ class AXPosition {
+     if (!text_position->IsIgnored() && !text_position->AtEndOfAnchor()) {
+       std::unique_ptr<base::i18n::BreakIterator> grapheme_iterator =
+           text_position->GetGraphemeIterator();
++      // The following situation should not be possible but there are existing
++      // crashes in the field.
++      //
++      // TODO(nektar): Remove this workaround as soon as the source of the bug
++      // is identified.
++      if (text_position->text_offset_ < 0 ||
++          text_position->text_offset_ > text_position->MaxTextOffset()) {
++        SANITIZER_NOTREACHED() << "Offset range error:\n" << ToDebugString();
++        return CreateNullPosition();
++      }
+       DCHECK_GE(text_position->text_offset_, 0);
+       DCHECK_LE(text_position->text_offset_, text_position->MaxTextOffset());
+       while (!text_position->AtStartOfAnchor() &&
+@@ -2645,9 +2666,11 @@ class AXPosition {
+       //
+       // TODO(nektar): Remove this workaround as soon as the source of the bug
+       // is identified.
+-      if (text_position->text_offset_ > text_position->MaxTextOffset())
++      if (text_position->text_offset_ < 0 ||
++          text_position->text_offset_ > text_position->MaxTextOffset()) {
++        SANITIZER_NOTREACHED() << "Offset range error:\n" << ToDebugString();
+         return CreateNullPosition();
+-
++      }
+       DCHECK_GE(text_position->text_offset_, 0);
+       DCHECK_LE(text_position->text_offset_, text_position->MaxTextOffset());
+       while (!text_position->AtEndOfAnchor() &&
+diff --git a/ui/accessibility/ax_tree_manager.h b/ui/accessibility/ax_tree_manager.h
+index 1081ed8fc3388ae7b6f535f2cd7437ac2e3db184..52f892c1acf3a50a24716bb361dd1ca231bd57a1 100644
+--- a/ui/accessibility/ax_tree_manager.h
++++ b/ui/accessibility/ax_tree_manager.h
+@@ -51,6 +51,11 @@ class AX_EXPORT AXTreeManager {
+   // Called when the tree manager is about to be removed from the tree map,
+   // `AXTreeManagerMap`.
+   virtual void WillBeRemovedFromMap() {}
++
++  // For debugging.
++  // TODO(benjamin.beaudry) Instead of this, implement GetTreeData() on all
++  // AXTreeManager subclasses, and have callers use GetTreeData().ToString();
++  virtual std::string ToString() const = 0;
+ };
+ 
+ }  // namespace ui
+diff --git a/ui/accessibility/test_ax_tree_manager.cc b/ui/accessibility/test_ax_tree_manager.cc
+index 15627a472481b46c66c3d40efa3895ab14cb89ef..5ee1750a265db3e9291c5f5a9beb1a4228278af2 100644
+--- a/ui/accessibility/test_ax_tree_manager.cc
++++ b/ui/accessibility/test_ax_tree_manager.cc
+@@ -116,4 +116,8 @@ AXNode* TestAXTreeManager::GetParentNodeFromParentTreeAsAXNode() const {
+   return nullptr;
+ }
+ 
++std::string TestAXTreeManager::ToString() const {
++  return "<TestAXTreeManager>";
++}
++
+ }  // namespace ui
+diff --git a/ui/accessibility/test_ax_tree_manager.h b/ui/accessibility/test_ax_tree_manager.h
+index c155aeb4f164129a3b484386f0e4802a361df80a..dabc5650132d01f121f8a9763afc499800bfbd9c 100644
+--- a/ui/accessibility/test_ax_tree_manager.h
++++ b/ui/accessibility/test_ax_tree_manager.h
+@@ -53,6 +53,7 @@ class AX_EXPORT TestAXTreeManager : public AXTreeManager {
+   AXTreeID GetParentTreeID() const override;
+   AXNode* GetRootAsAXNode() const override;
+   AXNode* GetParentNodeFromParentTreeAsAXNode() const override;
++  std::string ToString() const override;
+ 
+  private:
+   std::unique_ptr<AXTree> tree_;
+diff --git a/ui/views/accessibility/views_ax_tree_manager.cc b/ui/views/accessibility/views_ax_tree_manager.cc
+index 9ddd02d0e05d56247cbeb48d97b26227090a40d3..269002feff50b3c95f7216ba3e5c339bc7e641a4 100644
+--- a/ui/views/accessibility/views_ax_tree_manager.cc
++++ b/ui/views/accessibility/views_ax_tree_manager.cc
+@@ -4,8 +4,6 @@
+ 
+ #include "ui/views/accessibility/views_ax_tree_manager.h"
+ 
+-#include <string>
+-
+ #include "base/bind.h"
+ #include "base/callback.h"
+ #include "base/check.h"
+@@ -105,6 +103,10 @@ ui::AXNode* ViewsAXTreeManager::GetParentNodeFromParentTreeAsAXNode() const {
+   return nullptr;
+ }
+ 
++std::string ViewsAXTreeManager::ToString() const {
++  return "<ViewsAXTreeManager>";
++}
++
+ void ViewsAXTreeManager::OnViewEvent(View* view, ax::mojom::Event event) {
+   DCHECK(view);
+   AXAuraObjWrapper* wrapper = cache_.GetOrCreate(view);
+diff --git a/ui/views/accessibility/views_ax_tree_manager.h b/ui/views/accessibility/views_ax_tree_manager.h
+index 3c28a84ddcbddccc8e9d4ae6fd2a30cd4c29bc65..6a6a769f5280ac901df551a85c4de69fa4e8eeed 100644
+--- a/ui/views/accessibility/views_ax_tree_manager.h
++++ b/ui/views/accessibility/views_ax_tree_manager.h
+@@ -7,6 +7,7 @@
+ 
+ #include <memory>
+ #include <set>
++#include <string>
+ #include <vector>
+ 
+ #include "base/callback_forward.h"
+@@ -89,6 +90,7 @@ class VIEWS_EXPORT ViewsAXTreeManager : public ui::AXTreeManager,
+   ui::AXTreeID GetParentTreeID() const override;
+   ui::AXNode* GetRootAsAXNode() const override;
+   ui::AXNode* GetParentNodeFromParentTreeAsAXNode() const override;
++  std::string ToString() const override;
+ 
+   // AXActionHandlerBase implementation.
+   void PerformAction(const ui::AXActionData& data) override;

patches/chromium/cherry-pick-54e32332750c.patch

@@ -0,0 +1,141 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Min Qin <qinmin@chromium.org>
+Date: Tue, 12 Jul 2022 19:48:53 +0000
+Subject: Sanitize default file name in windows select file dialog
+
+On windows, '%' is a special character and can be used for environment
+variables. So if the default file name is '%DATADIR%', it can actually
+refer to another directory and thus causing weird behaviors.
+And '%' cannot be escaped when used in the file dialog. Both "^%" and
+"%%" don't work. This CL mitigates the issue by replacing '%' with '_'.
+This only affects the default file name when showing the dialog. Power
+users can still change the file name by adding '%' if needed.
+
+BUG=1308422
+
+(cherry picked from commit 9cdce354cb3b0da5b4b311638973d407be7712b6)
+
+Change-Id: Ibb275f5c3c2c9458c20d1e97ad527f7c95184eaa
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3688608
+Reviewed-by: Robert Liao <robliao@chromium.org>
+Commit-Queue: Min Qin <qinmin@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1014602}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3758469
+Cr-Commit-Position: refs/branch-heads/5112@{#822}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/ui/shell_dialogs/execute_select_file_win.cc b/ui/shell_dialogs/execute_select_file_win.cc
+index 063d4c7c96cba45448d4d7b0e7a8ddd3a6f67937..162dbc3aeb4ead16a415228b40fb67008e89fe63 100644
+--- a/ui/shell_dialogs/execute_select_file_win.cc
++++ b/ui/shell_dialogs/execute_select_file_win.cc
+@@ -10,6 +10,7 @@
+ #include "base/callback.h"
+ #include "base/files/file.h"
+ #include "base/files/file_util.h"
++#include "base/strings/string_tokenizer.h"
+ #include "base/strings/string_util.h"
+ #include "base/win/com_init_util.h"
+ #include "base/win/registry.h"
+@@ -50,7 +51,7 @@ bool SetDefaultPath(IFileDialog* file_dialog,
+     default_folder = default_path;
+   } else {
+     default_folder = default_path.DirName();
+-    default_file_name = default_path.BaseName();
++    default_file_name = GetSanitizedFileName(default_path.BaseName());
+   }
+ 
+   // Do not fail the file dialog operation if the specified folder is invalid.
+@@ -371,6 +372,33 @@ std::wstring AppendExtensionIfNeeded(const std::wstring& filename,
+   return return_value;
+ }
+ 
++base::FilePath GetSanitizedFileName(const base::FilePath& file_name) {
++  base::StringTokenizerT<std::wstring, std::wstring::const_iterator> t(
++      file_name.value(), L"%");
++  t.set_options(base::StringTokenizer::RETURN_EMPTY_TOKENS);
++  std::wstring result;
++  bool token_valid = t.GetNext();
++  while (token_valid) {
++    // Append substring before the first "%".
++    result.append(t.token());
++    // Done if we are reaching the end delimiter,
++    if (!t.GetNext()) {
++      break;
++    }
++    std::wstring string_after_first_percent = t.token();
++    token_valid = t.GetNext();
++    // If there are no other "%", append the string after
++    // the first "%". Otherwise, remove the string between
++    // the "%" and continue handing the remaining string.
++    if (!token_valid) {
++      result.append(L"%");
++      result.append(string_after_first_percent);
++      break;
++    }
++  }
++  return base::FilePath(result);
++}
++
+ void ExecuteSelectFile(
+     SelectFileDialog::Type type,
+     const std::u16string& title,
+diff --git a/ui/shell_dialogs/execute_select_file_win.h b/ui/shell_dialogs/execute_select_file_win.h
+index dc808af395333a2bd81c2bd73faac4c6063fd409..8fa96906c0288d0021c1500bd442a35c0c29dfd2 100644
+--- a/ui/shell_dialogs/execute_select_file_win.h
++++ b/ui/shell_dialogs/execute_select_file_win.h
+@@ -26,6 +26,12 @@ SHELL_DIALOGS_EXPORT std::wstring AppendExtensionIfNeeded(
+     const std::wstring& filter_selected,
+     const std::wstring& suggested_ext);
+ 
++// Given a file name, return the sanitized version by removing substrings that
++// are embedded in double '%' characters as those are reserved for environment
++// variables. Implementation detail exported for unit tests.
++SHELL_DIALOGS_EXPORT base::FilePath GetSanitizedFileName(
++    const base::FilePath& file_name);
++
+ // Describes a filter for a file dialog.
+ struct FileFilterSpec {
+   // A human readable description of this filter. E.g. "HTML Files."
+diff --git a/ui/shell_dialogs/execute_select_file_win_unittest.cc b/ui/shell_dialogs/execute_select_file_win_unittest.cc
+index df5e8a89d9b0854626a99750a56e3f2500dba812..b6c604fa5a798ba6e448e892ca7a9212cce507fc 100644
+--- a/ui/shell_dialogs/execute_select_file_win_unittest.cc
++++ b/ui/shell_dialogs/execute_select_file_win_unittest.cc
+@@ -50,3 +50,38 @@ TEST(ShellDialogsWin, AppendExtensionIfNeeded) {
+                                           test_cases[i].suggested_ext));
+   }
+ }
++
++TEST(ShellDialogsWin, GetSanitizedFileName) {
++  struct GetSanitizedFileNameTestCase {
++    const wchar_t* filename;
++    const wchar_t* sanitized_filename;
++  } test_cases[] = {
++      {L"", L""},
++      {L"a.txt", L"a.txt"},
++
++      // Only 1 "%" in file name.
++      {L"%", L"%"},
++      {L"%.txt", L"%.txt"},
++      {L"ab%c.txt", L"ab%c.txt"},
++      {L"abc.t%", L"abc.t%"},
++
++      // 2 "%" in file name.
++      {L"%%", L""},
++      {L"%c%", L""},
++      {L"%c%d", L"d"},
++      {L"d%c%.txt", L"d.txt"},
++      {L"ab%c.t%", L"ab"},
++      {L"abc.%t%", L"abc."},
++
++      // More than 2 "%" in file name.
++      {L"%ab%c%.txt", L"c%.txt"},
++      {L"%abc%.%txt%", L"."},
++      {L"%ab%c%.%txt%", L"ctxt%"},
++  };
++
++  for (size_t i = 0; i < std::size(test_cases); ++i) {
++    SCOPED_TRACE(base::StringPrintf("i=%zu", i));
++    EXPECT_EQ(base::FilePath(test_cases[i].sanitized_filename),
++              ui::GetSanitizedFileName(base::FilePath(test_cases[i].filename)));
++  }
++}

patches/chromium/cherry-pick-60d8559e150a.patch

@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Tue, 12 Jul 2022 18:52:14 +0000
+Subject: M104: Better define "first result" in PDFiumEngine::AddFindResult().
+
+Currently, changing the PDF layout confuses AddFindResult() and causes
+it to fail a DCHECK(). Adjust AddFindResult() to avoid the failing
+DCHECK().
+
+This is a cherry-pick of https://crrev.com/1021389 without the test
+changes.
+
+Bug: 1339745
+Change-Id: I25c2b6b436700f9aeca4924fef662ad2909f0a8c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3758626
+Reviewed-by: K. Moon <kmoon@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5112@{#820}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/pdf/pdfium/pdfium_engine.cc b/pdf/pdfium/pdfium_engine.cc
+index c015d4b06a44c9121576d14160b84e871081fa33..0afe3c60715c948c7e376f81646c11b29cc01486 100644
+--- a/pdf/pdfium/pdfium_engine.cc
++++ b/pdf/pdfium/pdfium_engine.cc
+@@ -1971,7 +1971,7 @@ void PDFiumEngine::SearchUsingICU(const std::u16string& term,
+ }
+ 
+ void PDFiumEngine::AddFindResult(const PDFiumRange& result) {
+-  bool first_result = find_results_.empty();
++  bool first_result = find_results_.empty() && !resume_find_index_.has_value();
+   // Figure out where to insert the new location, since we could have
+   // started searching midway and now we wrapped.
+   size_t result_index;
+@@ -1988,7 +1988,6 @@ void PDFiumEngine::AddFindResult(const PDFiumRange& result) {
+   UpdateTickMarks();
+   client_->NotifyNumberOfFindResultsChanged(find_results_.size(), false);
+   if (first_result) {
+-    DCHECK(!resume_find_index_);
+     DCHECK(!current_find_index_);
+     SelectFindResult(/*forward=*/true);
+   }

patches/chromium/cherry-pick-94a8bdafc8c6.patch

@@ -0,0 +1,414 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Keren Zhu <kerenzhu@chromium.org>
+Date: Thu, 9 Jun 2022 14:50:26 +0000
+Subject: Fix use-after-free vulnerability in ComboboxModel
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Stop the Combobox from observing the model when the model gets
+destroyed. This is done by adding a virtual OnComboboxModelDestroying()
+to the base observer class and calling it in ~ComboboxModel().
+
+This fix will prevent the use-after-free that happens when the combobox outlives the model, usually because the model lifetime
+is managed by non-UI component.
+
+Bug: 1264288
+Change-Id: Ia00881a9b674bbc83bbf54dd228490c1cc1290bc
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3693825
+Commit-Queue: Keren Zhu <kerenzhu@chromium.org>
+Reviewed-by: Matthias Körber <koerber@google.com>
+Auto-Submit: Keren Zhu <kerenzhu@chromium.org>
+Reviewed-by: Peter Boström <pbos@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1012504}
+
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
+index 323f85651611ff98e45884e3b0b7211eaa25039b..0d0bb0d21b1d96841a30bfea336af918b6da83f8 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
+@@ -130,16 +130,6 @@ int RecentlyUsedFoldersComboModel::GetDefaultIndex() const {
+   return it == items_.end() ? 0 : static_cast<int>(it - items_.begin());
+ }
+ 
+-void RecentlyUsedFoldersComboModel::AddObserver(
+-    ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void RecentlyUsedFoldersComboModel::RemoveObserver(
+-    ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ void RecentlyUsedFoldersComboModel::BookmarkModelLoaded(BookmarkModel* model,
+                                                         bool ids_reassigned) {}
+ 
+@@ -176,7 +166,7 @@ void RecentlyUsedFoldersComboModel::OnWillRemoveBookmarks(
+     }
+   }
+   if (changed) {
+-    for (ui::ComboboxModelObserver& observer : observers_)
++    for (ui::ComboboxModelObserver& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ }
+@@ -219,7 +209,7 @@ void RecentlyUsedFoldersComboModel::BookmarkAllUserNodesRemoved(
+     }
+   }
+   if (changed) {
+-    for (ui::ComboboxModelObserver& observer : observers_)
++    for (ui::ComboboxModelObserver& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
+index 8682e750f4407e615264986024e2a7dd0bae038f..0c02c685a02875c7b91ca9e6228864bc04e45c10 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
+@@ -38,8 +38,6 @@ class RecentlyUsedFoldersComboModel : public ui::ComboboxModel,
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+   int GetDefaultIndex() const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+   // Overriden from bookmarks::BookmarkModelObserver:
+   void BookmarkModelLoaded(bookmarks::BookmarkModel* model,
+@@ -90,8 +88,6 @@ class RecentlyUsedFoldersComboModel : public ui::ComboboxModel,
+   const raw_ptr<bookmarks::BookmarkModel> bookmark_model_;
+ 
+   const raw_ptr<const bookmarks::BookmarkNode> parent_node_;
+-
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ #endif  // CHROME_BROWSER_UI_BOOKMARKS_RECENTLY_USED_FOLDERS_COMBO_MODEL_H_
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
+index 60455386b7d5f1da72c92424ccf95fd971e7590a..3bfe6852b8a54a53aafea5eeec2da850097b2f0a 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
+@@ -41,6 +41,8 @@ class TestComboboxModelObserver : public ui::ComboboxModelObserver {
+     changed_ = true;
+   }
+ 
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override {}
++
+  private:
+   bool changed_;
+ };
+diff --git a/components/autofill/core/browser/ui/address_combobox_model.cc b/components/autofill/core/browser/ui/address_combobox_model.cc
+index c7e6f906ff32cb198f8723d6678971ae6cff28a2..d52dc0e925c54634452f86ca90792b318776e895 100644
+--- a/components/autofill/core/browser/ui/address_combobox_model.cc
++++ b/components/autofill/core/browser/ui/address_combobox_model.cc
+@@ -84,14 +84,6 @@ int AddressComboboxModel::GetDefaultIndex() const {
+   return ui::ComboboxModel::GetDefaultIndex();
+ }
+ 
+-void AddressComboboxModel::AddObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void AddressComboboxModel::RemoveObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ int AddressComboboxModel::AddNewProfile(const AutofillProfile& profile) {
+   profiles_cache_.push_back(std::make_unique<AutofillProfile>(profile));
+   UpdateAddresses();
+@@ -131,7 +123,7 @@ void AddressComboboxModel::UpdateAddresses() {
+   for (size_t i = 0; i < profiles_cache_.size(); ++i)
+     addresses_.emplace_back(profiles_cache_[i]->guid(), labels[i]);
+ 
+-  for (auto& observer : observers_) {
++  for (auto& observer : observers()) {
+     observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/components/autofill/core/browser/ui/address_combobox_model.h b/components/autofill/core/browser/ui/address_combobox_model.h
+index 02d65209d2729deae608481411e1539ba08f5f7e..3a41b30c92543633da29e40e2c64cc4597e322d2 100644
+--- a/components/autofill/core/browser/ui/address_combobox_model.h
++++ b/components/autofill/core/browser/ui/address_combobox_model.h
+@@ -40,8 +40,6 @@ class AddressComboboxModel : public ui::ComboboxModel {
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+   int GetDefaultIndex() const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+   // Adds |profile| to model and return its combobox index. The lifespan of
+   // |profile| beyond this call is undefined so a copy must be made.
+@@ -72,9 +70,6 @@ class AddressComboboxModel : public ui::ComboboxModel {
+ 
+   // If non empty, the guid of the address that should be selected by default.
+   std::string default_selected_guid_;
+-
+-  // To be called when the data for the given country code was loaded.
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ }  // namespace autofill
+diff --git a/components/autofill/core/browser/ui/region_combobox_model.cc b/components/autofill/core/browser/ui/region_combobox_model.cc
+index 6439ccb1f074f1c3965dfb2b45ab6f6636437c17..42626aff427f1b3f3400aba399e3f9c89faa06ba 100644
+--- a/components/autofill/core/browser/ui/region_combobox_model.cc
++++ b/components/autofill/core/browser/ui/region_combobox_model.cc
+@@ -67,14 +67,6 @@ bool RegionComboboxModel::IsItemSeparatorAt(int index) const {
+   return regions_[index].first.empty();
+ }
+ 
+-void RegionComboboxModel::AddObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void RegionComboboxModel::RemoveObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ void RegionComboboxModel::OnRegionDataLoaded(
+     const std::vector<const ::i18n::addressinput::RegionData*>& regions) {
+   // The RegionDataLoader will eventually self destruct after this call.
+@@ -95,7 +87,7 @@ void RegionComboboxModel::OnRegionDataLoaded(
+     failed_to_load_data_ = true;
+   }
+ 
+-  for (auto& observer : observers_) {
++  for (auto& observer : observers()) {
+     observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/components/autofill/core/browser/ui/region_combobox_model.h b/components/autofill/core/browser/ui/region_combobox_model.h
+index d1b5d8b9db0c4d9d15e4f2a50a6cba38b33f1be8..52cffd5d00649f8e2be7189bca128ba4c3e8a97d 100644
+--- a/components/autofill/core/browser/ui/region_combobox_model.h
++++ b/components/autofill/core/browser/ui/region_combobox_model.h
+@@ -54,8 +54,6 @@ class RegionComboboxModel : public ui::ComboboxModel {
+   int GetItemCount() const override;
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+  private:
+   // Callback for the RegionDataLoader.
+@@ -72,9 +70,6 @@ class RegionComboboxModel : public ui::ComboboxModel {
+   // List of <code, name> pairs for ADDRESS_HOME_STATE combobox values;
+   std::vector<std::pair<std::string, std::string>> regions_;
+ 
+-  // To be called when the data for the given country code was loaded.
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+-
+   // Weak pointer factory.
+   base::WeakPtrFactory<RegionComboboxModel> weak_factory_{this};
+ };
+diff --git a/ui/base/models/combobox_model.cc b/ui/base/models/combobox_model.cc
+index d307ee0ec592ae01a1d04cef85c0a492b7f7e29e..413adebd0349e304006de0cc0c4e2a4536ebbf06 100644
+--- a/ui/base/models/combobox_model.cc
++++ b/ui/base/models/combobox_model.cc
+@@ -4,10 +4,18 @@
+ 
+ #include "ui/base/models/combobox_model.h"
+ 
++#include "ui/base/models/combobox_model_observer.h"
+ #include "ui/base/models/image_model.h"
+ 
+ namespace ui {
+ 
++ComboboxModel::ComboboxModel() = default;
++
++ComboboxModel::~ComboboxModel() {
++  for (auto& observer : observers_)
++    observer.OnComboboxModelDestroying(this);
++}
++
+ std::u16string ComboboxModel::GetDropDownTextAt(int index) const {
+   return GetItemAt(index);
+ }
+@@ -36,4 +44,12 @@ bool ComboboxModel::IsItemEnabledAt(int index) const {
+   return true;
+ }
+ 
++void ComboboxModel::AddObserver(ComboboxModelObserver* observer) {
++  observers_.AddObserver(observer);
++}
++
++void ComboboxModel::RemoveObserver(ComboboxModelObserver* observer) {
++  observers_.RemoveObserver(observer);
++}
++
+ }  // namespace ui
+diff --git a/ui/base/models/combobox_model.h b/ui/base/models/combobox_model.h
+index 5264aaa5550859fce39a8485feff16c8fd83d897..eeff7dc8444e77fd598eb7ce05ab18259a9d7ef5 100644
+--- a/ui/base/models/combobox_model.h
++++ b/ui/base/models/combobox_model.h
+@@ -8,6 +8,7 @@
+ #include <string>
+ 
+ #include "base/component_export.h"
++#include "base/observer_list.h"
+ 
+ namespace ui {
+ 
+@@ -17,7 +18,8 @@ class ImageModel;
+ // A data model for a combo box.
+ class COMPONENT_EXPORT(UI_BASE) ComboboxModel {
+  public:
+-  virtual ~ComboboxModel() {}
++  ComboboxModel();
++  virtual ~ComboboxModel();
+ 
+   // Returns the number of items in the combo box.
+   virtual int GetItemCount() const = 0;
+@@ -52,9 +54,17 @@ class COMPONENT_EXPORT(UI_BASE) ComboboxModel {
+   // Returns true if the item at |index| is enabled.
+   virtual bool IsItemEnabledAt(int index) const;
+ 
+-  // Adds/removes an observer. Override if model supports mutation.
+-  virtual void AddObserver(ComboboxModelObserver* observer) {}
+-  virtual void RemoveObserver(ComboboxModelObserver* observer) {}
++  // Adds/removes an observer.
++  void AddObserver(ComboboxModelObserver* observer);
++  void RemoveObserver(ComboboxModelObserver* observer);
++
++ protected:
++  base::ObserverList<ui::ComboboxModelObserver>& observers() {
++    return observers_;
++  }
++
++ private:
++  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ }  // namespace ui
+diff --git a/ui/base/models/combobox_model_observer.h b/ui/base/models/combobox_model_observer.h
+index 5e00ab68a0c14d0b48317ca287e3f105351a102c..44325ff0aa94b75eb662be1637f44aa5524a33e8 100644
+--- a/ui/base/models/combobox_model_observer.h
++++ b/ui/base/models/combobox_model_observer.h
+@@ -16,10 +16,13 @@ class ComboboxModel;
+ class COMPONENT_EXPORT(UI_BASE) ComboboxModelObserver
+     : public base::CheckedObserver {
+  public:
+-  // Invoked when |model| has changed in some way. The observer should assume
++  // Invoked when `model` has changed in some way. The observer should assume
+   // everything changed.
+   virtual void OnComboboxModelChanged(ComboboxModel* model) = 0;
+ 
++  // Invoked when `model` is destroyed. The observer should stop observing.
++  virtual void OnComboboxModelDestroying(ComboboxModel* model) = 0;
++
+  protected:
+   ~ComboboxModelObserver() override = default;
+ };
+diff --git a/ui/views/controls/combobox/combobox.cc b/ui/views/controls/combobox/combobox.cc
+index aa135250e469d2405fba618c96b0bf38acaf59f0..b8d41cfeb67f3b4c098b2b329b2dfa7fe246dabb 100644
+--- a/ui/views/controls/combobox/combobox.cc
++++ b/ui/views/controls/combobox/combobox.cc
+@@ -578,6 +578,10 @@ void Combobox::OnComboboxModelChanged(ui::ComboboxModel* model) {
+   OnContentSizeMaybeChanged();
+ }
+ 
++void Combobox::OnComboboxModelDestroying(ui::ComboboxModel* model) {
++  SetModel(nullptr);
++}
++
+ const base::RepeatingClosure& Combobox::GetCallback() const {
+   return callback_;
+ }
+diff --git a/ui/views/controls/combobox/combobox.h b/ui/views/controls/combobox/combobox.h
+index fc77f8e49cead5fb689fba3d56c65c1b8e69f298..1a3f533256eca91e4fd4552ee5425b7ca8e7ad7e 100644
+--- a/ui/views/controls/combobox/combobox.h
++++ b/ui/views/controls/combobox/combobox.h
+@@ -131,6 +131,7 @@ class VIEWS_EXPORT Combobox : public View,
+  protected:
+   // Overridden from ComboboxModelObserver:
+   void OnComboboxModelChanged(ui::ComboboxModel* model) override;
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override;
+ 
+   // Getters to be used by metadata.
+   const base::RepeatingClosure& GetCallback() const;
+diff --git a/ui/views/controls/combobox/combobox_unittest.cc b/ui/views/controls/combobox/combobox_unittest.cc
+index 7ce20acc4b3ecd6470d5f017f9171d0be35c09d2..91661f33074d3453b4f28a410ecc918b793f86c6 100644
+--- a/ui/views/controls/combobox/combobox_unittest.cc
++++ b/ui/views/controls/combobox/combobox_unittest.cc
+@@ -84,13 +84,6 @@ class TestComboboxModel : public ui::ComboboxModel {
+     return 0;
+   }
+ 
+-  void AddObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.AddObserver(observer);
+-  }
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.RemoveObserver(observer);
+-  }
+-
+   void SetSeparators(const std::set<int>& separators) {
+     separators_ = separators;
+     OnModelChanged();
+@@ -103,11 +96,10 @@ class TestComboboxModel : public ui::ComboboxModel {
+ 
+  private:
+   void OnModelChanged() {
+-    for (auto& observer : observers_)
++    for (auto& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ 
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+   std::set<int> separators_;
+   int item_count_ = kItemCount;
+ };
+@@ -134,20 +126,13 @@ class VectorComboboxModel : public ui::ComboboxModel {
+   }
+   bool IsItemSeparatorAt(int index) const override { return false; }
+   int GetDefaultIndex() const override { return default_index_; }
+-  void AddObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.AddObserver(observer);
+-  }
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.RemoveObserver(observer);
+-  }
+ 
+   void ValuesChanged() {
+-    for (auto& observer : observers_)
++    for (auto& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ 
+  private:
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+   int default_index_ = 0;
+   const raw_ptr<std::vector<std::string>> values_;
+ };
+@@ -884,6 +869,15 @@ TEST_F(ComboboxTest, SetTooltipTextNotifiesAccessibilityEvent) {
+   EXPECT_EQ(test_tooltip_text, ASCIIToUTF16(name));
+ }
+ 
++// Regression test for crbug.com/1264288.
++// Should fail in ASan build before the fix.
++TEST_F(ComboboxTest, NoCrashWhenComboboxOutlivesModel) {
++  auto model = std::make_unique<TestComboboxModel>();
++  auto combobox = std::make_unique<TestCombobox>(model.get());
++  model.reset();
++  combobox.reset();
++}
++
+ namespace {
+ 
+ using ComboboxDefaultTest = ViewsTestBase;
+diff --git a/ui/views/controls/editable_combobox/editable_combobox.cc b/ui/views/controls/editable_combobox/editable_combobox.cc
+index b5301bfb0a3c8da3daa1d3646c2f4872cef2cdab..faac607fefcc8caf572eb83456e7520146c1d0ad 100644
+--- a/ui/views/controls/editable_combobox/editable_combobox.cc
++++ b/ui/views/controls/editable_combobox/editable_combobox.cc
+@@ -190,10 +190,15 @@ class EditableCombobox::EditableComboboxMenuModel
+     return combobox_model_->GetDropDownIconAt(items_shown_[index].index);
+   }
+ 
++  // ComboboxModelObserver:
+   void OnComboboxModelChanged(ui::ComboboxModel* model) override {
+     UpdateItemsShown();
+   }
+ 
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override {
++    observation_.Reset();
++  }
++
+   int GetItemCount() const override { return items_shown_.size(); }
+ 
+  private:

patches/chromium/cherry-pick-9b5207569882.patch

@@ -0,0 +1,179 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ken Rockot <rockot@google.com>
+Date: Wed, 31 Aug 2022 15:39:45 +0000
+Subject: Mojo: Validate response message type
+
+Ensures that a response message is actually the type expected by the
+original request.
+
+Fixed: 1358134
+Change-Id: I8f8f58168764477fbf7a6d2e8aeb040f07793d45
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3864274
+Reviewed-by: Robert Sesek <rsesek@chromium.org>
+Commit-Queue: Ken Rockot <rockot@google.com>
+Cr-Commit-Position: refs/heads/main@{#1041553}
+
+diff --git a/mojo/public/cpp/bindings/interface_endpoint_client.h b/mojo/public/cpp/bindings/interface_endpoint_client.h
+index 01cba995429b0accc21986aba0e3de17d013ee95..d3a1ab3a13a6662239ec28f99e5865afa54356b3 100644
+--- a/mojo/public/cpp/bindings/interface_endpoint_client.h
++++ b/mojo/public/cpp/bindings/interface_endpoint_client.h
+@@ -222,20 +222,32 @@ class COMPONENT_EXPORT(MOJO_CPP_BINDINGS) InterfaceEndpointClient
+   void ForgetAsyncRequest(uint64_t request_id);
+ 
+  private:
+-  // Maps from the id of a response to the MessageReceiver that handles the
+-  // response.
+-  using AsyncResponderMap =
+-      std::map<uint64_t, std::unique_ptr<MessageReceiver>>;
++  struct PendingAsyncResponse {
++   public:
++    PendingAsyncResponse(uint32_t request_message_name,
++                         std::unique_ptr<MessageReceiver> responder);
++    PendingAsyncResponse(PendingAsyncResponse&&);
++    PendingAsyncResponse(const PendingAsyncResponse&) = delete;
++    PendingAsyncResponse& operator=(PendingAsyncResponse&&);
++    PendingAsyncResponse& operator=(const PendingAsyncResponse&) = delete;
++    ~PendingAsyncResponse();
++
++    uint32_t request_message_name;
++    std::unique_ptr<MessageReceiver> responder;
++  };
++
++  using AsyncResponderMap = std::map<uint64_t, PendingAsyncResponse>;
+ 
+   struct SyncResponseInfo {
+    public:
+-    explicit SyncResponseInfo(bool* in_response_received);
++    SyncResponseInfo(uint32_t request_message_name, bool* in_response_received);
+ 
+     SyncResponseInfo(const SyncResponseInfo&) = delete;
+     SyncResponseInfo& operator=(const SyncResponseInfo&) = delete;
+ 
+     ~SyncResponseInfo();
+ 
++    uint32_t request_message_name;
+     Message response;
+ 
+     // Points to a stack-allocated variable.
+diff --git a/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc b/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc
+index b9db8f31a42b956c6125852cf162dc524d5308e6..6e87db197c603d8ac44b591f2cd70023217dcbe2 100644
+--- a/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc
++++ b/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc
+@@ -28,6 +28,7 @@
+ #include "mojo/public/cpp/bindings/sync_call_restrictions.h"
+ #include "mojo/public/cpp/bindings/sync_event_watcher.h"
+ #include "mojo/public/cpp/bindings/thread_safe_proxy.h"
++#include "third_party/abseil-cpp/absl/types/optional.h"
+ #include "third_party/perfetto/protos/perfetto/trace/track_event/chrome_mojo_event_info.pbzero.h"
+ 
+ namespace mojo {
+@@ -314,9 +315,27 @@ class ResponderThunk : public MessageReceiverWithStatus {
+ 
+ // ----------------------------------------------------------------------------
+ 
++InterfaceEndpointClient::PendingAsyncResponse::PendingAsyncResponse(
++    uint32_t request_message_name,
++    std::unique_ptr<MessageReceiver> responder)
++    : request_message_name(request_message_name),
++      responder(std::move(responder)) {}
++
++InterfaceEndpointClient::PendingAsyncResponse::PendingAsyncResponse(
++    PendingAsyncResponse&&) = default;
++
++InterfaceEndpointClient::PendingAsyncResponse&
++InterfaceEndpointClient::PendingAsyncResponse::operator=(
++    PendingAsyncResponse&&) = default;
++
++InterfaceEndpointClient::PendingAsyncResponse::~PendingAsyncResponse() =
++    default;
++
+ InterfaceEndpointClient::SyncResponseInfo::SyncResponseInfo(
++    uint32_t request_message_name,
+     bool* in_response_received)
+-    : response_received(in_response_received) {}
++    : request_message_name(request_message_name),
++      response_received(in_response_received) {}
+ 
+ InterfaceEndpointClient::SyncResponseInfo::~SyncResponseInfo() {}
+ 
+@@ -604,6 +623,7 @@ bool InterfaceEndpointClient::SendMessageWithResponder(
+   // message before calling |SendMessage()| below.
+ #endif
+ 
++  const uint32_t message_name = message->name();
+   const bool is_sync = message->has_flag(Message::kFlagIsSync);
+   const bool exclusive_wait = message->has_flag(Message::kFlagNoInterrupt);
+   if (!controller_->SendMessage(message))
+@@ -620,7 +640,8 @@ bool InterfaceEndpointClient::SendMessageWithResponder(
+       controller_->RegisterExternalSyncWaiter(request_id);
+     }
+     base::AutoLock lock(async_responders_lock_);
+-    async_responders_[request_id] = std::move(responder);
++    async_responders_.emplace(
++        request_id, PendingAsyncResponse{message_name, std::move(responder)});
+     return true;
+   }
+ 
+@@ -628,7 +649,8 @@ bool InterfaceEndpointClient::SendMessageWithResponder(
+ 
+   bool response_received = false;
+   sync_responses_.insert(std::make_pair(
+-      request_id, std::make_unique<SyncResponseInfo>(&response_received)));
++      request_id,
++      std::make_unique<SyncResponseInfo>(message_name, &response_received)));
+ 
+   base::WeakPtr<InterfaceEndpointClient> weak_self =
+       weak_ptr_factory_.GetWeakPtr();
+@@ -806,13 +828,13 @@ void InterfaceEndpointClient::ResetFromAnotherSequenceUnsafe() {
+ }
+ 
+ void InterfaceEndpointClient::ForgetAsyncRequest(uint64_t request_id) {
+-  std::unique_ptr<MessageReceiver> responder;
++  absl::optional<PendingAsyncResponse> response;
+   {
+     base::AutoLock lock(async_responders_lock_);
+     auto it = async_responders_.find(request_id);
+     if (it == async_responders_.end())
+       return;
+-    responder = std::move(it->second);
++    response = std::move(it->second);
+     async_responders_.erase(it);
+   }
+ }
+@@ -893,6 +915,10 @@ bool InterfaceEndpointClient::HandleValidatedMessage(Message* message) {
+         return false;
+ 
+       if (it->second) {
++        if (message->name() != it->second->request_message_name) {
++          return false;
++        }
++
+         it->second->response = std::move(*message);
+         *it->second->response_received = true;
+         return true;
+@@ -903,18 +929,22 @@ bool InterfaceEndpointClient::HandleValidatedMessage(Message* message) {
+       sync_responses_.erase(it);
+     }
+ 
+-    std::unique_ptr<MessageReceiver> responder;
++    absl::optional<PendingAsyncResponse> pending_response;
+     {
+       base::AutoLock lock(async_responders_lock_);
+       auto it = async_responders_.find(request_id);
+       if (it == async_responders_.end())
+         return false;
+-      responder = std::move(it->second);
++      pending_response = std::move(it->second);
+       async_responders_.erase(it);
+     }
+ 
++    if (message->name() != pending_response->request_message_name) {
++      return false;
++    }
++
+     internal::MessageDispatchContext dispatch_context(message);
+-    return responder->Accept(message);
++    return pending_response->responder->Accept(message);
+   } else {
+     if (mojo::internal::ControlMessageHandler::IsControlMessage(message))
+       return control_message_handler_.Accept(message);

patches/chromium/cherry-pick-bd9724c9fe63.patch

@@ -0,0 +1,203 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Min Qin <qinmin@chromium.org>
+Date: Tue, 28 Jun 2022 16:27:43 +0000
+Subject: passing update_first_party_url_on_redirect=false for fetch
+
+Background fetch doesn't work like regular download as it is not
+considered a top frame navigation. This CL let background fetch to
+pass update_first_party_url_on_redirect=false to DownloadURLParameters,
+and handle it properly w.r.t samesite cookies.
+
+BUG=1268580
+
+(cherry picked from commit bf1e93c6af21dad12088b615feda07a90a85c158)
+
+Change-Id: I3a1cc33be8578d5d8c796dbbb21fa35a47bdda36
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3712307
+Reviewed-by: Rayan Kanso <rayankans@chromium.org>
+Commit-Queue: Min Qin <qinmin@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1016316}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3727786
+Cr-Commit-Position: refs/branch-heads/5112@{#397}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/components/background_fetch/background_fetch_delegate_base.cc b/components/background_fetch/background_fetch_delegate_base.cc
+index 5f88192eb4e92d4c41c79db188b8b9982f005258..26f7716ae83b70cdcf7cdb23652c2c56d7dc27bf 100644
+--- a/components/background_fetch/background_fetch_delegate_base.cc
++++ b/components/background_fetch/background_fetch_delegate_base.cc
+@@ -101,6 +101,7 @@ void BackgroundFetchDelegateBase::DownloadUrl(
+                           weak_ptr_factory_.GetWeakPtr());
+   params.traffic_annotation =
+       net::MutableNetworkTrafficAnnotationTag(traffic_annotation);
++  params.request_params.update_first_party_url_on_redirect = false;
+ 
+   JobDetails* job_details = GetJobDetails(job_id);
+   if (job_details->job_state == JobDetails::State::kPendingWillStartPaused ||
+diff --git a/components/download/content/internal/download_driver_impl.cc b/components/download/content/internal/download_driver_impl.cc
+index 2b2da55b06e3b4859f439d5b3bf7013b981b75a0..b207ce5c6bd3c332a34885e1dc58cc11d91fe31c 100644
+--- a/components/download/content/internal/download_driver_impl.cc
++++ b/components/download/content/internal/download_driver_impl.cc
+@@ -229,6 +229,8 @@ void DownloadDriverImpl::Start(
+     download_url_params->set_isolation_info(
+         request_params.isolation_info.value());
+   }
++  download_url_params->set_update_first_party_url_on_redirect(
++      request_params.update_first_party_url_on_redirect);
+ 
+   download_manager_coordinator_->DownloadUrl(std::move(download_url_params));
+ }
+diff --git a/components/download/internal/common/download_utils.cc b/components/download/internal/common/download_utils.cc
+index 11f524861320eae8ab694022d97a6fe2ac7366ce..454326720b5c88cc61e4527790797fd7f522014d 100644
+--- a/components/download/internal/common/download_utils.cc
++++ b/components/download/internal/common/download_utils.cc
+@@ -386,8 +386,10 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
+     // cross-site URL has been visited before.
+     url::Origin origin = url::Origin::Create(params->url());
+     request->trusted_params->isolation_info = net::IsolationInfo::Create(
+-        net::IsolationInfo::RequestType::kMainFrame, origin, origin,
+-        net::SiteForCookies::FromOrigin(origin));
++        params->update_first_party_url_on_redirect()
++            ? net::IsolationInfo::RequestType::kMainFrame
++            : net::IsolationInfo::RequestType::kOther,
++        origin, origin, net::SiteForCookies::FromOrigin(origin));
+     request->site_for_cookies = net::SiteForCookies::FromUrl(params->url());
+   }
+ 
+@@ -395,7 +397,8 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
+   request->referrer = params->referrer();
+   request->referrer_policy = params->referrer_policy();
+   request->is_outermost_main_frame = true;
+-  request->update_first_party_url_on_redirect = true;
++  request->update_first_party_url_on_redirect =
++      params->update_first_party_url_on_redirect();
+ 
+   // Downloads should be treated as navigations from Fetch spec perspective.
+   // See also:
+diff --git a/components/download/public/background_service/download_params.h b/components/download/public/background_service/download_params.h
+index 8b911276e757ee889ed05a3fd60cc365ad8f1982..a976d470094462be735e81cf097f32b34c258270 100644
+--- a/components/download/public/background_service/download_params.h
++++ b/components/download/public/background_service/download_params.h
+@@ -126,6 +126,12 @@ struct RequestParams {
+   // be invalidate during download resumption in new browser session. Not
+   // supported on iOS.
+   absl::optional<net::IsolationInfo> isolation_info;
++
++  // First-party URL redirect policy: During server redirects, whether the
++  // first-party URL for cookies will need to be changed. Download is normally
++  // considered a main frame navigation. However, this is not true for
++  // background fetch.
++  bool update_first_party_url_on_redirect = true;
+ };
+ 
+ // The parameters that describe a download request made to the DownloadService.
+diff --git a/components/download/public/common/download_url_parameters.cc b/components/download/public/common/download_url_parameters.cc
+index 3dec7148d86cd3892670df8b95dcb78d49616e89..25ea6f13e0df9f23364b75c48b870d8ea6a53e92 100644
+--- a/components/download/public/common/download_url_parameters.cc
++++ b/components/download/public/common/download_url_parameters.cc
+@@ -34,7 +34,8 @@ DownloadUrlParameters::DownloadUrlParameters(
+       traffic_annotation_(traffic_annotation),
+       download_source_(DownloadSource::UNKNOWN),
+       require_safety_checks_(true),
+-      has_user_gesture_(false) {}
++      has_user_gesture_(false),
++      update_first_party_url_on_redirect_(true) {}
+ 
+ DownloadUrlParameters::~DownloadUrlParameters() = default;
+ 
+diff --git a/components/download/public/common/download_url_parameters.h b/components/download/public/common/download_url_parameters.h
+index ba0a03cb035a79651967ac2882f89f577bd0c012..61eb9af8a00c3e4adf700178994a9e6e864bcf0c 100644
+--- a/components/download/public/common/download_url_parameters.h
++++ b/components/download/public/common/download_url_parameters.h
+@@ -279,6 +279,11 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+     has_user_gesture_ = has_user_gesture;
+   }
+ 
++  void set_update_first_party_url_on_redirect(
++      bool update_first_party_url_on_redirect) {
++    update_first_party_url_on_redirect_ = update_first_party_url_on_redirect;
++  }
++
+   OnStartedCallback& callback() { return callback_; }
+   bool content_initiated() const { return content_initiated_; }
+   const std::string& last_modified() const { return last_modified_; }
+@@ -335,6 +340,9 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+     return isolation_info_;
+   }
+   bool has_user_gesture() const { return has_user_gesture_; }
++  bool update_first_party_url_on_redirect() const {
++    return update_first_party_url_on_redirect_;
++  }
+ 
+   // STATE CHANGING: All save_info_ sub-objects will be in an indeterminate
+   // state following this call.
+@@ -383,6 +391,7 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+   bool require_safety_checks_;
+   absl::optional<net::IsolationInfo> isolation_info_;
+   bool has_user_gesture_;
++  bool update_first_party_url_on_redirect_;
+ };
+ 
+ }  // namespace download
+diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
+index 6dcc861171b7034d7426c5c683cafca689e3d7ea..500521ce2c383d40c13a9359ba4c49d3417670f7 100644
+--- a/content/browser/download/download_browsertest.cc
++++ b/content/browser/download/download_browsertest.cc
+@@ -3763,6 +3763,58 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, UpdateSiteForCookies) {
+                                 site_a.GetURL("a.test", "/")));
+ }
+ 
++// Tests that if `update_first_party_url_on_redirect` is set to false, download
++// will not behave like a top-level frame navigation and SameSite=Strict cookies
++// will not be set on a redirection.
++IN_PROC_BROWSER_TEST_F(
++    DownloadContentTest,
++    SiteForCookies_DownloadUrl_NotUpdateFirstPartyUrlOnRedirect) {
++  net::EmbeddedTestServer site_a;
++  net::EmbeddedTestServer site_b;
++
++  base::StringPairs cookie_headers;
++  cookie_headers.push_back(std::make_pair(
++      std::string("Set-Cookie"), std::string("A=strict; SameSite=Strict")));
++  cookie_headers.push_back(std::make_pair(std::string("Set-Cookie"),
++                                          std::string("B=lax; SameSite=Lax")));
++
++  // This will request a URL on b.test, which redirects to a url that sets the
++  // cookies on a.test.
++  site_a.RegisterRequestHandler(CreateBasicResponseHandler(
++      "/sets-samesite-cookies", net::HTTP_OK, cookie_headers,
++      "application/octet-stream", "abcd"));
++  ASSERT_TRUE(site_a.Start());
++  site_b.RegisterRequestHandler(
++      CreateRedirectHandler("/redirected-download",
++                            site_a.GetURL("a.test", "/sets-samesite-cookies")));
++  ASSERT_TRUE(site_b.Start());
++
++  // Download the file.
++  SetupEnsureNoPendingDownloads();
++  std::unique_ptr<download::DownloadUrlParameters> download_parameters(
++      DownloadRequestUtils::CreateDownloadForWebContentsMainFrame(
++          shell()->web_contents(),
++          site_b.GetURL("b.test", "/redirected-download"),
++          TRAFFIC_ANNOTATION_FOR_TESTS));
++  download_parameters->set_update_first_party_url_on_redirect(false);
++  std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
++  DownloadManagerForShell(shell())->DownloadUrl(std::move(download_parameters));
++  observer->WaitForFinished();
++
++  // Get the important info from other threads and check it.
++  EXPECT_TRUE(EnsureNoPendingDownloads());
++
++  std::vector<download::DownloadItem*> downloads;
++  DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
++  ASSERT_EQ(1u, downloads.size());
++  ASSERT_EQ(download::DownloadItem::COMPLETE, downloads[0]->GetState());
++
++  // Check that the cookies were not set on a.test.
++  EXPECT_EQ("",
++            content::GetCookies(shell()->web_contents()->GetBrowserContext(),
++                                site_a.GetURL("a.test", "/")));
++}
++
+ // Verifies that isolation info set in DownloadUrlParameters can be populated.
+ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
+                        SiteForCookies_DownloadUrl_IsolationInfoPopulated) {

patches/chromium/cherry-pick-c643d18a078d.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Rayan Kanso <rayankans@google.com>
+Date: Tue, 7 Jun 2022 13:13:36 +0000
+Subject: Don't expose URL chain in case of CO redirect
+
+Bug: 1278255
+Change-Id: If853327b853e29792e5c8d1dfaeecf21d6fec004
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3693143
+Reviewed-by: Susanne Westphal <swestphal@google.com>
+Commit-Queue: Rayan Kanso <rayankans@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1011409}
+
+diff --git a/content/browser/background_fetch/storage/mark_request_complete_task.cc b/content/browser/background_fetch/storage/mark_request_complete_task.cc
+index 32a818ba8723f020fa536eb93a31c16b76ed92a1..d729dfc5d505c4c23872ef535a8b09f1af065914 100644
+--- a/content/browser/background_fetch/storage/mark_request_complete_task.cc
++++ b/content/browser/background_fetch/storage/mark_request_complete_task.cc
+@@ -104,6 +104,8 @@ void MarkRequestCompleteTask::StoreResponse(base::OnceClosure done_closure) {
+   BackgroundFetchCrossOriginFilter filter(
+       registration_id_.storage_key().origin(), *request_info_);
+   if (!filter.CanPopulateBody()) {
++    // Don't expose the initial URL in case of cross-origin redirects.
++    response_->url_list.resize(1);
+     failure_reason_ = proto::BackgroundFetchRegistration::FETCH_ERROR;
+     // No point writing the response to the cache since it won't be exposed.
+     CreateAndStoreCompletedRequest(std::move(done_closure));

patches/chromium/chore_add_electron_deps_to_gitignores.patch

@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Samuel Attard <sattard@salesforce.com>
+Date: Tue, 26 Jul 2022 00:05:29 -0700
+Subject: chore: add electron deps to gitignores
+
+Makes things like "git status" quicker when developing electron locally
+
+diff --git a/.gitignore b/.gitignore
+index cc0150c39bf635fa09d3efe9bfea2997b0b8263a..cdca4c4a9cccb7de0b13c8b803d6c74ba4d63d3a 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -224,6 +224,7 @@ vs-chromium-project.txt
+ /delegate_execute
+ /device/serial/device_serial_mojo.xml
+ /docs/website
++/electron
+ /google_apis/gcm/gcm.xml
+ /google_apis/internal
+ /googleurl
+diff --git a/third_party/.gitignore b/third_party/.gitignore
+index 567e1de3c31b2275e07b897c2644c91aef9ca076..a6744fa9d31781c6ee866ba6291588caf44e8559 100644
+--- a/third_party/.gitignore
++++ b/third_party/.gitignore
+@@ -83,6 +83,7 @@
+ /directxsdk
+ /dom_distiller_js/dist
+ /eigen3/src
++/electron_node
+ /elfutils/src
+ /emoji-segmenter/src
+ /emoji-metadata/src
+@@ -177,6 +178,7 @@
+ /mocha
+ /mockito/src
+ /nacl_sdk_binaries/
++/nan
+ /nasm
+ /nearby/src
+ /neon_2_sse/src
+@@ -239,6 +241,7 @@
+ /speex
+ /sqlite/src
+ /sqlite4java/lib/
++/squirrel.mac
+ /subresource-filter-ruleset/data/UnindexedRules
+ /swift-format
+ /swiftshader/

patches/chromium/chore_allow_chromium_to_handle_synthetic_mouse_events_for_touch.patch

@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: deepak1556 <hop2deep@gmail.com>
+Date: Fri, 29 Jul 2022 00:29:35 +0900
+Subject: chore: allow chromium to handle synthetic mouse events for touch
+
+With WCO, allow chromium to handle synthetic mouse events generated for touch
+actions in the non-client caption area.
+
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+index 9fd052c00a484cd1acd2031fda79e6307fd01b60..016dfe880a48168154c08839afa540880c2d52be 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+@@ -1169,6 +1169,10 @@ void DesktopWindowTreeHostWin::HandleWindowScaleFactorChanged(
+   }
+ }
+ 
++bool DesktopWindowTreeHostWin::HandleMouseEventForCaption(UINT message) const {
++  return false;
++}
++
+ DesktopNativeCursorManager*
+ DesktopWindowTreeHostWin::GetSingletonDesktopNativeCursorManager() {
+   return new DesktopNativeCursorManagerWin();
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+index 444581249014a8ce301591f269dbb194f0520732..9377f26b081b717db6b50c13ce3795907cf2fcd2 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+@@ -262,6 +262,7 @@ class VIEWS_EXPORT DesktopWindowTreeHostWin
+   void HandleWindowSizeChanging() override;
+   void HandleWindowSizeUnchanged() override;
+   void HandleWindowScaleFactorChanged(float window_scale_factor) override;
++  bool HandleMouseEventForCaption(UINT message) const override;
+ 
+   Widget* GetWidget();
+   const Widget* GetWidget() const;
+diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
+index 01ff95be00b3911749f66a136b2b5a6c02156bd3..23e8794c0551c377269ebecd6684206fc7087553 100644
+--- a/ui/views/win/hwnd_message_handler.cc
++++ b/ui/views/win/hwnd_message_handler.cc
+@@ -3064,15 +3064,19 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
+       SetMsgHandled(FALSE);
+     // We must let Windows handle the caption buttons if it's drawing them, or
+     // they won't work.
++    bool simulate_mouse_event_for_caption = false;
+     if (delegate_->GetFrameMode() == FrameMode::SYSTEM_DRAWN &&
+         (hittest == HTCLOSE || hittest == HTMINBUTTON ||
+          hittest == HTMAXBUTTON)) {
+-      SetMsgHandled(FALSE);
++      simulate_mouse_event_for_caption =
++          delegate_->HandleMouseEventForCaption(message);
++      if (!simulate_mouse_event_for_caption)
++        SetMsgHandled(FALSE);
+     }
+     // Let resize events fall through. Ignore everything else, as we're either
+     // letting Windows handle it above or we've already handled the equivalent
+     // touch message.
+-    if (!IsHitTestOnResizeHandle(hittest))
++    if (!IsHitTestOnResizeHandle(hittest) && !simulate_mouse_event_for_caption)
+       return 0;
+   }
+ 
+diff --git a/ui/views/win/hwnd_message_handler_delegate.h b/ui/views/win/hwnd_message_handler_delegate.h
+index 5dbb192d0840ca0ded61397c399b774a8cb05cce..098a9c3140e9e140fdc8f0dc9cf4e8ec84451221 100644
+--- a/ui/views/win/hwnd_message_handler_delegate.h
++++ b/ui/views/win/hwnd_message_handler_delegate.h
+@@ -258,6 +258,10 @@ class VIEWS_EXPORT HWNDMessageHandlerDelegate {
+   // Called when the window scale factor has changed.
+   virtual void HandleWindowScaleFactorChanged(float window_scale_factor) = 0;
+ 
++  // Called when synthetic mouse event is generated for touch event on
++  // caption buttons.
++  virtual bool HandleMouseEventForCaption(UINT message) const = 0;
++
+  protected:
+   virtual ~HWNDMessageHandlerDelegate() = default;
+ };

patches/chromium/disable_color_correct_rendering.patch

@@ -20,14 +20,15 @@ to deal with color spaces. That is being tracked at
 https://crbug.com/634542 and https://crbug.com/711107.
 
 diff --git a/cc/trees/layer_tree_host_impl.cc b/cc/trees/layer_tree_host_impl.cc
-index 14e13169de8b5e808e3284792237bef9939b1e00..7628a96dc8b2c9e8128cd462138d3487304c6e10 100644
+index 14e13169de8b5e808e3284792237bef9939b1e00..67839f87fb0dcb2eed9bc001806020befbed5f66 100644
 --- a/cc/trees/layer_tree_host_impl.cc
 +++ b/cc/trees/layer_tree_host_impl.cc
-@@ -1894,6 +1894,9 @@ void LayerTreeHostImpl::SetIsLikelyToRequireADraw(
+@@ -1894,6 +1894,10 @@ void LayerTreeHostImpl::SetIsLikelyToRequireADraw(
  TargetColorParams LayerTreeHostImpl::GetTargetColorParams(
      gfx::ContentColorUsage content_color_usage) const {
    TargetColorParams params;
 +  if (!settings_.enable_color_correct_rendering) {
++    params.color_space = gfx::ColorSpace();
 +    return params;
 +  }
  
@@ -259,8 +260,21 @@ index 09f72f1fbd7b782c5bf52245482b358103f0c243..80d9fd40efed1edc90e7bdf1db534acb
      switches::kDisableInProcessStackTraces,
      sandbox::policy::switches::kDisableSeccompFilterSandbox,
      sandbox::policy::switches::kNoSandbox,
+diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+index 396b2983f403b0684f952a5fbd2d0abf947328f0..35c44065ba8980c06bb35e64aa33cc5b3f290953 100644
+--- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
++++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+@@ -6194,7 +6194,7 @@ void WebGLRenderingContextBase::TexImageHelperImageBitmap(
+                                      : SkColorSpace::MakeSRGB();
+   const bool needs_color_conversion =
+       !SkColorSpace::Equals(unpack_color_space.get(), image_color_space.get());
+-  if (needs_color_conversion) {
++  if (needs_color_conversion && unpack_color_space) {
+     image = image->ConvertToColorSpace(unpack_color_space,
+                                        image->GetSkColorInfo().colorType());
+     if (!image) {
 diff --git a/third_party/blink/renderer/platform/graphics/canvas_color_params.cc b/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
-index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..0f87961ecd8c24e3ba82c6bae187a12c9b112bd4 100644
+index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..e42f8ba89070477b06777c7a0c37d30c8c5e4ed1 100644
 --- a/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
 +++ b/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
 @@ -4,6 +4,7 @@
@@ -279,7 +293,18 @@ index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..0f87961ecd8c24e3ba82c6bae187a12c
  
  namespace blink {
  
-@@ -118,6 +120,11 @@ uint8_t CanvasColorParams::BytesPerPixel() const {
+@@ -19,6 +21,10 @@ namespace blink {
+ // Level 4 specification.
+ gfx::ColorSpace PredefinedColorSpaceToGfxColorSpace(
+     PredefinedColorSpace color_space) {
++  auto* cmd_line = base::CommandLine::ForCurrentProcess();
++  if (cmd_line->HasSwitch(switches::kDisableColorCorrectRendering)) {
++    return gfx::ColorSpace();
++  }
+   switch (color_space) {
+     case PredefinedColorSpace::kSRGB:
+       return gfx::ColorSpace::CreateSRGB();
+@@ -118,6 +124,11 @@ uint8_t CanvasColorParams::BytesPerPixel() const {
  }
  
  gfx::ColorSpace CanvasColorParams::GetStorageGfxColorSpace() const {

patches/chromium/disable_gpu_acceleration_on_vmware_on_linux.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Zhenyao Mo <zmo@chromium.org>
+Date: Mon, 23 May 2022 21:43:16 +0000
+Subject: Disable GPU acceleration on VMware on Linux
+
+TEST=manual
+R=sunnyps@chromium.org
+
+Bug: 1327939
+Change-Id: Ib09b6623665ffecf0af1f9f8bc3ebef1ac042b2f
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3661941
+Auto-Submit: Zhenyao Mo <zmo@chromium.org>
+Commit-Queue: Zhenyao Mo <zmo@chromium.org>
+Commit-Queue: Maggie Chen <magchen@chromium.org>
+Reviewed-by: Maggie Chen <magchen@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1006613}
+
+diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
+index 8ed8faf0a0733568a81d955a5546d864d24f78b5..73b6e998f753cee5d77e6bd5983ed46702f13580 100644
+--- a/gpu/config/software_rendering_list.json
++++ b/gpu/config/software_rendering_list.json
+@@ -1699,6 +1699,18 @@
+       "features": [
+         "accelerated_video_encode"
+       ]
++    },
++    {
++      "id": 176,
++      "description": "VMware is buggy on Linux",
++      "cr_bugs": [1327939],
++      "os": {
++        "type": "linux"
++      },
++      "vendor_id": "0x15ad",
++      "features": [
++        "all"
++      ]
+     }
+   ]
+ }

patches/chromium/feat_add_set_can_resize_mutator.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Raymond Zhao <7199958+rzhao271@users.noreply.github.com>
+Date: Tue, 2 Aug 2022 09:30:36 -0700
+Subject: feat: Add set_can_resize mutator
+
+Adds a set_can_resize mutator to WidgetDelegate that
+doesn't emit the OnSizeConstraintsChanged event.
+This way, we can call set_can_resize from Electron before
+the widget is initialized to set the value earlier,
+and in turn, avoid showing a frame at startup
+for frameless applications.
+
+diff --git a/ui/views/widget/widget_delegate.h b/ui/views/widget/widget_delegate.h
+index 3375d6c3629235413362c4ed3d8c5a0eb53e23cd..8f4002ef6f5aa9b2cd8c1c911806772518d71f4b 100644
+--- a/ui/views/widget/widget_delegate.h
++++ b/ui/views/widget/widget_delegate.h
+@@ -328,6 +328,10 @@ class VIEWS_EXPORT WidgetDelegate {
+   // be cycled through with keyboard focus.
+   virtual void GetAccessiblePanes(std::vector<View*>* panes) {}
+ 
++  // A setter for the can_resize parameter that doesn't
++  // emit any events.
++  void set_can_resize(bool can_resize) { params_.can_resize = can_resize; }
++
+   // Setters for data parameters of the WidgetDelegate. If you use these
+   // setters, there is no need to override the corresponding virtual getters.
+   void SetAccessibleRole(ax::mojom::Role role);

patches/chromium/fix_mac_build_with_enable_plugins_false.patch

@@ -0,0 +1,119 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Thu, 23 Jun 2022 17:54:12 +0000
+Subject: Fix Mac build with enable_plugins=false.
+
+Remove spurious includes of plugin headers, and add appropriate #ifs.
+
+Bug: 1027360
+Change-Id: I445252f5de14dff8e89ab371429a24ad3e57ca97
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3719213
+Reviewed-by: Robert Sesek <rsesek@chromium.org>
+Reviewed-by: Thomas Lukaszewicz <tluk@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1017248}
+
+diff --git a/chrome/browser/app_controller_mac.mm b/chrome/browser/app_controller_mac.mm
+index 480244fb50f636f519485693b8d1a4cf5033c3b0..f426e30ff371c35382512d7ec7846ca6cf58515e 100644
+--- a/chrome/browser/app_controller_mac.mm
++++ b/chrome/browser/app_controller_mac.mm
+@@ -108,7 +108,6 @@
+ #include "components/prefs/pref_service.h"
+ #include "components/sessions/core/tab_restore_service.h"
+ #include "content/public/browser/download_manager.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "extensions/browser/extension_registry.h"
+ #include "extensions/browser/extension_system.h"
+ #include "net/base/filename_util.h"
+diff --git a/content/browser/sandbox_mac_unittest.mm b/content/browser/sandbox_mac_unittest.mm
+index 05e9b29d7a039094fb6fd63fb8b152439f089d41..b860c1e54f0ced814fb269087924d2f695f816f3 100644
+--- a/content/browser/sandbox_mac_unittest.mm
++++ b/content/browser/sandbox_mac_unittest.mm
+@@ -30,6 +30,7 @@
+ #include "content/browser/sandbox_parameters_mac.h"
+ #include "content/common/mac/font_loader.h"
+ #include "crypto/openssl_util.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "sandbox/mac/seatbelt.h"
+ #include "sandbox/mac/seatbelt_exec.h"
+ #include "sandbox/policy/mac/sandbox_mac.h"
+@@ -93,7 +94,9 @@ void ExecuteInAllSandboxTypes(const std::string& multiprocess_main,
+         sandbox::mojom::Sandbox::kCdm,
+         sandbox::mojom::Sandbox::kGpu,
+         sandbox::mojom::Sandbox::kNaClLoader,
++#if BUILDFLAG(ENABLE_PLUGINS)
+         sandbox::mojom::Sandbox::kPpapi,
++#endif
+         sandbox::mojom::Sandbox::kPrintBackend,
+         sandbox::mojom::Sandbox::kPrintCompositor,
+         sandbox::mojom::Sandbox::kRenderer,
+diff --git a/content/browser/sandbox_parameters_mac.mm b/content/browser/sandbox_parameters_mac.mm
+index 76a22420f605994ebe0a7ffa9a7f2a0535c2440f..cf8b251180177c3ea4f8ddb2450f0483d201ba2b 100644
+--- a/content/browser/sandbox_parameters_mac.mm
++++ b/content/browser/sandbox_parameters_mac.mm
+@@ -20,7 +20,6 @@
+ #include "base/strings/sys_string_conversions.h"
+ #include "base/system/sys_info.h"
+ #include "content/public/browser/content_browser_client.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/content_client.h"
+ #include "content/public/common/content_features.h"
+ #include "content/public/common/content_switches.h"
+@@ -34,6 +33,7 @@
+ #include "third_party/abseil-cpp/absl/types/optional.h"
+ 
+ #if BUILDFLAG(ENABLE_PLUGINS)
++#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/pepper_plugin_info.h"
+ #endif
+ 
+@@ -229,11 +229,11 @@ void SetupSandboxParameters(sandbox::mojom::Sandbox sandbox_type,
+     case sandbox::mojom::Sandbox::kNetwork:
+       SetupNetworkSandboxParameters(client);
+       break;
+-    case sandbox::mojom::Sandbox::kPpapi:
+ #if BUILDFLAG(ENABLE_PLUGINS)
++    case sandbox::mojom::Sandbox::kPpapi:
+       SetupPPAPISandboxParameters(client);
+-#endif
+       break;
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+       CHECK(false) << "Unhandled parameters for sandbox_type "
+                    << static_cast<int>(sandbox_type);
+diff --git a/sandbox/policy/mac/sandbox_mac.mm b/sandbox/policy/mac/sandbox_mac.mm
+index 34f8b003c96b9fff00b666ae184b5076e5d6fd45..11392b99ecad98f2cf39e67d545fe1947ede1593 100644
+--- a/sandbox/policy/mac/sandbox_mac.mm
++++ b/sandbox/policy/mac/sandbox_mac.mm
+@@ -12,6 +12,7 @@
+ #include "base/files/scoped_file.h"
+ #include "base/logging.h"
+ #include "base/posix/eintr_wrapper.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "printing/buildflags/buildflags.h"
+ #include "sandbox/policy/mac/audio.sb.h"
+ #include "sandbox/policy/mac/cdm.sb.h"
+@@ -69,9 +70,11 @@
+     case sandbox::mojom::Sandbox::kNetwork:
+       profile += kSeatbeltPolicyString_network;
+       break;
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
+       profile += kSeatbeltPolicyString_ppapi;
+       break;
++#endif
+ #if BUILDFLAG(ENABLE_PRINTING)
+     case sandbox::mojom::Sandbox::kPrintBackend:
+       profile += kSeatbeltPolicyString_print_backend;
+diff --git a/ui/views_content_client/views_content_client_main_parts_mac.mm b/ui/views_content_client/views_content_client_main_parts_mac.mm
+index 044600ad464fc48a805bf3e47811808983d43fef..df23f797e4f0898d9dc7742e05d286f540bfdacb 100644
+--- a/ui/views_content_client/views_content_client_main_parts_mac.mm
++++ b/ui/views_content_client/views_content_client_main_parts_mac.mm
+@@ -12,7 +12,6 @@
+ #include "base/mac/scoped_nsobject.h"
+ #include "base/path_service.h"
+ #include "content/public/browser/context_factory.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/content_paths.h"
+ #include "content/public/common/result_codes.h"
+ #include "content/shell/browser/shell_application_mac.h"

patches/chromium/fix_windows_build_with_enable_plugins_false.patch

@@ -0,0 +1,108 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Thu, 23 Jun 2022 18:52:27 +0000
+Subject: Fix Windows build with enable_plugins=false.
+
+Add some #if checks to Windows-only code so plugins enums are only
+referenced when plugins are enabled. Also only build
+plugin_list_unittest.cc when plugins are enabled.
+
+Bug: 1027360
+Change-Id: I0d265ae711e5e3401076dc89d1d49329f423ca64
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3719402
+Reviewed-by: Alex Gough <ajgo@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1017281}
+
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+index 939c28a029418bc353795aa1a007508680f42e57..2db6a0d23d72c3d77db6eec4de7c9d0f0500fbe2 100644
+--- a/chrome/browser/chrome_content_browser_client.cc
++++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -3951,7 +3951,9 @@ std::wstring ChromeContentBrowserClient::GetAppContainerSidForSandboxType(
+       return std::wstring();
+     case sandbox::mojom::Sandbox::kGpu:
+       return std::wstring();
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+     case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
+     case sandbox::mojom::Sandbox::kXrCompositing:
+@@ -4023,7 +4025,9 @@ bool ChromeContentBrowserClient::PreSpawnChild(
+       break;
+     case sandbox::mojom::Sandbox::kUtility:
+     case sandbox::mojom::Sandbox::kGpu:
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+     case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
+     case sandbox::mojom::Sandbox::kXrCompositing:
+diff --git a/chrome/child/pdf_child_init.cc b/chrome/child/pdf_child_init.cc
+index e53cfc60b41fe0d4eeb0362e9923f1e39e61a64d..8e0d72623bbb0c92c8fd8b97ab833c947806667b 100644
+--- a/chrome/child/pdf_child_init.cc
++++ b/chrome/child/pdf_child_init.cc
+@@ -14,6 +14,7 @@
+ #include "base/win/windows_version.h"
+ #include "content/public/child/child_thread.h"
+ #include "content/public/common/content_switches.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "sandbox/policy/mojom/sandbox.mojom.h"
+ #include "sandbox/policy/sandbox_type.h"
+ #include "sandbox/policy/switches.h"
+@@ -57,7 +58,9 @@ void MaybePatchGdiGetFontData() {
+   auto service_sandbox_type =
+       sandbox::policy::SandboxTypeFromCommandLine(command_line);
+   bool need_gdi =
++#if BUILDFLAG(ENABLE_PLUGINS)
+       service_sandbox_type == sandbox::mojom::Sandbox::kPpapi ||
++#endif
+       service_sandbox_type == sandbox::mojom::Sandbox::kPrintCompositor ||
+       service_sandbox_type == sandbox::mojom::Sandbox::kPdfConversion ||
+       (service_sandbox_type == sandbox::mojom::Sandbox::kRenderer &&
+diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
+index dec80de25675467a07d3c213538d240507916254..1df3675fed1656094e808fa4477ffd2ea126b83d 100644
+--- a/content/test/BUILD.gn
++++ b/content/test/BUILD.gn
+@@ -2168,7 +2168,6 @@ test("content_unittests") {
+     "../browser/payments/payment_manager_unittest.cc",
+     "../browser/permissions/permission_controller_impl_unittest.cc",
+     "../browser/picture_in_picture/picture_in_picture_service_impl_unittest.cc",
+-    "../browser/plugin_list_unittest.cc",
+     "../browser/ppapi_plugin_sandboxed_process_launcher_delegate_unittest.cc",
+     "../browser/prerender/prerender_host_registry_unittest.cc",
+     "../browser/prerender/prerender_host_unittest.cc",
+@@ -2870,8 +2869,8 @@ test("content_unittests") {
+     deps += [ "//ui/events:test_support" ]
+   }
+ 
+-  if (!is_win && !is_mac) {
+-    sources -= [ "../browser/plugin_list_unittest.cc" ]
++  if (enable_plugins && (is_win || is_mac)) {
++    sources += [ "../browser/plugin_list_unittest.cc" ]
+   }
+ 
+   if (use_ozone) {
+diff --git a/sandbox/policy/win/sandbox_win.cc b/sandbox/policy/win/sandbox_win.cc
+index e4e7cfe65b87ef3bc6b88073dc384a50fd8256ea..0f89e8b8e971fe77cc537cb2e92b54f1d988bc2a 100644
+--- a/sandbox/policy/win/sandbox_win.cc
++++ b/sandbox/policy/win/sandbox_win.cc
+@@ -38,6 +38,7 @@
+ #include "base/win/sid.h"
+ #include "base/win/win_util.h"
+ #include "base/win/windows_version.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "printing/buildflags/buildflags.h"
+ #include "sandbox/features.h"
+ #include "sandbox/policy/features.h"
+@@ -1216,8 +1217,10 @@ std::string SandboxWin::GetSandboxTypeInEnglish(Sandbox sandbox_type) {
+       return "Utility";
+     case Sandbox::kGpu:
+       return "GPU";
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case Sandbox::kPpapi:
+       return "PPAPI";
++#endif
+     case Sandbox::kNetwork:
+       return "Network";
+     case Sandbox::kCdm:

patches/config.json

@@ -19,5 +19,9 @@
 
   "src/electron/patches/Mantle": "src/third_party/squirrel.mac/vendor/Mantle",
 
-  "src/electron/patches/ReactiveObjC": "src/third_party/squirrel.mac/vendor/ReactiveObjC"
+  "src/electron/patches/ReactiveObjC": "src/third_party/squirrel.mac/vendor/ReactiveObjC",
+
+  "src/electron/patches/angle": "src/third_party/angle",
+
+  "src/electron/patches/sqlite": "src/third_party/sqlite/src"
 }

patches/node/feat_add_uv_loop_interrupt_on_io_change_option_to_uv_loop_configure.patch

@@ -136,7 +136,7 @@ index 7cd3a2a954ff7d70e6ba7a6f7538648841bc54b2..f89b7158218be60ac10e61484a2d5e5e
  
  
 diff --git a/deps/uv/src/unix/loop.c b/deps/uv/src/unix/loop.c
-index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..353143e5ebecae598425dc036f4458bb7c43bb0b 100644
+index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..46fc03264b6cc1a3a4d8faf5ec5a754fc07c9b6d 100644
 --- a/deps/uv/src/unix/loop.c
 +++ b/deps/uv/src/unix/loop.c
 @@ -217,6 +217,11 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
@@ -151,7 +151,7 @@ index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..353143e5ebecae598425dc036f4458bb
    if (option != UV_LOOP_BLOCK_SIGNAL)
      return UV_ENOSYS;
  
-@@ -226,3 +231,37 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
+@@ -226,3 +231,40 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
    loop->flags |= UV_LOOP_BLOCK_SIGPROF;
    return 0;
  }
@@ -183,6 +183,9 @@ index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..353143e5ebecae598425dc036f4458bb
 +  if (r == len)
 +    return;
 +
++  if (!uv_loop_alive(loop))
++    return;
++
 +  if (r == -1)
 +    if (errno == EAGAIN || errno == EWOULDBLOCK)
 +      return;

patches/sqlite/.patches

@@ -0,0 +1 @@
+utf-8_q_simplify_20the_20logic_20that_20converts_20the_20_1_20.patch

patches/sqlite/utf-8_q_simplify_20the_20logic_20that_20converts_20the_20_1_20.patch

@@ -0,0 +1,187 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Wed, 20 Jul 2022 17:01:18 +0000
+Subject: Simplify the logic that converts the "1" expression in "ORDER BY 1"
+ into a copy of the expression that defines the first output column.
+
+FossilOrigin-Name: 449935914c3f64e37bbfb9842e868927222fa3d5315c123a32818e67fcfbbf60
+
+diff --git a/amalgamation/sqlite3.c b/amalgamation/sqlite3.c
+index 4f3bbab24a2ddc9ae772e6ede9cb54891102f3dc..0368982346f2e97b0ea86c21a585012af50166d3 100644
+--- a/amalgamation/sqlite3.c
++++ b/amalgamation/sqlite3.c
+@@ -454,7 +454,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+@@ -100475,33 +100475,23 @@ static void resolveAlias(
+     sqlite3ExprDelete(db, pDup);
+     pDup = 0;
+   }else{
++    Expr temp;
+     incrAggFunctionDepth(pDup, nSubquery);
+     if( pExpr->op==TK_COLLATE ){
+       assert( !ExprHasProperty(pExpr, EP_IntValue) );
+       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
+     }
+-
+-    /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
+-    ** prevents ExprDelete() from deleting the Expr structure itself,
+-    ** allowing it to be repopulated by the memcpy() on the following line.
+-    ** The pExpr->u.zToken might point into memory that will be freed by the
+-    ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
+-    ** make a copy of the token before doing the sqlite3DbFree().
+-    */
+-    ExprSetProperty(pExpr, EP_Static);
+-    sqlite3ExprDelete(db, pExpr);
+-    memcpy(pExpr, pDup, sizeof(*pExpr));
+-    if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
+-      assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
+-      pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
+-      pExpr->flags |= EP_MemToken;
+-    }
++    memcpy(&temp, pDup, sizeof(Expr));
++    memcpy(pDup, pExpr, sizeof(Expr));
++    memcpy(pExpr, &temp, sizeof(Expr));
+     if( ExprHasProperty(pExpr, EP_WinFunc) ){
+       if( ALWAYS(pExpr->y.pWin!=0) ){
+         pExpr->y.pWin->pOwner = pExpr;
+       }
+     }
+-    sqlite3DbFree(db, pDup);
++    sqlite3ParserAddCleanup(pParse,
++      (void(*)(sqlite3*,void*))sqlite3ExprDelete,
++      pDup);
+   }
+ }
+ 
+diff --git a/amalgamation/sqlite3.h b/amalgamation/sqlite3.h
+index d7f21648941f0660807bf36ddd184a9a265d3141..4f731b7af261a6324c983a86633735e43fc5957a 100644
+--- a/amalgamation/sqlite3.h
++++ b/amalgamation/sqlite3.h
+@@ -148,7 +148,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+diff --git a/amalgamation_dev/sqlite3.c b/amalgamation_dev/sqlite3.c
+index c04763e6a395cbf766a84a055ae770015c60d593..4b7a61158cb98c125790091369d933b7d0bf1049 100644
+--- a/amalgamation_dev/sqlite3.c
++++ b/amalgamation_dev/sqlite3.c
+@@ -454,7 +454,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+@@ -100488,33 +100488,23 @@ static void resolveAlias(
+     sqlite3ExprDelete(db, pDup);
+     pDup = 0;
+   }else{
++    Expr temp;
+     incrAggFunctionDepth(pDup, nSubquery);
+     if( pExpr->op==TK_COLLATE ){
+       assert( !ExprHasProperty(pExpr, EP_IntValue) );
+       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
+     }
+-
+-    /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
+-    ** prevents ExprDelete() from deleting the Expr structure itself,
+-    ** allowing it to be repopulated by the memcpy() on the following line.
+-    ** The pExpr->u.zToken might point into memory that will be freed by the
+-    ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
+-    ** make a copy of the token before doing the sqlite3DbFree().
+-    */
+-    ExprSetProperty(pExpr, EP_Static);
+-    sqlite3ExprDelete(db, pExpr);
+-    memcpy(pExpr, pDup, sizeof(*pExpr));
+-    if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
+-      assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
+-      pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
+-      pExpr->flags |= EP_MemToken;
+-    }
++    memcpy(&temp, pDup, sizeof(Expr));
++    memcpy(pDup, pExpr, sizeof(Expr));
++    memcpy(pExpr, &temp, sizeof(Expr));
+     if( ExprHasProperty(pExpr, EP_WinFunc) ){
+       if( ALWAYS(pExpr->y.pWin!=0) ){
+         pExpr->y.pWin->pOwner = pExpr;
+       }
+     }
+-    sqlite3DbFree(db, pDup);
++    sqlite3ParserAddCleanup(pParse,
++      (void(*)(sqlite3*,void*))sqlite3ExprDelete,
++      pDup);
+   }
+ }
+ 
+diff --git a/amalgamation_dev/sqlite3.h b/amalgamation_dev/sqlite3.h
+index d7f21648941f0660807bf36ddd184a9a265d3141..4f731b7af261a6324c983a86633735e43fc5957a 100644
+--- a/amalgamation_dev/sqlite3.h
++++ b/amalgamation_dev/sqlite3.h
+@@ -148,7 +148,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+diff --git a/src/resolve.c b/src/resolve.c
+index 480694f6f5756dba81212f64f2a0fd260a9a5ef8..c50f191c194225d7d3d9426dc7329bc0f769ea9d 100644
+--- a/src/resolve.c
++++ b/src/resolve.c
+@@ -85,33 +85,23 @@ static void resolveAlias(
+     sqlite3ExprDelete(db, pDup);
+     pDup = 0;
+   }else{
++    Expr temp;
+     incrAggFunctionDepth(pDup, nSubquery);
+     if( pExpr->op==TK_COLLATE ){
+       assert( !ExprHasProperty(pExpr, EP_IntValue) );
+       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
+     }
+-
+-    /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This 
+-    ** prevents ExprDelete() from deleting the Expr structure itself,
+-    ** allowing it to be repopulated by the memcpy() on the following line.
+-    ** The pExpr->u.zToken might point into memory that will be freed by the
+-    ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
+-    ** make a copy of the token before doing the sqlite3DbFree().
+-    */
+-    ExprSetProperty(pExpr, EP_Static);
+-    sqlite3ExprDelete(db, pExpr);
+-    memcpy(pExpr, pDup, sizeof(*pExpr));
+-    if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
+-      assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
+-      pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
+-      pExpr->flags |= EP_MemToken;
+-    }
++    memcpy(&temp, pDup, sizeof(Expr));
++    memcpy(pDup, pExpr, sizeof(Expr));
++    memcpy(pExpr, &temp, sizeof(Expr));
+     if( ExprHasProperty(pExpr, EP_WinFunc) ){
+       if( ALWAYS(pExpr->y.pWin!=0) ){
+         pExpr->y.pWin->pOwner = pExpr;
+       }
+     }
+-    sqlite3DbFree(db, pDup);
++    sqlite3ParserAddCleanup(pParse,
++      (void(*)(sqlite3*,void*))sqlite3ExprDelete,
++      pDup);
+   }
+ }
+ 

patches/webrtc/.patches

@@ -1 +1,2 @@
 add_thread_local_to_x_error_trap_cc.patch
+cherry-pick-06aea31d10f8.patch

patches/webrtc/cherry-pick-06aea31d10f8.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Henrik=20Bostr=C3=B6m?= <hbos@webrtc.org>
+Date: Wed, 13 Jul 2022 11:10:14 +0200
+Subject: Disallow invalid arguments in RestoreEncodingLayers.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Changing DCHECK into CHECK for good measure.
+
+(cherry picked from commit 2b1f509f3a05035a17917061a71b16114e8c72dc)
+
+No-Try: True
+Bug: chromium:1343889
+Change-Id: I2cede85dc2d2a4238739f73afe25275047f4aa50
+Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/268460
+Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org>
+Commit-Queue: Henrik Boström <hbos@webrtc.org>
+Cr-Original-Commit-Position: refs/heads/main@{#37511}
+Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/269242
+Cr-Commit-Position: refs/branch-heads/5112@{#8}
+Cr-Branched-From: a976a871159f85f975fbd6f170d0a8f00a4aee49-refs/heads/main@{#37168}
+
+diff --git a/pc/rtp_sender.cc b/pc/rtp_sender.cc
+index 58fef4041ecfcef3a76fcfb296c923355f68625c..3604d198e8fabf8a689746f073b6783fc827e7c5 100644
+--- a/pc/rtp_sender.cc
++++ b/pc/rtp_sender.cc
+@@ -75,8 +75,8 @@ RtpParameters RestoreEncodingLayers(
+     const RtpParameters& parameters,
+     const std::vector<std::string>& removed_rids,
+     const std::vector<RtpEncodingParameters>& all_layers) {
+-  RTC_DCHECK_EQ(parameters.encodings.size() + removed_rids.size(),
+-                all_layers.size());
++  RTC_CHECK_EQ(parameters.encodings.size() + removed_rids.size(),
++               all_layers.size());
+   RtpParameters result(parameters);
+   result.encodings.clear();
+   size_t index = 0;

script/release/ci-release-build.js

@@ -2,11 +2,10 @@ if (!process.env.CI) require('dotenv-safe').load();
 
 const assert = require('assert');
 const got = require('got');
+const { Octokit } = require('@octokit/rest');
 
 const BUILD_APPVEYOR_URL = 'https://ci.appveyor.com/api/builds';
 const CIRCLECI_PIPELINE_URL = 'https://circleci.com/api/v2/project/gh/electron/electron/pipeline';
-const VSTS_URL = 'https://github.visualstudio.com/electron/_apis/build';
-const DEVOPS_URL = 'https://dev.azure.com/electron-ci/electron/_apis/build';
 const CIRCLECI_WAIT_TIME = process.env.CIRCLECI_WAIT_TIME || 30000;
 
 const appVeyorJobs = {
@@ -25,13 +24,7 @@ const circleCIPublishIndividualArches = {
   'linux-publish': ['arm', 'arm64', 'x64']
 };
 
-const vstsArmJobs = [
-  'electron-arm-testing',
-  'electron-osx-arm64-testing',
-  'electron-mas-arm64-testing',
-  'electron-arm64-testing',
-  'electron-woa-testing'
-];
+const GHAJobs = ['electron-woa-testing'];
 
 let jobRequestedCount = 0;
 
@@ -247,75 +240,28 @@ function buildCircleCI (targetBranch, options) {
   }
 }
 
-async function buildVSTS (targetBranch, options) {
-  assert(options.armTest, `${options.ci} only works with the --armTest option.`);
-  assert(vstsArmJobs.includes(options.job), `Unknown VSTS CI arm test job name: ${options.job}. Valid values are: ${vstsArmJobs}.`);
+async function buildGHA (targetBranch, options) {
+  const { GHA_TOKEN } = process.env;
+  assert(GHA_TOKEN, `${options.ci} requires the $GHA_TOKEN environment variable to be provided`);
 
-  console.log(`Triggering VSTS to run build on branch: ${targetBranch}.`);
-  const environmentVariables = {};
+  const octokit = new Octokit({ auth: GHA_TOKEN });
 
-  if (options.circleBuildNum) {
-    environmentVariables.CIRCLE_BUILD_NUM = options.circleBuildNum;
-  } else if (options.appveyorJobId) {
-    environmentVariables.APPVEYOR_JOB_ID = options.appveyorJobId;
-  }
+  assert(GHAJobs.includes(options.job), `Unknown GitHub Actions arm test job name: ${options.job}. Valid values are: ${GHAJobs}.`);
+  assert(options.commit !== null, 'commit is a required option for GitHub Actions');
 
-  let vstsURL = VSTS_URL;
-  let vstsToken = process.env.VSTS_TOKEN;
-  assert(vstsToken, `${options.ci} requires the $VSTS_TOKEN environment variable to be provided`);
-  if (options.ci === 'DevOps') {
-    vstsURL = DEVOPS_URL;
-    vstsToken = process.env.DEVOPS_TOKEN;
-  }
-  const requestOpts = {
-    url: `${vstsURL}/definitions?api-version=4.1`,
-    auth: {
-      user: '',
-      password: vstsToken
-    },
-    headers: {
-      'Content-Type': 'application/json'
-    }
-  };
+  console.log(`Triggering GitHub Actions to run build on branch: ${targetBranch}.`);
 
   jobRequestedCount++;
 
   try {
-    const vstsResponse = await makeRequest(requestOpts, true);
-    const buildToRun = vstsResponse.value.find(build => build.name === options.job);
-    callVSTSBuild(buildToRun, targetBranch, environmentVariables, vstsURL, vstsToken);
+    const response = await octokit.request('POST /repos/electron/electron/actions/workflows/electron_woa_testing.yml/dispatches', {
+      ref: targetBranch,
+      inputs: {
+        appveyor_job_id: `${options.appveyorJobId}`
+      }
+    });
   } catch (err) {
-    console.log('Problem calling VSTS to get build definitions: ', err);
-  }
-}
-
-async function callVSTSBuild (build, targetBranch, environmentVariables, vstsURL, vstsToken) {
-  const buildBody = {
-    definition: build,
-    sourceBranch: targetBranch,
-    priority: 'high'
-  };
-  if (Object.keys(environmentVariables).length !== 0) {
-    buildBody.parameters = JSON.stringify(environmentVariables);
-  }
-  const requestOpts = {
-    url: `${vstsURL}/builds?api-version=4.1`,
-    auth: {
-      user: '',
-      password: vstsToken
-    },
-    headers: {
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify(buildBody),
-    method: 'POST'
-  };
-
-  try {
-    const { _links } = await makeRequest(requestOpts, true);
-    console.log(`VSTS release build request for ${build.name} successful. Check ${_links.web.href} for status.`);
-  } catch (err) {
-    console.log(`Could not call VSTS for job ${build.name}: `, err);
+    console.log('Problem calling GitHub Actions to get build definitions: ', err);
   }
 }
 
@@ -330,9 +276,8 @@ function runRelease (targetBranch, options) {
         buildAppVeyor(targetBranch, options);
         break;
       }
-      case 'DevOps':
-      case 'VSTS': {
-        buildVSTS(targetBranch, options);
+      case 'GHA': {
+        buildGHA(targetBranch, options);
         break;
       }
       default: {
@@ -351,13 +296,13 @@ module.exports = runRelease;
 
 if (require.main === module) {
   const args = require('minimist')(process.argv.slice(2), {
-    boolean: ['ghRelease', 'armTest']
+    boolean: ['ghRelease']
   });
   const targetBranch = args._[0];
   if (args._.length < 1) {
     console.log(`Trigger CI to build release builds of electron.
-    Usage: ci-release-build.js [--job=CI_JOB_NAME] [--arch=INDIVIDUAL_ARCH] [--ci=CircleCI|AppVeyor|VSTS|DevOps]
-    [--ghRelease] [--armTest] [--circleBuildNum=xxx] [--appveyorJobId=xxx] [--commit=sha] TARGET_BRANCH
+    Usage: ci-release-build.js [--job=CI_JOB_NAME] [--arch=INDIVIDUAL_ARCH] [--ci=CircleCI|AppVeyor|GHA]
+    [--ghRelease] [--circleBuildNum=xxx] [--appveyorJobId=xxx] [--commit=sha] TARGET_BRANCH
     `);
     process.exit(0);
   }

shell/app/electron_crash_reporter_client.cc

@@ -190,7 +190,9 @@ bool ElectronCrashReporterClient::GetShouldCompressUploads() {
 
 void ElectronCrashReporterClient::GetProcessSimpleAnnotations(
     std::map<std::string, std::string>* annotations) {
-  *annotations = global_annotations_;
+  for (auto&& pair : global_annotations_) {
+    (*annotations)[pair.first] = pair.second;
+  }
   (*annotations)["prod"] = ELECTRON_PRODUCT_NAME;
   (*annotations)["ver"] = ELECTRON_VERSION_STRING;
 }

shell/browser/api/electron_api_app.cc

@@ -1152,7 +1152,9 @@ bool App::Relaunch(gin::Arguments* js_args) {
 
   gin_helper::Dictionary options;
   if (js_args->GetNext(&options)) {
-    if (options.Get("execPath", &exec_path) || options.Get("args", &args))
+    bool has_exec_path = options.Get("execPath", &exec_path);
+    bool has_args = options.Get("args", &args);
+    if (has_exec_path || has_args)
       override_argv = true;
   }
 

shell/browser/api/electron_api_data_pipe_holder.cc

@@ -88,8 +88,11 @@ class DataPipeReader {
     if (result == MOJO_RESULT_OK) {  // success
       remaining_size_ -= length;
       head_ += length;
-      if (remaining_size_ == 0)
+      if (remaining_size_ == 0) {
         OnSuccess();
+      } else {
+        handle_watcher_.ArmOrNotify();
+      }
     } else if (result == MOJO_RESULT_SHOULD_WAIT) {  // IO pending
       handle_watcher_.ArmOrNotify();
     } else {  // error

shell/browser/api/electron_api_menu_mac.mm

@@ -134,7 +134,7 @@ void MenuMac::PopupOnUI(const base::WeakPtr<NativeWindow>& native_window,
   if (!item) {
     CGFloat windowBottom = CGRectGetMinY([view window].frame);
     CGFloat lowestMenuPoint = windowBottom + position.y - [menu size].height;
-    CGFloat screenBottom = CGRectGetMinY([view window].screen.frame);
+    CGFloat screenBottom = CGRectGetMinY([view window].screen.visibleFrame);
     CGFloat distanceFromBottom = lowestMenuPoint - screenBottom;
     if (distanceFromBottom < 0)
       position.y = position.y - distanceFromBottom + 4;
@@ -143,7 +143,7 @@ void MenuMac::PopupOnUI(const base::WeakPtr<NativeWindow>& native_window,
   // Place the menu left of cursor if it is overflowing off right of screen.
   CGFloat windowLeft = CGRectGetMinX([view window].frame);
   CGFloat rightmostMenuPoint = windowLeft + position.x + [menu size].width;
-  CGFloat screenRight = CGRectGetMaxX([view window].screen.frame);
+  CGFloat screenRight = CGRectGetMaxX([view window].screen.visibleFrame);
   if (rightmostMenuPoint > screenRight)
     position.x = position.x - [menu size].width;
 

shell/browser/api/electron_api_web_contents.cc

@@ -174,6 +174,7 @@
 
 #if BUILDFLAG(IS_WIN)
 #include "printing/backend/win_helper.h"
+#include "shell/browser/native_window_views.h"
 #endif
 #endif
 
@@ -676,10 +677,8 @@ WebContents::WebContents(v8::Isolate* isolate,
   auto session = Session::CreateFrom(isolate, GetBrowserContext());
   session_.Reset(isolate, session.ToV8());
 
-  absl::optional<std::string> user_agent_override =
-      GetBrowserContext()->GetUserAgentOverride();
-  if (user_agent_override)
-    SetUserAgent(*user_agent_override);
+  SetUserAgent(GetBrowserContext()->GetUserAgent());
+
   web_contents->SetUserData(kElectronApiWebContentsKey,
                             std::make_unique<UserDataLink>(GetWeakPtr()));
   InitZoomController(web_contents, gin::Dictionary::CreateEmpty(isolate));
@@ -885,10 +884,7 @@ void WebContents::InitWithSessionAndOptions(
 
   AutofillDriverFactory::CreateForWebContents(web_contents());
 
-  absl::optional<std::string> user_agent_override =
-      GetBrowserContext()->GetUserAgentOverride();
-  if (user_agent_override)
-    SetUserAgent(*user_agent_override);
+  SetUserAgent(GetBrowserContext()->GetUserAgent());
 
   if (IsGuest()) {
     NativeWindow* owner_window = nullptr;
@@ -1345,6 +1341,8 @@ void WebContents::OnEnterFullscreenModeForTab(
     return;
   }
 
+  owner_window()->set_fullscreen_transition_type(
+      NativeWindow::FullScreenTransitionType::HTML);
   exclusive_access_manager_->fullscreen_controller()->EnterFullscreenModeForTab(
       requesting_frame, options.display_id);
 
@@ -1396,11 +1394,6 @@ bool WebContents::HandleContextMenu(content::RenderFrameHost& render_frame_host,
   return true;
 }
 
-bool WebContents::OnGoToEntryOffset(int offset) {
-  GoToOffset(offset);
-  return false;
-}
-
 void WebContents::FindReply(content::WebContents* web_contents,
                             int request_id,
                             int number_of_matches,
@@ -2441,6 +2434,14 @@ void WebContents::OpenDevTools(gin::Arguments* args) {
     }
   }
 
+#if BUILDFLAG(IS_WIN)
+  auto* win = static_cast<NativeWindowViews*>(owner_window());
+  // Force a detached state when WCO is enabled to match Chrome
+  // behavior and prevent occlusion of DevTools.
+  if (win && win->IsWindowControlsOverlayEnabled())
+    state = "detach";
+#endif
+
   DCHECK(inspectable_web_contents_);
   inspectable_web_contents_->SetDockState(state);
   inspectable_web_contents_->ShowDevTools(activate);
@@ -3524,12 +3525,15 @@ void WebContents::EnumerateDirectory(
 
 bool WebContents::IsFullscreenForTabOrPending(
     const content::WebContents* source) {
-  bool transition_fs = owner_window()
-                           ? owner_window()->fullscreen_transition_state() !=
-                                 NativeWindow::FullScreenTransitionState::NONE
-                           : false;
+  if (!owner_window())
+    return html_fullscreen_;
 
-  return html_fullscreen_ || transition_fs;
+  bool in_transition = owner_window()->fullscreen_transition_state() !=
+                       NativeWindow::FullScreenTransitionState::NONE;
+  bool is_html_transition = owner_window()->fullscreen_transition_type() ==
+                            NativeWindow::FullScreenTransitionType::HTML;
+
+  return html_fullscreen_ || (in_transition && is_html_transition);
 }
 
 bool WebContents::TakeFocus(content::WebContents* source, bool reverse) {

shell/browser/api/electron_api_web_contents.h

@@ -552,7 +552,6 @@ class WebContents : public ExclusiveAccessContext,
       content::RenderWidgetHost* render_widget_host) override;
   bool HandleContextMenu(content::RenderFrameHost& render_frame_host,
                          const content::ContextMenuParams& params) override;
-  bool OnGoToEntryOffset(int offset) override;
   void FindReply(content::WebContents* web_contents,
                  int request_id,
                  int number_of_matches,

shell/browser/electron_browser_client.cc

@@ -1497,9 +1497,6 @@ bool ElectronBrowserClient::WillCreateURLLoaderFactory(
       std::move(proxied_receiver), std::move(target_factory_remote),
       std::move(header_client_receiver), type);
 
-  if (bypass_redirect_checks)
-    *bypass_redirect_checks = true;
-
   return true;
 }
 

shell/browser/electron_browser_context.cc

@@ -308,11 +308,6 @@ std::string ElectronBrowserContext::GetUserAgent() const {
   return user_agent_.value_or(ElectronBrowserClient::Get()->GetUserAgent());
 }
 
-absl::optional<std::string> ElectronBrowserContext::GetUserAgentOverride()
-    const {
-  return user_agent_;
-}
-
 predictors::PreconnectManager* ElectronBrowserContext::GetPreconnectManager() {
   if (!preconnect_manager_.get()) {
     preconnect_manager_ =

shell/browser/electron_browser_context.h

@@ -85,7 +85,6 @@ class ElectronBrowserContext : public content::BrowserContext {
 
   void SetUserAgent(const std::string& user_agent);
   std::string GetUserAgent() const;
-  absl::optional<std::string> GetUserAgentOverride() const;
   bool CanUseHttpCache() const;
   int GetMaxCacheSize() const;
   ResolveProxyHelper* GetResolveProxyHelper();

shell/browser/electron_browser_main_parts.cc

@@ -17,6 +17,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/icon_manager.h"
+#include "chrome/browser/ui/color/chrome_color_mixers.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "components/os_crypt/key_storage_config_linux.h"
@@ -222,6 +223,9 @@ int ElectronBrowserMainParts::PreEarlyInitialization() {
   ui::OzonePlatform::PreEarlyInitialization();
 #endif
 
+  ui::ColorProviderManager::Get().AppendColorProviderInitializer(
+      base::BindRepeating(AddChromeColorMixers));
+
   return GetExitCode();
 }
 

shell/browser/electron_download_manager_delegate.cc

@@ -31,6 +31,16 @@
 #include "shell/common/gin_converters/file_path_converter.h"
 #include "shell/common/options_switches.h"
 
+#if BUILDFLAG(IS_WIN)
+#include <vector>
+
+#include "base/i18n/case_conversion.h"
+#include "base/win/registry.h"
+#include "ui/base/l10n/l10n_util.h"
+#include "ui/shell_dialogs/execute_select_file_win.h"
+#include "ui/strings/grit/ui_strings.h"
+#endif  // BUILDFLAG(IS_WIN)
+
 namespace electron {
 
 namespace {
@@ -63,6 +73,116 @@ base::FilePath CreateDownloadPath(const GURL& url,
   return download_path.Append(generated_name);
 }
 
+#if BUILDFLAG(IS_WIN)
+// Get the file type description from the registry. This will be "Text Document"
+// for .txt files, "JPEG Image" for .jpg files, etc. If the registry doesn't
+// have an entry for the file type, we return false, true if the description was
+// found. 'file_ext' must be in form ".txt".
+// Modified from ui/shell_dialogs/select_file_dialog_win.cc
+bool GetRegistryDescriptionFromExtension(const std::string& file_ext,
+                                         std::string* reg_description) {
+  DCHECK(reg_description);
+  base::win::RegKey reg_ext(HKEY_CLASSES_ROOT,
+                            base::UTF8ToWide(file_ext).c_str(), KEY_READ);
+  std::wstring reg_app;
+  if (reg_ext.ReadValue(nullptr, &reg_app) == ERROR_SUCCESS &&
+      !reg_app.empty()) {
+    base::win::RegKey reg_link(HKEY_CLASSES_ROOT, reg_app.c_str(), KEY_READ);
+    std::wstring description;
+    if (reg_link.ReadValue(nullptr, &description) == ERROR_SUCCESS) {
+      *reg_description = base::WideToUTF8(description);
+      return true;
+    }
+  }
+  return false;
+}
+
+// Set up a filter for a Save/Open dialog, |ext_desc| as the text descriptions
+// of the |file_ext| types (optional), and (optionally) the default 'All Files'
+// view. The purpose of the filter is to show only files of a particular type in
+// a Windows Save/Open dialog box. The resulting filter is returned. The filters
+// created here are:
+//   1. only files that have 'file_ext' as their extension
+//   2. all files (only added if 'include_all_files' is true)
+// If a description is not provided for a file extension, it will be retrieved
+// from the registry. If the file extension does not exist in the registry, a
+// default description will be created (e.g. "qqq" yields "QQQ File").
+// Modified from ui/shell_dialogs/select_file_dialog_win.cc
+file_dialog::Filters FormatFilterForExtensions(
+    const std::vector<std::string>& file_ext,
+    const std::vector<std::string>& ext_desc,
+    bool include_all_files,
+    bool keep_extension_visible) {
+  const std::string all_ext = "*";
+  const std::string all_desc =
+      l10n_util::GetStringUTF8(IDS_APP_SAVEAS_ALL_FILES);
+
+  DCHECK(file_ext.size() >= ext_desc.size());
+
+  if (file_ext.empty())
+    include_all_files = true;
+
+  file_dialog::Filters result;
+  result.reserve(file_ext.size() + 1);
+
+  for (size_t i = 0; i < file_ext.size(); ++i) {
+    std::string ext = file_ext[i];
+    std::string desc;
+    if (i < ext_desc.size())
+      desc = ext_desc[i];
+
+    if (ext.empty()) {
+      // Force something reasonable to appear in the dialog box if there is no
+      // extension provided.
+      include_all_files = true;
+      continue;
+    }
+
+    if (desc.empty()) {
+      DCHECK(ext.find('.') != std::string::npos);
+      std::string first_extension = ext.substr(ext.find('.'));
+      size_t first_separator_index = first_extension.find(';');
+      if (first_separator_index != std::string::npos)
+        first_extension = first_extension.substr(0, first_separator_index);
+
+      // Find the extension name without the preceeding '.' character.
+      std::string ext_name = first_extension;
+      size_t ext_index = ext_name.find_first_not_of('.');
+      if (ext_index != std::string::npos)
+        ext_name = ext_name.substr(ext_index);
+
+      if (!GetRegistryDescriptionFromExtension(first_extension, &desc)) {
+        // The extension doesn't exist in the registry. Create a description
+        // based on the unknown extension type (i.e. if the extension is .qqq,
+        // then we create a description "QQQ File").
+        desc = l10n_util::GetStringFUTF8(
+            IDS_APP_SAVEAS_EXTENSION_FORMAT,
+            base::i18n::ToUpper(base::UTF8ToUTF16(ext_name)));
+        include_all_files = true;
+      }
+      if (desc.empty())
+        desc = "*." + ext_name;
+    } else if (keep_extension_visible) {
+      // Having '*' in the description could cause the windows file dialog to
+      // not include the file extension in the file dialog. So strip out any '*'
+      // characters if `keep_extension_visible` is set.
+      base::ReplaceChars(desc, "*", base::StringPiece(), &desc);
+    }
+
+    // Remove the preceeding '.' character from the extension.
+    size_t ext_index = ext.find_first_not_of('.');
+    if (ext_index != std::string::npos)
+      ext = ext.substr(ext_index);
+    result.push_back({desc, {ext}});
+  }
+
+  if (include_all_files)
+    result.push_back({all_desc, {all_ext}});
+
+  return result;
+}
+#endif  // BUILDFLAG(IS_WIN)
+
 }  // namespace
 
 ElectronDownloadManagerDelegate::ElectronDownloadManagerDelegate(
@@ -131,6 +251,16 @@ void ElectronDownloadManagerDelegate::OnDownloadPathGenerated(
     const bool offscreen = !web_preferences || web_preferences->IsOffscreen();
     settings.force_detached = offscreen;
 
+#if BUILDFLAG(IS_WIN)
+    if (settings.filters.empty()) {
+      const std::wstring extension = settings.default_path.FinalExtension();
+      if (!extension.empty()) {
+        settings.filters = FormatFilterForExtensions(
+            {base::WideToUTF8(extension)}, {""}, true, true);
+      }
+    }
+#endif  // BUILDFLAG(IS_WIN)
+
     v8::Isolate* isolate = JavascriptEnvironment::GetIsolate();
     v8::HandleScope scope(isolate);
     gin_helper::Promise<gin_helper::Dictionary> dialog_promise(isolate);

shell/browser/native_browser_view_mac.mm

@@ -262,9 +262,21 @@ void NativeBrowserViewMac::SetBounds(const gfx::Rect& bounds) {
   auto* view = iwc_view->GetNativeView().GetNativeNSView();
   auto* superview = view.superview;
   const auto superview_height = superview ? superview.frame.size.height : 0;
+
+  // We need to use the content rect to calculate the titlebar height if the
+  // superview is an framed NSWindow, otherwise it will be offset incorrectly by
+  // the height of the titlebar.
+  auto titlebar_height = 0;
+  if (auto* win = [superview window]) {
+    const auto content_rect_height =
+        [win contentRectForFrameRect:superview.frame].size.height;
+    titlebar_height = superview_height - content_rect_height;
+  }
+
+  auto new_height =
+      superview_height - bounds.y() - bounds.height() + titlebar_height;
   view.frame =
-      NSMakeRect(bounds.x(), superview_height - bounds.y() - bounds.height(),
-                 bounds.width(), bounds.height());
+      NSMakeRect(bounds.x(), new_height, bounds.width(), bounds.height());
 
   // Ensure draggable regions are properly updated to reflect new bounds.
   UpdateDraggableRegions(draggable_regions_);
@@ -275,12 +287,23 @@ gfx::Rect NativeBrowserViewMac::GetBounds() {
   if (!iwc_view)
     return gfx::Rect();
   NSView* view = iwc_view->GetNativeView().GetNativeNSView();
-  const int superview_height =
-      (view.superview) ? view.superview.frame.size.height : 0;
-  return gfx::Rect(
-      view.frame.origin.x,
-      superview_height - view.frame.origin.y - view.frame.size.height,
-      view.frame.size.width, view.frame.size.height);
+  auto* superview = view.superview;
+  const int superview_height = superview ? superview.frame.size.height : 0;
+
+  // We need to use the content rect to calculate the titlebar height if the
+  // superview is an framed NSWindow, otherwise it will be offset incorrectly by
+  // the height of the titlebar.
+  auto titlebar_height = 0;
+  if (auto* win = [superview window]) {
+    const auto content_rect_height =
+        [win contentRectForFrameRect:superview.frame].size.height;
+    titlebar_height = superview_height - content_rect_height;
+  }
+
+  auto new_height = superview_height - view.frame.origin.y -
+                    view.frame.size.height + titlebar_height;
+  return gfx::Rect(view.frame.origin.x, new_height, view.frame.size.width,
+                   view.frame.size.height);
 }
 
 void NativeBrowserViewMac::SetBackgroundColor(SkColor color) {

shell/browser/native_window.cc

@@ -719,8 +719,10 @@ std::string NativeWindow::GetAccessibleTitle() {
 }
 
 void NativeWindow::HandlePendingFullscreenTransitions() {
-  if (pending_transitions_.empty())
+  if (pending_transitions_.empty()) {
+    set_fullscreen_transition_type(FullScreenTransitionType::NONE);
     return;
+  }
 
   bool next_transition = pending_transitions_.front();
   pending_transitions_.pop();

shell/browser/native_window.h

@@ -318,10 +318,11 @@ class NativeWindow : public base::SupportsUserData,
     observers_.RemoveObserver(obs);
   }
 
-  enum class FullScreenTransitionState { ENTERING, EXITING, NONE };
-
   // Handle fullscreen transitions.
   void HandlePendingFullscreenTransitions();
+
+  enum class FullScreenTransitionState { ENTERING, EXITING, NONE };
+
   void set_fullscreen_transition_state(FullScreenTransitionState state) {
     fullscreen_transition_state_ = state;
   }
@@ -329,6 +330,15 @@ class NativeWindow : public base::SupportsUserData,
     return fullscreen_transition_state_;
   }
 
+  enum class FullScreenTransitionType { HTML, NATIVE, NONE };
+
+  void set_fullscreen_transition_type(FullScreenTransitionType type) {
+    fullscreen_transition_type_ = type;
+  }
+  FullScreenTransitionType fullscreen_transition_type() const {
+    return fullscreen_transition_type_;
+  }
+
   views::Widget* widget() const { return widget_.get(); }
   views::View* content_view() const { return content_view_; }
 
@@ -390,6 +400,8 @@ class NativeWindow : public base::SupportsUserData,
   std::queue<bool> pending_transitions_;
   FullScreenTransitionState fullscreen_transition_state_ =
       FullScreenTransitionState::NONE;
+  FullScreenTransitionType fullscreen_transition_type_ =
+      FullScreenTransitionType::NONE;
 
  private:
   std::unique_ptr<views::Widget> widget_;

shell/browser/native_window_mac.mm

@@ -300,7 +300,7 @@ NativeWindowMac::NativeWindowMac(const gin_helper::Dictionary& options,
   bool rounded_corner = true;
   options.Get(options::kRoundedCorners, &rounded_corner);
   if (!rounded_corner && !has_frame())
-    styleMask = 0;
+    styleMask = NSWindowStyleMaskBorderless;
 
   if (minimizable)
     styleMask |= NSMiniaturizableWindowMask;
@@ -690,6 +690,9 @@ bool NativeWindowMac::HandleDeferredClose() {
 }
 
 void NativeWindowMac::SetFullScreen(bool fullscreen) {
+  if (!has_frame() && !HasStyleMask(NSWindowStyleMaskTitled))
+    return;
+
   // [NSWindow -toggleFullScreen] is an asynchronous operation, which means
   // that it's possible to call it while a fullscreen transition is currently
   // in process. This can create weird behavior (incl. phantom windows),

shell/browser/native_window_views.cc

@@ -281,7 +281,24 @@ NativeWindowViews::NativeWindowViews(const gin_helper::Dictionary& options,
       new ElectronDesktopWindowTreeHostLinux(this, native_widget);
 #endif
 
+  // Ref https://github.com/electron/electron/issues/30760
+  // Set the can_resize param before initializing the widget.
+  // When resizable_ is true, this causes the WS_THICKFRAME style
+  // to be passed into CreateWindowEx and SetWindowLong calls in
+  // WindowImpl::Init and HwndMessageHandler::SizeConstraintsChanged
+  // respectively. As a result, the Windows 7 frame doesn't show,
+  // but it isn't clear why this is the case.
+  // When resizable_ is false, WS_THICKFRAME is not passed into the
+  // SetWindowLong call, so the Windows 7 frame still shows.
+  // One workaround would be to call set_can_resize(true) here,
+  // and then move the SetCanResize(resizable_) call after the
+  // SetWindowLong call around line 365, but that's a much larger change.
+  set_can_resize(true);
   widget()->Init(std::move(params));
+
+  // When the workaround above is not needed anymore, only this
+  // call should be necessary.
+  // With the workaround in place, this call doesn't do anything.
   SetCanResize(resizable_);
 
   bool fullscreen = false;

shell/browser/native_window_views_win.cc

@@ -413,6 +413,8 @@ void NativeWindowViews::HandleSizeEvent(WPARAM w_param, LPARAM l_param) {
       // multiple times for one resize because of the SetWindowPlacement call.
       if (w_param == SIZE_MAXIMIZED &&
           last_window_state_ != ui::SHOW_STATE_MAXIMIZED) {
+        if (last_window_state_ == ui::SHOW_STATE_MINIMIZED)
+          NotifyWindowRestore();
         last_window_state_ = ui::SHOW_STATE_MAXIMIZED;
         NotifyWindowMaximize();
         ResetWindowControls();

shell/browser/resources/win/electron.rc

@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 19,0,10,0
- PRODUCTVERSION 19,0,10,0
+ FILEVERSION 19,0,17,0
+ PRODUCTVERSION 19,0,17,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "19.0.10"
+            VALUE "FileVersion", "19.0.17"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "19.0.10"
+            VALUE "ProductVersion", "19.0.17"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

shell/browser/ui/cocoa/electron_ns_window_delegate.mm

@@ -19,7 +19,7 @@
 
 using TitleBarStyle = electron::NativeWindowMac::TitleBarStyle;
 using FullScreenTransitionState =
-    electron::NativeWindowMac::FullScreenTransitionState;
+    electron::NativeWindow::FullScreenTransitionState;
 
 @implementation ElectronNSWindowDelegate
 

shell/browser/ui/views/client_frame_view_linux.cc

@@ -107,7 +107,7 @@ void ClientFrameViewLinux::Init(NativeWindowViews* window,
   host_supports_client_frame_shadow_ = tree_host->SupportsClientFrameShadow();
 
   frame_provider_ = views::LinuxUI::instance()->GetWindowFrameProvider(
-      !host_supports_client_frame_shadow_);
+      !host_supports_client_frame_shadow_, frame_->IsMaximized());
 
   UpdateWindowTitle();
 
@@ -179,7 +179,7 @@ gfx::Rect ClientFrameViewLinux::GetBoundsForClientView() const {
   if (!frame_->IsFullscreen()) {
     client_bounds.Inset(GetBorderDecorationInsets());
     client_bounds.Inset(
-        gfx::Insets::TLBR(0, GetTitlebarBounds().height(), 0, 0));
+        gfx::Insets::TLBR(GetTitlebarBounds().height(), 0, 0, 0));
   }
   return client_bounds;
 }
@@ -251,6 +251,9 @@ void ClientFrameViewLinux::Layout() {
     return;
   }
 
+  frame_provider_ = views::LinuxUI::instance()->GetWindowFrameProvider(
+      !host_supports_client_frame_shadow_, frame_->IsMaximized());
+
   UpdateButtonImages();
   LayoutButtons();
 
@@ -461,4 +464,9 @@ gfx::Size ClientFrameViewLinux::SizeWithDecorations(gfx::Size size) const {
   return size;
 }
 
+views::View* ClientFrameViewLinux::TargetForRect(views::View* root,
+                                                 const gfx::Rect& rect) {
+  return views::NonClientFrameView::TargetForRect(root, rect);
+}
+
 }  // namespace electron

shell/browser/ui/views/client_frame_view_linux.h

@@ -69,6 +69,9 @@ class ClientFrameViewLinux : public FramelessView,
   void OnPaint(gfx::Canvas* canvas) override;
   const char* GetClassName() const override;
 
+  // Overriden from views::ViewTargeterDelegate
+  views::View* TargetForRect(views::View* root, const gfx::Rect& rect) override;
+
  private:
   static constexpr int kNavButtonCount = 4;
 

shell/browser/ui/views/win_caption_button.cc

@@ -10,6 +10,7 @@
 
 #include "base/i18n/rtl.h"
 #include "base/numerics/safe_conversions.h"
+#include "base/win/windows_version.h"
 #include "chrome/grit/theme_resources.h"
 #include "shell/browser/ui/views/win_frame_view.h"
 #include "shell/common/color_util.h"
@@ -28,6 +29,7 @@ WinCaptionButton::WinCaptionButton(PressedCallback callback,
                                    const std::u16string& accessible_name)
     : views::Button(std::move(callback)),
       frame_view_(frame_view),
+      icon_painter_(CreateIconPainter()),
       button_type_(button_type) {
   SetAnimateOnStateChange(true);
   // Not focusable by default, only for accessibility.
@@ -35,6 +37,15 @@ WinCaptionButton::WinCaptionButton(PressedCallback callback,
   SetAccessibleName(accessible_name);
 }
 
+WinCaptionButton::~WinCaptionButton() = default;
+
+std::unique_ptr<WinIconPainter> WinCaptionButton::CreateIconPainter() {
+  if (base::win::GetVersion() >= base::win::Version::WIN11) {
+    return std::make_unique<Win11IconPainter>();
+  }
+  return std::make_unique<WinIconPainter>();
+}
+
 gfx::Size WinCaptionButton::CalculatePreferredSize() const {
   // TODO(bsep): The sizes in this function are for 1x device scale and don't
   // match Windows button sizes at hidpi.
@@ -50,9 +61,10 @@ void WinCaptionButton::OnPaintBackground(gfx::Canvas* canvas) {
   const SkAlpha theme_alpha = SkColorGetA(bg_color);
 
   gfx::Rect bounds = GetContentsBounds();
-  bounds.Inset(gfx::Insets::TLBR(0, 0, 0, 0));
+  bounds.Inset(gfx::Insets::TLBR(0, GetBetweenButtonSpacing(), 0, 0));
 
-  canvas->FillRect(bounds, SkColorSetA(bg_color, theme_alpha));
+  if (theme_alpha > 0)
+    canvas->FillRect(bounds, SkColorSetA(bg_color, theme_alpha));
 
   SkColor base_color;
   SkAlpha hovered_alpha, pressed_alpha;
@@ -136,21 +148,6 @@ int WinCaptionButton::GetButtonDisplayOrderIndex() const {
   return button_display_order;
 }
 
-namespace {
-
-// Canvas::DrawRect's stroke can bleed out of |rect|'s bounds, so this draws a
-// rectangle inset such that the result is constrained to |rect|'s size.
-void DrawRect(gfx::Canvas* canvas,
-              const gfx::Rect& rect,
-              const cc::PaintFlags& flags) {
-  gfx::RectF rect_f(rect);
-  float stroke_half_width = flags.getStrokeWidth() / 2;
-  rect_f.Inset(gfx::InsetsF::VH(stroke_half_width, stroke_half_width));
-  canvas->DrawRect(rect_f, flags);
-}
-
-}  // namespace
-
 void WinCaptionButton::PaintSymbol(gfx::Canvas* canvas) {
   SkColor symbol_color = frame_view_->window()->overlay_symbol_color();
 
@@ -183,32 +180,21 @@ void WinCaptionButton::PaintSymbol(gfx::Canvas* canvas) {
 
   switch (button_type_) {
     case VIEW_ID_MINIMIZE_BUTTON: {
-      const int y = symbol_rect.CenterPoint().y();
-      const gfx::Point p1 = gfx::Point(symbol_rect.x(), y);
-      const gfx::Point p2 = gfx::Point(symbol_rect.right(), y);
-      canvas->DrawLine(p1, p2, flags);
+      icon_painter_->PaintMinimizeIcon(canvas, symbol_rect, flags);
       return;
     }
 
-    case VIEW_ID_MAXIMIZE_BUTTON:
-      DrawRect(canvas, symbol_rect, flags);
+    case VIEW_ID_MAXIMIZE_BUTTON: {
+      icon_painter_->PaintMaximizeIcon(canvas, symbol_rect, flags);
       return;
+    }
 
     case VIEW_ID_RESTORE_BUTTON: {
-      // Bottom left ("in front") square.
-      const int separation = std::floor(2 * scale);
-      symbol_rect.Inset(gfx::Insets::TLBR(0, separation, separation, 0));
-      DrawRect(canvas, symbol_rect, flags);
-
-      // Top right ("behind") square.
-      canvas->ClipRect(symbol_rect, SkClipOp::kDifference);
-      symbol_rect.Offset(separation, -separation);
-      DrawRect(canvas, symbol_rect, flags);
+      icon_painter_->PaintRestoreIcon(canvas, symbol_rect, flags);
       return;
     }
 
     case VIEW_ID_CLOSE_BUTTON: {
-      flags.setAntiAlias(true);
       // The close button's X is surrounded by a "halo" of transparent pixels.
       // When the X is white, the transparent pixels need to be a bit brighter
       // to be visible.
@@ -216,15 +202,7 @@ void WinCaptionButton::PaintSymbol(gfx::Canvas* canvas) {
           stroke_width * (symbol_color == SK_ColorWHITE ? 0.1f : 0.05f);
       flags.setStrokeWidth(stroke_width + stroke_halo);
 
-      // TODO(bsep): This sometimes draws misaligned at fractional device scales
-      // because the button's origin isn't necessarily aligned to pixels.
-      canvas->ClipRect(symbol_rect);
-      SkPath path;
-      path.moveTo(symbol_rect.x(), symbol_rect.y());
-      path.lineTo(symbol_rect.right(), symbol_rect.bottom());
-      path.moveTo(symbol_rect.right(), symbol_rect.y());
-      path.lineTo(symbol_rect.x(), symbol_rect.bottom());
-      canvas->DrawPath(path, flags);
+      icon_painter_->PaintCloseIcon(canvas, symbol_rect, flags);
       return;
     }
 

shell/browser/ui/views/win_caption_button.h

@@ -7,8 +7,11 @@
 #ifndef ELECTRON_SHELL_BROWSER_UI_VIEWS_WIN_CAPTION_BUTTON_H_
 #define ELECTRON_SHELL_BROWSER_UI_VIEWS_WIN_CAPTION_BUTTON_H_
 
+#include <memory>
+
 #include "chrome/browser/ui/frame/window_frame_util.h"
 #include "chrome/browser/ui/view_ids.h"
+#include "shell/browser/ui/views/win_icon_painter.h"
 #include "ui/base/metadata/metadata_header_macros.h"
 #include "ui/gfx/canvas.h"
 #include "ui/views/controls/button/button.h"
@@ -23,6 +26,8 @@ class WinCaptionButton : public views::Button {
                    WinFrameView* frame_view,
                    ViewID button_type,
                    const std::u16string& accessible_name);
+  ~WinCaptionButton() override;
+
   WinCaptionButton(const WinCaptionButton&) = delete;
   WinCaptionButton& operator=(const WinCaptionButton&) = delete;
 
@@ -35,6 +40,7 @@ class WinCaptionButton : public views::Button {
   void SetSize(gfx::Size size);
 
  private:
+  std::unique_ptr<WinIconPainter> CreateIconPainter();
   // Returns the amount we should visually reserve on the left (right in RTL)
   // for spacing between buttons. We do this instead of repositioning the
   // buttons to avoid the sliver of deadspace that would result.
@@ -53,6 +59,7 @@ class WinCaptionButton : public views::Button {
   void PaintSymbol(gfx::Canvas* canvas);
 
   WinFrameView* frame_view_;
+  std::unique_ptr<WinIconPainter> icon_painter_;
   ViewID button_type_;
 
   int base_width_ = WindowFrameUtil::kWindows10GlassCaptionButtonWidth;

shell/browser/ui/views/win_caption_button_container.cc

@@ -14,6 +14,7 @@
 #include "shell/browser/ui/views/win_frame_view.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/strings/grit/ui_strings.h"
+#include "ui/views/background.h"
 #include "ui/views/layout/flex_layout.h"
 #include "ui/views/view_class_properties.h"
 
@@ -128,6 +129,8 @@ void WinCaptionButtonContainer::AddedToWidget() {
   UpdateButtons();
 
   if (frame_view_->window()->IsWindowControlsOverlayEnabled()) {
+    SetBackground(views::CreateSolidBackground(
+        frame_view_->window()->overlay_button_color()));
     SetPaintToLayer();
   }
 }

shell/browser/ui/views/win_frame_view.cc

@@ -19,6 +19,7 @@
 #include "ui/display/win/dpi.h"
 #include "ui/display/win/screen_win.h"
 #include "ui/gfx/geometry/dip_util.h"
+#include "ui/views/background.h"
 #include "ui/views/widget/widget.h"
 #include "ui/views/win/hwnd_util.h"
 
@@ -58,6 +59,8 @@ void WinFrameView::InvalidateCaptionButtons() {
   if (!caption_button_container_)
     return;
 
+  caption_button_container_->SetBackground(
+      views::CreateSolidBackground(window()->overlay_button_color()));
   caption_button_container_->InvalidateLayout();
   caption_button_container_->SchedulePaint();
 }

shell/browser/ui/views/win_icon_painter.cc

@@ -0,0 +1,143 @@
+// Copyright (c) 2022 Microsoft, Inc. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "shell/browser/ui/views/win_icon_painter.h"
+
+#include "base/numerics/safe_conversions.h"
+#include "ui/gfx/color_utils.h"
+#include "ui/gfx/geometry/rect_conversions.h"
+#include "ui/gfx/geometry/skia_conversions.h"
+#include "ui/gfx/scoped_canvas.h"
+
+namespace {
+
+// Canvas::DrawRect's stroke can bleed out of |rect|'s bounds, so this draws a
+// rectangle inset such that the result is constrained to |rect|'s size.
+void DrawRect(gfx::Canvas* canvas,
+              const gfx::Rect& rect,
+              const cc::PaintFlags& flags) {
+  gfx::RectF rect_f(rect);
+  float stroke_half_width = flags.getStrokeWidth() / 2;
+  rect_f.Inset(stroke_half_width);
+  canvas->DrawRect(rect_f, flags);
+}
+
+void DrawRoundRect(gfx::Canvas* canvas,
+                   const gfx::Rect& rect,
+                   int radius,
+                   const cc::PaintFlags& flags) {
+  gfx::RectF rect_f(rect);
+  float stroke_half_width = flags.getStrokeWidth() / 2;
+  rect_f.Inset(stroke_half_width);
+  canvas->DrawRoundRect(rect_f, radius, flags);
+}
+
+// Draws a path containing the top and right edges of a rounded rectangle.
+void DrawRoundRectEdges(gfx::Canvas* canvas,
+                        const gfx::Rect& rect,
+                        float radius,
+                        const cc::PaintFlags& flags) {
+  gfx::RectF symbol_rect_f(rect);
+  float stroke_half_width = flags.getStrokeWidth() / 2;
+  symbol_rect_f.Inset(stroke_half_width);
+  SkPath path;
+  path.moveTo(symbol_rect_f.x(), symbol_rect_f.y());
+  path.arcTo(symbol_rect_f.right(), symbol_rect_f.y(), symbol_rect_f.right(),
+             symbol_rect_f.y() + radius, radius);
+  path.lineTo(symbol_rect_f.right(), symbol_rect_f.bottom());
+  canvas->DrawPath(path, flags);
+}
+
+}  // namespace
+
+namespace electron {
+
+WinIconPainter::WinIconPainter() = default;
+WinIconPainter::~WinIconPainter() = default;
+
+void WinIconPainter::PaintMinimizeIcon(gfx::Canvas* canvas,
+                                       const gfx::Rect& symbol_rect,
+                                       const cc::PaintFlags& flags) {
+  const int y = symbol_rect.CenterPoint().y();
+  const gfx::Point p1 = gfx::Point(symbol_rect.x(), y);
+  const gfx::Point p2 = gfx::Point(symbol_rect.right(), y);
+  canvas->DrawLine(p1, p2, flags);
+}
+
+void WinIconPainter::PaintMaximizeIcon(gfx::Canvas* canvas,
+                                       const gfx::Rect& symbol_rect,
+                                       const cc::PaintFlags& flags) {
+  DrawRect(canvas, symbol_rect, flags);
+}
+
+void WinIconPainter::PaintRestoreIcon(gfx::Canvas* canvas,
+                                      const gfx::Rect& symbol_rect,
+                                      const cc::PaintFlags& flags) {
+  const int separation = std::floor(2 * canvas->image_scale());
+  gfx::Rect icon_rect = symbol_rect;
+  icon_rect.Inset(gfx::Insets::TLBR(separation, 0, 0, separation));
+
+  // Bottom left ("in front") square.
+  DrawRect(canvas, icon_rect, flags);
+
+  // Top right ("behind") square.
+  canvas->ClipRect(icon_rect, SkClipOp::kDifference);
+  icon_rect.Offset(separation, -separation);
+  DrawRect(canvas, icon_rect, flags);
+}
+
+void WinIconPainter::PaintCloseIcon(gfx::Canvas* canvas,
+                                    const gfx::Rect& symbol_rect,
+                                    const cc::PaintFlags& flags) {
+  // TODO(bsep): This sometimes draws misaligned at fractional device scales
+  // because the button's origin isn't necessarily aligned to pixels.
+  cc::PaintFlags paint_flags = flags;
+  paint_flags.setAntiAlias(true);
+
+  canvas->ClipRect(symbol_rect);
+  SkPath path;
+  path.moveTo(symbol_rect.x(), symbol_rect.y());
+  path.lineTo(symbol_rect.right(), symbol_rect.bottom());
+  path.moveTo(symbol_rect.right(), symbol_rect.y());
+  path.lineTo(symbol_rect.x(), symbol_rect.bottom());
+  canvas->DrawPath(path, flags);
+}
+
+Win11IconPainter::Win11IconPainter() = default;
+Win11IconPainter::~Win11IconPainter() = default;
+
+void Win11IconPainter::PaintMaximizeIcon(gfx::Canvas* canvas,
+                                         const gfx::Rect& symbol_rect,
+                                         const cc::PaintFlags& flags) {
+  cc::PaintFlags paint_flags = flags;
+  paint_flags.setAntiAlias(true);
+
+  const float corner_radius = 2 * canvas->image_scale();
+  DrawRoundRect(canvas, symbol_rect, corner_radius, flags);
+}
+
+void Win11IconPainter::PaintRestoreIcon(gfx::Canvas* canvas,
+                                        const gfx::Rect& symbol_rect,
+                                        const cc::PaintFlags& flags) {
+  const int separation = std::floor(2 * canvas->image_scale());
+  gfx::Rect icon_rect = symbol_rect;
+  icon_rect.Inset(gfx::Insets::TLBR(separation, 0, 0, separation));
+
+  cc::PaintFlags paint_flags = flags;
+  paint_flags.setAntiAlias(true);
+
+  // Bottom left ("in front") rounded square.
+  const float bottom_rect_radius = 1 * canvas->image_scale();
+  DrawRoundRect(canvas, icon_rect, bottom_rect_radius, flags);
+
+  // Top right ("behind") top+right edges of rounded square (2.5x).
+  icon_rect.Offset(separation, -separation);
+  // Apply inset to left+bottom edges since we don't draw arcs for those edges
+  constexpr int top_rect_inset = 1;
+  icon_rect.Inset(gfx::Insets::TLBR(0, top_rect_inset, top_rect_inset, 0));
+
+  const float top_rect_radius = 2.5f * canvas->image_scale();
+  DrawRoundRectEdges(canvas, icon_rect, top_rect_radius, flags);
+}
+}  // namespace electron

shell/browser/ui/views/win_icon_painter.h

@@ -0,0 +1,64 @@
+// Copyright (c) 2022 Microsoft, Inc. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ELECTRON_SHELL_BROWSER_UI_VIEWS_WIN_ICON_PAINTER_H_
+#define ELECTRON_SHELL_BROWSER_UI_VIEWS_WIN_ICON_PAINTER_H_
+
+#include "base/memory/raw_ptr.h"
+#include "ui/gfx/canvas.h"
+
+namespace electron {
+
+class WinIconPainter {
+ public:
+  WinIconPainter();
+  virtual ~WinIconPainter();
+
+  WinIconPainter(const WinIconPainter&) = delete;
+  WinIconPainter& operator=(const WinIconPainter&) = delete;
+
+ public:
+  // Paints the minimize icon for the button
+  virtual void PaintMinimizeIcon(gfx::Canvas* canvas,
+                                 const gfx::Rect& symbol_rect,
+                                 const cc::PaintFlags& flags);
+
+  // Paints the maximize icon for the button
+  virtual void PaintMaximizeIcon(gfx::Canvas* canvas,
+                                 const gfx::Rect& symbol_rect,
+                                 const cc::PaintFlags& flags);
+
+  // Paints the restore icon for the button
+  virtual void PaintRestoreIcon(gfx::Canvas* canvas,
+                                const gfx::Rect& symbol_rect,
+                                const cc::PaintFlags& flags);
+
+  // Paints the close icon for the button
+  virtual void PaintCloseIcon(gfx::Canvas* canvas,
+                              const gfx::Rect& symbol_rect,
+                              const cc::PaintFlags& flags);
+};
+
+class Win11IconPainter : public WinIconPainter {
+ public:
+  Win11IconPainter();
+  ~Win11IconPainter() override;
+
+  Win11IconPainter(const Win11IconPainter&) = delete;
+  Win11IconPainter& operator=(const Win11IconPainter&) = delete;
+
+ public:
+  // Paints the maximize icon for the button
+  void PaintMaximizeIcon(gfx::Canvas* canvas,
+                         const gfx::Rect& symbol_rect,
+                         const cc::PaintFlags& flags) override;
+
+  // Paints the restore icon for the button
+  void PaintRestoreIcon(gfx::Canvas* canvas,
+                        const gfx::Rect& symbol_rect,
+                        const cc::PaintFlags& flags) override;
+};
+}  // namespace electron
+
+#endif  // ELECTRON_SHELL_BROWSER_UI_VIEWS_WIN_ICON_PAINTER_H_

shell/browser/ui/win/electron_desktop_window_tree_host_win.cc

@@ -99,4 +99,25 @@ bool ElectronDesktopWindowTreeHostWin::GetClientAreaInsets(
   return false;
 }
 
+bool ElectronDesktopWindowTreeHostWin::HandleMouseEventForCaption(
+    UINT message) const {
+  // Windows does not seem to generate WM_NCPOINTERDOWN/UP touch events for
+  // caption buttons with WCO. This results in a no-op for
+  // HWNDMessageHandler::HandlePointerEventTypeTouchOrNonClient and
+  // WM_SYSCOMMAND is not generated for the touch action. However, Windows will
+  // also generate a mouse event for every touch action and this gets handled in
+  // HWNDMessageHandler::HandleMouseEventInternal.
+  // With https://chromium-review.googlesource.com/c/chromium/src/+/1048877/
+  // Chromium lets the OS handle caption buttons for FrameMode::SYSTEM_DRAWN but
+  // again this does not generate the SC_MINIMIZE, SC_MAXIMIZE, SC_RESTORE
+  // commands when Non-client mouse events are generated for HTCLOSE,
+  // HTMINBUTTON, HTMAXBUTTON. To workaround this issue, wit this delegate we
+  // let chromium handle the mouse events via
+  // HWNDMessageHandler::HandleMouseInputForCaption instead of the OS and this
+  // will generate the necessary system commands to perform caption button
+  // actions due to the DefWindowProc call.
+  // https://source.chromium.org/chromium/chromium/src/+/main:ui/views/win/hwnd_message_handler.cc;l=3611
+  return native_window_view_->IsWindowControlsOverlayEnabled();
+}
+
 }  // namespace electron

shell/browser/ui/win/electron_desktop_window_tree_host_win.h

@@ -36,6 +36,7 @@ class ElectronDesktopWindowTreeHostWin
   bool GetDwmFrameInsetsInPixels(gfx::Insets* insets) const override;
   bool GetClientAreaInsets(gfx::Insets* insets,
                            HMONITOR monitor) const override;
+  bool HandleMouseEventForCaption(UINT message) const override;
 
  private:
   NativeWindowViews* native_window_view_;  // weak ref

shell/common/node_bindings.cc

@@ -37,6 +37,7 @@
 #include "shell/common/mac/main_application_bundle.h"
 #include "shell/common/node_includes.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_initializer.h"  // nogncheck
+#include "third_party/electron_node/src/debug_utils.h"
 
 #if !defined(MAS_BUILD)
 #include "shell/common/crash_keys.h"
@@ -135,6 +136,7 @@ void stop_and_close_uv_loop(uv_loop_t* loop) {
       break;
 
   DCHECK_EQ(0, uv_loop_alive(loop));
+  node::CheckedUvLoopClose(loop);
 }
 
 bool g_is_initialized = false;

spec-main/api-app-spec.ts

@@ -370,9 +370,11 @@ describe('app module', () => {
       server!.once('error', error => done(error));
       server!.on('connection', client => {
         client.once('data', data => {
-          if (String(data) === 'false' && state === 'none') {
+          if (String(data) === '--first' && state === 'none') {
             state = 'first-launch';
-          } else if (String(data) === 'true' && state === 'first-launch') {
+          } else if (String(data) === '--second' && state === 'first-launch') {
+            state = 'second-launch';
+          } else if (String(data) === '--third' && state === 'second-launch') {
             done();
           } else {
             done(`Unexpected state: "${state}", data: "${data}"`);
@@ -381,7 +383,7 @@ describe('app module', () => {
       });
 
       const appPath = path.join(fixturesPath, 'api', 'relaunch');
-      const child = cp.spawn(process.execPath, [appPath]);
+      const child = cp.spawn(process.execPath, [appPath, '--first']);
       child.stdout.on('data', (c) => console.log(c.toString()));
       child.stderr.on('data', (c) => console.log(c.toString()));
       child.on('exit', (code, signal) => {

spec-main/api-browser-view-spec.ts

@@ -146,7 +146,14 @@ describe('BrowserView module', () => {
   });
 
   describe('BrowserView.getBounds()', () => {
-    it('returns the current bounds', () => {
+    it('returns correct bounds on a framed window', () => {
+      view = new BrowserView();
+      const bounds = { x: 10, y: 20, width: 30, height: 40 };
+      view.setBounds(bounds);
+      expect(view.getBounds()).to.deep.equal(bounds);
+    });
+
+    it('returns correct bounds on a frameless window', () => {
       view = new BrowserView();
       const bounds = { x: 10, y: 20, width: 30, height: 40 };
       view.setBounds(bounds);

spec-main/api-browser-window-spec.ts

@@ -1450,6 +1450,11 @@ describe('BrowserWindow module', () => {
             expect(w.fullScreen).to.be.true();
           });
 
+          it('does not go fullscreen if roundedCorners are enabled', async () => {
+            w = new BrowserWindow({ frame: false, roundedCorners: false, fullscreen: true });
+            expect(w.fullScreen).to.be.false();
+          });
+
           it('can be changed', () => {
             w.fullScreen = false;
             expect(w.fullScreen).to.be.false();
@@ -4946,6 +4951,23 @@ describe('BrowserWindow module', () => {
         await leaveFullScreen;
       });
 
+      it('should be able to load a URL while transitioning to fullscreen', async () => {
+        const w = new BrowserWindow({ fullscreen: true });
+        w.loadFile(path.join(fixtures, 'pages', 'c.html'));
+
+        const load = emittedOnce(w.webContents, 'did-finish-load');
+        const enterFS = emittedOnce(w, 'enter-full-screen');
+
+        await Promise.all([enterFS, load]);
+        expect(w.fullScreen).to.be.true();
+
+        await delay();
+
+        const leaveFullScreen = emittedOnce(w, 'leave-full-screen');
+        w.setFullScreen(false);
+        await leaveFullScreen;
+      });
+
       it('can be changed with setFullScreen method', async () => {
         const w = new BrowserWindow();
         const enterFullScreen = emittedOnce(w, 'enter-full-screen');

spec-main/api-session-spec.ts

@@ -528,6 +528,50 @@ describe('session module', () => {
     });
   });
 
+  describe('ses.getBlobData2()', () => {
+    const scheme = 'cors-blob';
+    const protocol = session.defaultSession.protocol;
+    const url = `${scheme}://host`;
+    after(async () => {
+      await protocol.unregisterProtocol(scheme);
+    });
+    afterEach(closeAllWindows);
+
+    it('returns blob data for uuid', (done) => {
+      const content = `<html>
+                       <script>
+                       let fd = new FormData();
+                       fd.append("data", new Blob(new Array(65_537).fill('a')));
+                       fetch('${url}', {method:'POST', body: fd });
+                       </script>
+                       </html>`;
+
+      protocol.registerStringProtocol(scheme, (request, callback) => {
+        try {
+          if (request.method === 'GET') {
+            callback({ data: content, mimeType: 'text/html' });
+          } else if (request.method === 'POST') {
+            const uuid = request.uploadData![1].blobUUID;
+            expect(uuid).to.be.a('string');
+            session.defaultSession.getBlobData(uuid!).then(result => {
+              try {
+                const data = new Array(65_537).fill('a');
+                expect(result.toString()).to.equal(data.join(''));
+                done();
+              } catch (e) {
+                done(e);
+              }
+            });
+          }
+        } catch (e) {
+          done(e);
+        }
+      });
+      const w = new BrowserWindow({ show: false });
+      w.loadURL(url);
+    });
+  });
+
   describe('ses.setCertificateVerifyProc(callback)', () => {
     let server: http.Server;
 

spec-main/api-web-contents-spec.ts

@@ -903,6 +903,12 @@ describe('webContents module', () => {
   });
 
   describe('userAgent APIs', () => {
+    it('is not empty by default', () => {
+      const w = new BrowserWindow({ show: false });
+      const userAgent = w.webContents.getUserAgent();
+      expect(userAgent).to.be.a('string').that.is.not.empty();
+    });
+
     it('can set the user agent (functions)', () => {
       const w = new BrowserWindow({ show: false });
       const userAgent = w.webContents.getUserAgent();

spec-main/chromium-spec.ts

@@ -1461,6 +1461,34 @@ describe('chromium features', () => {
         expect((w.webContents as any).length()).to.equal(2);
       });
     });
+
+    describe('window.history.back', () => {
+      it('should not allow sandboxed iframe to modify main frame state', async () => {
+        const w = new BrowserWindow({ show: false });
+        w.loadURL('data:text/html,<iframe sandbox="allow-scripts"></iframe>');
+        await Promise.all([
+          emittedOnce(w.webContents, 'navigation-entry-committed'),
+          emittedOnce(w.webContents, 'did-frame-navigate'),
+          emittedOnce(w.webContents, 'did-navigate')
+        ]);
+
+        w.webContents.executeJavaScript('window.history.pushState(1, "")');
+        await Promise.all([
+          emittedOnce(w.webContents, 'navigation-entry-committed'),
+          emittedOnce(w.webContents, 'did-navigate-in-page')
+        ]);
+
+        (w.webContents as any).once('navigation-entry-committed', () => {
+          expect.fail('Unexpected navigation-entry-committed');
+        });
+        w.webContents.once('did-navigate-in-page', () => {
+          expect.fail('Unexpected did-navigate-in-page');
+        });
+        await w.webContents.mainFrame.frames[0].executeJavaScript('window.history.back()');
+        expect(await w.webContents.executeJavaScript('window.history.state')).to.equal(1);
+        expect((w.webContents as any).getActiveIndex()).to.equal(1);
+      });
+    });
   });
 
   describe('chrome://media-internals', () => {

spec/fixtures/api/relaunch/main.js

@@ -11,11 +11,15 @@ app.whenReady().then(() => {
   const lastArg = process.argv[process.argv.length - 1];
   const client = net.connect(socketPath);
   client.once('connect', () => {
-    client.end(String(lastArg === '--second'));
+    client.end(lastArg);
   });
   client.once('end', () => {
-    if (lastArg !== '--second') {
-      app.relaunch({ args: process.argv.slice(1).concat('--second') });
+    if (lastArg === '--first') {
+      // Once without execPath specified
+      app.relaunch({ args: process.argv.slice(1, -1).concat('--second') });
+    } else if (lastArg === '--second') {
+      // And once with execPath specified
+      app.relaunch({ execPath: process.argv[0], args: process.argv.slice(1, -1).concat('--third') });
     }
     app.exit(0);
   });

vsts-arm-test-steps.yml

@@ -1,110 +0,0 @@
-steps:
-- task: CopyFiles@2
-  displayName: 'Copy Files to: src/electron'
-  inputs:
-    TargetFolder: src/electron
-
-- bash: |
-    cd src/electron
-    node script/yarn.js install --frozen-lockfile
-  displayName: 'Yarn install'
-
-- bash: |
-    export ZIP_DEST=$PWD/src/out/Default
-    echo "##vso[task.setvariable variable=ZIP_DEST]$ZIP_DEST"
-    mkdir -p $ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=dist.zip --dest=$ZIP_DEST
-    cd $ZIP_DEST
-    unzip -o dist.zip
-  displayName: 'Download and unzip dist files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    export FFMPEG_ZIP_DEST=$PWD/src/out/ffmpeg
-    mkdir -p $FFMPEG_ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=ffmpeg.zip --dest=$FFMPEG_ZIP_DEST
-    cd $FFMPEG_ZIP_DEST
-    unzip -o ffmpeg.zip
-  displayName: 'Download and unzip ffmpeg for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export NODE_HEADERS_DEST=$PWD/src/out/Default/gen
-   mkdir -p $NODE_HEADERS_DEST
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=node_headers.tar.gz --dest=$NODE_HEADERS_DEST
-   cd $NODE_HEADERS_DEST
-   tar xzf node_headers.tar.gz
-  displayName: 'Download and untar node header files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export CROSS_ARCH_SNAPSHOTS=$PWD/src/out/Default/cross-arch-snapshots
-   mkdir -p $CROSS_ARCH_SNAPSHOTS
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/snapshot_blob.bin --dest=$CROSS_ARCH_SNAPSHOTS
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/v8_context_snapshot.bin --dest=$CROSS_ARCH_SNAPSHOTS
-  displayName: 'Download cross arch snapshot files'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export NATIVE_UNITTESTS_DEST=$PWD/src/out/Default
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=shell_browser_ui_unittests --dest=$NATIVE_UNITTESTS_DEST
-   chmod +x $NATIVE_UNITTESTS_DEST/shell_browser_ui_unittests
-  displayName: 'Download native unittest executables'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    sh -e /etc/init.d/xvfb start
-  displayName: Setup for headless testing
-  env:
-    DISPLAY: ":99.0"
-
-- bash: |
-    # Next line needed to avoid crash on arm32
-    sudo gdk-pixbuf-query-loaders --update-cache
-    cd src
-    export ELECTRON_OUT_DIR=Default
-    (cd electron && node script/yarn test -- --enable-logging)
-  displayName: 'Run Electron tests'
-  timeoutInMinutes: 20
-  env:
-    ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-    CI: 1
-
-- bash: |
-    cd src
-    python electron/script/verify-ffmpeg.py --source-root "$PWD" --build-dir out/Default --ffmpeg-path out/ffmpeg
-  displayName: Verify non proprietary ffmpeg
-  timeoutInMinutes: 5
-
-- bash: |
-    cd src
-    echo Verify cross arch snapshot
-    python electron/script/verify-mksnapshot.py --source-root "$PWD" --build-dir out/Default --snapshot-files-dir $PWD/out/Default/cross-arch-snapshots
-  displayName: Verify cross arch snapshot
-  timeoutInMinutes: 5
-
-- task: PublishTestResults@2
-  displayName: 'Publish Test Results'
-  inputs:
-    testResultsFiles: '*.xml'
-
-    searchFolder: '$(System.DefaultWorkingDirectory)/src/junit/'
-
-  condition: succeededOrFailed()
-
-- task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3
-  displayName: 'Clean Agent Directories'
-
-  condition: always()

vsts-arm32v7.yml

@@ -1,13 +0,0 @@
-resources:
-  containers:
-  - container: arm32v7-test-container
-    image: ghcr.io/electron/build:arm32v7-27db4a3e3512bfd2e47f58cea69922da0835f1d9
-    options: --shm-size 128m
-
-jobs:
-- job: Test_Arm32v7
-  container: arm32v7-test-container
-  displayName: Test Arm on Arm32v7 hardware
-  timeoutInMinutes: 30
-  steps:
-  - template: vsts-arm-test-steps.yml

vsts-arm64v8.yml

@@ -1,13 +0,0 @@
-resources:
-  containers:
-  - container: arm64v8-test-container
-    image: ghcr.io/electron/build:arm64v8-27db4a3e3512bfd2e47f58cea69922da0835f1d9
-    options: --shm-size 128m
-
-jobs:
-- job: Test_Arm64
-  container: arm64v8-test-container
-  displayName: Test Arm64 on Arm64 hardware
-  timeoutInMinutes: 30
-  steps:
-  - template: vsts-arm-test-steps.yml