Bump v19.1.3

* chore: cherry-pick 05a0d99c9715 from chromium

* chore: cherry-pick 05a0d99c9715 from chromium

Co-authored-by: Adam Prasil <adamprasil@microsoft.com>

.circleci/config/base.yml

@@ -216,6 +216,7 @@ step-maybe-cleanup-arm64-mac: &step-maybe-cleanup-arm64-mac
         rm -rf ~/Library/Application\ Support/electron*
         security delete-generic-password -l "Chromium Safe Storage" || echo "✓ Keychain does not contain password from tests"
         security delete-generic-password -l "Electron Test Main Safe Storage" || echo "✓ Keychain does not contain password from tests"
+        security delete-generic-password -a "electron-safe-storage" || echo "✓ Keychain does not contain password from tests"
       elif [ "$TARGET_ARCH" == "arm" ] || [ "$TARGET_ARCH" == "arm64" ]; then
         XVFB=/usr/bin/Xvfb
         /sbin/start-stop-daemon --stop --exec $XVFB || echo "Xvfb not running"

.github/semantic.yml

@@ -1,2 +0,0 @@
-# Always validate the PR title, and ignore the commits
-titleOnly: true

.github/workflows/electron_woa_testing.yml

@@ -0,0 +1,178 @@
+name: Electron WOA Testing
+
+on:
+  push:    
+    branches: '**'
+  workflow_dispatch:
+    inputs:
+      appveyor_job_id:
+        description: 'Job Id of Appveyor WOA job to test'
+        type: text
+        required: true
+
+jobs:
+  electron-woa-init:
+    if: ${{ github.event_name == 'push' && github.repository == 'electron/electron' }}
+    runs-on: ubuntu-latest
+    steps:
+        - name: Dummy step for push event
+          run: |
+            echo "This job is a needed initialization step for Electron WOA testing.  Another test result will appear once the electron-woa-testing build is done."
+
+  electron-woa-testing:    
+    if: ${{ github.event_name == 'workflow_dispatch' && github.repository == 'electron/electron' }}    
+    runs-on: [self-hosted, woa]  
+    permissions:
+      checks: write
+      pull-requests: write
+    steps:
+    - uses: LouisBrunner/checks-action@v1.1.1
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        status: in_progress
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}    
+        output: |
+          {"summary":"Test In Progress","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}        
+    - name: Clean Workspace
+      run: |
+        Remove-Item * -Recurse -Force
+      shell: powershell
+    - name: Checkout
+      uses: actions/checkout@v3
+      with:
+        path: src\electron
+        fetch-depth: 0
+    - name: Yarn install
+      run: |
+        cd src\electron
+        node script/yarn.js install --frozen-lockfile
+    - name: Download and extract dist.zip for test
+      run: |
+        $localArtifactPath = "$pwd\dist.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/dist.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -osrc\out\Default -y $localArtifactPath
+      shell: powershell
+    - name: Download and extract native test executables for test
+      run: |
+        $localArtifactPath = "src\out\Default\shell_browser_ui_unittests.exe"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/shell_browser_ui_unittests.exe"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+      shell: powershell
+    - name: Download and extract ffmpeg.zip for test
+      run: |
+        $localArtifactPath = "$pwd\ffmpeg.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/ffmpeg.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -osrc\out\ffmpeg $localArtifactPath
+      shell: powershell
+    - name: Download node headers for test
+      run: |
+        $localArtifactPath = "src\node_headers.zip"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/node_headers.zip"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+        cd src
+        & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y node_headers.zip
+      shell: powershell
+    - name: Download electron.lib for test
+      run: |
+        $localArtifactPath = "src\out\Default\electron.lib"
+        $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/electron.lib"
+        Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+      shell: powershell
+    # Uncomment the following block if pdb files are needed to debug issues
+    # - name: Download pdb files for detailed stacktraces
+    #   if: ${{ github.event_name == 'workflow_dispatch' }}
+    #   run: |
+    #     try {
+    #       $localArtifactPath = "src\pdb.zip"
+    #       $serverArtifactPath = "https://ci.appveyor.com/api/buildjobs/${{ inputs.appveyor_job_id }}/artifacts/pdb.zip"
+    #       Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer ${{ secrets.APPVEYOR_TOKEN }}" }
+    #       cd src
+    #       & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y pdb.zip
+    #     } catch {
+    #       Write-Host "There was an exception encountered while downloading pdb files:" $_.Exception.Message
+    #     } finally {
+    #       $global:LASTEXITCODE = 0
+    #     }
+    #   shell: powershell
+    - name: Setup node headers
+      run: |
+        New-Item src\out\Default\gen\node_headers\Release -Type directory
+        Copy-Item -path src\out\Default\electron.lib -destination src\out\Default\gen\node_headers\Release\node.lib
+      shell: powershell
+    - name: Run Electron Main process tests
+      run: |
+        cd src
+        set npm_config_nodedir=%cd%\out\Default\gen\node_headers
+        set npm_config_arch=arm64
+        cd electron
+        node script/yarn test --runners=main --enable-logging --disable-features=CalculateNativeWinOcclusion  
+      env:
+        ELECTRON_ENABLE_STACK_DUMPING: true
+        ELECTRON_OUT_DIR: Default
+        IGNORE_YARN_INSTALL_ERROR: 1
+        ELECTRON_TEST_RESULTS_DIR: junit
+        MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
+        MOCHA_REPORTER: mocha-multi-reporters
+        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
+    - name: Run Electron Remote based tests
+      if: ${{ success() || failure() }}
+      run: |
+        cd src
+        set npm_config_nodedir=%cd%\out\Default\gen\node_headers
+        set npm_config_arch=arm64
+        cd electron
+        node script/yarn test --runners=remote --enable-logging --disable-features=CalculateNativeWinOcclusion
+      env:
+        ELECTRON_OUT_DIR: Default
+        IGNORE_YARN_INSTALL_ERROR: 1
+        ELECTRON_TEST_RESULTS_DIR: junit
+        MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
+        MOCHA_REPORTER: mocha-multi-reporters
+        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
+    - name: Verify ffmpeg
+      run: |
+        cd src
+        echo "Verifying non proprietary ffmpeg"
+        python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
+      shell: cmd
+    - name: Kill processes left running from last test run
+      if: ${{ always() }}
+      run: |
+        Get-Process | Where Name -Like "electron*" | Stop-Process
+        Get-Process | Where Name -Like "msedge*" | Stop-Process
+      shell: powershell
+    - name: Delete user app data directories
+      if: ${{ always() }}
+      run: |
+        Remove-Item -path $env:APPDATA/Electron* -Recurse -Force -ErrorAction Ignore
+      shell: powershell
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"${{ job.status }}","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"Job Succeeded","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}          
+    - uses: LouisBrunner/checks-action@v1.1.1
+      if: ${{ ! success() }}
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: electron-woa-testing
+        conclusion: "${{ job.status }}"
+        details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        output: |
+          {"summary":"Job Failed","text_description":"See job details here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}                    

ELECTRON_VERSION

@@ -1 +1 @@
-19.0.10
+19.1.3

appveyor.yml

@@ -228,7 +228,7 @@ deploy_script:
           & python script\release\uploaders\upload.py --verbose
         }
       } elseif (Test-Path Env:\TEST_WOA) {
-        node script/release/ci-release-build.js --job=electron-woa-testing --ci=VSTS --armTest --appveyorJobId=$env:APPVEYOR_JOB_ID $env:APPVEYOR_REPO_BRANCH
+        node script/release/ci-release-build.js --job=electron-woa-testing --ci=GHA --appveyorJobId=$env:APPVEYOR_JOB_ID $env:APPVEYOR_REPO_BRANCH
       }
 on_finish:
   - cd ..

azure-pipelines-arm.yml

@@ -1,121 +0,0 @@
-steps:
-- task: CopyFiles@2
-  displayName: 'Copy Files to: src/electron'
-  inputs:
-    TargetFolder: src/electron
-
-- bash: |
-    cd src/electron
-    node script/yarn.js install --frozen-lockfile
-  displayName: 'Yarn install'
-
-- bash: |
-    export ZIP_DEST=$PWD/src/out/Default
-    echo "##vso[task.setvariable variable=ZIP_DEST]$ZIP_DEST"
-    mkdir -p $ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=dist.zip --dest=$ZIP_DEST
-    cd $ZIP_DEST
-    unzip -o dist.zip
-    xattr -cr Electron.app    
-  displayName: 'Download and unzip dist files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    export FFMPEG_ZIP_DEST=$PWD/src/out/ffmpeg
-    mkdir -p $FFMPEG_ZIP_DEST
-    cd src/electron
-    node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=ffmpeg.zip --dest=$FFMPEG_ZIP_DEST
-    cd $FFMPEG_ZIP_DEST
-    unzip -o ffmpeg.zip
-  displayName: 'Download and unzip ffmpeg for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export NODE_HEADERS_DEST=$PWD/src/out/Default/gen
-   mkdir -p $NODE_HEADERS_DEST
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=node_headers.tar.gz --dest=$NODE_HEADERS_DEST
-   cd $NODE_HEADERS_DEST
-   tar xzf node_headers.tar.gz
-  displayName: 'Download and untar node header files for test'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-   export CROSS_ARCH_SNAPSHOTS=$PWD/src/out/Default/cross-arch-snapshots
-   mkdir -p $CROSS_ARCH_SNAPSHOTS
-   cd src/electron
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/snapshot_blob.bin --dest=$CROSS_ARCH_SNAPSHOTS
-   node script/download-circleci-artifacts.js --buildNum=$CIRCLE_BUILD_NUM --name=cross-arch-snapshots/v8_context_snapshot.arm64.bin --dest=$CROSS_ARCH_SNAPSHOTS
-  displayName: 'Download cross arch snapshot files'
-  env:
-    CIRCLE_TOKEN: $(CIRCLECI_TOKEN)
-
-- bash: |
-    cd src
-    export ELECTRON_OUT_DIR=Default
-    export npm_config_arch=arm64
-    (cd electron && node script/yarn test --enable-logging --runners main)
-  displayName: 'Run Electron main tests'
-  timeoutInMinutes: 20
-  env:
-    ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-
-- bash: |
-    cd src
-    export ELECTRON_OUT_DIR=Default
-    export npm_config_arch=arm64
-    (cd electron && node script/yarn test --enable-logging --runners remote)
-  displayName: 'Run Electron remote tests'
-  timeoutInMinutes: 20
-  condition: succeededOrFailed()
-  env:
-    ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-
-- bash: |
-    cd src
-    python electron/script/verify-ffmpeg.py --source-root "$PWD" --build-dir out/Default --ffmpeg-path out/ffmpeg
-  displayName: Verify non proprietary ffmpeg
-  timeoutInMinutes: 5
-  condition: succeededOrFailed()
-  env:
-    TARGET_ARCH: arm64
-
-- bash: |
-    cd src
-    echo Verify cross arch snapshot
-    python electron/script/verify-mksnapshot.py --source-root "$PWD" --build-dir out/Default --snapshot-files-dir $PWD/out/Default/cross-arch-snapshots
-  displayName: Verify cross arch snapshot
-  timeoutInMinutes: 5
-  condition: succeededOrFailed()
-
-- task: PublishTestResults@2
-  displayName: 'Publish Test Results'
-  inputs:
-    testResultsFiles: '*.xml'
-
-    searchFolder: '$(System.DefaultWorkingDirectory)/src/junit/'
-
-  condition: succeededOrFailed()
-
-- bash: killall Electron || echo "No Electron processes left running"
-  displayName: 'Kill processes left running from last test run'
-  condition: always()
-
-- bash: |
-    rm -rf ~/Library/Application\ Support/Electron*
-    rm -rf ~/Library/Application\ Support/electron*
-  displayName: 'Delete user app data directories'
-  condition: always()
-
-- task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3
-  displayName: 'Clean Agent Directories'
-
-  condition: always()

azure-pipelines-woa.yml

@@ -1,130 +0,0 @@
-workspace:
-  clean: all
-
-steps:
-- checkout: self
-  path: src\electron
-
-- script: |
-    node script/yarn.js install --frozen-lockfile
-  displayName: 'Yarn install'
-
-- powershell: |
-    $localArtifactPath = "$pwd\dist.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/dist.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -o$(Pipeline.Workspace)\src\out\Default -y $localArtifactPath
-  displayName: 'Download and extract dist.zip for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\out\Default\shell_browser_ui_unittests.exe"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/shell_browser_ui_unittests.exe"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-  displayName: 'Download and extract native test executables for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$pwd\ffmpeg.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/ffmpeg.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -o$(Pipeline.Workspace)\src\out\ffmpeg $localArtifactPath
-  displayName: 'Download and extract ffmpeg.zip for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\node_headers.zip"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/node_headers.zip"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-    cd $(Pipeline.Workspace)\src
-    & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y node_headers.zip
-  displayName: 'Download node headers for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    $localArtifactPath = "$(Pipeline.Workspace)\src\out\Default\electron.lib"
-    $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/electron.lib"
-    Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-  displayName: 'Download electron.lib for test'
-  env:
-    APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-# Uncomment the following block if pdb files are needed to debug issues
-# - powershell: |
-#     try {
-#       $localArtifactPath = "$(Pipeline.Workspace)\src\pdb.zip"
-#       $serverArtifactPath = "$env:APPVEYOR_URL/buildjobs/$env:APPVEYOR_JOB_ID/artifacts/pdb.zip"
-#       Invoke-RestMethod -Method Get -Uri $serverArtifactPath -OutFile $localArtifactPath -Headers @{ "Authorization" = "Bearer $env:APPVEYOR_TOKEN" }
-#       cd $(Pipeline.Workspace)\src
-#       & "${env:ProgramFiles(x86)}\7-Zip\7z.exe" x -y pdb.zip
-#     } catch {
-#       Write-Host "There was an exception encountered while downloading pdb files:" $_.Exception.Message
-#     } finally {
-#       $global:LASTEXITCODE = 0
-#     }
-#   displayName: 'Download pdb files for detailed stacktraces'
-#   env:
-#     APPVEYOR_TOKEN: $(APPVEYOR_TOKEN)
-
-- powershell: |
-    New-Item $(Pipeline.Workspace)\src\out\Default\gen\node_headers\Release -Type directory
-    Copy-Item -path $(Pipeline.Workspace)\src\out\Default\electron.lib -destination $(Pipeline.Workspace)\src\out\Default\gen\node_headers\Release\node.lib
-  displayName: 'Setup node headers'
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    set npm_config_nodedir=%cd%\out\Default\gen\node_headers
-    set npm_config_arch=arm64
-    cd electron
-    node script/yarn test --runners=main --enable-logging --disable-features=CalculateNativeWinOcclusion
-  displayName: 'Run Electron Main process tests'
-  env:
-    ELECTRON_ENABLE_STACK_DUMPING: true
-    ELECTRON_OUT_DIR: Default
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-    MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
-    MOCHA_REPORTER: mocha-multi-reporters
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    set npm_config_nodedir=%cd%\out\Default\gen\node_headers
-    set npm_config_arch=arm64
-    cd electron
-    node script/yarn test --runners=remote --enable-logging --disable-features=CalculateNativeWinOcclusion
-  displayName: 'Run Electron Remote based tests'
-  env:
-    ELECTRON_OUT_DIR: Default
-    IGNORE_YARN_INSTALL_ERROR: 1
-    ELECTRON_TEST_RESULTS_DIR: junit
-    MOCHA_MULTI_REPORTERS: 'mocha-junit-reporter, tap'
-    MOCHA_REPORTER: mocha-multi-reporters
-  condition: succeededOrFailed()
-
-- task: PublishTestResults@2
-  displayName: 'Publish Test Results'
-  inputs:
-    testResultsFiles: '*.xml'
-    searchFolder: '$(Pipeline.Workspace)/src/junit/'
-  condition: always()
-
-- script: |
-    cd $(Pipeline.Workspace)\src
-    echo "Verifying non proprietary ffmpeg"
-    python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
-  displayName: 'Verify ffmpeg'
-
-- powershell: |
-    Get-Process | Where Name –Like "electron*" | Stop-Process
-    Get-Process | Where Name –Like "msedge*" | Stop-Process
-  displayName: 'Kill processes left running from last test run'
-  condition: always()
-
-- powershell: |
-    Remove-Item -path $env:APPDATA/Electron* -Recurse -Force -ErrorAction Ignore
-  displayName: 'Delete user app data directories'
-  condition: always()

chromium_src/BUILD.gn

@@ -55,6 +55,14 @@ static_library("chrome") {
     "//chrome/browser/process_singleton.h",
     "//chrome/browser/process_singleton_internal.cc",
     "//chrome/browser/process_singleton_internal.h",
+    "//chrome/browser/themes/browser_theme_pack.cc",
+    "//chrome/browser/themes/browser_theme_pack.h",
+    "//chrome/browser/themes/custom_theme_supplier.cc",
+    "//chrome/browser/themes/custom_theme_supplier.h",
+    "//chrome/browser/themes/theme_properties.cc",
+    "//chrome/browser/themes/theme_properties.h",
+    "//chrome/browser/ui/color/chrome_color_mixers.cc",
+    "//chrome/browser/ui/color/chrome_color_mixers.h",
     "//chrome/browser/ui/exclusive_access/exclusive_access_bubble_type.cc",
     "//chrome/browser/ui/exclusive_access/exclusive_access_bubble_type.h",
     "//chrome/browser/ui/exclusive_access/exclusive_access_controller_base.cc",
@@ -69,7 +77,11 @@ static_library("chrome") {
     "//chrome/browser/ui/exclusive_access/keyboard_lock_controller.h",
     "//chrome/browser/ui/exclusive_access/mouse_lock_controller.cc",
     "//chrome/browser/ui/exclusive_access/mouse_lock_controller.h",
+    "//chrome/browser/ui/frame/window_frame_util.cc",
+    "//chrome/browser/ui/frame/window_frame_util.h",
     "//chrome/browser/ui/native_window_tracker.h",
+    "//chrome/browser/ui/ui_features.cc",
+    "//chrome/browser/ui/ui_features.h",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper.cc",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper.h",
     "//chrome/browser/ui/views/eye_dropper/eye_dropper_view.cc",
@@ -107,6 +119,8 @@ static_library("chrome") {
       "//chrome/browser/ui/view_ids.h",
       "//chrome/browser/win/chrome_process_finder.cc",
       "//chrome/browser/win/chrome_process_finder.h",
+      "//chrome/browser/win/titlebar_config.cc",
+      "//chrome/browser/win/titlebar_config.h",
       "//chrome/browser/win/titlebar_config.h",
       "//chrome/child/v8_crashpad_support_win.cc",
       "//chrome/child/v8_crashpad_support_win.h",
@@ -128,6 +142,7 @@ static_library("chrome") {
 
   public_deps = [
     "//chrome/browser:dev_ui_browser_resources",
+    "//chrome/browser/ui/color:mixers",
     "//chrome/common",
     "//chrome/common:version_header",
     "//components/keyed_service/content",

docs/api/browser-window.md

@@ -243,7 +243,8 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
   * `trafficLightPosition` [Point](structures/point.md) (optional) _macOS_ -
     Set a custom position for the traffic light buttons in frameless windows.
   * `roundedCorners` boolean (optional) _macOS_ - Whether frameless window
-    should have rounded corners on macOS. Default is `true`.
+    should have rounded corners on macOS. Default is `true`. Setting this property
+    to `false` will prevent the window from being fullscreenable.
   * `fullscreenWindowTitle` boolean (optional) _macOS_ _Deprecated_ - Shows
     the title in the title bar in full screen mode on macOS for `hiddenInset`
     titleBarStyle. Default is `false`.

docs/api/session.md

@@ -610,7 +610,7 @@ win.webContents.session.setCertificateVerifyProc((request, callback) => {
     * `notifications` - Request notification creation and the ability to display them in the user's system tray.
     * `midi` - Request MIDI access in the `webmidi` API.
     * `midiSysex` - Request the use of system exclusive messages in the `webmidi` API.
-    * `pointerLock` - Request to directly interpret mouse movements as an input method. Click [here](https://developer.mozilla.org/en-US/docs/Web/API/Pointer_Lock_API) to know more.
+    * `pointerLock` - Request to directly interpret mouse movements as an input method. Click [here](https://developer.mozilla.org/en-US/docs/Web/API/Pointer_Lock_API) to know more. These requests always appear to originate from the main frame.
     * `fullscreen` - Request for the app to enter fullscreen mode.
     * `openExternal` - Request to open links in external applications.
     * `unknown` - An unrecognized permission request
@@ -1025,7 +1025,7 @@ is emitted.
 
 #### `ses.getStoragePath()`
 
-A `string | null` indicating the absolute file system path where data for this
+Returns `string | null` - The absolute file system path where data for this
 session is persisted on disk.  For in memory sessions this returns `null`.
 
 ### Instance Properties

docs/api/tray.md

@@ -25,15 +25,20 @@ app.whenReady().then(() => {
 })
 ```
 
-__Platform limitations:__
+__Platform Considerations__
+
+If you want to keep exact same behaviors on all platforms, you should not
+rely on the `click` event; instead, always attach a context menu to the tray icon.
+
+__Linux__
 
-* On Linux the app indicator will be used if it is supported, otherwise
-  `GtkStatusIcon` will be used instead.
 * On Linux distributions that only have app indicator support, you have to
   install `libappindicator1` to make the tray icon work.
+* The app indicator will be used if it is supported, otherwise
+  `GtkStatusIcon` will be used instead.
 * App indicator will only be shown when it has a context menu.
-* When app indicator is used on Linux, the `click` event is ignored.
-* On Linux in order for changes made to individual `MenuItem`s to take effect,
+* The `click` event is ignored when using the app indicator.
+* In order for changes made to individual `MenuItem`s to take effect,
   you have to call `setContextMenu` again. For example:
 
 ```javascript
@@ -55,10 +60,16 @@ app.whenReady().then(() => {
 })
 ```
 
-* On Windows it is recommended to use `ICO` icons to get best visual effects.
+__MacOS__
 
-If you want to keep exact same behaviors on all platforms, you should not
-rely on the `click` event and always attach a context menu to the tray icon.
+* Icons passed to the Tray constructor should be [Template Images](native-image.md#template-image).
+* To make sure your icon isn't grainy on retina monitors, be sure your `@2x` image is 144dpi.
+* If you are bundling your application (e.g., with webpack for development), be sure that the file names are not being mangled or hashed. The filename needs to end in Template, and the `@2x` image needs to have the same filename as the standard image, or MacOS will not magically invert your image's colors or use the high density image.
+* 16x16 (72dpi) and 32x32@2x (144dpi) work well for most icons.
+
+__Windows__
+
+* It is recommended to use `ICO` icons to get best visual effects.
 
 ### `new Tray(image, [guid])`
 

docs/api/web-contents.md

@@ -1635,6 +1635,8 @@ Opens the devtools.
 When `contents` is a `<webview>` tag, the `mode` would be `detach` by default,
 explicitly passing an empty `mode` can force using last used dock state.
 
+On Windows, if Windows Control Overlay is enabled, Devtools will be opened with `mode: 'detach'`.
+
 #### `contents.closeDevTools()`
 
 Closes the devtools.

docs/api/web-frame-main.md

@@ -144,6 +144,16 @@ ipcRenderer.on('port', (e, msg) => {
 
 A `string` representing the current URL of the frame.
 
+#### `frame.origin` _Readonly_
+
+A `string` representing the current origin of the frame, serialized according
+to [RFC 6454](https://www.rfc-editor.org/rfc/rfc6454). This may be different
+from the URL. For instance, if the frame is a child window opened to
+`about:blank`, then `frame.origin` will return the parent frame's origin, while
+`frame.url` will return the empty string. Pages without a scheme/host/port
+triple origin will have the serialized origin of `"null"` (that is, the string
+containing the letters n, u, l, l).
+
 #### `frame.top` _Readonly_
 
 A `WebFrameMain | null` representing top frame in the frame hierarchy to which `frame`

docs/faq.md

@@ -135,7 +135,7 @@ is only available in renderer processes.
 
 If [sub-pixel anti-aliasing](https://alienryderflex.com/sub_pixel/) is deactivated, then fonts on LCD screens can look blurry. Example:
 
-![subpixel rendering example]
+![Subpixel rendering example](images/subpixel-rendering-screenshot.gif)
 
 Sub-pixel anti-aliasing needs a non-transparent background of the layer containing the font glyphs. (See [this issue](https://github.com/electron/electron/issues/6344#issuecomment-420371918) for more info).
 
@@ -161,4 +161,3 @@ Notice that just setting the background in the CSS does not have the desired eff
 [indexed-db]: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API
 [message-port]: https://developer.mozilla.org/en-US/docs/Web/API/MessagePort
 [browser-window]: api/browser-window.md
-[subpixel rendering example]: images/subpixel-rendering-screenshot.gif

docs/fiddles/features/web-serial/main.js

@@ -28,12 +28,16 @@ function createWindow () {
     if (permission === 'serial' && details.securityOrigin === 'file:///') {
       return true
     }
+    
+    return false
   })
 
   mainWindow.webContents.session.setDevicePermissionHandler((details) => {
     if (details.deviceType === 'serial' && details.origin === 'file://') {
       return true
     }
+    
+    return false
   })
   
   mainWindow.loadFile('index.html')

docs/tutorial/introduction.md

@@ -44,14 +44,14 @@ are the different categories and what you can expect on each one:
   application.
 - **Processes in Electron**: In-depth reference on Electron processes and how to work with them.
 - **Best Practices**: Important checklists to keep in mind when developing an Electron app.
-- **How-To Examples**: Quick references to add features to your Electron app.
+- **Examples**: Quick references to add features to your Electron app.
 - **Development**: Miscellaneous development guides.
 - **Distribution**: Learn how to distribute your app to end users.
 - **Testing and debugging**: How to debug JavaScript, write tests, and other tools used
   to create quality Electron applications.
-- **Resources**: Useful links to better understand how the Electron project works
+- **References**: Useful links to better understand how the Electron project works
   and is organized.
-- **Contributing to Electron**: Compiling Electron and making contributions can be daunting.
+- **Contributing**: Compiling Electron and making contributions can be daunting.
   We try to make it easier in this section.
 
 ## Getting help

docs/tutorial/message-ports.md

@@ -8,8 +8,7 @@ your app.
 
 Here is a very brief example of what a MessagePort is and how it works:
 
-```js
-// renderer.js ///////////////////////////////////////////////////////////////
+```js title='renderer.js (Renderer Process)'
 // MessagePorts are created in pairs. A connected pair of message ports is
 // called a channel.
 const channel = new MessageChannel()
@@ -28,8 +27,7 @@ port2.postMessage({ answer: 42 })
 ipcRenderer.postMessage('port', null, [port1])
 ```
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 // In the main process, we receive the port.
 ipcMain.on('port', (event) => {
   // When we receive a MessagePort in the main process, it becomes a
@@ -84,14 +82,84 @@ process, you can listen for the `close` event by calling `port.on('close',
 
 ## Example use cases
 
+### Setting up a MessageChannel between two renderers
+
+In this example, the main process sets up a MessageChannel, then sends each port
+to a different renderer. This allows renderers to send messages to each other
+without needing to use the main process as an in-between.
+
+```js title='main.js (Main Process)'
+const { BrowserWindow, app, MessageChannelMain } = require('electron')
+
+app.whenReady().then(async () => {
+  // create the windows.
+  const mainWindow = new BrowserWindow({
+    show: false,
+    webPreferences: {
+      contextIsolation: false,
+      preload: 'preloadMain.js'
+    }
+  })
+
+  const secondaryWindow = BrowserWindow({
+    show: false,
+    webPreferences: {
+      contextIsolation: false,
+      preload: 'preloadSecondary.js'
+    }
+  })
+
+  // set up the channel.
+  const { port1, port2 } = new MessageChannelMain()
+
+  // once the webContents are ready, send a port to each webContents with postMessage.
+  mainWindow.once('ready-to-show', () => {
+    mainWindow.webContents.postMessage('port', null, [port1])
+  })
+
+  secondaryWindow.once('ready-to-show', () => {
+    secondaryWindow.webContents.postMessage('port', null, [port2])
+  })
+})
+```
+
+Then, in your preload scripts you receive the port through IPC and set up the
+listeners.
+
+```js title='preloadMain.js and preloadSecondary.js (Preload scripts)'
+const { ipcRenderer } = require('electron')
+
+ipcRenderer.on('port', e => {
+  // port received, make it globally available.
+  window.electronMessagePort = e.ports[0]
+
+  window.electronMessagePort.onmessage = messageEvent => {
+    // handle message
+  }
+})
+```
+
+In this example messagePort is bound to the `window` object directly. It is better
+to use `contextIsolation` and set up specific contextBridge calls for each of your
+expected messages, but for the simplicity of this example we don't. You can find an
+example of context isolation further down this page at [Communicating directly between the main process and the main world of a context-isolated page](#communicating-directly-between-the-main-process-and-the-main-world-of-a-context-isolated-page)
+
+That means window.messagePort is globally available and you can call
+`postMessage` on it from anywhere in your app to send a message to the other
+renderer.
+
+```js title='renderer.js (Renderer Process)'
+// elsewhere in your code to send a message to the other renderers message handler
+window.electronMessagePort.postmessage('ping')
+```
+
 ### Worker process
 
 In this example, your app has a worker process implemented as a hidden window.
 You want the app page to be able to communicate directly with the worker
 process, without the performance overhead of relaying via the main process.
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 const { BrowserWindow, app, ipcMain, MessageChannelMain } = require('electron')
 
 app.whenReady().then(async () => {
@@ -129,8 +197,7 @@ app.whenReady().then(async () => {
 })
 ```
 
-```html
-<!-- worker.html ------------------------------------------------------------>
+```html  title='worker.html'
 <script>
 const { ipcRenderer } = require('electron')
 
@@ -153,8 +220,7 @@ ipcRenderer.on('new-client', (event) => {
 </script>
 ```
 
-```html
-<!-- app.html --------------------------------------------------------------->
+```html  title='app.html'
 <script>
 const { ipcRenderer } = require('electron')
 
@@ -182,9 +248,7 @@ Electron's built-in IPC methods only support two modes: fire-and-forget
 can implement a "response stream", where a single request responds with a
 stream of data.
 
-```js
-// renderer.js ///////////////////////////////////////////////////////////////
-
+```js title='renderer.js (Renderer Process)'
 const makeStreamingRequest = (element, callback) => {
   // MessageChannels are lightweight--it's cheap to create a new one for each
   // request.
@@ -213,9 +277,7 @@ makeStreamingRequest(42, (data) => {
 // We will see "got response data: 42" 10 times.
 ```
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
-
+```js  title='main.js (Main Process)'
 ipcMain.on('give-me-a-stream', (event, msg) => {
   // The renderer has sent us a MessagePort that it wants us to send our
   // response over.
@@ -242,8 +304,7 @@ the renderer are delivered to the isolated world, rather than to the main
 world. Sometimes you want to deliver messages to the main world directly,
 without having to step through the isolated world.
 
-```js
-// main.js ///////////////////////////////////////////////////////////////////
+```js title='main.js (Main Process)'
 const { BrowserWindow, app, MessageChannelMain } = require('electron')
 const path = require('path')
 
@@ -278,8 +339,7 @@ app.whenReady().then(async () => {
 })
 ```
 
-```js
-// preload.js ////////////////////////////////////////////////////////////////
+```js title='preload.js (Preload Script)'
 const { ipcRenderer } = require('electron')
 
 // We need to wait until the main world is ready to receive the message before
@@ -297,8 +357,7 @@ ipcRenderer.on('main-world-port', async (event) => {
 })
 ```
 
-```html
-<!-- index.html ------------------------------------------------------------->
+```html title='index.html'
 <script>
 window.onmessage = (event) => {
   // event.source === window means the message is coming from the preload

docs/tutorial/tutorial-2-first-app.md

@@ -350,7 +350,7 @@ app.whenReady().then(() => {
 
 ## Optional: Debugging from VS Code
 
-If you want to debug your application using VS Code, you have need attach VS Code to
+If you want to debug your application using VS Code, you need to attach VS Code to
 both the main and renderer processes. Here is a sample configuration for you to
 run. Create a launch.json configuration in a new `.vscode` folder in your project:
 

filenames.gni

@@ -86,6 +86,8 @@ filenames = {
     "shell/browser/ui/message_box_win.cc",
     "shell/browser/ui/tray_icon_win.cc",
     "shell/browser/ui/views/electron_views_delegate_win.cc",
+    "shell/browser/ui/views/win_icon_painter.cc",
+    "shell/browser/ui/views/win_icon_painter.h",
     "shell/browser/ui/views/win_frame_view.cc",
     "shell/browser/ui/views/win_frame_view.h",
     "shell/browser/ui/views/win_caption_button.cc",

lib/browser/.eslintrc.json

@@ -18,4 +18,4 @@
       }
     ]
   }
-}
+}

lib/browser/api/browser-window.ts

@@ -72,9 +72,8 @@ BrowserWindow.getAllWindows = () => {
 
 BrowserWindow.getFocusedWindow = () => {
   for (const window of BrowserWindow.getAllWindows()) {
-    const hasWC = window.webContents && !window.webContents.isDestroyed();
-    if (!window.isDestroyed() && hasWC) {
-      if (window.isFocused() || window.isDevToolsFocused()) return window;
+    if (!window.isDestroyed() && window.webContents && !window.webContents.isDestroyed()) {
+      if (window.isFocused() || window.webContents.isDevToolsFocused()) return window;
     }
   }
   return null;

lib/common/.eslintrc.json

@@ -0,0 +1,23 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          "electron",
+          "electron/main",
+          "electron/renderer"
+        ],
+        "patterns": [
+          "./*",
+          "../*",
+          "@electron/internal/browser/*",
+          "@electron/internal/isolated_renderer/*",
+          "@electron/internal/renderer/*",
+          "@electron/internal/sandboxed_worker/*",
+          "@electron/internal/worker/*"
+        ]
+      }
+    ]
+  }
+}

lib/common/api/clipboard.ts

@@ -1,5 +1,6 @@
 import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 
+// eslint-disable-next-line no-restricted-imports
 import type * as ipcRendererUtilsModule from '@electron/internal/renderer/ipc-renderer-internal-utils';
 
 const clipboard = process._linkedBinding('electron_common_clipboard');

lib/isolated_renderer/.eslintrc.json

@@ -0,0 +1,18 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          "electron",
+          "electron/main"
+        ],
+        "patterns": [
+          "./*",
+          "../*",
+          "@electron/internal/browser/*"
+        ]
+      }
+    ]
+  }
+}

lib/renderer/.eslintrc.json

@@ -0,0 +1,18 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          "electron",
+          "electron/main"
+        ],
+        "patterns": [
+          "./*",
+          "../*",
+          "@electron/internal/browser/*"
+        ]
+      }
+    ]
+  }
+}

lib/renderer/common-init.ts

@@ -1,4 +1,4 @@
-import { ipcRenderer } from 'electron';
+import { ipcRenderer } from 'electron/renderer';
 import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
 
 import type * as webViewInitModule from '@electron/internal/renderer/web-view/web-view-init';

lib/renderer/inspector.ts

@@ -2,7 +2,7 @@ import { internalContextBridge } from '@electron/internal/renderer/api/context-b
 import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
 import * as ipcRendererUtils from '@electron/internal/renderer/ipc-renderer-internal-utils';
 import { webFrame } from 'electron/renderer';
-import { IPC_MESSAGES } from '../common/ipc-messages';
+import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 
 const { contextIsolationEnabled } = internalContextBridge;
 

lib/renderer/web-frame-init.ts

@@ -1,4 +1,4 @@
-import { webFrame, WebFrame } from 'electron';
+import { webFrame, WebFrame } from 'electron/renderer';
 import * as ipcRendererUtils from '@electron/internal/renderer/ipc-renderer-internal-utils';
 import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 

lib/sandboxed_renderer/.eslintrc.json

@@ -0,0 +1,18 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          "electron",
+          "electron/main"
+        ],
+        "patterns": [
+          "./*",
+          "../*",
+          "@electron/internal/browser/*"
+        ]
+      }
+    ]
+  }
+}

lib/worker/.eslintrc.json

@@ -0,0 +1,18 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          "electron",
+          "electron/main"
+        ],
+        "patterns": [
+          "./*",
+          "../*",
+          "@electron/internal/browser/*"
+        ]
+      }
+    ]
+  }
+}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "19.0.10",
+  "version": "19.1.3",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {

patches/angle/.patches

@@ -0,0 +1,2 @@
+m104_vulkan_fix_garbage_collection_vs_outside-rp-only_flush.patch
+m104_vulkan_fix_xfb_buffer_redefine_to_smaller_size.patch

patches/angle/m104_vulkan_fix_garbage_collection_vs_outside-rp-only_flush.patch

@@ -0,0 +1,287 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shahbaz Youssefi <syoussefi@chromium.org>
+Date: Thu, 4 Aug 2022 12:28:12 -0400
+Subject: M104: Vulkan: Fix garbage collection vs outside-RP-only flush
+
+In https://chromium-review.googlesource.com/c/angle/angle/+/3379231, an
+optimization was implemented such that the excessive recorded texture
+uploads would get flushed early and submitted.  This caused a
+use-after-free bug in the following situation:
+
+* Draw with pipeline A
+* Delete A <--- this puts A in the Context garbage list
+* Upload a lot of data
+
+At this point, the flush threshold could pass and the commands recorded
+outside of the render pass up to this point would be submitted.
+Associated with this submission was the current garbage, including
+pipeline A.  However, the render pass that uses pipeline A is still not
+submitted.
+
+Now if after some time the render pass is still open, but the "completed
+commands" are checked (another set of uploads causing another
+submission, a query status check, etc), the garbage can be cleaned up.
+
+When the render pass closes next and is submitted, the implementation
+attempts to use the pipeline, which is already deleted.
+
+In this change, outside-render-pass-only submissions no longer reference
+the current garbage.  This has the side effect that the temporary
+buffers used for uploading texture data won't be released early.  A
+future optimization may want to separate the garbage list in ContextVk
+to render pass and outside render pass garbage.
+
+Bug: chromium:1337538
+Change-Id: Ibfc11f2b0d166b0c325fced725f23d6b9328ff98
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3821371
+Reviewed-by: Amirali Abdolrashidi <abdolrashidi@google.com>
+
+diff --git a/src/libANGLE/renderer/vulkan/ContextVk.cpp b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+index 90ecf42b2cc22cee5b74296d7a2f73b77f9a0f2c..41c06dc42810d6c55565686c87adf20367024f05 100644
+--- a/src/libANGLE/renderer/vulkan/ContextVk.cpp
++++ b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+@@ -2614,14 +2614,16 @@ void ContextVk::addOverlayUsedBuffersCount(vk::CommandBufferHelperCommon *comman
+     }
+ }
+ 
+-angle::Result ContextVk::submitFrame(const vk::Semaphore *signalSemaphore, Serial *submitSerialOut)
++angle::Result ContextVk::submitFrame(const vk::Semaphore *signalSemaphore,
++                                     Submit submission,
++                                     Serial *submitSerialOut)
+ {
+     getShareGroupVk()->acquireResourceUseList(
+         std::move(mOutsideRenderPassCommands->getResourceUseList()));
+     getShareGroupVk()->acquireResourceUseList(std::move(mResourceUseList));
+     getShareGroupVk()->acquireResourceUseList(std::move(mRenderPassCommands->getResourceUseList()));
+ 
+-    ANGLE_TRY(submitCommands(signalSemaphore, submitSerialOut));
++    ANGLE_TRY(submitCommands(signalSemaphore, submission, submitSerialOut));
+ 
+     onRenderPassFinished(RenderPassClosureReason::AlreadySpecifiedElsewhere);
+     return angle::Result::Continue;
+@@ -2633,10 +2635,11 @@ angle::Result ContextVk::submitFrameOutsideCommandBufferOnly(Serial *submitSeria
+     getShareGroupVk()->acquireResourceUseList(
+         std::move(mOutsideRenderPassCommands->getResourceUseList()));
+ 
+-    return submitCommands(nullptr, submitSerialOut);
++    return submitCommands(nullptr, Submit::OutsideRenderPassCommandsOnly, submitSerialOut);
+ }
+ 
+ angle::Result ContextVk::submitCommands(const vk::Semaphore *signalSemaphore,
++                                        Submit submission,
+                                         Serial *submitSerialOut)
+ {
+     if (mCurrentWindowSurface)
+@@ -2655,10 +2658,18 @@ angle::Result ContextVk::submitCommands(const vk::Semaphore *signalSemaphore,
+         dumpCommandStreamDiagnostics();
+     }
+ 
++    // Clean up garbage only when submitting all commands.  Otherwise there may be garbage
++    // associated with commands that are not yet flushed.
++    vk::GarbageList garbage;
++    if (submission == Submit::AllCommands)
++    {
++        garbage = std::move(mCurrentGarbage);
++    }
++
+     ANGLE_TRY(mRenderer->submitFrame(this, hasProtectedContent(), mContextPriority,
+                                      std::move(mWaitSemaphores),
+                                      std::move(mWaitSemaphoreStageMasks), signalSemaphore,
+-                                     std::move(mCurrentGarbage), &mCommandPools, submitSerialOut));
++                                     std::move(garbage), &mCommandPools, submitSerialOut));
+ 
+     getShareGroupVk()->releaseResourceUseLists(*submitSerialOut);
+     // Now that we have processed resourceUseList, some of pending garbage may no longer pending
+@@ -6128,7 +6139,7 @@ angle::Result ContextVk::flushAndGetSerial(const vk::Semaphore *signalSemaphore,
+         mHasInFlightStreamedVertexBuffers.reset();
+     }
+ 
+-    ANGLE_TRY(submitFrame(signalSemaphore, submitSerialOut));
++    ANGLE_TRY(submitFrame(signalSemaphore, Submit::AllCommands, submitSerialOut));
+ 
+     resetPerFramePerfCounters();
+ 
+diff --git a/src/libANGLE/renderer/vulkan/ContextVk.h b/src/libANGLE/renderer/vulkan/ContextVk.h
+index 6c6a3797c6e9a387abf13442613088bd5f4341ec..8ed00be4eb19fea01bb2ada65d2c05ad1d3284f4 100644
+--- a/src/libANGLE/renderer/vulkan/ContextVk.h
++++ b/src/libANGLE/renderer/vulkan/ContextVk.h
+@@ -1078,9 +1078,19 @@ class ContextVk : public ContextImpl, public vk::Context, public MultisampleText
+ 
+     void writeAtomicCounterBufferDriverUniformOffsets(uint32_t *offsetsOut, size_t offsetsSize);
+ 
+-    angle::Result submitFrame(const vk::Semaphore *signalSemaphore, Serial *submitSerialOut);
++    enum class Submit
++    {
++        OutsideRenderPassCommandsOnly,
++        AllCommands,
++    };
++
++    angle::Result submitFrame(const vk::Semaphore *signalSemaphore,
++                              Submit submission,
++                              Serial *submitSerialOut);
+     angle::Result submitFrameOutsideCommandBufferOnly(Serial *submitSerialOut);
+-    angle::Result submitCommands(const vk::Semaphore *signalSemaphore, Serial *submitSerialOut);
++    angle::Result submitCommands(const vk::Semaphore *signalSemaphore,
++                                 Submit submission,
++                                 Serial *submitSerialOut);
+ 
+     angle::Result synchronizeCpuGpuTime();
+     angle::Result traceGpuEventImpl(vk::OutsideRenderPassCommandBuffer *commandBuffer,
+diff --git a/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp b/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp
+index a5021e3248933815e3ac43cc0477671109befb1e..1a4e35592d0573991cc54136c80a9299714162a4 100644
+--- a/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp
++++ b/src/tests/gl_tests/VulkanPerformanceCounterTest.cpp
+@@ -18,6 +18,7 @@
+ #include "test_utils/gl_raii.h"
+ #include "util/random_utils.h"
+ #include "util/shader_utils.h"
++#include "util/test_utils.h"
+ 
+ using namespace angle;
+ 
+@@ -561,22 +562,21 @@ TEST_P(VulkanPerformanceCounterTest, NewTextureDoesNotBreakRenderPass)
+ TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotBreakRenderPass)
+ {
+     initANGLEFeatures();
+-    // http://anglebug.com/6354
+ 
+-    size_t kMaxBufferToImageCopySize     = 1 << 28;
+-    uint32_t kNumSubmits                 = 2;
+-    uint32_t expectedRenderPassCount     = getPerfCounters().renderPasses + 1;
+-    uint32_t expectedSubmitCommandsCount = getPerfCounters().submittedCommands + kNumSubmits;
++    constexpr size_t kMaxBufferToImageCopySize     = 1 << 28;
++    constexpr uint32_t kNumSubmits                 = 2;
++    uint32_t expectedRenderPassCount               = getPerfCounters().renderPasses + 1;
++    uint32_t expectedSubmitCommandsCount           = getPerfCounters().submittedCommands + kNumSubmits;
+ 
+     // Step 1: Set up a simple 2D texture.
+     GLTexture texture;
+-    GLsizei texDim         = 256;
+-    uint32_t pixelSizeRGBA = 4;
+-    uint32_t textureSize   = texDim * texDim * pixelSizeRGBA;
+-    std::vector<GLColor> kInitialData(texDim * texDim, GLColor::green);
++    constexpr GLsizei kTexDim         = 256;
++    constexpr uint32_t kPixelSizeRGBA = 4;
++    constexpr uint32_t kTextureSize   = kTexDim * kTexDim * kPixelSizeRGBA;
++    std::vector<GLColor> kInitialData(kTexDim * kTexDim, GLColor::green);
+ 
+     glBindTexture(GL_TEXTURE_2D, texture);
+-    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, texDim, texDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                  kInitialData.data());
+     glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+     glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+@@ -603,13 +603,12 @@ TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotBreakR
+ 
+     // Step 2: Load a new 2D Texture multiple times with the same Program and Framebuffer. The total
+     // size of the loaded textures must exceed the threshold to submit the outside command buffer.
+-    auto maxLoadCount =
+-        static_cast<size_t>((kMaxBufferToImageCopySize / textureSize) * kNumSubmits + 1);
+-    for (size_t loadCount = 0; loadCount < maxLoadCount; loadCount++)
++    constexpr size_t kMaxLoadCount = kMaxBufferToImageCopySize / kTextureSize * kNumSubmits + 1;
++    for (size_t loadCount = 0; loadCount < kMaxLoadCount; loadCount++)
+     {
+         GLTexture newTexture;
+         glBindTexture(GL_TEXTURE_2D, newTexture);
+-        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, texDim, texDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                      kInitialData.data());
+         glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+         glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+@@ -623,6 +622,96 @@ TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotBreakR
+     EXPECT_EQ(getPerfCounters().submittedCommands, expectedSubmitCommandsCount);
+ }
+ 
++// Tests that submitting the outside command buffer due to texture upload size does not result in
++// garbage collection of render pass resources..
++TEST_P(VulkanPerformanceCounterTest, SubmittingOutsideCommandBufferDoesNotCollectRenderPassGarbage)
++{
++    ANGLE_SKIP_TEST_IF(!IsGLExtensionEnabled("GL_EXT_disjoint_timer_query"));
++
++    initANGLEFeatures();
++
++    uint64_t expectedRenderPassCount = getPerfCounters().renderPasses + 1;
++    uint64_t submitCommandsCount     = getPerfCounters().vkQueueSubmitCallsTotal;
++
++    // Set up a simple 2D texture.
++    GLTexture texture;
++    constexpr GLsizei kTexDim = 256;
++    std::vector<GLColor> kInitialData(kTexDim * kTexDim, GLColor::green);
++
++    glBindTexture(GL_TEXTURE_2D, texture);
++    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++                 kInitialData.data());
++    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
++    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
++
++    auto quadVerts = GetQuadVertices();
++
++    GLBuffer vertexBuffer;
++    glBindBuffer(GL_ARRAY_BUFFER, vertexBuffer);
++    glBufferData(GL_ARRAY_BUFFER, quadVerts.size() * sizeof(quadVerts[0]), quadVerts.data(),
++                 GL_STATIC_DRAW);
++
++    ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Texture2D(), essl1_shaders::fs::Texture2D());
++    glUseProgram(program);
++
++    GLint posLoc = glGetAttribLocation(program, essl1_shaders::PositionAttrib());
++    ASSERT_NE(-1, posLoc);
++
++    glVertexAttribPointer(posLoc, 3, GL_FLOAT, GL_FALSE, 0, nullptr);
++    glEnableVertexAttribArray(posLoc);
++    ASSERT_GL_NO_ERROR();
++
++    // Issue a timestamp query, just for the sake of using it as a means of knowing when a
++    // submission is finished.  In the Vulkan backend, querying the status of the query results in a
++    // check of completed submissions, at which point associated garbage is also destroyed.
++    GLQuery query;
++    glQueryCounterEXT(query, GL_TIMESTAMP_EXT);
++
++    // Issue a draw call, and delete the program
++    glDrawArrays(GL_TRIANGLES, 0, 6);
++    ASSERT_GL_NO_ERROR();
++    program.reset();
++
++    ANGLE_GL_PROGRAM(program2, essl1_shaders::vs::Texture2D(), essl1_shaders::fs::Texture2D());
++    glUseProgram(program2);
++    ASSERT_EQ(posLoc, glGetAttribLocation(program2, essl1_shaders::PositionAttrib()));
++
++    // Issue uploads until there's an implicit submission
++    while (getPerfCounters().vkQueueSubmitCallsTotal == submitCommandsCount)
++    {
++        GLTexture newTexture;
++        glBindTexture(GL_TEXTURE_2D, newTexture);
++        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kTexDim, kTexDim, 0, GL_RGBA, GL_UNSIGNED_BYTE,
++                     kInitialData.data());
++        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
++        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
++
++        glDrawArrays(GL_TRIANGLES, 0, 6);
++        ASSERT_GL_NO_ERROR();
++    }
++
++    ++submitCommandsCount;
++    EXPECT_EQ(getPerfCounters().vkQueueSubmitCallsTotal, submitCommandsCount);
++
++    // Busy wait until the query results are available.
++    GLuint ready = GL_FALSE;
++    while (ready == GL_FALSE)
++    {
++        angle::Sleep(0);
++        glGetQueryObjectuivEXT(query, GL_QUERY_RESULT_AVAILABLE_EXT, &ready);
++    }
++
++    // At this point, the render pass should still not be submitted, and the pipeline that is
++    // deleted should still not be garbage collected.  Submit the commands and ensure there is no
++    // crash.
++    EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
++    ++submitCommandsCount;
++
++    // Verify counters.
++    EXPECT_EQ(getPerfCounters().renderPasses, expectedRenderPassCount);
++    EXPECT_EQ(getPerfCounters().vkQueueSubmitCallsTotal, submitCommandsCount);
++}
++
+ // Tests that RGB texture should not break renderpass.
+ TEST_P(VulkanPerformanceCounterTest, SampleFromRGBTextureDoesNotBreakRenderPass)
+ {

patches/angle/m104_vulkan_fix_xfb_buffer_redefine_to_smaller_size.patch

@@ -0,0 +1,122 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shahbaz Youssefi <syoussefi@chromium.org>
+Date: Tue, 26 Jul 2022 21:07:04 -0400
+Subject: M104: Vulkan: Fix xfb buffer redefine to smaller size
+
+In 89e11878b275b15735eaf273ababfa6fd43a2e3d, a use-after-free bug was
+fixed where glBufferData redefined a buffer, leading to a change in
+storage.  This was only tested for the case where the new buffer was
+larger than the old buffer.
+
+When the new buffer is smaller however, another issue remains where the
+buffer size as cached by the transform feedback object used the old
+object's size.  This is worked around in this change, with a fix for the
+real issue (that the buffer state is updated after calling into the
+backend instead of before) coming up.
+
+Bug: chromium:1345042
+Change-Id: I7bafd51b6203a419e5ef123da26b9e1eaf079bf1
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3812556
+Reviewed-by: Ian Elliott <ianelliott@google.com>
+
+diff --git a/src/libANGLE/renderer/vulkan/BufferVk.cpp b/src/libANGLE/renderer/vulkan/BufferVk.cpp
+index 9c9cee78d890f5cc13d8762aa03de9dcf9c00abf..ceb065822984cf44bd4319fb97cb7e4dd49517b2 100644
+--- a/src/libANGLE/renderer/vulkan/BufferVk.cpp
++++ b/src/libANGLE/renderer/vulkan/BufferVk.cpp
+@@ -798,6 +798,7 @@ angle::Result BufferVk::updateBuffer(ContextVk *contextVk,
+     }
+     return angle::Result::Continue;
+ }
++
+ angle::Result BufferVk::directUpdate(ContextVk *contextVk,
+                                      const uint8_t *data,
+                                      size_t size,
+diff --git a/src/libANGLE/renderer/vulkan/ContextVk.cpp b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+index 41c06dc42810d6c55565686c87adf20367024f05..1319bf771339210dcb9a3e0ccd0936112c746582 100644
+--- a/src/libANGLE/renderer/vulkan/ContextVk.cpp
++++ b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+@@ -799,7 +799,8 @@ ContextVk::ContextVk(const gl::State &state, gl::ErrorSet *errorSet, RendererVk
+                                                    DIRTY_BIT_DRIVER_UNIFORMS_BINDING,
+                                                    DIRTY_BIT_VIEWPORT,
+                                                    DIRTY_BIT_SCISSOR};
+-    if (getFeatures().supportsTransformFeedbackExtension.enabled)
++    if (getFeatures().supportsTransformFeedbackExtension.enabled ||
++        getFeatures().emulateTransformFeedback.enabled)
+     {
+         mNewGraphicsCommandBufferDirtyBits.set(DIRTY_BIT_TRANSFORM_FEEDBACK_BUFFERS);
+     }
+diff --git a/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp b/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp
+index dbaa4eeedbf36c4a3f6cb818b50bdcac856766c2..f785fe5f7c36033163a77a7e29957ebca6edaf79 100644
+--- a/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp
++++ b/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp
+@@ -362,7 +362,8 @@ void TransformFeedbackVk::onSubjectStateChange(angle::SubjectIndex index,
+         ASSERT(bufferVk->isBufferValid());
+         mBufferHelpers[index] = &bufferVk->getBuffer();
+         mBufferOffsets[index] = binding.getOffset() + mBufferHelpers[index]->getOffset();
+-        mBufferSizes[index]   = gl::GetBoundBufferAvailableSize(binding);
++        mBufferSizes[index]   = std::min<VkDeviceSize>(gl::GetBoundBufferAvailableSize(binding),
++                                                     mBufferHelpers[index]->getSize());
+         mBufferObserverBindings[index].bind(bufferVk);
+ 
+         mXFBBuffersDesc.updateTransformFeedbackBuffer(
+diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
+index af74f258fb3d901dac8a738ca9be53511963137b..22230db0ecb77f16cb2cc494a74225731401a47d 100644
+--- a/src/tests/angle_end2end_tests_expectations.txt
++++ b/src/tests/angle_end2end_tests_expectations.txt
+@@ -161,6 +161,7 @@
+ 6738 MAC AMD OPENGL : Texture3DTestES3.PixelUnpackStateTex* = SKIP
+ 1296467 MAC OPENGL : VertexAttributeTestES3.emptyBuffer/* = SKIP
+ 7203 MAC INTEL OPENGL : CopyTextureTest.CopyToMipmap/* = SKIP
++7530 MAC NVIDIA OPENGL : TransformFeedbackTest.RenderOnceChangeXfbBufferRenderAgain/* = SKIP
+ 
+ // BlitFramebufferTest.ScissoredMultisampleStencil failures
+ 3496 MAC INTEL OPENGL : BlitFramebufferTest.ScissoredMultisampleStencil/* = SKIP
+diff --git a/src/tests/gl_tests/TransformFeedbackTest.cpp b/src/tests/gl_tests/TransformFeedbackTest.cpp
+index a4e4f86157232de46c6e06ee7b5a6dfa2b8a2261..dc944d4249e0a26708d01bd0bde7efc4d68db3e3 100644
+--- a/src/tests/gl_tests/TransformFeedbackTest.cpp
++++ b/src/tests/gl_tests/TransformFeedbackTest.cpp
+@@ -403,7 +403,6 @@ TEST_P(TransformFeedbackTest, RecordAndDraw)
+ // Test that transform feedback can cover multiple render passes.
+ TEST_P(TransformFeedbackTest, SpanMultipleRenderPasses)
+ {
+-
+     // TODO(anglebug.com/4533) This fails after the upgrade to the 26.20.100.7870 driver.
+     ANGLE_SKIP_TEST_IF(IsWindows() && IsIntel() && IsVulkan());
+ 
+@@ -4105,6 +4104,36 @@ TEST_P(TransformFeedbackTest, ResumingTransformFeedbackAfterDeletebuffer)
+     ASSERT_GL_ERROR(GL_INVALID_OPERATION);
+ }
+ 
++// Test that redefining the transform feedback buffer and starting a new render pass works.
++TEST_P(TransformFeedbackTest, RenderOnceChangeXfbBufferRenderAgain)
++{
++    std::vector<std::string> tfVaryings;
++    tfVaryings.push_back("gl_Position");
++    ANGLE_GL_PROGRAM_TRANSFORM_FEEDBACK(drawColor, essl3_shaders::vs::Simple(),
++                                        essl3_shaders::fs::Red(), tfVaryings,
++                                        GL_INTERLEAVED_ATTRIBS);
++
++    GLBuffer buffer;
++    glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, buffer);
++    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 10'000'000, nullptr, GL_DYNAMIC_READ);
++
++    glUseProgram(drawColor);
++    glBeginTransformFeedback(GL_TRIANGLES);
++
++    drawQuad(drawColor, essl3_shaders::PositionAttrib(), 0.5f);
++
++    // Break the render pass
++    EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
++
++    // Redefine the transform feedback buffer
++    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 40, nullptr, GL_DYNAMIC_READ);
++
++    // Start a new render pass
++    drawQuad(drawColor, essl3_shaders::PositionAttrib(), 0.5f);
++
++    glEndTransformFeedback();
++}
++
+ GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TransformFeedbackTest);
+ ANGLE_INSTANTIATE_TEST_ES3(TransformFeedbackTest);
+ 

patches/chromium/.patches

@@ -122,3 +122,27 @@ posix_replace_doubleforkandexec_with_forkandspawn.patch
 cherry-pick-22c61cfae5d1.patch
 remove_default_window_title.patch
 keep_handling_scroll_update_if_you_can.patch
+chore_add_electron_deps_to_gitignores.patch
+chore_allow_chromium_to_handle_synthetic_mouse_events_for_touch.patch
+disable_gpu_acceleration_on_vmware_on_linux.patch
+add_maximized_parameter_to_linuxui_getwindowframeprovider.patch
+cherry-pick-94a8bdafc8c6.patch
+fix_mac_build_with_enable_plugins_false.patch
+fix_windows_build_with_enable_plugins_false.patch
+cherry-pick-54e32332750c.patch
+cherry-pick-60d8559e150a.patch
+cherry-pick-54a7927b19f9.patch
+cherry-pick-bd9724c9fe63.patch
+cherry-pick-c643d18a078d.patch
+feat_add_set_can_resize_mutator.patch
+cherry-pick-2083e894852c.patch
+cherry-pick-079105b7ebba.patch
+cherry-pick-51daffbf5cd8.patch
+cherry-pick-9b5207569882.patch
+dpwa_enable_window_controls_overlay_by_default.patch
+cherry-pick-eb4d31309df7.patch
+add_electron_deps_to_license_credits_file.patch
+cherry-pick-fefd6198da31.patch
+cherry-pick-1eb1e18ad41d.patch
+cherry-pick-9bebe8549a36.patch
+cherry-pick-05a0d99c9715.patch

patches/chromium/add_electron_deps_to_license_credits_file.patch

@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Kerr <charles@charleskerr.com>
+Date: Tue, 9 Aug 2022 12:35:36 -0500
+Subject: add electron deps to license credits file
+
+Ensure that licenses for the dependencies introduced by Electron
+are included in `LICENSES.chromium.html`
+
+diff --git a/tools/licenses.py b/tools/licenses.py
+index b083d3509433aa97aa85c59a4269def5ef5a5359..c032e1f9dc058ff2c76b54ac5da6805163d1eadf 100755
+--- a/tools/licenses.py
++++ b/tools/licenses.py
+@@ -340,6 +340,32 @@ SPECIAL_CASES = {
+         "License File":
+         "/third_party/swiftshader/third_party/SPIRV-Tools/LICENSE",
+     },
++
++    os.path.join('third_party', 'electron_node'): {
++        "Name": "Node.js",
++        "URL": "https://github.com/nodejs/node",
++        "License": "MIT",
++        "License File": "/third_party/electron_node/LICENSE",
++    },
++    os.path.join('third_party', 'squirrel.mac'): {
++        "Name": "Squirrel",
++        "URL": "https://github.com/Squirrel/Squirrel.Mac",
++        "License": "MIT",
++        "License File": "/third_party/squirrel.mac/LICENSE",
++    },
++    os.path.join('third_party', 'squirrel.mac', 'vendor', 'mantle'): {
++        "Name": "Mantle",
++        "URL": "https://github.com/Mantle/Mantle",
++        "License": "MIT",
++        "License File": "/third_party/squirrel.mac/vendor/mantle/LICENSE.md",
++    },
++    os.path.join('third_party', 'squirrel.mac', 'vendor', 'ReactiveObjC'): {
++        "Name": "ReactiveObjC",
++        "URL": "https://github.com/ReactiveCocoa/ReactiveObjC",
++        "License": "MIT",
++        "License File":
++        "/third_party/squirrel.mac/vendor/ReactiveObjC/LICENSE.md",
++    },
+ }
+ 
+ # Special value for 'License File' field used to indicate that the license file

patches/chromium/add_maximized_parameter_to_linuxui_getwindowframeprovider.patch

@@ -0,0 +1,176 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: msizanoen1 <msizanoen@qtmlabs.xyz>
+Date: Tue, 19 Jul 2022 05:11:06 +0200
+Subject: Add maximized parameter to LinuxUI::GetWindowFrameProvider
+
+This allows ClientFrameViewLinux to instruct the toolkit to draw the window
+decorations in maximized mode where needed, preventing empty space caused
+by decoration shadows and rounded titlebars around the window while maximized.
+
+diff --git a/ui/gtk/gtk_ui.cc b/ui/gtk/gtk_ui.cc
+index c037fa8db6d4a5ebeb7257627db206e9bab57ecc..14eddfd043e748400a9ee81ce5346a53f10ea03c 100644
+--- a/ui/gtk/gtk_ui.cc
++++ b/ui/gtk/gtk_ui.cc
+@@ -757,13 +757,15 @@ std::unique_ptr<views::NavButtonProvider> GtkUi::CreateNavButtonProvider() {
+   return nullptr;
+ }
+ 
+-views::WindowFrameProvider* GtkUi::GetWindowFrameProvider(bool solid_frame) {
++views::WindowFrameProvider* GtkUi::GetWindowFrameProvider(bool solid_frame, bool maximized) {
+   if (!GtkCheckVersion(3, 14))
+     return nullptr;
+   auto& provider =
+-      solid_frame ? solid_frame_provider_ : transparent_frame_provider_;
++      maximized
++        ? (solid_frame ? solid_maximized_frame_provider_ : transparent_maximized_frame_provider_)
++        : (solid_frame ? solid_frame_provider_ : transparent_frame_provider_);
+   if (!provider)
+-    provider = std::make_unique<gtk::WindowFrameProviderGtk>(solid_frame);
++    provider = std::make_unique<gtk::WindowFrameProviderGtk>(solid_frame, maximized);
+   return provider.get();
+ }
+ 
+diff --git a/ui/gtk/gtk_ui.h b/ui/gtk/gtk_ui.h
+index 8e609b8311c6b69ef7b6753117542d9e60b2c8ab..a329822c3285599954d77dd5a8e33ccc10e5f626 100644
+--- a/ui/gtk/gtk_ui.h
++++ b/ui/gtk/gtk_ui.h
+@@ -107,7 +107,7 @@ class GtkUi : public views::LinuxUI {
+   bool PreferDarkTheme() const override;
+   bool AnimationsEnabled() const override;
+   std::unique_ptr<views::NavButtonProvider> CreateNavButtonProvider() override;
+-  views::WindowFrameProvider* GetWindowFrameProvider(bool solid_frame) override;
++  views::WindowFrameProvider* GetWindowFrameProvider(bool solid_frame, bool maximized) override;
+   base::flat_map<std::string, std::string> GetKeyboardLayoutMap() override;
+   std::string GetCursorThemeName() override;
+   int GetCursorThemeSize() override;
+@@ -218,6 +218,8 @@ class GtkUi : public views::LinuxUI {
+   // while Chrome is running.
+   std::unique_ptr<views::WindowFrameProvider> solid_frame_provider_;
+   std::unique_ptr<views::WindowFrameProvider> transparent_frame_provider_;
++  std::unique_ptr<views::WindowFrameProvider> solid_maximized_frame_provider_;
++  std::unique_ptr<views::WindowFrameProvider> transparent_maximized_frame_provider_;
+ };
+ 
+ }  // namespace gtk
+diff --git a/ui/gtk/window_frame_provider_gtk.cc b/ui/gtk/window_frame_provider_gtk.cc
+index e4dbdad327eb77994ffd7f068c67336a19897915..d3ae0636455489a7c7443df85cb769952c98aca2 100644
+--- a/ui/gtk/window_frame_provider_gtk.cc
++++ b/ui/gtk/window_frame_provider_gtk.cc
+@@ -38,16 +38,18 @@ std::string GetThemeName() {
+   return theme_string;
+ }
+ 
+-GtkCssContext WindowContext(bool solid_frame, bool focused) {
++GtkCssContext WindowContext(bool solid_frame, bool maximized, bool focused) {
+   std::string selector = "#window.background.";
+   selector += solid_frame ? "solid-csd" : "csd";
++  if (maximized)
++    selector += ".maximized";
+   if (!focused)
+     selector += ":inactive";
+   return AppendCssNodeToStyleContext({}, selector);
+ }
+ 
+-GtkCssContext DecorationContext(bool solid_frame, bool focused) {
+-  auto context = WindowContext(solid_frame, focused);
++GtkCssContext DecorationContext(bool solid_frame, bool maximized, bool focused) {
++  auto context = WindowContext(solid_frame, maximized, focused);
+   // GTK4 renders the decoration directly on the window.
+   if (!GtkCheckVersion(4))
+     context = AppendCssNodeToStyleContext(context, "#decoration");
+@@ -64,8 +66,8 @@ GtkCssContext DecorationContext(bool solid_frame, bool focused) {
+   return context;
+ }
+ 
+-GtkCssContext HeaderContext(bool solid_frame, bool focused) {
+-  auto context = WindowContext(solid_frame, focused);
++GtkCssContext HeaderContext(bool solid_frame, bool maximized, bool focused) {
++  auto context = WindowContext(solid_frame, maximized, focused);
+   context =
+       AppendCssNodeToStyleContext(context, "#headerbar.header-bar.titlebar");
+   if (!focused)
+@@ -110,8 +112,8 @@ int ComputeTopCornerRadius() {
+   // need to experimentally determine the corner radius by rendering a sample.
+   // Additionally, in GTK4, the headerbar corners get clipped by the window
+   // rather than the headerbar having its own rounded corners.
+-  auto context = GtkCheckVersion(4) ? DecorationContext(false, false)
+-                                    : HeaderContext(false, false);
++  auto context = GtkCheckVersion(4) ? DecorationContext(false, false, false)
++                                    : HeaderContext(false, false, false);
+   ApplyCssToContext(context, R"(window, headerbar {
+     background-image: none;
+     background-color: black;
+@@ -169,8 +171,8 @@ void WindowFrameProviderGtk::Asset::CloneFrom(
+   unfocused_bitmap = src.unfocused_bitmap;
+ }
+ 
+-WindowFrameProviderGtk::WindowFrameProviderGtk(bool solid_frame)
+-    : solid_frame_(solid_frame) {}
++WindowFrameProviderGtk::WindowFrameProviderGtk(bool solid_frame, bool maximized)
++    : solid_frame_(solid_frame), maximized_(maximized) {}
+ 
+ WindowFrameProviderGtk::~WindowFrameProviderGtk() = default;
+ 
+@@ -264,7 +266,7 @@ void WindowFrameProviderGtk::PaintWindowFrame(gfx::Canvas* canvas,
+       top_area_height_dip * scale - asset.frame_thickness_px.top();
+ 
+   auto header = PaintHeaderbar({client_bounds_px.width(), top_area_height_px},
+-                               HeaderContext(solid_frame_, focused), scale);
++                               HeaderContext(solid_frame_, maximized_, focused), scale);
+   image = gfx::ImageSkia::CreateFrom1xBitmap(header);
+   // In GTK4, the headerbar gets clipped by the window.
+   if (GtkCheckVersion(4)) {
+@@ -296,7 +298,7 @@ void WindowFrameProviderGtk::MaybeUpdateBitmaps(float scale) {
+ 
+   gfx::Rect frame_bounds_dip(kMaxFrameSizeDip, kMaxFrameSizeDip,
+                              2 * kMaxFrameSizeDip, 2 * kMaxFrameSizeDip);
+-  auto focused_context = DecorationContext(solid_frame_, true);
++  auto focused_context = DecorationContext(solid_frame_, maximized_, true);
+   frame_bounds_dip.Inset(-GtkStyleContextGetPadding(focused_context));
+   frame_bounds_dip.Inset(-GtkStyleContextGetBorder(focused_context));
+   gfx::Size bitmap_size(BitmapSizePx(asset), BitmapSizePx(asset));
+@@ -304,7 +306,7 @@ void WindowFrameProviderGtk::MaybeUpdateBitmaps(float scale) {
+       PaintBitmap(bitmap_size, frame_bounds_dip, focused_context, scale);
+   asset.unfocused_bitmap =
+       PaintBitmap(bitmap_size, frame_bounds_dip,
+-                  DecorationContext(solid_frame_, false), scale);
++                  DecorationContext(solid_frame_, maximized_, false), scale);
+ 
+   // In GTK4, there's no way to obtain the frame thickness from CSS values
+   // directly, so we must determine it experimentally based on the drawn
+diff --git a/ui/gtk/window_frame_provider_gtk.h b/ui/gtk/window_frame_provider_gtk.h
+index d3039d73161378197557947aece88d2710c1e486..f7d4605938210b0b75517bb7bcab28b588a16520 100644
+--- a/ui/gtk/window_frame_provider_gtk.h
++++ b/ui/gtk/window_frame_provider_gtk.h
+@@ -14,7 +14,7 @@ namespace gtk {
+ 
+ class WindowFrameProviderGtk : public views::WindowFrameProvider {
+  public:
+-  explicit WindowFrameProviderGtk(bool solid_frame);
++  explicit WindowFrameProviderGtk(bool solid_frame, bool maximized);
+ 
+   WindowFrameProviderGtk(const WindowFrameProviderGtk&) = delete;
+   WindowFrameProviderGtk& operator=(const WindowFrameProviderGtk&) = delete;
+@@ -69,6 +69,9 @@ class WindowFrameProviderGtk : public views::WindowFrameProvider {
+ 
+   // Cached bitmaps and metrics.  The scale is rounded to percent.
+   base::flat_map<int, Asset> assets_;
++
++  // Whether to draw the window decorations as maximized.
++  bool maximized_;
+ };
+ 
+ }  // namespace gtk
+diff --git a/ui/views/linux_ui/linux_ui.h b/ui/views/linux_ui/linux_ui.h
+index 5f312e01508c49033bf2d05b9dc083e524f37e5f..7590acd760ba4f36e5a77c1972afc5fc08e616ff 100644
+--- a/ui/views/linux_ui/linux_ui.h
++++ b/ui/views/linux_ui/linux_ui.h
+@@ -189,7 +189,7 @@ class VIEWS_EXPORT LinuxUI : public ui::LinuxInputMethodContextFactory,
+   // if transparency is unsupported and the frame should be rendered opaque.
+   // The returned object is not owned by the caller and will remain alive until
+   // the process ends.
+-  virtual WindowFrameProvider* GetWindowFrameProvider(bool solid_frame) = 0;
++  virtual WindowFrameProvider* GetWindowFrameProvider(bool solid_frame, bool maximized) = 0;
+ 
+   // Returns a map of KeyboardEvent code to KeyboardEvent key values.
+   virtual base::flat_map<std::string, std::string> GetKeyboardLayoutMap() = 0;

patches/chromium/cherry-pick-05a0d99c9715.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: David Bokan <bokan@chromium.org>
+Date: Thu, 28 Jul 2022 18:09:13 +0000
+Subject: Prevent handling input for provisional frames
+
+Bug: 1347644,1322812
+Change-Id: Ifd60f6aa593ce23ca6cbb65552fc9fb8f8690035
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3791883
+Commit-Queue: David Bokan <bokan@chromium.org>
+Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1029361}
+
+diff --git a/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc b/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
+index c7d6c63a3c3b640436835e986d2e03ee232b65f0..6106168562e5300b5d15666e1278b207358c63b8 100644
+--- a/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
++++ b/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
+@@ -2448,10 +2448,15 @@ WebInputEventResult WebFrameWidgetImpl::HandleInputEvent(
+   DCHECK(!WebInputEvent::IsTouchEventType(input_event.GetType()));
+   CHECK(LocalRootImpl());
+ 
++  // Clients shouldn't be dispatching events to a provisional frame but this
++  // can happen. Ensure that event handling can assume we're in a committed
++  // frame.
++  if (IsProvisional())
++    return WebInputEventResult::kHandledSuppressed;
++
+   // Only record metrics for the root frame.
+-  if (ForTopMostMainFrame()) {
++  if (ForTopMostMainFrame())
+     GetPage()->GetVisualViewport().StartTrackingPinchStats();
+-  }
+ 
+   // If a drag-and-drop operation is in progress, ignore input events except
+   // PointerCancel and GestureLongPress.

patches/chromium/cherry-pick-079105b7ebba.patch

@@ -0,0 +1,272 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Yuki Shiino <yukishiino@chromium.org>
+Date: Tue, 23 Aug 2022 09:18:50 +0000
+Subject: bindings: Add argument type checks to ObservableArray<T>
+
+Performs type checks for arguments of trap functions and throws
+a TypeError if a type is wrong.
+
+(cherry picked from commit 4d67bb1dbf55e2eddf513f29ac33e38e8e1d2fab)
+
+Bug: 1352549
+Change-Id: I66df3a9eeae5e4f44bdf714666a2c6304ebec0f5
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3835494
+Auto-Submit: Yuki Shiino <yukishiino@chromium.org>
+Reviewed-by: Kentaro Hara <haraken@chromium.org>
+Commit-Queue: Kentaro Hara <haraken@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1036005}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3849901
+Cr-Commit-Position: refs/branch-heads/5112@{#1514}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h
+index 1b31781f4b445b2dab7967b1137c28de50455623..4b17428992c66fad9f7eee1e2956f4218017fb8f 100644
+--- a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h
++++ b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_handler.h
+@@ -54,13 +54,17 @@ class ObservableArrayExoticObjectHandler {
+       const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
+-    v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    v8::Local<v8::Value> v8_desc_obj = info[2];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
+     ExceptionState exception_state(
+-        isolate, ExceptionContext::Context::kNamedPropertyDefine,
+-        backing_list.ObservableArrayNameInIDL());
++        isolate, ExceptionContext::Context::kOperationInvoke,
++        BackingListWrappable::ObservableArrayNameInIDL(), "defineProperty");
++    if (!(info[0]->IsArray() && info[1]->IsName() && info[2]->IsObject())) {
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
++    v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    v8::Local<v8::Object> v8_desc_obj = info[2].As<v8::Object>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     V8PropertyDescriptorBag desc_bag;
+     V8ObjectToPropertyDescriptor(isolate, v8_desc_obj, desc_bag,
+@@ -112,9 +116,7 @@ class ObservableArrayExoticObjectHandler {
+         desc.set_configurable(desc_bag.configurable);
+       if (desc_bag.has_enumerable)
+         desc.set_enumerable(desc_bag.enumerable);
+-      if (!v8_target
+-               ->DefineProperty(current_context, v8_property.As<v8::Name>(),
+-                                desc)
++      if (!v8_target->DefineProperty(current_context, v8_property, desc)
+                .To(&is_defined)) {
+         return;
+       }
+@@ -124,9 +126,7 @@ class ObservableArrayExoticObjectHandler {
+         desc.set_configurable(desc_bag.configurable);
+       if (desc_bag.has_enumerable)
+         desc.set_enumerable(desc_bag.enumerable);
+-      if (!v8_target
+-               ->DefineProperty(current_context, v8_property.As<v8::Name>(),
+-                                desc)
++      if (!v8_target->DefineProperty(current_context, v8_property, desc)
+                .To(&is_defined)) {
+         return;
+       }
+@@ -139,9 +139,16 @@ class ObservableArrayExoticObjectHandler {
+       const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "deleteProperty");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -154,7 +161,7 @@ class ObservableArrayExoticObjectHandler {
+         ScriptState* script_state = ScriptState::From(current_context);
+         ExceptionState exception_state(
+             isolate, ExceptionContext::Context::kIndexedPropertyDelete,
+-            backing_list.ObservableArrayNameInIDL());
++            BackingListWrappable::ObservableArrayNameInIDL());
+         if (!RunDeleteAlgorithm(script_state, backing_list, index,
+                                 exception_state)) {
+           return;
+@@ -181,9 +188,16 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapGet(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "get");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -221,9 +235,17 @@ class ObservableArrayExoticObjectHandler {
+       const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(),
++          "getOwnPropertyDescriptor");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -258,9 +280,7 @@ class ObservableArrayExoticObjectHandler {
+     }
+ 
+     v8::Local<v8::Value> v8_value;
+-    if (!v8_target
+-             ->GetOwnPropertyDescriptor(current_context,
+-                                        v8_property.As<v8::Name>())
++    if (!v8_target->GetOwnPropertyDescriptor(current_context, v8_property)
+              .ToLocal(&v8_value)) {
+       return;
+     }
+@@ -271,9 +291,16 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapHas(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "has");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+@@ -300,8 +327,15 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapOwnKeys(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!info[0]->IsArray()) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "ownKeys");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     // 2. Let length be handler.[[BackingList]]'s size.
+     // 3. Let keys be an empty list.
+@@ -357,17 +391,24 @@ class ObservableArrayExoticObjectHandler {
+   static void TrapSet(const v8::FunctionCallbackInfo<v8::Value>& info) {
+     v8::Isolate* isolate = info.GetIsolate();
+     v8::Local<v8::Context> current_context = isolate->GetCurrentContext();
++    if (!(info[0]->IsArray() && info[1]->IsName())) {
++      ExceptionState exception_state(
++          isolate, ExceptionContext::Context::kOperationInvoke,
++          BackingListWrappable::ObservableArrayNameInIDL(), "set");
++      exception_state.ThrowTypeError("Invalid argument.");
++      return;
++    }
+     v8::Local<v8::Array> v8_target = info[0].As<v8::Array>();
+-    v8::Local<v8::Value> v8_property = info[1];
++    v8::Local<v8::Name> v8_property = info[1].As<v8::Name>();
+     v8::Local<v8::Value> v8_value = info[2];
+-    BackingListWrappable& backing_list = ToWrappableUnsafe(isolate, v8_target);
++    BackingListWrappable& backing_list = ToWrappableOrDie(isolate, v8_target);
+ 
+     if (v8_property->IsString()) {
+       v8::Local<v8::Uint32> v8_index;
+       if (v8_property->ToArrayIndex(current_context).ToLocal(&v8_index)) {
+         ExceptionState exception_state(
+             isolate, ExceptionContext::Context::kIndexedPropertySet,
+-            backing_list.ObservableArrayNameInIDL());
++            BackingListWrappable::ObservableArrayNameInIDL());
+         uint32_t index = v8_index->Value();
+         bool result =
+             DoSetTheIndexedValue(isolate, current_context, backing_list, index,
+@@ -380,7 +421,7 @@ class ObservableArrayExoticObjectHandler {
+               V8AtomicString(isolate, "length"))) {
+         ExceptionState exception_state(
+             isolate, ExceptionContext::Context::kAttributeSet,
+-            backing_list.ObservableArrayNameInIDL(), "length");
++            BackingListWrappable::ObservableArrayNameInIDL(), "length");
+         bool result = DoSetTheLength(isolate, current_context, backing_list,
+                                      v8_value, exception_state);
+         V8SetReturnValue(info, result);
+@@ -431,11 +472,11 @@ class ObservableArrayExoticObjectHandler {
+   }
+ 
+  private:
+-  static BackingListWrappable& ToWrappableUnsafe(v8::Isolate* isolate,
+-                                                 v8::Local<v8::Array> target) {
++  static BackingListWrappable& ToWrappableOrDie(v8::Isolate* isolate,
++                                                v8::Local<v8::Array> target) {
+     bindings::ObservableArrayBase* base =
+         bindings::ObservableArrayExoticObjectImpl::
+-            ProxyTargetToObservableArrayBase(isolate, target);
++            ProxyTargetToObservableArrayBaseOrDie(isolate, target);
+     return *static_cast<BackingListWrappable*>(base);
+   }
+ 
+diff --git a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc
+index 8672414aba480c4af3b7431e6db071a03d61569e..88c2adf501a3a3088c635c8d24215fbce787b3e5 100644
+--- a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc
++++ b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.cc
+@@ -42,7 +42,7 @@ const WrapperTypeInfo& ObservableArrayExoticObjectImpl::wrapper_type_info_ =
+ 
+ // static
+ bindings::ObservableArrayBase*
+-ObservableArrayExoticObjectImpl::ProxyTargetToObservableArrayBase(
++ObservableArrayExoticObjectImpl::ProxyTargetToObservableArrayBaseOrDie(
+     v8::Isolate* isolate,
+     v8::Local<v8::Array> v8_proxy_target) {
+   // See the implementation comment in ObservableArrayExoticObjectImpl::Wrap.
+@@ -50,6 +50,8 @@ ObservableArrayExoticObjectImpl::ProxyTargetToObservableArrayBase(
+       V8PrivateProperty::GetSymbol(isolate, kV8ProxyTargetToV8WrapperKey);
+   v8::Local<v8::Value> backing_list_wrapper =
+       private_property.GetOrUndefined(v8_proxy_target).ToLocalChecked();
++  // Crash when author script managed to pass something else other than the
++  // right proxy target object.
+   CHECK(backing_list_wrapper->IsObject());
+   return ToScriptWrappable(backing_list_wrapper.As<v8::Object>())
+       ->ToImpl<bindings::ObservableArrayBase>();
+diff --git a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h
+index 4d262a4981c1404d9b403b0fcf4ec9d71e109bea..8c56428c40e5b0d246b45c741f8bdcbfdcfb23ee 100644
+--- a/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h
++++ b/third_party/blink/renderer/bindings/core/v8/observable_array_exotic_object_impl.h
+@@ -22,7 +22,7 @@ class CORE_EXPORT ObservableArrayExoticObjectImpl final
+  public:
+   // Returns the backing list object extracted from the proxy target object
+   // of type JS Array.
+-  static bindings::ObservableArrayBase* ProxyTargetToObservableArrayBase(
++  static bindings::ObservableArrayBase* ProxyTargetToObservableArrayBaseOrDie(
+       v8::Isolate* isolate,
+       v8::Local<v8::Array> v8_proxy_target);
+ 

patches/chromium/cherry-pick-1eb1e18ad41d.patch

@@ -0,0 +1,184 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Anders Hartvoll Ruud <andruud@chromium.org>
+Date: Tue, 20 Sep 2022 17:43:47 +0000
+Subject: Add CSSTokenizer-created strings to CSSVariableData's backing strings
+
+When computing the value of a registered custom property, we create
+a CSSVariableData object equivalent to the computed CSSValue by
+serializing that CSSValue to a String, then tokenizing that value.
+
+The problem is that CSSTokenizer can create *new* string objects
+during the tokenization process (see calls to CSSTokenizer::
+RegisterString), without communicating that fact to the call-site.
+
+Therefore, this CL adds a way to access those strings so they can
+be added to the backing strings of the CSSVariableData.
+
+Also added a DCHECK to verify that we don't have any tokens with
+non-backed string pointers.
+
+Fixed: 1358907
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3892782
+Reviewed-by: Steinar H Gunderson <sesse@chromium.org>
+Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1046868}
+Change-Id: Ifb6d194508e99030a5a3ed5fbad5496b7263bdc1
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3905727
+Auto-Submit: Anders Hartvoll Ruud <andruud@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5249@{#518}
+Cr-Branched-From: 4f7bea5de862aaa52e6bde5920755a9ef9db120b-refs/heads/main@{#1036826}
+
+diff --git a/third_party/blink/renderer/core/css/css_variable_data.cc b/third_party/blink/renderer/core/css/css_variable_data.cc
+index a2294cc70c59ac0357dddf0f7719cc3c09d23554..b3a61b312eb5f0360e8aa4cb706c60f0085fead9 100644
+--- a/third_party/blink/renderer/core/css/css_variable_data.cc
++++ b/third_party/blink/renderer/core/css/css_variable_data.cc
+@@ -4,6 +4,7 @@
+ 
+ #include "third_party/blink/renderer/core/css/css_variable_data.h"
+ 
++#include "base/containers/span.h"
+ #include "third_party/blink/renderer/core/css/css_syntax_definition.h"
+ #include "third_party/blink/renderer/core/css/parser/css_parser_context.h"
+ #include "third_party/blink/renderer/platform/wtf/text/character_names.h"
+@@ -109,6 +110,51 @@ void CSSVariableData::ConsumeAndUpdateTokens(const CSSParserTokenRange& range) {
+     UpdateTokens<UChar>(range, backing_string, tokens_);
+ }
+ 
++#if EXPENSIVE_DCHECKS_ARE_ON()
++
++namespace {
++
++template <typename CharacterType>
++bool IsSubspan(base::span<const CharacterType> inner,
++               base::span<const CharacterType> outer) {
++  // Note that base::span uses CheckedContiguousIterator, which restricts
++  // which comparisons are allowed. Therefore we must avoid begin()/end() here.
++  return inner.data() >= outer.data() &&
++         (inner.data() + inner.size()) <= (outer.data() + outer.size());
++}
++
++bool TokenValueIsBacked(const CSSParserToken& token,
++                        const String& backing_string) {
++  StringView value = token.Value();
++  if (value.Is8Bit() != backing_string.Is8Bit())
++    return false;
++  return value.Is8Bit() ? IsSubspan(value.Span8(), backing_string.Span8())
++                        : IsSubspan(value.Span16(), backing_string.Span16());
++}
++
++bool TokenValueIsBacked(const CSSParserToken& token,
++                        const Vector<String>& backing_strings) {
++  DCHECK(token.HasStringBacking());
++  for (const String& backing_string : backing_strings) {
++    if (TokenValueIsBacked(token, backing_string)) {
++      return true;
++    }
++  }
++  return false;
++}
++
++}  // namespace
++
++void CSSVariableData::VerifyStringBacking() const {
++  for (const CSSParserToken& token : tokens_) {
++    DCHECK(!token.HasStringBacking() ||
++           TokenValueIsBacked(token, backing_strings_))
++        << "Token value is not backed: " << token.Value().ToString();
++  }
++}
++
++#endif  // EXPENSIVE_DCHECKS_ARE_ON()
++
+ CSSVariableData::CSSVariableData(const CSSTokenizedValue& tokenized_value,
+                                  bool is_animation_tainted,
+                                  bool needs_variable_resolution,
+@@ -120,6 +166,9 @@ CSSVariableData::CSSVariableData(const CSSTokenizedValue& tokenized_value,
+       base_url_(base_url.IsValid() ? base_url.GetString() : String()),
+       charset_(charset) {
+   ConsumeAndUpdateTokens(tokenized_value.range);
++#if EXPENSIVE_DCHECKS_ARE_ON()
++  VerifyStringBacking();
++#endif  // EXPENSIVE_DCHECKS_ARE_ON()
+ }
+ 
+ const CSSValue* CSSVariableData::ParseForSyntax(
+diff --git a/third_party/blink/renderer/core/css/css_variable_data.h b/third_party/blink/renderer/core/css/css_variable_data.h
+index f042f85736c2c49f8337c29cb742976c5e97a14b..7be7d201313ec3e591e2c45c9fd5bda327856645 100644
+--- a/third_party/blink/renderer/core/css/css_variable_data.h
++++ b/third_party/blink/renderer/core/css/css_variable_data.h
+@@ -100,11 +100,18 @@ class CORE_EXPORT CSSVariableData : public RefCounted<CSSVariableData> {
+         has_font_units_(has_font_units),
+         has_root_font_units_(has_root_font_units),
+         base_url_(base_url),
+-        charset_(charset) {}
++        charset_(charset) {
++#if EXPENSIVE_DCHECKS_ARE_ON()
++    VerifyStringBacking();
++#endif  // EXPENSIVE_DCHECKS_ARE_ON()
++  }
+   CSSVariableData(const CSSVariableData&) = delete;
+   CSSVariableData& operator=(const CSSVariableData&) = delete;
+ 
+   void ConsumeAndUpdateTokens(const CSSParserTokenRange&);
++#if EXPENSIVE_DCHECKS_ARE_ON()
++  void VerifyStringBacking() const;
++#endif  // EXPENSIVE_DCHECKS_ARE_ON()
+ 
+   // tokens_ may have raw pointers to string data, we store the String objects
+   // owning that data in backing_strings_ to keep it alive alongside the
+diff --git a/third_party/blink/renderer/core/css/parser/css_tokenizer.h b/third_party/blink/renderer/core/css/parser/css_tokenizer.h
+index 817bcbd4b6b9a9a5519bb92d6870c5b16a19278f..682a44a478bcd0ee3aa1638601650fd420033625 100644
+--- a/third_party/blink/renderer/core/css/parser/css_tokenizer.h
++++ b/third_party/blink/renderer/core/css/parser/css_tokenizer.h
+@@ -33,6 +33,7 @@ class CORE_EXPORT CSSTokenizer {
+   wtf_size_t Offset() const { return input_.Offset(); }
+   wtf_size_t PreviousOffset() const { return prev_offset_; }
+   StringView StringRangeAt(wtf_size_t start, wtf_size_t length) const;
++  const Vector<String>& StringPool() const { return string_pool_; }
+ 
+  private:
+   CSSParserToken TokenizeSingle();
+diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
+index ae863c8df923f55b116ed1c70557e5d5916794d3..dbc654e9079f4f79fe6883a6ea34e8fa00e1a26f 100644
+--- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
++++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
+@@ -2170,6 +2170,10 @@ StyleBuilderConverter::ConvertRegisteredPropertyVariableData(
+ 
+   Vector<String> backing_strings;
+   backing_strings.push_back(text);
++  // CSSTokenizer may allocate new strings for some tokens (e.g. for escapes)
++  // and produce tokens that point to those strings. We need to retain those
++  // strings (if any) as well.
++  backing_strings.AppendVector(tokenizer.StringPool());
+ 
+   const bool has_font_units = false;
+   const bool has_root_font_units = false;
+diff --git a/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation-expected.txt b/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation-expected.txt
+index 3823a752b99f506d11c50aee36474c6c51c849cd..eeed0dfc0def17b1ba636f7f6a076caf770e1327 100644
+--- a/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation-expected.txt
++++ b/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation-expected.txt
+@@ -1,5 +1,5 @@
+ This is a testharness.js-based test.
+-Found 60 tests; 59 PASS, 1 FAIL, 0 TIMEOUT, 0 NOTRUN.
++Found 61 tests; 60 PASS, 1 FAIL, 0 TIMEOUT, 0 NOTRUN.
+ PASS <length> values computed are correctly via var()-reference
+ PASS <length> values computed are correctly via var()-reference when font-size is inherited
+ PASS <length> values are computed correctly when font-size is inherited [14em]
+@@ -60,5 +60,6 @@ PASS * values are computed correctly [50dpi]
+ PASS <resolution> values are computed correctly [1dppx]
+ PASS <resolution> values are computed correctly [96dpi]
+ FAIL <resolution> values are computed correctly [calc(1dppx + 96dpi)] assert_equals: expected "2dppx" but got "0dppx"
++PASS * values are computed correctly [url(why)]
+ Harness: the test ran to completion.
+ 
+diff --git a/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation.html b/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation.html
+index f03b257246e520bd93055203a5cb27188babc8ca..168495247a3b16a2203fb361f662b6db83044d09 100644
+--- a/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation.html
++++ b/third_party/blink/web_tests/external/wpt/css/css-properties-values-api/registered-property-computation.html
+@@ -167,4 +167,6 @@ test_computed_value('<resolution>', '1dppx', '1dppx');
+ test_computed_value('<resolution>', '96dpi', '1dppx');
+ test_computed_value('<resolution>', 'calc(1dppx + 96dpi)', '2dppx');
+ 
++test_computed_value('*', 'url(why)', 'url(why)');
++
+ </script>

patches/chromium/cherry-pick-2083e894852c.patch

@@ -0,0 +1,29 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Anton Bikineev <bikineev@chromium.org>
+Date: Sun, 10 Jul 2022 22:17:03 +0000
+Subject: Fix heap-overflow in blink::TableLayoutAlgorithmAuto::InsertSpanCell
+
+The CL fixes size confusion between Member<> and raw pointers.
+
+The bug was found (and the fix was proposed) by m.cooolie@gmail.com.
+
+Bug: 1341539
+Change-Id: I99d524fd65c2d6305693d09ad274c23178271269
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3751138
+Reviewed-by: Kentaro Hara <haraken@chromium.org>
+Commit-Queue: Anton Bikineev <bikineev@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1022529}
+
+diff --git a/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc b/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc
+index 1e1575cf47027584a9d06d7c5f6046fa15990b10..1a4a06a4761c52b8dd9ae9052b7c51b9236694a5 100644
+--- a/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc
++++ b/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.cc
+@@ -673,7 +673,7 @@ void TableLayoutAlgorithmAuto::InsertSpanCell(LayoutTableCell* cell) {
+          span > span_cells_[pos]->ColSpan())
+     pos++;
+   memmove(span_cells_.data() + pos + 1, span_cells_.data() + pos,
+-          (size - pos - 1) * sizeof(LayoutTableCell*));
++          (size - pos - 1) * sizeof(decltype(span_cells_)::value_type));
+   span_cells_[pos] = cell;
+ }
+ 

patches/chromium/cherry-pick-51daffbf5cd8.patch

@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Yutaka Hirano <yhirano@chromium.org>
+Date: Mon, 4 Jul 2022 11:48:20 +0000
+Subject: Fix UAF on network::URLLoader
+
+network::URLLoader::SetUpUpload calls NotifyCompleted asynchronously,
+as it can be called in the constructor and we don't want to run
+NotifyCompleted in the constructor.
+
+The problem is that it attaches a raw pointer to the method, which leads to a use-after-free problem if the URLLoader is destructed before
+NotifyCompleted is called.
+
+Use weak pointers instead of raw pointers to avoid the problem.
+
+Bug: 1340253
+Change-Id: Iacb1e772bf7a8e3de4a7bb9de342fea9ba0f3f3c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3740150
+Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
+Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1020539}
+
+diff --git a/services/network/url_loader.cc b/services/network/url_loader.cc
+index dbe9e809898ee720c0670e9c6db73c38658613b2..666e82ee2f14a77592b52159ee81a2029de28172 100644
+--- a/services/network/url_loader.cc
++++ b/services/network/url_loader.cc
+@@ -793,8 +793,8 @@ void URLLoader::OpenFilesForUpload(const ResourceRequest& request) {
+     // initializing before getting deleted.
+     base::SequencedTaskRunnerHandle::Get()->PostTask(
+         FROM_HERE,
+-        base::BindOnce(&URLLoader::NotifyCompleted, base::Unretained(this),
+-                       net::ERR_ACCESS_DENIED));
++        base::BindOnce(&URLLoader::NotifyCompleted,
++                       weak_ptr_factory_.GetWeakPtr(), net::ERR_ACCESS_DENIED));
+     return;
+   }
+   url_request_->LogBlockedBy("Opening Files");
+@@ -813,7 +813,7 @@ void URLLoader::SetUpUpload(const ResourceRequest& request,
+     // initializing before getting deleted.
+     base::SequencedTaskRunnerHandle::Get()->PostTask(
+         FROM_HERE, base::BindOnce(&URLLoader::NotifyCompleted,
+-                                  base::Unretained(this), error_code));
++                                  weak_ptr_factory_.GetWeakPtr(), error_code));
+     return;
+   }
+   scoped_refptr<base::SequencedTaskRunner> task_runner =

patches/chromium/cherry-pick-54a7927b19f9.patch

@@ -0,0 +1,276 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Aaron Leventhal <aleventhal@google.com>
+Date: Tue, 26 Jul 2022 17:36:04 +0000
+Subject: Merge 104: Speculative fix for IsValidCodePointInIndex() range crash
+
+(cherry picked from commit b4d1ce62d7783a9b31a0a2bec1b886a9a6519a40)
+
+Bug: 1333970
+Change-Id: I5a4c78e708357074fdec1f7a18fa928e39f9c51a
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3757922
+Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
+Reviewed-by: Nektarios Paisios <nektar@chromium.org>
+Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1025405}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3788215
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Cr-Commit-Position: refs/branch-heads/5112@{#1206}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/content/browser/accessibility/browser_accessibility_manager.cc b/content/browser/accessibility/browser_accessibility_manager.cc
+index 65213c9e3569d6a9f8d74eb655d48c1df5c9356b..d33fb5d5a3e6f741b03270f63aa34e5d58cac850 100644
+--- a/content/browser/accessibility/browser_accessibility_manager.cc
++++ b/content/browser/accessibility/browser_accessibility_manager.cc
+@@ -394,6 +394,10 @@ const ui::AXTreeData& BrowserAccessibilityManager::GetTreeData() const {
+   return ax_tree()->data();
+ }
+ 
++std::string BrowserAccessibilityManager::ToString() const {
++  return GetTreeData().ToString();
++}
++
+ void BrowserAccessibilityManager::OnWindowFocused() {
+   if (IsRootTree())
+     FireFocusEventsIfNeeded();
+diff --git a/content/browser/accessibility/browser_accessibility_manager.h b/content/browser/accessibility/browser_accessibility_manager.h
+index 92d62b5832d4fc87830b1c2bad7c7b972f1de74e..ca696fd855dcfe45e80e6c070546b19b19d42f69 100644
+--- a/content/browser/accessibility/browser_accessibility_manager.h
++++ b/content/browser/accessibility/browser_accessibility_manager.h
+@@ -225,6 +225,8 @@ class CONTENT_EXPORT BrowserAccessibilityManager
+   // Get the AXTreeData for this frame.
+   const ui::AXTreeData& GetTreeData() const;
+ 
++  std::string ToString() const override;
++
+   // Called to notify the accessibility manager that its associated native
+   // view got focused.
+   virtual void OnWindowFocused();
+diff --git a/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc b/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc
+index 93f59054158d089fd2754a8b99c0dc5407716e58..c50d65a55b4cadf8a5579ae7aca79f671088796f 100644
+--- a/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc
++++ b/extensions/renderer/api/automation/automation_ax_tree_wrapper.cc
+@@ -4,6 +4,7 @@
+ 
+ #include "extensions/renderer/api/automation/automation_ax_tree_wrapper.h"
+ 
++#include "automation_ax_tree_wrapper.h"
+ #include "base/containers/contains.h"
+ #include "base/containers/cxx20_erase.h"
+ #include "base/no_destructor.h"
+@@ -573,4 +574,8 @@ ui::AXNode* AutomationAXTreeWrapper::GetParentNodeFromParentTreeAsAXNode()
+   return owner_->GetParent(tree_.root(), &wrapper);
+ }
+ 
++std::string AutomationAXTreeWrapper::ToString() const {
++  return "<AutomationAXTreeWrapper>";
++}
++
+ }  // namespace extensions
+diff --git a/extensions/renderer/api/automation/automation_ax_tree_wrapper.h b/extensions/renderer/api/automation/automation_ax_tree_wrapper.h
+index afb92e41edb824bf7c642fd2bb542daac653abf8..2c64b5eaac8d2521b0c9ff754b36c057f73f9e90 100644
+--- a/extensions/renderer/api/automation/automation_ax_tree_wrapper.h
++++ b/extensions/renderer/api/automation/automation_ax_tree_wrapper.h
+@@ -116,6 +116,7 @@ class AutomationAXTreeWrapper : public ui::AXTreeObserver,
+   ui::AXTreeID GetParentTreeID() const override;
+   ui::AXNode* GetRootAsAXNode() const override;
+   ui::AXNode* GetParentNodeFromParentTreeAsAXNode() const override;
++  std::string ToString() const override;
+ 
+  private:
+   // AXTreeObserver overrides.
+diff --git a/ui/accessibility/ax_node_position_unittest.cc b/ui/accessibility/ax_node_position_unittest.cc
+index b0f06a0912447e5fa9bad9e62b2523817490ea02..3081258496dacc4f26976dfd99ea005a70bcd210 100644
+--- a/ui/accessibility/ax_node_position_unittest.cc
++++ b/ui/accessibility/ax_node_position_unittest.cc
+@@ -9105,8 +9105,12 @@ TEST_F(AXPositionTest,
+   EXPECT_TRUE(test_position->IsNullPosition());
+ }
+ 
++// TODO(crbug.com/1333970) It is not legal to call
++// AsLeafTextPositionBeforeCharacter or AsLeafTextPositionAfterCharacter with
++// a text position using out-of-range offsets. It's necessary to call
++// AsValidPosition() first. Therefore, this test currently triggers a DCHECK.
+ TEST_F(AXPositionTest,
+-       AsLeafTextPositionBeforeAndAfterCharacterWithInvalidPosition) {
++       DISABLED_AsLeafTextPositionBeforeAndAfterCharacterWithInvalidPosition) {
+   AXNodeData root_data;
+   root_data.id = 1;
+   root_data.role = ax::mojom::Role::kRootWebArea;
+diff --git a/ui/accessibility/ax_position.h b/ui/accessibility/ax_position.h
+index 9eaf0df84b04e88d9f78e95523732d90ecd0fe22..d23bb61a0713a44e864e6b940c78433d81490776 100644
+--- a/ui/accessibility/ax_position.h
++++ b/ui/accessibility/ax_position.h
+@@ -26,6 +26,7 @@
+ #include "base/strings/string_util.h"
+ #include "base/strings/utf_string_conversions.h"
+ #include "third_party/abseil-cpp/absl/types/optional.h"
++#include "ui/accessibility/ax_common.h"
+ #include "ui/accessibility/ax_enum_util.h"
+ #include "ui/accessibility/ax_enums.mojom.h"
+ #include "ui/accessibility/ax_node.h"
+@@ -383,16 +384,33 @@ class AXPosition {
+     return str + " annotated_text=" + base::UTF16ToUTF8(annotated_text);
+   }
+ 
++  // Helper for logging the position, the AXTreeManager and the anchor node.
++  std::string ToDebugString() const {
++    if (IsNullPosition()) {
++      return "* Position: null";
++    }
++    DCHECK(GetAnchor());
++    DCHECK(GetManager());
++    std::ostringstream str;
++    str << "* Position: " << ToString()
++        << "\n* Manager: " << GetManager()->ToString()
++        << "\n* Anchor node: " << *GetAnchor();
++    return str.str();
++  }
++
+   AXPositionKind kind() const { return kind_; }
+   AXTreeID tree_id() const { return tree_id_; }
+   AXNodeID anchor_id() const { return anchor_id_; }
+ 
++  AXTreeManager* GetManager() const {
++    return AXTreeManagerMap::GetInstance().GetManager(tree_id());
++  }
++
+   AXNode* GetAnchor() const {
+     if (tree_id_ == AXTreeIDUnknown() || anchor_id_ == kInvalidAXNodeID)
+       return nullptr;
+ 
+-    const AXTreeManager* manager =
+-        AXTreeManagerMap::GetInstance().GetManager(tree_id());
++    const AXTreeManager* manager = GetManager();
+     if (manager)
+       return manager->GetNodeFromTree(anchor_id());
+ 
+@@ -2569,13 +2587,6 @@ class AXPosition {
+       return Clone();
+ 
+     AXPositionInstance text_position = AsTextPosition();
+-    // The following situation should not be possible but there are existing
+-    // crashes in the field.
+-    //
+-    // TODO(nektar): Remove this workaround as soon as the source of the bug
+-    // is identified.
+-    if (text_position->text_offset_ > text_position->MaxTextOffset())
+-      return CreateNullPosition();
+ 
+     // In case the input affinity is upstream, reset it to downstream.
+     //
+@@ -2593,6 +2604,16 @@ class AXPosition {
+     if (!text_position->IsIgnored() && !text_position->AtEndOfAnchor()) {
+       std::unique_ptr<base::i18n::BreakIterator> grapheme_iterator =
+           text_position->GetGraphemeIterator();
++      // The following situation should not be possible but there are existing
++      // crashes in the field.
++      //
++      // TODO(nektar): Remove this workaround as soon as the source of the bug
++      // is identified.
++      if (text_position->text_offset_ < 0 ||
++          text_position->text_offset_ > text_position->MaxTextOffset()) {
++        SANITIZER_NOTREACHED() << "Offset range error:\n" << ToDebugString();
++        return CreateNullPosition();
++      }
+       DCHECK_GE(text_position->text_offset_, 0);
+       DCHECK_LE(text_position->text_offset_, text_position->MaxTextOffset());
+       while (!text_position->AtStartOfAnchor() &&
+@@ -2645,9 +2666,11 @@ class AXPosition {
+       //
+       // TODO(nektar): Remove this workaround as soon as the source of the bug
+       // is identified.
+-      if (text_position->text_offset_ > text_position->MaxTextOffset())
++      if (text_position->text_offset_ < 0 ||
++          text_position->text_offset_ > text_position->MaxTextOffset()) {
++        SANITIZER_NOTREACHED() << "Offset range error:\n" << ToDebugString();
+         return CreateNullPosition();
+-
++      }
+       DCHECK_GE(text_position->text_offset_, 0);
+       DCHECK_LE(text_position->text_offset_, text_position->MaxTextOffset());
+       while (!text_position->AtEndOfAnchor() &&
+diff --git a/ui/accessibility/ax_tree_manager.h b/ui/accessibility/ax_tree_manager.h
+index 1081ed8fc3388ae7b6f535f2cd7437ac2e3db184..52f892c1acf3a50a24716bb361dd1ca231bd57a1 100644
+--- a/ui/accessibility/ax_tree_manager.h
++++ b/ui/accessibility/ax_tree_manager.h
+@@ -51,6 +51,11 @@ class AX_EXPORT AXTreeManager {
+   // Called when the tree manager is about to be removed from the tree map,
+   // `AXTreeManagerMap`.
+   virtual void WillBeRemovedFromMap() {}
++
++  // For debugging.
++  // TODO(benjamin.beaudry) Instead of this, implement GetTreeData() on all
++  // AXTreeManager subclasses, and have callers use GetTreeData().ToString();
++  virtual std::string ToString() const = 0;
+ };
+ 
+ }  // namespace ui
+diff --git a/ui/accessibility/test_ax_tree_manager.cc b/ui/accessibility/test_ax_tree_manager.cc
+index 15627a472481b46c66c3d40efa3895ab14cb89ef..5ee1750a265db3e9291c5f5a9beb1a4228278af2 100644
+--- a/ui/accessibility/test_ax_tree_manager.cc
++++ b/ui/accessibility/test_ax_tree_manager.cc
+@@ -116,4 +116,8 @@ AXNode* TestAXTreeManager::GetParentNodeFromParentTreeAsAXNode() const {
+   return nullptr;
+ }
+ 
++std::string TestAXTreeManager::ToString() const {
++  return "<TestAXTreeManager>";
++}
++
+ }  // namespace ui
+diff --git a/ui/accessibility/test_ax_tree_manager.h b/ui/accessibility/test_ax_tree_manager.h
+index c155aeb4f164129a3b484386f0e4802a361df80a..dabc5650132d01f121f8a9763afc499800bfbd9c 100644
+--- a/ui/accessibility/test_ax_tree_manager.h
++++ b/ui/accessibility/test_ax_tree_manager.h
+@@ -53,6 +53,7 @@ class AX_EXPORT TestAXTreeManager : public AXTreeManager {
+   AXTreeID GetParentTreeID() const override;
+   AXNode* GetRootAsAXNode() const override;
+   AXNode* GetParentNodeFromParentTreeAsAXNode() const override;
++  std::string ToString() const override;
+ 
+  private:
+   std::unique_ptr<AXTree> tree_;
+diff --git a/ui/views/accessibility/views_ax_tree_manager.cc b/ui/views/accessibility/views_ax_tree_manager.cc
+index 9ddd02d0e05d56247cbeb48d97b26227090a40d3..269002feff50b3c95f7216ba3e5c339bc7e641a4 100644
+--- a/ui/views/accessibility/views_ax_tree_manager.cc
++++ b/ui/views/accessibility/views_ax_tree_manager.cc
+@@ -4,8 +4,6 @@
+ 
+ #include "ui/views/accessibility/views_ax_tree_manager.h"
+ 
+-#include <string>
+-
+ #include "base/bind.h"
+ #include "base/callback.h"
+ #include "base/check.h"
+@@ -105,6 +103,10 @@ ui::AXNode* ViewsAXTreeManager::GetParentNodeFromParentTreeAsAXNode() const {
+   return nullptr;
+ }
+ 
++std::string ViewsAXTreeManager::ToString() const {
++  return "<ViewsAXTreeManager>";
++}
++
+ void ViewsAXTreeManager::OnViewEvent(View* view, ax::mojom::Event event) {
+   DCHECK(view);
+   AXAuraObjWrapper* wrapper = cache_.GetOrCreate(view);
+diff --git a/ui/views/accessibility/views_ax_tree_manager.h b/ui/views/accessibility/views_ax_tree_manager.h
+index 3c28a84ddcbddccc8e9d4ae6fd2a30cd4c29bc65..6a6a769f5280ac901df551a85c4de69fa4e8eeed 100644
+--- a/ui/views/accessibility/views_ax_tree_manager.h
++++ b/ui/views/accessibility/views_ax_tree_manager.h
+@@ -7,6 +7,7 @@
+ 
+ #include <memory>
+ #include <set>
++#include <string>
+ #include <vector>
+ 
+ #include "base/callback_forward.h"
+@@ -89,6 +90,7 @@ class VIEWS_EXPORT ViewsAXTreeManager : public ui::AXTreeManager,
+   ui::AXTreeID GetParentTreeID() const override;
+   ui::AXNode* GetRootAsAXNode() const override;
+   ui::AXNode* GetParentNodeFromParentTreeAsAXNode() const override;
++  std::string ToString() const override;
+ 
+   // AXActionHandlerBase implementation.
+   void PerformAction(const ui::AXActionData& data) override;

patches/chromium/cherry-pick-54e32332750c.patch

@@ -0,0 +1,141 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Min Qin <qinmin@chromium.org>
+Date: Tue, 12 Jul 2022 19:48:53 +0000
+Subject: Sanitize default file name in windows select file dialog
+
+On windows, '%' is a special character and can be used for environment
+variables. So if the default file name is '%DATADIR%', it can actually
+refer to another directory and thus causing weird behaviors.
+And '%' cannot be escaped when used in the file dialog. Both "^%" and
+"%%" don't work. This CL mitigates the issue by replacing '%' with '_'.
+This only affects the default file name when showing the dialog. Power
+users can still change the file name by adding '%' if needed.
+
+BUG=1308422
+
+(cherry picked from commit 9cdce354cb3b0da5b4b311638973d407be7712b6)
+
+Change-Id: Ibb275f5c3c2c9458c20d1e97ad527f7c95184eaa
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3688608
+Reviewed-by: Robert Liao <robliao@chromium.org>
+Commit-Queue: Min Qin <qinmin@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1014602}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3758469
+Cr-Commit-Position: refs/branch-heads/5112@{#822}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/ui/shell_dialogs/execute_select_file_win.cc b/ui/shell_dialogs/execute_select_file_win.cc
+index 063d4c7c96cba45448d4d7b0e7a8ddd3a6f67937..162dbc3aeb4ead16a415228b40fb67008e89fe63 100644
+--- a/ui/shell_dialogs/execute_select_file_win.cc
++++ b/ui/shell_dialogs/execute_select_file_win.cc
+@@ -10,6 +10,7 @@
+ #include "base/callback.h"
+ #include "base/files/file.h"
+ #include "base/files/file_util.h"
++#include "base/strings/string_tokenizer.h"
+ #include "base/strings/string_util.h"
+ #include "base/win/com_init_util.h"
+ #include "base/win/registry.h"
+@@ -50,7 +51,7 @@ bool SetDefaultPath(IFileDialog* file_dialog,
+     default_folder = default_path;
+   } else {
+     default_folder = default_path.DirName();
+-    default_file_name = default_path.BaseName();
++    default_file_name = GetSanitizedFileName(default_path.BaseName());
+   }
+ 
+   // Do not fail the file dialog operation if the specified folder is invalid.
+@@ -371,6 +372,33 @@ std::wstring AppendExtensionIfNeeded(const std::wstring& filename,
+   return return_value;
+ }
+ 
++base::FilePath GetSanitizedFileName(const base::FilePath& file_name) {
++  base::StringTokenizerT<std::wstring, std::wstring::const_iterator> t(
++      file_name.value(), L"%");
++  t.set_options(base::StringTokenizer::RETURN_EMPTY_TOKENS);
++  std::wstring result;
++  bool token_valid = t.GetNext();
++  while (token_valid) {
++    // Append substring before the first "%".
++    result.append(t.token());
++    // Done if we are reaching the end delimiter,
++    if (!t.GetNext()) {
++      break;
++    }
++    std::wstring string_after_first_percent = t.token();
++    token_valid = t.GetNext();
++    // If there are no other "%", append the string after
++    // the first "%". Otherwise, remove the string between
++    // the "%" and continue handing the remaining string.
++    if (!token_valid) {
++      result.append(L"%");
++      result.append(string_after_first_percent);
++      break;
++    }
++  }
++  return base::FilePath(result);
++}
++
+ void ExecuteSelectFile(
+     SelectFileDialog::Type type,
+     const std::u16string& title,
+diff --git a/ui/shell_dialogs/execute_select_file_win.h b/ui/shell_dialogs/execute_select_file_win.h
+index dc808af395333a2bd81c2bd73faac4c6063fd409..8fa96906c0288d0021c1500bd442a35c0c29dfd2 100644
+--- a/ui/shell_dialogs/execute_select_file_win.h
++++ b/ui/shell_dialogs/execute_select_file_win.h
+@@ -26,6 +26,12 @@ SHELL_DIALOGS_EXPORT std::wstring AppendExtensionIfNeeded(
+     const std::wstring& filter_selected,
+     const std::wstring& suggested_ext);
+ 
++// Given a file name, return the sanitized version by removing substrings that
++// are embedded in double '%' characters as those are reserved for environment
++// variables. Implementation detail exported for unit tests.
++SHELL_DIALOGS_EXPORT base::FilePath GetSanitizedFileName(
++    const base::FilePath& file_name);
++
+ // Describes a filter for a file dialog.
+ struct FileFilterSpec {
+   // A human readable description of this filter. E.g. "HTML Files."
+diff --git a/ui/shell_dialogs/execute_select_file_win_unittest.cc b/ui/shell_dialogs/execute_select_file_win_unittest.cc
+index df5e8a89d9b0854626a99750a56e3f2500dba812..b6c604fa5a798ba6e448e892ca7a9212cce507fc 100644
+--- a/ui/shell_dialogs/execute_select_file_win_unittest.cc
++++ b/ui/shell_dialogs/execute_select_file_win_unittest.cc
+@@ -50,3 +50,38 @@ TEST(ShellDialogsWin, AppendExtensionIfNeeded) {
+                                           test_cases[i].suggested_ext));
+   }
+ }
++
++TEST(ShellDialogsWin, GetSanitizedFileName) {
++  struct GetSanitizedFileNameTestCase {
++    const wchar_t* filename;
++    const wchar_t* sanitized_filename;
++  } test_cases[] = {
++      {L"", L""},
++      {L"a.txt", L"a.txt"},
++
++      // Only 1 "%" in file name.
++      {L"%", L"%"},
++      {L"%.txt", L"%.txt"},
++      {L"ab%c.txt", L"ab%c.txt"},
++      {L"abc.t%", L"abc.t%"},
++
++      // 2 "%" in file name.
++      {L"%%", L""},
++      {L"%c%", L""},
++      {L"%c%d", L"d"},
++      {L"d%c%.txt", L"d.txt"},
++      {L"ab%c.t%", L"ab"},
++      {L"abc.%t%", L"abc."},
++
++      // More than 2 "%" in file name.
++      {L"%ab%c%.txt", L"c%.txt"},
++      {L"%abc%.%txt%", L"."},
++      {L"%ab%c%.%txt%", L"ctxt%"},
++  };
++
++  for (size_t i = 0; i < std::size(test_cases); ++i) {
++    SCOPED_TRACE(base::StringPrintf("i=%zu", i));
++    EXPECT_EQ(base::FilePath(test_cases[i].sanitized_filename),
++              ui::GetSanitizedFileName(base::FilePath(test_cases[i].filename)));
++  }
++}

patches/chromium/cherry-pick-60d8559e150a.patch

@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Tue, 12 Jul 2022 18:52:14 +0000
+Subject: M104: Better define "first result" in PDFiumEngine::AddFindResult().
+
+Currently, changing the PDF layout confuses AddFindResult() and causes
+it to fail a DCHECK(). Adjust AddFindResult() to avoid the failing
+DCHECK().
+
+This is a cherry-pick of https://crrev.com/1021389 without the test
+changes.
+
+Bug: 1339745
+Change-Id: I25c2b6b436700f9aeca4924fef662ad2909f0a8c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3758626
+Reviewed-by: K. Moon <kmoon@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5112@{#820}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/pdf/pdfium/pdfium_engine.cc b/pdf/pdfium/pdfium_engine.cc
+index c015d4b06a44c9121576d14160b84e871081fa33..0afe3c60715c948c7e376f81646c11b29cc01486 100644
+--- a/pdf/pdfium/pdfium_engine.cc
++++ b/pdf/pdfium/pdfium_engine.cc
+@@ -1971,7 +1971,7 @@ void PDFiumEngine::SearchUsingICU(const std::u16string& term,
+ }
+ 
+ void PDFiumEngine::AddFindResult(const PDFiumRange& result) {
+-  bool first_result = find_results_.empty();
++  bool first_result = find_results_.empty() && !resume_find_index_.has_value();
+   // Figure out where to insert the new location, since we could have
+   // started searching midway and now we wrapped.
+   size_t result_index;
+@@ -1988,7 +1988,6 @@ void PDFiumEngine::AddFindResult(const PDFiumRange& result) {
+   UpdateTickMarks();
+   client_->NotifyNumberOfFindResultsChanged(find_results_.size(), false);
+   if (first_result) {
+-    DCHECK(!resume_find_index_);
+     DCHECK(!current_find_index_);
+     SelectFindResult(/*forward=*/true);
+   }

patches/chromium/cherry-pick-94a8bdafc8c6.patch

@@ -0,0 +1,414 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Keren Zhu <kerenzhu@chromium.org>
+Date: Thu, 9 Jun 2022 14:50:26 +0000
+Subject: Fix use-after-free vulnerability in ComboboxModel
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Stop the Combobox from observing the model when the model gets
+destroyed. This is done by adding a virtual OnComboboxModelDestroying()
+to the base observer class and calling it in ~ComboboxModel().
+
+This fix will prevent the use-after-free that happens when the combobox outlives the model, usually because the model lifetime
+is managed by non-UI component.
+
+Bug: 1264288
+Change-Id: Ia00881a9b674bbc83bbf54dd228490c1cc1290bc
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3693825
+Commit-Queue: Keren Zhu <kerenzhu@chromium.org>
+Reviewed-by: Matthias Körber <koerber@google.com>
+Auto-Submit: Keren Zhu <kerenzhu@chromium.org>
+Reviewed-by: Peter Boström <pbos@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1012504}
+
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
+index 323f85651611ff98e45884e3b0b7211eaa25039b..0d0bb0d21b1d96841a30bfea336af918b6da83f8 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
+@@ -130,16 +130,6 @@ int RecentlyUsedFoldersComboModel::GetDefaultIndex() const {
+   return it == items_.end() ? 0 : static_cast<int>(it - items_.begin());
+ }
+ 
+-void RecentlyUsedFoldersComboModel::AddObserver(
+-    ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void RecentlyUsedFoldersComboModel::RemoveObserver(
+-    ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ void RecentlyUsedFoldersComboModel::BookmarkModelLoaded(BookmarkModel* model,
+                                                         bool ids_reassigned) {}
+ 
+@@ -176,7 +166,7 @@ void RecentlyUsedFoldersComboModel::OnWillRemoveBookmarks(
+     }
+   }
+   if (changed) {
+-    for (ui::ComboboxModelObserver& observer : observers_)
++    for (ui::ComboboxModelObserver& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ }
+@@ -219,7 +209,7 @@ void RecentlyUsedFoldersComboModel::BookmarkAllUserNodesRemoved(
+     }
+   }
+   if (changed) {
+-    for (ui::ComboboxModelObserver& observer : observers_)
++    for (ui::ComboboxModelObserver& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
+index 8682e750f4407e615264986024e2a7dd0bae038f..0c02c685a02875c7b91ca9e6228864bc04e45c10 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.h
+@@ -38,8 +38,6 @@ class RecentlyUsedFoldersComboModel : public ui::ComboboxModel,
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+   int GetDefaultIndex() const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+   // Overriden from bookmarks::BookmarkModelObserver:
+   void BookmarkModelLoaded(bookmarks::BookmarkModel* model,
+@@ -90,8 +88,6 @@ class RecentlyUsedFoldersComboModel : public ui::ComboboxModel,
+   const raw_ptr<bookmarks::BookmarkModel> bookmark_model_;
+ 
+   const raw_ptr<const bookmarks::BookmarkNode> parent_node_;
+-
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ #endif  // CHROME_BROWSER_UI_BOOKMARKS_RECENTLY_USED_FOLDERS_COMBO_MODEL_H_
+diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
+index 60455386b7d5f1da72c92424ccf95fd971e7590a..3bfe6852b8a54a53aafea5eeec2da850097b2f0a 100644
+--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
++++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model_unittest.cc
+@@ -41,6 +41,8 @@ class TestComboboxModelObserver : public ui::ComboboxModelObserver {
+     changed_ = true;
+   }
+ 
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override {}
++
+  private:
+   bool changed_;
+ };
+diff --git a/components/autofill/core/browser/ui/address_combobox_model.cc b/components/autofill/core/browser/ui/address_combobox_model.cc
+index c7e6f906ff32cb198f8723d6678971ae6cff28a2..d52dc0e925c54634452f86ca90792b318776e895 100644
+--- a/components/autofill/core/browser/ui/address_combobox_model.cc
++++ b/components/autofill/core/browser/ui/address_combobox_model.cc
+@@ -84,14 +84,6 @@ int AddressComboboxModel::GetDefaultIndex() const {
+   return ui::ComboboxModel::GetDefaultIndex();
+ }
+ 
+-void AddressComboboxModel::AddObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void AddressComboboxModel::RemoveObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ int AddressComboboxModel::AddNewProfile(const AutofillProfile& profile) {
+   profiles_cache_.push_back(std::make_unique<AutofillProfile>(profile));
+   UpdateAddresses();
+@@ -131,7 +123,7 @@ void AddressComboboxModel::UpdateAddresses() {
+   for (size_t i = 0; i < profiles_cache_.size(); ++i)
+     addresses_.emplace_back(profiles_cache_[i]->guid(), labels[i]);
+ 
+-  for (auto& observer : observers_) {
++  for (auto& observer : observers()) {
+     observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/components/autofill/core/browser/ui/address_combobox_model.h b/components/autofill/core/browser/ui/address_combobox_model.h
+index 02d65209d2729deae608481411e1539ba08f5f7e..3a41b30c92543633da29e40e2c64cc4597e322d2 100644
+--- a/components/autofill/core/browser/ui/address_combobox_model.h
++++ b/components/autofill/core/browser/ui/address_combobox_model.h
+@@ -40,8 +40,6 @@ class AddressComboboxModel : public ui::ComboboxModel {
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+   int GetDefaultIndex() const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+   // Adds |profile| to model and return its combobox index. The lifespan of
+   // |profile| beyond this call is undefined so a copy must be made.
+@@ -72,9 +70,6 @@ class AddressComboboxModel : public ui::ComboboxModel {
+ 
+   // If non empty, the guid of the address that should be selected by default.
+   std::string default_selected_guid_;
+-
+-  // To be called when the data for the given country code was loaded.
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ }  // namespace autofill
+diff --git a/components/autofill/core/browser/ui/region_combobox_model.cc b/components/autofill/core/browser/ui/region_combobox_model.cc
+index 6439ccb1f074f1c3965dfb2b45ab6f6636437c17..42626aff427f1b3f3400aba399e3f9c89faa06ba 100644
+--- a/components/autofill/core/browser/ui/region_combobox_model.cc
++++ b/components/autofill/core/browser/ui/region_combobox_model.cc
+@@ -67,14 +67,6 @@ bool RegionComboboxModel::IsItemSeparatorAt(int index) const {
+   return regions_[index].first.empty();
+ }
+ 
+-void RegionComboboxModel::AddObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.AddObserver(observer);
+-}
+-
+-void RegionComboboxModel::RemoveObserver(ui::ComboboxModelObserver* observer) {
+-  observers_.RemoveObserver(observer);
+-}
+-
+ void RegionComboboxModel::OnRegionDataLoaded(
+     const std::vector<const ::i18n::addressinput::RegionData*>& regions) {
+   // The RegionDataLoader will eventually self destruct after this call.
+@@ -95,7 +87,7 @@ void RegionComboboxModel::OnRegionDataLoaded(
+     failed_to_load_data_ = true;
+   }
+ 
+-  for (auto& observer : observers_) {
++  for (auto& observer : observers()) {
+     observer.OnComboboxModelChanged(this);
+   }
+ }
+diff --git a/components/autofill/core/browser/ui/region_combobox_model.h b/components/autofill/core/browser/ui/region_combobox_model.h
+index d1b5d8b9db0c4d9d15e4f2a50a6cba38b33f1be8..52cffd5d00649f8e2be7189bca128ba4c3e8a97d 100644
+--- a/components/autofill/core/browser/ui/region_combobox_model.h
++++ b/components/autofill/core/browser/ui/region_combobox_model.h
+@@ -54,8 +54,6 @@ class RegionComboboxModel : public ui::ComboboxModel {
+   int GetItemCount() const override;
+   std::u16string GetItemAt(int index) const override;
+   bool IsItemSeparatorAt(int index) const override;
+-  void AddObserver(ui::ComboboxModelObserver* observer) override;
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override;
+ 
+  private:
+   // Callback for the RegionDataLoader.
+@@ -72,9 +70,6 @@ class RegionComboboxModel : public ui::ComboboxModel {
+   // List of <code, name> pairs for ADDRESS_HOME_STATE combobox values;
+   std::vector<std::pair<std::string, std::string>> regions_;
+ 
+-  // To be called when the data for the given country code was loaded.
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+-
+   // Weak pointer factory.
+   base::WeakPtrFactory<RegionComboboxModel> weak_factory_{this};
+ };
+diff --git a/ui/base/models/combobox_model.cc b/ui/base/models/combobox_model.cc
+index d307ee0ec592ae01a1d04cef85c0a492b7f7e29e..413adebd0349e304006de0cc0c4e2a4536ebbf06 100644
+--- a/ui/base/models/combobox_model.cc
++++ b/ui/base/models/combobox_model.cc
+@@ -4,10 +4,18 @@
+ 
+ #include "ui/base/models/combobox_model.h"
+ 
++#include "ui/base/models/combobox_model_observer.h"
+ #include "ui/base/models/image_model.h"
+ 
+ namespace ui {
+ 
++ComboboxModel::ComboboxModel() = default;
++
++ComboboxModel::~ComboboxModel() {
++  for (auto& observer : observers_)
++    observer.OnComboboxModelDestroying(this);
++}
++
+ std::u16string ComboboxModel::GetDropDownTextAt(int index) const {
+   return GetItemAt(index);
+ }
+@@ -36,4 +44,12 @@ bool ComboboxModel::IsItemEnabledAt(int index) const {
+   return true;
+ }
+ 
++void ComboboxModel::AddObserver(ComboboxModelObserver* observer) {
++  observers_.AddObserver(observer);
++}
++
++void ComboboxModel::RemoveObserver(ComboboxModelObserver* observer) {
++  observers_.RemoveObserver(observer);
++}
++
+ }  // namespace ui
+diff --git a/ui/base/models/combobox_model.h b/ui/base/models/combobox_model.h
+index 5264aaa5550859fce39a8485feff16c8fd83d897..eeff7dc8444e77fd598eb7ce05ab18259a9d7ef5 100644
+--- a/ui/base/models/combobox_model.h
++++ b/ui/base/models/combobox_model.h
+@@ -8,6 +8,7 @@
+ #include <string>
+ 
+ #include "base/component_export.h"
++#include "base/observer_list.h"
+ 
+ namespace ui {
+ 
+@@ -17,7 +18,8 @@ class ImageModel;
+ // A data model for a combo box.
+ class COMPONENT_EXPORT(UI_BASE) ComboboxModel {
+  public:
+-  virtual ~ComboboxModel() {}
++  ComboboxModel();
++  virtual ~ComboboxModel();
+ 
+   // Returns the number of items in the combo box.
+   virtual int GetItemCount() const = 0;
+@@ -52,9 +54,17 @@ class COMPONENT_EXPORT(UI_BASE) ComboboxModel {
+   // Returns true if the item at |index| is enabled.
+   virtual bool IsItemEnabledAt(int index) const;
+ 
+-  // Adds/removes an observer. Override if model supports mutation.
+-  virtual void AddObserver(ComboboxModelObserver* observer) {}
+-  virtual void RemoveObserver(ComboboxModelObserver* observer) {}
++  // Adds/removes an observer.
++  void AddObserver(ComboboxModelObserver* observer);
++  void RemoveObserver(ComboboxModelObserver* observer);
++
++ protected:
++  base::ObserverList<ui::ComboboxModelObserver>& observers() {
++    return observers_;
++  }
++
++ private:
++  base::ObserverList<ui::ComboboxModelObserver> observers_;
+ };
+ 
+ }  // namespace ui
+diff --git a/ui/base/models/combobox_model_observer.h b/ui/base/models/combobox_model_observer.h
+index 5e00ab68a0c14d0b48317ca287e3f105351a102c..44325ff0aa94b75eb662be1637f44aa5524a33e8 100644
+--- a/ui/base/models/combobox_model_observer.h
++++ b/ui/base/models/combobox_model_observer.h
+@@ -16,10 +16,13 @@ class ComboboxModel;
+ class COMPONENT_EXPORT(UI_BASE) ComboboxModelObserver
+     : public base::CheckedObserver {
+  public:
+-  // Invoked when |model| has changed in some way. The observer should assume
++  // Invoked when `model` has changed in some way. The observer should assume
+   // everything changed.
+   virtual void OnComboboxModelChanged(ComboboxModel* model) = 0;
+ 
++  // Invoked when `model` is destroyed. The observer should stop observing.
++  virtual void OnComboboxModelDestroying(ComboboxModel* model) = 0;
++
+  protected:
+   ~ComboboxModelObserver() override = default;
+ };
+diff --git a/ui/views/controls/combobox/combobox.cc b/ui/views/controls/combobox/combobox.cc
+index aa135250e469d2405fba618c96b0bf38acaf59f0..b8d41cfeb67f3b4c098b2b329b2dfa7fe246dabb 100644
+--- a/ui/views/controls/combobox/combobox.cc
++++ b/ui/views/controls/combobox/combobox.cc
+@@ -578,6 +578,10 @@ void Combobox::OnComboboxModelChanged(ui::ComboboxModel* model) {
+   OnContentSizeMaybeChanged();
+ }
+ 
++void Combobox::OnComboboxModelDestroying(ui::ComboboxModel* model) {
++  SetModel(nullptr);
++}
++
+ const base::RepeatingClosure& Combobox::GetCallback() const {
+   return callback_;
+ }
+diff --git a/ui/views/controls/combobox/combobox.h b/ui/views/controls/combobox/combobox.h
+index fc77f8e49cead5fb689fba3d56c65c1b8e69f298..1a3f533256eca91e4fd4552ee5425b7ca8e7ad7e 100644
+--- a/ui/views/controls/combobox/combobox.h
++++ b/ui/views/controls/combobox/combobox.h
+@@ -131,6 +131,7 @@ class VIEWS_EXPORT Combobox : public View,
+  protected:
+   // Overridden from ComboboxModelObserver:
+   void OnComboboxModelChanged(ui::ComboboxModel* model) override;
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override;
+ 
+   // Getters to be used by metadata.
+   const base::RepeatingClosure& GetCallback() const;
+diff --git a/ui/views/controls/combobox/combobox_unittest.cc b/ui/views/controls/combobox/combobox_unittest.cc
+index 7ce20acc4b3ecd6470d5f017f9171d0be35c09d2..91661f33074d3453b4f28a410ecc918b793f86c6 100644
+--- a/ui/views/controls/combobox/combobox_unittest.cc
++++ b/ui/views/controls/combobox/combobox_unittest.cc
+@@ -84,13 +84,6 @@ class TestComboboxModel : public ui::ComboboxModel {
+     return 0;
+   }
+ 
+-  void AddObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.AddObserver(observer);
+-  }
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.RemoveObserver(observer);
+-  }
+-
+   void SetSeparators(const std::set<int>& separators) {
+     separators_ = separators;
+     OnModelChanged();
+@@ -103,11 +96,10 @@ class TestComboboxModel : public ui::ComboboxModel {
+ 
+  private:
+   void OnModelChanged() {
+-    for (auto& observer : observers_)
++    for (auto& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ 
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+   std::set<int> separators_;
+   int item_count_ = kItemCount;
+ };
+@@ -134,20 +126,13 @@ class VectorComboboxModel : public ui::ComboboxModel {
+   }
+   bool IsItemSeparatorAt(int index) const override { return false; }
+   int GetDefaultIndex() const override { return default_index_; }
+-  void AddObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.AddObserver(observer);
+-  }
+-  void RemoveObserver(ui::ComboboxModelObserver* observer) override {
+-    observers_.RemoveObserver(observer);
+-  }
+ 
+   void ValuesChanged() {
+-    for (auto& observer : observers_)
++    for (auto& observer : observers())
+       observer.OnComboboxModelChanged(this);
+   }
+ 
+  private:
+-  base::ObserverList<ui::ComboboxModelObserver> observers_;
+   int default_index_ = 0;
+   const raw_ptr<std::vector<std::string>> values_;
+ };
+@@ -884,6 +869,15 @@ TEST_F(ComboboxTest, SetTooltipTextNotifiesAccessibilityEvent) {
+   EXPECT_EQ(test_tooltip_text, ASCIIToUTF16(name));
+ }
+ 
++// Regression test for crbug.com/1264288.
++// Should fail in ASan build before the fix.
++TEST_F(ComboboxTest, NoCrashWhenComboboxOutlivesModel) {
++  auto model = std::make_unique<TestComboboxModel>();
++  auto combobox = std::make_unique<TestCombobox>(model.get());
++  model.reset();
++  combobox.reset();
++}
++
+ namespace {
+ 
+ using ComboboxDefaultTest = ViewsTestBase;
+diff --git a/ui/views/controls/editable_combobox/editable_combobox.cc b/ui/views/controls/editable_combobox/editable_combobox.cc
+index b5301bfb0a3c8da3daa1d3646c2f4872cef2cdab..faac607fefcc8caf572eb83456e7520146c1d0ad 100644
+--- a/ui/views/controls/editable_combobox/editable_combobox.cc
++++ b/ui/views/controls/editable_combobox/editable_combobox.cc
+@@ -190,10 +190,15 @@ class EditableCombobox::EditableComboboxMenuModel
+     return combobox_model_->GetDropDownIconAt(items_shown_[index].index);
+   }
+ 
++  // ComboboxModelObserver:
+   void OnComboboxModelChanged(ui::ComboboxModel* model) override {
+     UpdateItemsShown();
+   }
+ 
++  void OnComboboxModelDestroying(ui::ComboboxModel* model) override {
++    observation_.Reset();
++  }
++
+   int GetItemCount() const override { return items_shown_.size(); }
+ 
+  private:

patches/chromium/cherry-pick-9b5207569882.patch

@@ -0,0 +1,179 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ken Rockot <rockot@google.com>
+Date: Wed, 31 Aug 2022 15:39:45 +0000
+Subject: Mojo: Validate response message type
+
+Ensures that a response message is actually the type expected by the
+original request.
+
+Fixed: 1358134
+Change-Id: I8f8f58168764477fbf7a6d2e8aeb040f07793d45
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3864274
+Reviewed-by: Robert Sesek <rsesek@chromium.org>
+Commit-Queue: Ken Rockot <rockot@google.com>
+Cr-Commit-Position: refs/heads/main@{#1041553}
+
+diff --git a/mojo/public/cpp/bindings/interface_endpoint_client.h b/mojo/public/cpp/bindings/interface_endpoint_client.h
+index 01cba995429b0accc21986aba0e3de17d013ee95..d3a1ab3a13a6662239ec28f99e5865afa54356b3 100644
+--- a/mojo/public/cpp/bindings/interface_endpoint_client.h
++++ b/mojo/public/cpp/bindings/interface_endpoint_client.h
+@@ -222,20 +222,32 @@ class COMPONENT_EXPORT(MOJO_CPP_BINDINGS) InterfaceEndpointClient
+   void ForgetAsyncRequest(uint64_t request_id);
+ 
+  private:
+-  // Maps from the id of a response to the MessageReceiver that handles the
+-  // response.
+-  using AsyncResponderMap =
+-      std::map<uint64_t, std::unique_ptr<MessageReceiver>>;
++  struct PendingAsyncResponse {
++   public:
++    PendingAsyncResponse(uint32_t request_message_name,
++                         std::unique_ptr<MessageReceiver> responder);
++    PendingAsyncResponse(PendingAsyncResponse&&);
++    PendingAsyncResponse(const PendingAsyncResponse&) = delete;
++    PendingAsyncResponse& operator=(PendingAsyncResponse&&);
++    PendingAsyncResponse& operator=(const PendingAsyncResponse&) = delete;
++    ~PendingAsyncResponse();
++
++    uint32_t request_message_name;
++    std::unique_ptr<MessageReceiver> responder;
++  };
++
++  using AsyncResponderMap = std::map<uint64_t, PendingAsyncResponse>;
+ 
+   struct SyncResponseInfo {
+    public:
+-    explicit SyncResponseInfo(bool* in_response_received);
++    SyncResponseInfo(uint32_t request_message_name, bool* in_response_received);
+ 
+     SyncResponseInfo(const SyncResponseInfo&) = delete;
+     SyncResponseInfo& operator=(const SyncResponseInfo&) = delete;
+ 
+     ~SyncResponseInfo();
+ 
++    uint32_t request_message_name;
+     Message response;
+ 
+     // Points to a stack-allocated variable.
+diff --git a/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc b/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc
+index b9db8f31a42b956c6125852cf162dc524d5308e6..6e87db197c603d8ac44b591f2cd70023217dcbe2 100644
+--- a/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc
++++ b/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc
+@@ -28,6 +28,7 @@
+ #include "mojo/public/cpp/bindings/sync_call_restrictions.h"
+ #include "mojo/public/cpp/bindings/sync_event_watcher.h"
+ #include "mojo/public/cpp/bindings/thread_safe_proxy.h"
++#include "third_party/abseil-cpp/absl/types/optional.h"
+ #include "third_party/perfetto/protos/perfetto/trace/track_event/chrome_mojo_event_info.pbzero.h"
+ 
+ namespace mojo {
+@@ -314,9 +315,27 @@ class ResponderThunk : public MessageReceiverWithStatus {
+ 
+ // ----------------------------------------------------------------------------
+ 
++InterfaceEndpointClient::PendingAsyncResponse::PendingAsyncResponse(
++    uint32_t request_message_name,
++    std::unique_ptr<MessageReceiver> responder)
++    : request_message_name(request_message_name),
++      responder(std::move(responder)) {}
++
++InterfaceEndpointClient::PendingAsyncResponse::PendingAsyncResponse(
++    PendingAsyncResponse&&) = default;
++
++InterfaceEndpointClient::PendingAsyncResponse&
++InterfaceEndpointClient::PendingAsyncResponse::operator=(
++    PendingAsyncResponse&&) = default;
++
++InterfaceEndpointClient::PendingAsyncResponse::~PendingAsyncResponse() =
++    default;
++
+ InterfaceEndpointClient::SyncResponseInfo::SyncResponseInfo(
++    uint32_t request_message_name,
+     bool* in_response_received)
+-    : response_received(in_response_received) {}
++    : request_message_name(request_message_name),
++      response_received(in_response_received) {}
+ 
+ InterfaceEndpointClient::SyncResponseInfo::~SyncResponseInfo() {}
+ 
+@@ -604,6 +623,7 @@ bool InterfaceEndpointClient::SendMessageWithResponder(
+   // message before calling |SendMessage()| below.
+ #endif
+ 
++  const uint32_t message_name = message->name();
+   const bool is_sync = message->has_flag(Message::kFlagIsSync);
+   const bool exclusive_wait = message->has_flag(Message::kFlagNoInterrupt);
+   if (!controller_->SendMessage(message))
+@@ -620,7 +640,8 @@ bool InterfaceEndpointClient::SendMessageWithResponder(
+       controller_->RegisterExternalSyncWaiter(request_id);
+     }
+     base::AutoLock lock(async_responders_lock_);
+-    async_responders_[request_id] = std::move(responder);
++    async_responders_.emplace(
++        request_id, PendingAsyncResponse{message_name, std::move(responder)});
+     return true;
+   }
+ 
+@@ -628,7 +649,8 @@ bool InterfaceEndpointClient::SendMessageWithResponder(
+ 
+   bool response_received = false;
+   sync_responses_.insert(std::make_pair(
+-      request_id, std::make_unique<SyncResponseInfo>(&response_received)));
++      request_id,
++      std::make_unique<SyncResponseInfo>(message_name, &response_received)));
+ 
+   base::WeakPtr<InterfaceEndpointClient> weak_self =
+       weak_ptr_factory_.GetWeakPtr();
+@@ -806,13 +828,13 @@ void InterfaceEndpointClient::ResetFromAnotherSequenceUnsafe() {
+ }
+ 
+ void InterfaceEndpointClient::ForgetAsyncRequest(uint64_t request_id) {
+-  std::unique_ptr<MessageReceiver> responder;
++  absl::optional<PendingAsyncResponse> response;
+   {
+     base::AutoLock lock(async_responders_lock_);
+     auto it = async_responders_.find(request_id);
+     if (it == async_responders_.end())
+       return;
+-    responder = std::move(it->second);
++    response = std::move(it->second);
+     async_responders_.erase(it);
+   }
+ }
+@@ -893,6 +915,10 @@ bool InterfaceEndpointClient::HandleValidatedMessage(Message* message) {
+         return false;
+ 
+       if (it->second) {
++        if (message->name() != it->second->request_message_name) {
++          return false;
++        }
++
+         it->second->response = std::move(*message);
+         *it->second->response_received = true;
+         return true;
+@@ -903,18 +929,22 @@ bool InterfaceEndpointClient::HandleValidatedMessage(Message* message) {
+       sync_responses_.erase(it);
+     }
+ 
+-    std::unique_ptr<MessageReceiver> responder;
++    absl::optional<PendingAsyncResponse> pending_response;
+     {
+       base::AutoLock lock(async_responders_lock_);
+       auto it = async_responders_.find(request_id);
+       if (it == async_responders_.end())
+         return false;
+-      responder = std::move(it->second);
++      pending_response = std::move(it->second);
+       async_responders_.erase(it);
+     }
+ 
++    if (message->name() != pending_response->request_message_name) {
++      return false;
++    }
++
+     internal::MessageDispatchContext dispatch_context(message);
+-    return responder->Accept(message);
++    return pending_response->responder->Accept(message);
+   } else {
+     if (mojo::internal::ControlMessageHandler::IsControlMessage(message))
+       return control_message_handler_.Accept(message);

patches/chromium/cherry-pick-9bebe8549a36.patch

@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xiaocheng Hu <xiaochengh@chromium.org>
+Date: Wed, 28 Sep 2022 19:09:02 +0000
+Subject: Ensure iterator validity in CustomElementRegistry::DefineInternal()
+
+Currently, this function first resolves a promise, and then erases an
+iterator from a hash map, but the promise resolving may run synchronous
+JavaScript that invalidates the iterator.
+
+This patch switches the ordering so that we always use the iterator when
+it's valid.
+
+(cherry picked from commit ed87ab54b29898a96a87e8fd497425db32539350)
+
+(cherry picked from commit b0bfc4334369bd1d44bc6507dfefc012afb7e12d)
+
+Fixed: 1366813
+Change-Id: Iaa6631db5f3ad47049f46ddf909f18a49e5880c0
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3915346
+Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
+Reviewed-by: Joey Arhar <jarhar@chromium.org>
+Cr-Original-Original-Commit-Position: refs/heads/main@{#1050816}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3922738
+Commit-Queue: Joey Arhar <jarhar@chromium.org>
+Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org>
+Cr-Original-Commit-Position: refs/branch-heads/5304@{#203}
+Cr-Original-Branched-From: 5d7b1fc9cb7103d9c82eed647cf4be38cf09738b-refs/heads/main@{#1047731}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3924290
+Cr-Commit-Position: refs/branch-heads/5249@{#686}
+Cr-Branched-From: 4f7bea5de862aaa52e6bde5920755a9ef9db120b-refs/heads/main@{#1036826}
+
+diff --git a/third_party/blink/renderer/core/html/custom/custom_element_registry.cc b/third_party/blink/renderer/core/html/custom/custom_element_registry.cc
+index 5a63b6f0fd74d8c836c805e4d03e7be0b0205f15..6e37fba2cd627d69e602381e79f64c8ba72128b6 100644
+--- a/third_party/blink/renderer/core/html/custom/custom_element_registry.cc
++++ b/third_party/blink/renderer/core/html/custom/custom_element_registry.cc
+@@ -217,8 +217,11 @@ CustomElementDefinition* CustomElementRegistry::DefineInternal(
+   // 16: when-defined promise processing
+   const auto& entry = when_defined_promise_map_.find(name);
+   if (entry != when_defined_promise_map_.end()) {
+-    entry->value->Resolve();
++    ScriptPromiseResolver* resolver = entry->value;
+     when_defined_promise_map_.erase(entry);
++    // Resolve() may run synchronous JavaScript that invalidates iterators of
++    // |when_defined_promise_map_|, so it must be called after erasing |entry|.
++    resolver->Resolve();
+   }
+ 
+   return definition;
+diff --git a/third_party/blink/web_tests/external/wpt/custom-elements/when-defined-reentry-crash.html b/third_party/blink/web_tests/external/wpt/custom-elements/when-defined-reentry-crash.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..38614cbbd7836a955c40ea64165a22bcb44f7e63
+--- /dev/null
++++ b/third_party/blink/web_tests/external/wpt/custom-elements/when-defined-reentry-crash.html
+@@ -0,0 +1,25 @@
++<!DOCTYPE html>
++<meta charset="utf-8">
++<title>Check for crashes when a whenDefined promise resolving re-entries</title>
++<meta name="author" href="mailto:xiaochengh@chromium.org">
++<link rel="help" href="https://html.spec.whatwg.org/multipage/custom-elements.html#custom-elements-api">
++<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1366813">
++<script>
++class CustomElement extends HTMLElement {}
++
++Object.prototype.__defineGetter__("then", main);
++
++let depth = 0;
++function main() {
++  if (depth > 1) return;
++  ++depth;
++  customElements.whenDefined("custom-a"); // Causes re-entry of main()
++  try { customElements.define("custom-a", CustomElement) } catch (e) {}
++  customElements.whenDefined("custom-b");
++  --depth;
++}
++
++main();
++</script>
++
++Test passes if it does not crash.

patches/chromium/cherry-pick-bd9724c9fe63.patch

@@ -0,0 +1,203 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Min Qin <qinmin@chromium.org>
+Date: Tue, 28 Jun 2022 16:27:43 +0000
+Subject: passing update_first_party_url_on_redirect=false for fetch
+
+Background fetch doesn't work like regular download as it is not
+considered a top frame navigation. This CL let background fetch to
+pass update_first_party_url_on_redirect=false to DownloadURLParameters,
+and handle it properly w.r.t samesite cookies.
+
+BUG=1268580
+
+(cherry picked from commit bf1e93c6af21dad12088b615feda07a90a85c158)
+
+Change-Id: I3a1cc33be8578d5d8c796dbbb21fa35a47bdda36
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3712307
+Reviewed-by: Rayan Kanso <rayankans@chromium.org>
+Commit-Queue: Min Qin <qinmin@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1016316}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3727786
+Cr-Commit-Position: refs/branch-heads/5112@{#397}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/components/background_fetch/background_fetch_delegate_base.cc b/components/background_fetch/background_fetch_delegate_base.cc
+index 5f88192eb4e92d4c41c79db188b8b9982f005258..26f7716ae83b70cdcf7cdb23652c2c56d7dc27bf 100644
+--- a/components/background_fetch/background_fetch_delegate_base.cc
++++ b/components/background_fetch/background_fetch_delegate_base.cc
+@@ -101,6 +101,7 @@ void BackgroundFetchDelegateBase::DownloadUrl(
+                           weak_ptr_factory_.GetWeakPtr());
+   params.traffic_annotation =
+       net::MutableNetworkTrafficAnnotationTag(traffic_annotation);
++  params.request_params.update_first_party_url_on_redirect = false;
+ 
+   JobDetails* job_details = GetJobDetails(job_id);
+   if (job_details->job_state == JobDetails::State::kPendingWillStartPaused ||
+diff --git a/components/download/content/internal/download_driver_impl.cc b/components/download/content/internal/download_driver_impl.cc
+index 2b2da55b06e3b4859f439d5b3bf7013b981b75a0..b207ce5c6bd3c332a34885e1dc58cc11d91fe31c 100644
+--- a/components/download/content/internal/download_driver_impl.cc
++++ b/components/download/content/internal/download_driver_impl.cc
+@@ -229,6 +229,8 @@ void DownloadDriverImpl::Start(
+     download_url_params->set_isolation_info(
+         request_params.isolation_info.value());
+   }
++  download_url_params->set_update_first_party_url_on_redirect(
++      request_params.update_first_party_url_on_redirect);
+ 
+   download_manager_coordinator_->DownloadUrl(std::move(download_url_params));
+ }
+diff --git a/components/download/internal/common/download_utils.cc b/components/download/internal/common/download_utils.cc
+index 11f524861320eae8ab694022d97a6fe2ac7366ce..454326720b5c88cc61e4527790797fd7f522014d 100644
+--- a/components/download/internal/common/download_utils.cc
++++ b/components/download/internal/common/download_utils.cc
+@@ -386,8 +386,10 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
+     // cross-site URL has been visited before.
+     url::Origin origin = url::Origin::Create(params->url());
+     request->trusted_params->isolation_info = net::IsolationInfo::Create(
+-        net::IsolationInfo::RequestType::kMainFrame, origin, origin,
+-        net::SiteForCookies::FromOrigin(origin));
++        params->update_first_party_url_on_redirect()
++            ? net::IsolationInfo::RequestType::kMainFrame
++            : net::IsolationInfo::RequestType::kOther,
++        origin, origin, net::SiteForCookies::FromOrigin(origin));
+     request->site_for_cookies = net::SiteForCookies::FromUrl(params->url());
+   }
+ 
+@@ -395,7 +397,8 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
+   request->referrer = params->referrer();
+   request->referrer_policy = params->referrer_policy();
+   request->is_outermost_main_frame = true;
+-  request->update_first_party_url_on_redirect = true;
++  request->update_first_party_url_on_redirect =
++      params->update_first_party_url_on_redirect();
+ 
+   // Downloads should be treated as navigations from Fetch spec perspective.
+   // See also:
+diff --git a/components/download/public/background_service/download_params.h b/components/download/public/background_service/download_params.h
+index 8b911276e757ee889ed05a3fd60cc365ad8f1982..a976d470094462be735e81cf097f32b34c258270 100644
+--- a/components/download/public/background_service/download_params.h
++++ b/components/download/public/background_service/download_params.h
+@@ -126,6 +126,12 @@ struct RequestParams {
+   // be invalidate during download resumption in new browser session. Not
+   // supported on iOS.
+   absl::optional<net::IsolationInfo> isolation_info;
++
++  // First-party URL redirect policy: During server redirects, whether the
++  // first-party URL for cookies will need to be changed. Download is normally
++  // considered a main frame navigation. However, this is not true for
++  // background fetch.
++  bool update_first_party_url_on_redirect = true;
+ };
+ 
+ // The parameters that describe a download request made to the DownloadService.
+diff --git a/components/download/public/common/download_url_parameters.cc b/components/download/public/common/download_url_parameters.cc
+index 3dec7148d86cd3892670df8b95dcb78d49616e89..25ea6f13e0df9f23364b75c48b870d8ea6a53e92 100644
+--- a/components/download/public/common/download_url_parameters.cc
++++ b/components/download/public/common/download_url_parameters.cc
+@@ -34,7 +34,8 @@ DownloadUrlParameters::DownloadUrlParameters(
+       traffic_annotation_(traffic_annotation),
+       download_source_(DownloadSource::UNKNOWN),
+       require_safety_checks_(true),
+-      has_user_gesture_(false) {}
++      has_user_gesture_(false),
++      update_first_party_url_on_redirect_(true) {}
+ 
+ DownloadUrlParameters::~DownloadUrlParameters() = default;
+ 
+diff --git a/components/download/public/common/download_url_parameters.h b/components/download/public/common/download_url_parameters.h
+index ba0a03cb035a79651967ac2882f89f577bd0c012..61eb9af8a00c3e4adf700178994a9e6e864bcf0c 100644
+--- a/components/download/public/common/download_url_parameters.h
++++ b/components/download/public/common/download_url_parameters.h
+@@ -279,6 +279,11 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+     has_user_gesture_ = has_user_gesture;
+   }
+ 
++  void set_update_first_party_url_on_redirect(
++      bool update_first_party_url_on_redirect) {
++    update_first_party_url_on_redirect_ = update_first_party_url_on_redirect;
++  }
++
+   OnStartedCallback& callback() { return callback_; }
+   bool content_initiated() const { return content_initiated_; }
+   const std::string& last_modified() const { return last_modified_; }
+@@ -335,6 +340,9 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+     return isolation_info_;
+   }
+   bool has_user_gesture() const { return has_user_gesture_; }
++  bool update_first_party_url_on_redirect() const {
++    return update_first_party_url_on_redirect_;
++  }
+ 
+   // STATE CHANGING: All save_info_ sub-objects will be in an indeterminate
+   // state following this call.
+@@ -383,6 +391,7 @@ class COMPONENTS_DOWNLOAD_EXPORT DownloadUrlParameters {
+   bool require_safety_checks_;
+   absl::optional<net::IsolationInfo> isolation_info_;
+   bool has_user_gesture_;
++  bool update_first_party_url_on_redirect_;
+ };
+ 
+ }  // namespace download
+diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
+index 6dcc861171b7034d7426c5c683cafca689e3d7ea..500521ce2c383d40c13a9359ba4c49d3417670f7 100644
+--- a/content/browser/download/download_browsertest.cc
++++ b/content/browser/download/download_browsertest.cc
+@@ -3763,6 +3763,58 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, UpdateSiteForCookies) {
+                                 site_a.GetURL("a.test", "/")));
+ }
+ 
++// Tests that if `update_first_party_url_on_redirect` is set to false, download
++// will not behave like a top-level frame navigation and SameSite=Strict cookies
++// will not be set on a redirection.
++IN_PROC_BROWSER_TEST_F(
++    DownloadContentTest,
++    SiteForCookies_DownloadUrl_NotUpdateFirstPartyUrlOnRedirect) {
++  net::EmbeddedTestServer site_a;
++  net::EmbeddedTestServer site_b;
++
++  base::StringPairs cookie_headers;
++  cookie_headers.push_back(std::make_pair(
++      std::string("Set-Cookie"), std::string("A=strict; SameSite=Strict")));
++  cookie_headers.push_back(std::make_pair(std::string("Set-Cookie"),
++                                          std::string("B=lax; SameSite=Lax")));
++
++  // This will request a URL on b.test, which redirects to a url that sets the
++  // cookies on a.test.
++  site_a.RegisterRequestHandler(CreateBasicResponseHandler(
++      "/sets-samesite-cookies", net::HTTP_OK, cookie_headers,
++      "application/octet-stream", "abcd"));
++  ASSERT_TRUE(site_a.Start());
++  site_b.RegisterRequestHandler(
++      CreateRedirectHandler("/redirected-download",
++                            site_a.GetURL("a.test", "/sets-samesite-cookies")));
++  ASSERT_TRUE(site_b.Start());
++
++  // Download the file.
++  SetupEnsureNoPendingDownloads();
++  std::unique_ptr<download::DownloadUrlParameters> download_parameters(
++      DownloadRequestUtils::CreateDownloadForWebContentsMainFrame(
++          shell()->web_contents(),
++          site_b.GetURL("b.test", "/redirected-download"),
++          TRAFFIC_ANNOTATION_FOR_TESTS));
++  download_parameters->set_update_first_party_url_on_redirect(false);
++  std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
++  DownloadManagerForShell(shell())->DownloadUrl(std::move(download_parameters));
++  observer->WaitForFinished();
++
++  // Get the important info from other threads and check it.
++  EXPECT_TRUE(EnsureNoPendingDownloads());
++
++  std::vector<download::DownloadItem*> downloads;
++  DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
++  ASSERT_EQ(1u, downloads.size());
++  ASSERT_EQ(download::DownloadItem::COMPLETE, downloads[0]->GetState());
++
++  // Check that the cookies were not set on a.test.
++  EXPECT_EQ("",
++            content::GetCookies(shell()->web_contents()->GetBrowserContext(),
++                                site_a.GetURL("a.test", "/")));
++}
++
+ // Verifies that isolation info set in DownloadUrlParameters can be populated.
+ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
+                        SiteForCookies_DownloadUrl_IsolationInfoPopulated) {

patches/chromium/cherry-pick-c643d18a078d.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Rayan Kanso <rayankans@google.com>
+Date: Tue, 7 Jun 2022 13:13:36 +0000
+Subject: Don't expose URL chain in case of CO redirect
+
+Bug: 1278255
+Change-Id: If853327b853e29792e5c8d1dfaeecf21d6fec004
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3693143
+Reviewed-by: Susanne Westphal <swestphal@google.com>
+Commit-Queue: Rayan Kanso <rayankans@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1011409}
+
+diff --git a/content/browser/background_fetch/storage/mark_request_complete_task.cc b/content/browser/background_fetch/storage/mark_request_complete_task.cc
+index 32a818ba8723f020fa536eb93a31c16b76ed92a1..d729dfc5d505c4c23872ef535a8b09f1af065914 100644
+--- a/content/browser/background_fetch/storage/mark_request_complete_task.cc
++++ b/content/browser/background_fetch/storage/mark_request_complete_task.cc
+@@ -104,6 +104,8 @@ void MarkRequestCompleteTask::StoreResponse(base::OnceClosure done_closure) {
+   BackgroundFetchCrossOriginFilter filter(
+       registration_id_.storage_key().origin(), *request_info_);
+   if (!filter.CanPopulateBody()) {
++    // Don't expose the initial URL in case of cross-origin redirects.
++    response_->url_list.resize(1);
+     failure_reason_ = proto::BackgroundFetchRegistration::FETCH_ERROR;
+     // No point writing the response to the cache since it won't be exposed.
+     CreateAndStoreCompletedRequest(std::move(done_closure));

patches/chromium/cherry-pick-eb4d31309df7.patch

@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Zager <szager@chromium.org>
+Date: Fri, 9 Sep 2022 01:56:46 +0000
+Subject: Fix for reference to invalid iterator
+
+Evidently, LocalFrameView::layout_subtree_root_list_ can be modified
+during LayoutFromRootObject, leaving the loop variable in an invalid
+state. I don't know the exact sequence, but the test case crashes for
+me without this patch, and doesn't crash with the patch.
+
+(cherry picked from commit 815aa5ca03ab4ecc619b2d2ad7650531bd3892a8)
+
+Bug: 1355237
+Change-Id: Ib17b1fac5b2ec060eda39be76305db18075802fa
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3864877
+Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
+Commit-Queue: Stefan Zager <szager@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1041903}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3884238
+Owners-Override: Srinivas Sista <srinivassista@chromium.org>
+Auto-Submit: Srinivas Sista <srinivassista@chromium.org>
+Reviewed-by: Stefan Zager <szager@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5112@{#1566}
+Cr-Branched-From: b13d3fe7b3c47a56354ef54b221008afa754412e-refs/heads/main@{#1012729}
+
+diff --git a/third_party/blink/renderer/core/frame/local_frame_view.cc b/third_party/blink/renderer/core/frame/local_frame_view.cc
+index 8a9dabd602b54b4801406bffb26723b4105c5fdc..82963b7edb85da99f4bbf345b22e70d50ac1573c 100644
+--- a/third_party/blink/renderer/core/frame/local_frame_view.cc
++++ b/third_party/blink/renderer/core/frame/local_frame_view.cc
+@@ -821,6 +821,7 @@ void LocalFrameView::PerformLayout() {
+       }
+       for (auto& root : layout_subtree_root_list_.Ordered()) {
+         bool should_rebuild_fragments = false;
++        LayoutObject& root_layout_object = *root;
+         LayoutBlock* cb = root->ContainingNGBlock();
+         if (cb) {
+           auto it = fragment_tree_spines.find(cb);
+@@ -840,7 +841,7 @@ void LocalFrameView::PerformLayout() {
+         // We need to ensure that we mark up all layoutObjects up to the
+         // LayoutView for paint invalidation. This simplifies our code as we
+         // just always do a full tree walk.
+-        if (LayoutObject* container = root->Container())
++        if (LayoutObject* container = root_layout_object.Container())
+           container->SetShouldCheckForPaintInvalidation();
+       }
+       layout_subtree_root_list_.Clear();

patches/chromium/cherry-pick-fefd6198da31.patch

@@ -0,0 +1,305 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ben Wagner <benjaminwagner@google.com>
+Date: Tue, 20 Sep 2022 18:38:53 +0000
+Subject: Fix races in FrameQueueUnderlyingSource related to
+ CrossThreadPersistent
+
+The repro in bug 1323488 unfortunately does not reliably reproduce
+the races when run as a web test. I was also not able to repro the
+races in a unit test.
+
+There are actually three fixes in this CL; it was easiest to fix them
+all together so that I can run the repro locally for an extended period
+without it being stopped by a crash.
+
+The underlying cause for all three races is that CrossThreadPersistent
+can refer to an object whose heap has already been destroyed. When
+accessed on the thread corresponding to that heap, there is no race,
+but when accessed from a different thread, there is a period of time
+after the heap is destroyed before the CrossThreadPersistent is
+cleared.
+
+1. The FrameQueueUnderlyingSource::transferred_source_ member's pointer
+   is accessed in FrameQueueUnderlyingSource::Close. This CL adds a
+   callback to clear the pointer in
+   TransferredFrameQueueUnderlyingSource::ContextDestroyed.
+
+2. The TransferredFrameQueueUnderlyingSource constructor takes a raw
+   pointer to the original FrameQueueUnderlyingSource, which is
+   associated with a different thread. GC won't be able to update this
+   raw pointer since it's on the wrong stack. This CL changes the raw
+   pointer to a CrossThreadPersistent which is visible to GC.
+
+3. Same as 2, but for the callstack ConnectHostCallback,
+   MediaStream(Audio|Video)TrackUnderlyingSource::OnSourceTransferStarted
+   and FrameQueueUnderlyingSource::TransferSource.
+
+(cherry picked from commit 63ce9c40e1a67395278dfc70ecfb545a818747bb)
+
+Bug: 1323488
+Change-Id: Id63484eebefd2e003959b25bd752ac8263caab4f
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3865452
+Commit-Queue: Ben Wagner <benjaminwagner@google.com>
+Reviewed-by: Thomas Guilbert <tguilbert@chromium.org>
+Auto-Submit: Ben Wagner <benjaminwagner@google.com>
+Cr-Original-Commit-Position: refs/heads/main@{#1041434}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3908010
+Commit-Queue: Srinivas Sista <srinivassista@chromium.org>
+Reviewed-by: Srinivas Sista <srinivassista@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5249@{#521}
+Cr-Branched-From: 4f7bea5de862aaa52e6bde5920755a9ef9db120b-refs/heads/main@{#1036826}
+
+diff --git a/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.cc b/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.cc
+index 2cc89e8cd32421bf80b262bac2e4a7cb685db62f..ab41fa086ad9eb8c1cd66db74ea1f05a66ac56a4 100644
+--- a/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.cc
++++ b/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.cc
+@@ -19,10 +19,13 @@ FrameQueueTransferringOptimizer<NativeFrameType>::
+         FrameQueueHost* host,
+         scoped_refptr<base::SequencedTaskRunner> host_runner,
+         wtf_size_t max_queue_size,
+-        ConnectHostCallback connect_host_callback)
++        ConnectHostCallback connect_host_callback,
++        CrossThreadOnceClosure transferred_source_destroyed_callback)
+     : host_(host),
+       host_runner_(std::move(host_runner)),
+       connect_host_callback_(std::move(connect_host_callback)),
++      transferred_source_destroyed_callback_(
++          std::move(transferred_source_destroyed_callback)),
+       max_queue_size_(max_queue_size) {}
+ 
+ template <typename NativeFrameType>
+@@ -40,7 +43,8 @@ FrameQueueTransferringOptimizer<NativeFrameType>::PerformInProcessOptimization(
+ 
+   auto* source = MakeGarbageCollected<
+       TransferredFrameQueueUnderlyingSource<NativeFrameType>>(
+-      script_state, host, host_runner_);
++      script_state, host, host_runner_,
++      std::move(transferred_source_destroyed_callback_));
+ 
+   PostCrossThreadTask(
+       *host_runner_, FROM_HERE,
+diff --git a/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.h b/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.h
+index 6d33945b7c840e55ae73a1efd1f1cf33ccfaaa71..336073235ba7f6c05cf2cf19fccbfac0be9597c9 100644
+--- a/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.h
++++ b/third_party/blink/renderer/modules/breakout_box/frame_queue_transferring_optimizer.h
+@@ -25,13 +25,15 @@ class FrameQueueTransferringOptimizer final
+ 
+   using ConnectHostCallback = CrossThreadOnceFunction<void(
+       scoped_refptr<base::SequencedTaskRunner>,
+-      TransferredFrameQueueUnderlyingSource<NativeFrameType>*)>;
++      CrossThreadPersistent<
++          TransferredFrameQueueUnderlyingSource<NativeFrameType>>)>;
+ 
+   FrameQueueTransferringOptimizer(
+       FrameQueueHost*,
+       scoped_refptr<base::SequencedTaskRunner> host_runner,
+       wtf_size_t max_queue_size,
+-      ConnectHostCallback callback);
++      ConnectHostCallback connect_host_callback,
++      CrossThreadOnceFunction<void()> transferred_source_destroyed_callback);
+   ~FrameQueueTransferringOptimizer() override = default;
+ 
+   UnderlyingSourceBase* PerformInProcessOptimization(
+@@ -41,6 +43,7 @@ class FrameQueueTransferringOptimizer final
+   CrossThreadWeakPersistent<FrameQueueHost> host_;
+   scoped_refptr<base::SequencedTaskRunner> host_runner_;
+   ConnectHostCallback connect_host_callback_;
++  CrossThreadOnceFunction<void()> transferred_source_destroyed_callback_;
+   wtf_size_t max_queue_size_;
+ };
+ 
+diff --git a/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.cc b/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.cc
+index b93b67f131e1e58118e32d2c9b29e472a28d4664..fcd676b3035e19c6e0b28ee1c44109c6737a1c35 100644
+--- a/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.cc
++++ b/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.cc
+@@ -266,15 +266,22 @@ double FrameQueueUnderlyingSource<NativeFrameType>::DesiredSizeForTesting()
+ 
+ template <typename NativeFrameType>
+ void FrameQueueUnderlyingSource<NativeFrameType>::TransferSource(
+-    FrameQueueUnderlyingSource<NativeFrameType>* transferred_source) {
++    CrossThreadPersistent<FrameQueueUnderlyingSource<NativeFrameType>>
++        transferred_source) {
+   DCHECK(realm_task_runner_->RunsTasksInCurrentSequence());
+   MutexLocker locker(mutex_);
+   DCHECK(!transferred_source_);
+-  transferred_source_ = transferred_source;
++  transferred_source_ = std::move(transferred_source);
+   CloseController();
+   frame_queue_handle_.Invalidate();
+ }
+ 
++template <typename NativeFrameType>
++void FrameQueueUnderlyingSource<NativeFrameType>::ClearTransferredSource() {
++  MutexLocker locker(mutex_);
++  transferred_source_.Clear();
++}
++
+ template <typename NativeFrameType>
+ void FrameQueueUnderlyingSource<NativeFrameType>::CloseController() {
+   DCHECK(realm_task_runner_->RunsTasksInCurrentSequence());
+diff --git a/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.h b/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.h
+index a5d529a4231a8951e95adb6804ea45d82ccb4673..f7457b15002b244490b286f596e6e227d940ca52 100644
+--- a/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.h
++++ b/third_party/blink/renderer/modules/breakout_box/frame_queue_underlying_source.h
+@@ -84,7 +84,13 @@ class FrameQueueUnderlyingSource
+   // QueueFrame(). |transferred_source| will pull frames from the same circular
+   // queue. Must be called on |realm_task_runner_|.
+   void TransferSource(
+-      FrameQueueUnderlyingSource<NativeFrameType>* transferred_source);
++      CrossThreadPersistent<FrameQueueUnderlyingSource<NativeFrameType>>
++          transferred_source);
++
++  // Due to a potential race condition between |transferred_source_|'s heap
++  // being destroyed and the Close() method being called, we need to explicitly
++  // clear |transferred_source_| when its context is being destroyed.
++  void ClearTransferredSource();
+ 
+  protected:
+   bool MustUseMonitor() const;
+diff --git a/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.cc b/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.cc
+index bfc966452e4134e5133d559698497ce82f89aad4..da9a4bffc3a8c9ec5a1595a7cd78110bfadbfb5e 100644
+--- a/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.cc
++++ b/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.cc
+@@ -93,14 +93,17 @@ MediaStreamAudioTrackUnderlyingSource::GetTransferringOptimizer() {
+       this, GetRealmRunner(), MaxQueueSize(),
+       CrossThreadBindOnce(
+           &MediaStreamAudioTrackUnderlyingSource::OnSourceTransferStarted,
++          WrapCrossThreadWeakPersistent(this)),
++      CrossThreadBindOnce(
++          &MediaStreamAudioTrackUnderlyingSource::ClearTransferredSource,
+           WrapCrossThreadWeakPersistent(this)));
+ }
+ 
+ void MediaStreamAudioTrackUnderlyingSource::OnSourceTransferStarted(
+     scoped_refptr<base::SequencedTaskRunner> transferred_runner,
+-    TransferredAudioDataQueueUnderlyingSource* source) {
++    CrossThreadPersistent<TransferredAudioDataQueueUnderlyingSource> source) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  TransferSource(source);
++  TransferSource(std::move(source));
+   RecordBreakoutBoxUsage(BreakoutBoxUsage::kReadableAudioWorker);
+ }
+ 
+diff --git a/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.h b/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.h
+index 19a290ea6b83e4b56b8d96cb7632fca55bd65fd0..73c16dc5ff3855e258e1e70397def478485f1481 100644
+--- a/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.h
++++ b/third_party/blink/renderer/modules/breakout_box/media_stream_audio_track_underlying_source.h
+@@ -56,7 +56,7 @@ class MODULES_EXPORT MediaStreamAudioTrackUnderlyingSource
+   void DisconnectFromTrack();
+   void OnSourceTransferStarted(
+       scoped_refptr<base::SequencedTaskRunner> transferred_runner,
+-      TransferredAudioDataQueueUnderlyingSource* source);
++      CrossThreadPersistent<TransferredAudioDataQueueUnderlyingSource> source);
+ 
+   // Only used to prevent the gargabe collector from reclaiming the media
+   // stream track processor that created |this|.
+diff --git a/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.cc b/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.cc
+index bcb941aca4e4d0729dc1253e01ef477fdaae1877..e748bf6eaf8f9d1acf8519c38a5a8cb53b031d0e 100644
+--- a/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.cc
++++ b/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.cc
+@@ -66,6 +66,9 @@ MediaStreamVideoTrackUnderlyingSource::GetStreamTransferOptimizer() {
+       this, GetRealmRunner(), MaxQueueSize(),
+       CrossThreadBindOnce(
+           &MediaStreamVideoTrackUnderlyingSource::OnSourceTransferStarted,
++          WrapCrossThreadWeakPersistent(this)),
++      CrossThreadBindOnce(
++          &MediaStreamVideoTrackUnderlyingSource::ClearTransferredSource,
+           WrapCrossThreadWeakPersistent(this)));
+ }
+ 
+@@ -76,9 +79,9 @@ MediaStreamVideoTrackUnderlyingSource::GetIOTaskRunner() {
+ 
+ void MediaStreamVideoTrackUnderlyingSource::OnSourceTransferStarted(
+     scoped_refptr<base::SequencedTaskRunner> transferred_runner,
+-    TransferredVideoFrameQueueUnderlyingSource* source) {
++    CrossThreadPersistent<TransferredVideoFrameQueueUnderlyingSource> source) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  TransferSource(source);
++  TransferSource(std::move(source));
+   RecordBreakoutBoxUsage(BreakoutBoxUsage::kReadableVideoWorker);
+ }
+ 
+diff --git a/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.h b/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.h
+index 1bbd4f6bbf20eaf168bf1319f1b35819dabe3cce..8964eb5eb83964c4bb2633092a12cb144da4e9b0 100644
+--- a/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.h
++++ b/third_party/blink/renderer/modules/breakout_box/media_stream_video_track_underlying_source.h
+@@ -59,8 +59,9 @@ class MODULES_EXPORT MediaStreamVideoTrackUnderlyingSource
+   bool StartFrameDelivery() override;
+   void StopFrameDelivery() override;
+ 
+-  void OnSourceTransferStarted(scoped_refptr<base::SequencedTaskRunner>,
+-                               TransferredVideoFrameQueueUnderlyingSource*);
++  void OnSourceTransferStarted(
++      scoped_refptr<base::SequencedTaskRunner>,
++      CrossThreadPersistent<TransferredVideoFrameQueueUnderlyingSource>);
+ 
+   void OnFrameFromTrack(
+       scoped_refptr<media::VideoFrame> media_frame,
+diff --git a/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.cc b/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.cc
+index 5c62b8f1b752c24f8b8d0048d646ea64dba0e49c..e38173482d455788861a1d831dd3422119d4d4d6 100644
+--- a/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.cc
++++ b/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.cc
+@@ -15,11 +15,14 @@ template <typename NativeFrameType>
+ TransferredFrameQueueUnderlyingSource<NativeFrameType>::
+     TransferredFrameQueueUnderlyingSource(
+         ScriptState* script_state,
+-        FrameQueueHost* host,
+-        scoped_refptr<base::SequencedTaskRunner> host_runner)
++        CrossThreadPersistent<FrameQueueHost> host,
++        scoped_refptr<base::SequencedTaskRunner> host_runner,
++        CrossThreadOnceClosure transferred_source_destroyed_callback)
+     : FrameQueueUnderlyingSource<NativeFrameType>(script_state, host),
+       host_runner_(host_runner),
+-      host_(host) {}
++      host_(std::move(host)),
++      transferred_source_destroyed_callback_(
++          std::move(transferred_source_destroyed_callback)) {}
+ 
+ template <typename NativeFrameType>
+ bool TransferredFrameQueueUnderlyingSource<
+@@ -44,6 +47,13 @@ void TransferredFrameQueueUnderlyingSource<
+                       CrossThreadBindOnce(&FrameQueueHost::Close, host_));
+ }
+ 
++template <typename NativeFrameType>
++void TransferredFrameQueueUnderlyingSource<
++    NativeFrameType>::ContextDestroyed() {
++  std::move(transferred_source_destroyed_callback_).Run();
++  FrameQueueUnderlyingSource<NativeFrameType>::ContextDestroyed();
++}
++
+ template <typename NativeFrameType>
+ void TransferredFrameQueueUnderlyingSource<NativeFrameType>::Trace(
+     Visitor* visitor) const {
+diff --git a/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.h b/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.h
+index 5f8a36719407a404756d672530c0b9fcff9d6924..7cd3270fbb3cf5b0e2c09b16000ea5c0e4247866 100644
+--- a/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.h
++++ b/third_party/blink/renderer/modules/breakout_box/transferred_frame_queue_underlying_source.h
+@@ -19,8 +19,9 @@ class TransferredFrameQueueUnderlyingSource
+ 
+   TransferredFrameQueueUnderlyingSource(
+       ScriptState*,
+-      FrameQueueHost*,
+-      scoped_refptr<base::SequencedTaskRunner> host_runner);
++      CrossThreadPersistent<FrameQueueHost>,
++      scoped_refptr<base::SequencedTaskRunner> host_runner,
++      CrossThreadOnceClosure transferred_source_destroyed_callback);
+   ~TransferredFrameQueueUnderlyingSource() override = default;
+ 
+   TransferredFrameQueueUnderlyingSource(
+@@ -32,11 +33,15 @@ class TransferredFrameQueueUnderlyingSource
+   bool StartFrameDelivery() override;
+   void StopFrameDelivery() override;
+ 
++  // ExecutionLifecycleObserver
++  void ContextDestroyed() override;
++
+   void Trace(Visitor*) const override;
+ 
+  private:
+   scoped_refptr<base::SequencedTaskRunner> host_runner_;
+   CrossThreadPersistent<FrameQueueHost> host_;
++  CrossThreadOnceClosure transferred_source_destroyed_callback_;
+ };
+ 
+ extern template class MODULES_EXTERN_TEMPLATE_EXPORT

patches/chromium/chore_add_electron_deps_to_gitignores.patch

@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Samuel Attard <sattard@salesforce.com>
+Date: Tue, 26 Jul 2022 00:05:29 -0700
+Subject: chore: add electron deps to gitignores
+
+Makes things like "git status" quicker when developing electron locally
+
+diff --git a/.gitignore b/.gitignore
+index cc0150c39bf635fa09d3efe9bfea2997b0b8263a..cdca4c4a9cccb7de0b13c8b803d6c74ba4d63d3a 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -224,6 +224,7 @@ vs-chromium-project.txt
+ /delegate_execute
+ /device/serial/device_serial_mojo.xml
+ /docs/website
++/electron
+ /google_apis/gcm/gcm.xml
+ /google_apis/internal
+ /googleurl
+diff --git a/third_party/.gitignore b/third_party/.gitignore
+index 567e1de3c31b2275e07b897c2644c91aef9ca076..a6744fa9d31781c6ee866ba6291588caf44e8559 100644
+--- a/third_party/.gitignore
++++ b/third_party/.gitignore
+@@ -83,6 +83,7 @@
+ /directxsdk
+ /dom_distiller_js/dist
+ /eigen3/src
++/electron_node
+ /elfutils/src
+ /emoji-segmenter/src
+ /emoji-metadata/src
+@@ -177,6 +178,7 @@
+ /mocha
+ /mockito/src
+ /nacl_sdk_binaries/
++/nan
+ /nasm
+ /nearby/src
+ /neon_2_sse/src
+@@ -239,6 +241,7 @@
+ /speex
+ /sqlite/src
+ /sqlite4java/lib/
++/squirrel.mac
+ /subresource-filter-ruleset/data/UnindexedRules
+ /swift-format
+ /swiftshader/

patches/chromium/chore_allow_chromium_to_handle_synthetic_mouse_events_for_touch.patch

@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: deepak1556 <hop2deep@gmail.com>
+Date: Fri, 29 Jul 2022 00:29:35 +0900
+Subject: chore: allow chromium to handle synthetic mouse events for touch
+
+With WCO, allow chromium to handle synthetic mouse events generated for touch
+actions in the non-client caption area.
+
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+index 9fd052c00a484cd1acd2031fda79e6307fd01b60..016dfe880a48168154c08839afa540880c2d52be 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+@@ -1169,6 +1169,10 @@ void DesktopWindowTreeHostWin::HandleWindowScaleFactorChanged(
+   }
+ }
+ 
++bool DesktopWindowTreeHostWin::HandleMouseEventForCaption(UINT message) const {
++  return false;
++}
++
+ DesktopNativeCursorManager*
+ DesktopWindowTreeHostWin::GetSingletonDesktopNativeCursorManager() {
+   return new DesktopNativeCursorManagerWin();
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+index 444581249014a8ce301591f269dbb194f0520732..9377f26b081b717db6b50c13ce3795907cf2fcd2 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+@@ -262,6 +262,7 @@ class VIEWS_EXPORT DesktopWindowTreeHostWin
+   void HandleWindowSizeChanging() override;
+   void HandleWindowSizeUnchanged() override;
+   void HandleWindowScaleFactorChanged(float window_scale_factor) override;
++  bool HandleMouseEventForCaption(UINT message) const override;
+ 
+   Widget* GetWidget();
+   const Widget* GetWidget() const;
+diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
+index 01ff95be00b3911749f66a136b2b5a6c02156bd3..23e8794c0551c377269ebecd6684206fc7087553 100644
+--- a/ui/views/win/hwnd_message_handler.cc
++++ b/ui/views/win/hwnd_message_handler.cc
+@@ -3064,15 +3064,19 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
+       SetMsgHandled(FALSE);
+     // We must let Windows handle the caption buttons if it's drawing them, or
+     // they won't work.
++    bool simulate_mouse_event_for_caption = false;
+     if (delegate_->GetFrameMode() == FrameMode::SYSTEM_DRAWN &&
+         (hittest == HTCLOSE || hittest == HTMINBUTTON ||
+          hittest == HTMAXBUTTON)) {
+-      SetMsgHandled(FALSE);
++      simulate_mouse_event_for_caption =
++          delegate_->HandleMouseEventForCaption(message);
++      if (!simulate_mouse_event_for_caption)
++        SetMsgHandled(FALSE);
+     }
+     // Let resize events fall through. Ignore everything else, as we're either
+     // letting Windows handle it above or we've already handled the equivalent
+     // touch message.
+-    if (!IsHitTestOnResizeHandle(hittest))
++    if (!IsHitTestOnResizeHandle(hittest) && !simulate_mouse_event_for_caption)
+       return 0;
+   }
+ 
+diff --git a/ui/views/win/hwnd_message_handler_delegate.h b/ui/views/win/hwnd_message_handler_delegate.h
+index 5dbb192d0840ca0ded61397c399b774a8cb05cce..098a9c3140e9e140fdc8f0dc9cf4e8ec84451221 100644
+--- a/ui/views/win/hwnd_message_handler_delegate.h
++++ b/ui/views/win/hwnd_message_handler_delegate.h
+@@ -258,6 +258,10 @@ class VIEWS_EXPORT HWNDMessageHandlerDelegate {
+   // Called when the window scale factor has changed.
+   virtual void HandleWindowScaleFactorChanged(float window_scale_factor) = 0;
+ 
++  // Called when synthetic mouse event is generated for touch event on
++  // caption buttons.
++  virtual bool HandleMouseEventForCaption(UINT message) const = 0;
++
+  protected:
+   virtual ~HWNDMessageHandlerDelegate() = default;
+ };

patches/chromium/disable_color_correct_rendering.patch

@@ -20,14 +20,15 @@ to deal with color spaces. That is being tracked at
 https://crbug.com/634542 and https://crbug.com/711107.
 
 diff --git a/cc/trees/layer_tree_host_impl.cc b/cc/trees/layer_tree_host_impl.cc
-index 14e13169de8b5e808e3284792237bef9939b1e00..7628a96dc8b2c9e8128cd462138d3487304c6e10 100644
+index 14e13169de8b5e808e3284792237bef9939b1e00..67839f87fb0dcb2eed9bc001806020befbed5f66 100644
 --- a/cc/trees/layer_tree_host_impl.cc
 +++ b/cc/trees/layer_tree_host_impl.cc
-@@ -1894,6 +1894,9 @@ void LayerTreeHostImpl::SetIsLikelyToRequireADraw(
+@@ -1894,6 +1894,10 @@ void LayerTreeHostImpl::SetIsLikelyToRequireADraw(
  TargetColorParams LayerTreeHostImpl::GetTargetColorParams(
      gfx::ContentColorUsage content_color_usage) const {
    TargetColorParams params;
 +  if (!settings_.enable_color_correct_rendering) {
++    params.color_space = gfx::ColorSpace();
 +    return params;
 +  }
  
@@ -259,8 +260,21 @@ index 09f72f1fbd7b782c5bf52245482b358103f0c243..80d9fd40efed1edc90e7bdf1db534acb
      switches::kDisableInProcessStackTraces,
      sandbox::policy::switches::kDisableSeccompFilterSandbox,
      sandbox::policy::switches::kNoSandbox,
+diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+index 396b2983f403b0684f952a5fbd2d0abf947328f0..35c44065ba8980c06bb35e64aa33cc5b3f290953 100644
+--- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
++++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+@@ -6194,7 +6194,7 @@ void WebGLRenderingContextBase::TexImageHelperImageBitmap(
+                                      : SkColorSpace::MakeSRGB();
+   const bool needs_color_conversion =
+       !SkColorSpace::Equals(unpack_color_space.get(), image_color_space.get());
+-  if (needs_color_conversion) {
++  if (needs_color_conversion && unpack_color_space) {
+     image = image->ConvertToColorSpace(unpack_color_space,
+                                        image->GetSkColorInfo().colorType());
+     if (!image) {
 diff --git a/third_party/blink/renderer/platform/graphics/canvas_color_params.cc b/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
-index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..0f87961ecd8c24e3ba82c6bae187a12c9b112bd4 100644
+index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..e42f8ba89070477b06777c7a0c37d30c8c5e4ed1 100644
 --- a/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
 +++ b/third_party/blink/renderer/platform/graphics/canvas_color_params.cc
 @@ -4,6 +4,7 @@
@@ -279,7 +293,18 @@ index 648f25d99884b99f49e26cd9f280a8a6ae63e1c7..0f87961ecd8c24e3ba82c6bae187a12c
  
  namespace blink {
  
-@@ -118,6 +120,11 @@ uint8_t CanvasColorParams::BytesPerPixel() const {
+@@ -19,6 +21,10 @@ namespace blink {
+ // Level 4 specification.
+ gfx::ColorSpace PredefinedColorSpaceToGfxColorSpace(
+     PredefinedColorSpace color_space) {
++  auto* cmd_line = base::CommandLine::ForCurrentProcess();
++  if (cmd_line->HasSwitch(switches::kDisableColorCorrectRendering)) {
++    return gfx::ColorSpace();
++  }
+   switch (color_space) {
+     case PredefinedColorSpace::kSRGB:
+       return gfx::ColorSpace::CreateSRGB();
+@@ -118,6 +124,11 @@ uint8_t CanvasColorParams::BytesPerPixel() const {
  }
  
  gfx::ColorSpace CanvasColorParams::GetStorageGfxColorSpace() const {

patches/chromium/disable_gpu_acceleration_on_vmware_on_linux.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Zhenyao Mo <zmo@chromium.org>
+Date: Mon, 23 May 2022 21:43:16 +0000
+Subject: Disable GPU acceleration on VMware on Linux
+
+TEST=manual
+R=sunnyps@chromium.org
+
+Bug: 1327939
+Change-Id: Ib09b6623665ffecf0af1f9f8bc3ebef1ac042b2f
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3661941
+Auto-Submit: Zhenyao Mo <zmo@chromium.org>
+Commit-Queue: Zhenyao Mo <zmo@chromium.org>
+Commit-Queue: Maggie Chen <magchen@chromium.org>
+Reviewed-by: Maggie Chen <magchen@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1006613}
+
+diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
+index 8ed8faf0a0733568a81d955a5546d864d24f78b5..73b6e998f753cee5d77e6bd5983ed46702f13580 100644
+--- a/gpu/config/software_rendering_list.json
++++ b/gpu/config/software_rendering_list.json
+@@ -1699,6 +1699,18 @@
+       "features": [
+         "accelerated_video_encode"
+       ]
++    },
++    {
++      "id": 176,
++      "description": "VMware is buggy on Linux",
++      "cr_bugs": [1327939],
++      "os": {
++        "type": "linux"
++      },
++      "vendor_id": "0x15ad",
++      "features": [
++        "all"
++      ]
+     }
+   ]
+ }

patches/chromium/dpwa_enable_window_controls_overlay_by_default.patch

@@ -0,0 +1,125 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hassan Talat <hatalat@microsoft.com>
+Date: Mon, 13 Jun 2022 21:27:53 +0000
+Subject: dpwa: Enable Window Controls Overlay by default
+
+This reverts commit d61c4042374672712176e43e33f39a1e66da4faa.
+I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/guI1QCPJTAA
+
+Bug: 937121
+Change-Id: I3dfebec2356c7a12fd7eab32f12ef8d9e4bf6ee6
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3430266
+Commit-Queue: Alex Russell <slightlyoff@chromium.org>
+Reviewed-by: Alex Russell <slightlyoff@chromium.org>
+Reviewed-by: Avi Drissman <avi@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1013665}
+
+diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
+index aa4a054fad59f57af17251a3ede7cd6c9806b4cb..ea32976ab88bdae7417b2e0ce25d6778369085ae 100644
+--- a/content/public/common/content_features.cc
++++ b/content/public/common/content_features.cc
+@@ -1045,7 +1045,7 @@ const base::Feature kV8VmFuture{"V8VmFuture",
+ 
+ // Enable window controls overlays for desktop PWAs
+ const base::Feature kWebAppWindowControlsOverlay{
+-    "WebAppWindowControlsOverlay", base::FEATURE_DISABLED_BY_DEFAULT};
++    "WebAppWindowControlsOverlay", base::FEATURE_ENABLED_BY_DEFAULT};
+ 
+ // Enable WebAssembly baseline compilation (Liftoff).
+ const base::Feature kWebAssemblyBaseline{"WebAssemblyBaseline",
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+index 47cfcc8c758bed2fe46c6c75ba45b3cec2576ba6..ebf862fcc88579db6300b6972187f4b06f2af9e3 100644
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
++++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -2543,7 +2543,7 @@
+       name: "WebAppWindowControlsOverlay",
+       origin_trial_feature_name: "WebAppWindowControlsOverlay",
+       origin_trial_os: ["win", "mac", "linux", "chromeos"],
+-      status: "experimental",
++      status: "stable",
+     },
+     {
+       name: "WebAssemblyCSP",
+diff --git a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-navigated-expected.txt b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-navigated-expected.txt
+index a2bac6e1f0fc6404a8fabbab87cd78da3e50570c..d6e4d3d5846ec3de2056af5a89a74f168a0e216d 100644
+--- a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-navigated-expected.txt
++++ b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-navigated-expected.txt
+@@ -77,6 +77,8 @@ PASS window.cached_navigator_virtualKeyboard.boundingRect.x is 0
+ PASS window.cached_navigator_virtualKeyboard.boundingRect.y is 0
+ PASS window.cached_navigator_virtualKeyboard.ongeometrychange is null
+ PASS window.cached_navigator_virtualKeyboard.overlaysContent is false
++PASS window.cached_navigator_windowControlsOverlay.ongeometrychange is null
++PASS window.cached_navigator_windowControlsOverlay.visible is false
+ PASS window.cached_navigator_xr.ondevicechange is null
+ PASS window.cached_performance.onresourcetimingbufferfull is null
+ PASS window.cached_performance_navigation.redirectCount is 0
+diff --git a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-and-gced-expected.txt b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-and-gced-expected.txt
+index 9b413dea03d864d6cef496279187b39cf81ba4b0..5cfdedb36e5f9bd0dbfae11d5ba5cc1172823071 100644
+--- a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-and-gced-expected.txt
++++ b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-and-gced-expected.txt
+@@ -77,6 +77,8 @@ PASS window.cached_navigator_virtualKeyboard.boundingRect.x is 0
+ PASS window.cached_navigator_virtualKeyboard.boundingRect.y is 0
+ PASS window.cached_navigator_virtualKeyboard.ongeometrychange is null
+ PASS window.cached_navigator_virtualKeyboard.overlaysContent is false
++PASS window.cached_navigator_windowControlsOverlay.ongeometrychange is null
++PASS window.cached_navigator_windowControlsOverlay.visible is false
+ PASS window.cached_navigator_xr.ondevicechange is null
+ PASS window.cached_performance.onresourcetimingbufferfull is null
+ PASS window.cached_performance_navigation.redirectCount is 0
+diff --git a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-expected.txt b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-expected.txt
+index 6f480ccfc7031fbdab98b50511a667aed5840af1..37bba469a00c719128762f861313e383d1ad4b86 100644
+--- a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-expected.txt
++++ b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-properties-after-frame-removed-expected.txt
+@@ -77,6 +77,8 @@ PASS window.cached_navigator_virtualKeyboard.boundingRect.x is 0
+ PASS window.cached_navigator_virtualKeyboard.boundingRect.y is 0
+ PASS window.cached_navigator_virtualKeyboard.ongeometrychange is null
+ PASS window.cached_navigator_virtualKeyboard.overlaysContent is false
++PASS window.cached_navigator_windowControlsOverlay.ongeometrychange is null
++PASS window.cached_navigator_windowControlsOverlay.visible is false
+ PASS window.cached_navigator_xr.ondevicechange is null
+ PASS window.cached_performance.onresourcetimingbufferfull is null
+ PASS window.cached_performance_navigation.redirectCount is 0
+diff --git a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt
+index ef72385e2cc50ae9519f2d0cf496e8cc771cf5aa..36efa30d35e4b8e5e7752bfde58f50cdef865e89 100644
+--- a/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt
++++ b/third_party/blink/web_tests/virtual/stable/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt
+@@ -87,6 +87,8 @@ PASS oldChildWindow.navigator.virtualKeyboard.boundingRect.y is newChildWindow.n
+ PASS oldChildWindow.navigator.virtualKeyboard.ongeometrychange is newChildWindow.navigator.virtualKeyboard.ongeometrychange
+ PASS oldChildWindow.navigator.virtualKeyboard.overlaysContent is newChildWindow.navigator.virtualKeyboard.overlaysContent
+ PASS oldChildWindow.navigator.webdriver is newChildWindow.navigator.webdriver
++PASS oldChildWindow.navigator.windowControlsOverlay.ongeometrychange is newChildWindow.navigator.windowControlsOverlay.ongeometrychange
++PASS oldChildWindow.navigator.windowControlsOverlay.visible is newChildWindow.navigator.windowControlsOverlay.visible
+ PASS oldChildWindow.navigator.xr.ondevicechange is newChildWindow.navigator.xr.ondevicechange
+ PASS oldChildWindow.onabort is newChildWindow.onabort
+ PASS oldChildWindow.onafterprint is newChildWindow.onafterprint
+diff --git a/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt b/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt
+index 1f0f00e9879c0e5f24029617d146f760e6abb100..6789814dd76154ce4d2547d5e89616255585249f 100644
+--- a/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt
++++ b/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt
+@@ -4955,6 +4955,7 @@ interface Navigator
+     getter webdriver
+     getter webkitPersistentStorage
+     getter webkitTemporaryStorage
++    getter windowControlsOverlay
+     getter xr
+     method clearAppBadge
+     method constructor
+@@ -9646,6 +9647,18 @@ interface Window : EventTarget
+     attribute PERSISTENT
+     attribute TEMPORARY
+     method constructor
++interface WindowControlsOverlay : EventTarget
++    attribute @@toStringTag
++    getter ongeometrychange
++    getter visible
++    method constructor
++    method getTitlebarAreaRect
++    setter ongeometrychange
++interface WindowControlsOverlayGeometryChangeEvent : Event
++    attribute @@toStringTag
++    getter titlebarAreaRect
++    getter visible
++    method constructor
+ interface Worker : EventTarget
+     attribute @@toStringTag
+     getter onerror

patches/chromium/feat_add_set_can_resize_mutator.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Raymond Zhao <7199958+rzhao271@users.noreply.github.com>
+Date: Tue, 2 Aug 2022 09:30:36 -0700
+Subject: feat: Add set_can_resize mutator
+
+Adds a set_can_resize mutator to WidgetDelegate that
+doesn't emit the OnSizeConstraintsChanged event.
+This way, we can call set_can_resize from Electron before
+the widget is initialized to set the value earlier,
+and in turn, avoid showing a frame at startup
+for frameless applications.
+
+diff --git a/ui/views/widget/widget_delegate.h b/ui/views/widget/widget_delegate.h
+index 3375d6c3629235413362c4ed3d8c5a0eb53e23cd..8f4002ef6f5aa9b2cd8c1c911806772518d71f4b 100644
+--- a/ui/views/widget/widget_delegate.h
++++ b/ui/views/widget/widget_delegate.h
+@@ -328,6 +328,10 @@ class VIEWS_EXPORT WidgetDelegate {
+   // be cycled through with keyboard focus.
+   virtual void GetAccessiblePanes(std::vector<View*>* panes) {}
+ 
++  // A setter for the can_resize parameter that doesn't
++  // emit any events.
++  void set_can_resize(bool can_resize) { params_.can_resize = can_resize; }
++
+   // Setters for data parameters of the WidgetDelegate. If you use these
+   // setters, there is no need to override the corresponding virtual getters.
+   void SetAccessibleRole(ax::mojom::Role role);

patches/chromium/fix_mac_build_with_enable_plugins_false.patch

@@ -0,0 +1,119 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Thu, 23 Jun 2022 17:54:12 +0000
+Subject: Fix Mac build with enable_plugins=false.
+
+Remove spurious includes of plugin headers, and add appropriate #ifs.
+
+Bug: 1027360
+Change-Id: I445252f5de14dff8e89ab371429a24ad3e57ca97
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3719213
+Reviewed-by: Robert Sesek <rsesek@chromium.org>
+Reviewed-by: Thomas Lukaszewicz <tluk@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1017248}
+
+diff --git a/chrome/browser/app_controller_mac.mm b/chrome/browser/app_controller_mac.mm
+index 480244fb50f636f519485693b8d1a4cf5033c3b0..f426e30ff371c35382512d7ec7846ca6cf58515e 100644
+--- a/chrome/browser/app_controller_mac.mm
++++ b/chrome/browser/app_controller_mac.mm
+@@ -108,7 +108,6 @@
+ #include "components/prefs/pref_service.h"
+ #include "components/sessions/core/tab_restore_service.h"
+ #include "content/public/browser/download_manager.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "extensions/browser/extension_registry.h"
+ #include "extensions/browser/extension_system.h"
+ #include "net/base/filename_util.h"
+diff --git a/content/browser/sandbox_mac_unittest.mm b/content/browser/sandbox_mac_unittest.mm
+index 05e9b29d7a039094fb6fd63fb8b152439f089d41..b860c1e54f0ced814fb269087924d2f695f816f3 100644
+--- a/content/browser/sandbox_mac_unittest.mm
++++ b/content/browser/sandbox_mac_unittest.mm
+@@ -30,6 +30,7 @@
+ #include "content/browser/sandbox_parameters_mac.h"
+ #include "content/common/mac/font_loader.h"
+ #include "crypto/openssl_util.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "sandbox/mac/seatbelt.h"
+ #include "sandbox/mac/seatbelt_exec.h"
+ #include "sandbox/policy/mac/sandbox_mac.h"
+@@ -93,7 +94,9 @@ void ExecuteInAllSandboxTypes(const std::string& multiprocess_main,
+         sandbox::mojom::Sandbox::kCdm,
+         sandbox::mojom::Sandbox::kGpu,
+         sandbox::mojom::Sandbox::kNaClLoader,
++#if BUILDFLAG(ENABLE_PLUGINS)
+         sandbox::mojom::Sandbox::kPpapi,
++#endif
+         sandbox::mojom::Sandbox::kPrintBackend,
+         sandbox::mojom::Sandbox::kPrintCompositor,
+         sandbox::mojom::Sandbox::kRenderer,
+diff --git a/content/browser/sandbox_parameters_mac.mm b/content/browser/sandbox_parameters_mac.mm
+index 76a22420f605994ebe0a7ffa9a7f2a0535c2440f..cf8b251180177c3ea4f8ddb2450f0483d201ba2b 100644
+--- a/content/browser/sandbox_parameters_mac.mm
++++ b/content/browser/sandbox_parameters_mac.mm
+@@ -20,7 +20,6 @@
+ #include "base/strings/sys_string_conversions.h"
+ #include "base/system/sys_info.h"
+ #include "content/public/browser/content_browser_client.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/content_client.h"
+ #include "content/public/common/content_features.h"
+ #include "content/public/common/content_switches.h"
+@@ -34,6 +33,7 @@
+ #include "third_party/abseil-cpp/absl/types/optional.h"
+ 
+ #if BUILDFLAG(ENABLE_PLUGINS)
++#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/pepper_plugin_info.h"
+ #endif
+ 
+@@ -229,11 +229,11 @@ void SetupSandboxParameters(sandbox::mojom::Sandbox sandbox_type,
+     case sandbox::mojom::Sandbox::kNetwork:
+       SetupNetworkSandboxParameters(client);
+       break;
+-    case sandbox::mojom::Sandbox::kPpapi:
+ #if BUILDFLAG(ENABLE_PLUGINS)
++    case sandbox::mojom::Sandbox::kPpapi:
+       SetupPPAPISandboxParameters(client);
+-#endif
+       break;
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+       CHECK(false) << "Unhandled parameters for sandbox_type "
+                    << static_cast<int>(sandbox_type);
+diff --git a/sandbox/policy/mac/sandbox_mac.mm b/sandbox/policy/mac/sandbox_mac.mm
+index 34f8b003c96b9fff00b666ae184b5076e5d6fd45..11392b99ecad98f2cf39e67d545fe1947ede1593 100644
+--- a/sandbox/policy/mac/sandbox_mac.mm
++++ b/sandbox/policy/mac/sandbox_mac.mm
+@@ -12,6 +12,7 @@
+ #include "base/files/scoped_file.h"
+ #include "base/logging.h"
+ #include "base/posix/eintr_wrapper.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "printing/buildflags/buildflags.h"
+ #include "sandbox/policy/mac/audio.sb.h"
+ #include "sandbox/policy/mac/cdm.sb.h"
+@@ -69,9 +70,11 @@
+     case sandbox::mojom::Sandbox::kNetwork:
+       profile += kSeatbeltPolicyString_network;
+       break;
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
+       profile += kSeatbeltPolicyString_ppapi;
+       break;
++#endif
+ #if BUILDFLAG(ENABLE_PRINTING)
+     case sandbox::mojom::Sandbox::kPrintBackend:
+       profile += kSeatbeltPolicyString_print_backend;
+diff --git a/ui/views_content_client/views_content_client_main_parts_mac.mm b/ui/views_content_client/views_content_client_main_parts_mac.mm
+index 044600ad464fc48a805bf3e47811808983d43fef..df23f797e4f0898d9dc7742e05d286f540bfdacb 100644
+--- a/ui/views_content_client/views_content_client_main_parts_mac.mm
++++ b/ui/views_content_client/views_content_client_main_parts_mac.mm
+@@ -12,7 +12,6 @@
+ #include "base/mac/scoped_nsobject.h"
+ #include "base/path_service.h"
+ #include "content/public/browser/context_factory.h"
+-#include "content/public/browser/plugin_service.h"
+ #include "content/public/common/content_paths.h"
+ #include "content/public/common/result_codes.h"
+ #include "content/shell/browser/shell_application_mac.h"

patches/chromium/fix_windows_build_with_enable_plugins_false.patch

@@ -0,0 +1,108 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lei Zhang <thestig@chromium.org>
+Date: Thu, 23 Jun 2022 18:52:27 +0000
+Subject: Fix Windows build with enable_plugins=false.
+
+Add some #if checks to Windows-only code so plugins enums are only
+referenced when plugins are enabled. Also only build
+plugin_list_unittest.cc when plugins are enabled.
+
+Bug: 1027360
+Change-Id: I0d265ae711e5e3401076dc89d1d49329f423ca64
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3719402
+Reviewed-by: Alex Gough <ajgo@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1017281}
+
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+index 939c28a029418bc353795aa1a007508680f42e57..2db6a0d23d72c3d77db6eec4de7c9d0f0500fbe2 100644
+--- a/chrome/browser/chrome_content_browser_client.cc
++++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -3951,7 +3951,9 @@ std::wstring ChromeContentBrowserClient::GetAppContainerSidForSandboxType(
+       return std::wstring();
+     case sandbox::mojom::Sandbox::kGpu:
+       return std::wstring();
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+     case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
+     case sandbox::mojom::Sandbox::kXrCompositing:
+@@ -4023,7 +4025,9 @@ bool ChromeContentBrowserClient::PreSpawnChild(
+       break;
+     case sandbox::mojom::Sandbox::kUtility:
+     case sandbox::mojom::Sandbox::kGpu:
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case sandbox::mojom::Sandbox::kPpapi:
++#endif
+     case sandbox::mojom::Sandbox::kNoSandbox:
+     case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
+     case sandbox::mojom::Sandbox::kXrCompositing:
+diff --git a/chrome/child/pdf_child_init.cc b/chrome/child/pdf_child_init.cc
+index e53cfc60b41fe0d4eeb0362e9923f1e39e61a64d..8e0d72623bbb0c92c8fd8b97ab833c947806667b 100644
+--- a/chrome/child/pdf_child_init.cc
++++ b/chrome/child/pdf_child_init.cc
+@@ -14,6 +14,7 @@
+ #include "base/win/windows_version.h"
+ #include "content/public/child/child_thread.h"
+ #include "content/public/common/content_switches.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "sandbox/policy/mojom/sandbox.mojom.h"
+ #include "sandbox/policy/sandbox_type.h"
+ #include "sandbox/policy/switches.h"
+@@ -57,7 +58,9 @@ void MaybePatchGdiGetFontData() {
+   auto service_sandbox_type =
+       sandbox::policy::SandboxTypeFromCommandLine(command_line);
+   bool need_gdi =
++#if BUILDFLAG(ENABLE_PLUGINS)
+       service_sandbox_type == sandbox::mojom::Sandbox::kPpapi ||
++#endif
+       service_sandbox_type == sandbox::mojom::Sandbox::kPrintCompositor ||
+       service_sandbox_type == sandbox::mojom::Sandbox::kPdfConversion ||
+       (service_sandbox_type == sandbox::mojom::Sandbox::kRenderer &&
+diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
+index dec80de25675467a07d3c213538d240507916254..1df3675fed1656094e808fa4477ffd2ea126b83d 100644
+--- a/content/test/BUILD.gn
++++ b/content/test/BUILD.gn
+@@ -2168,7 +2168,6 @@ test("content_unittests") {
+     "../browser/payments/payment_manager_unittest.cc",
+     "../browser/permissions/permission_controller_impl_unittest.cc",
+     "../browser/picture_in_picture/picture_in_picture_service_impl_unittest.cc",
+-    "../browser/plugin_list_unittest.cc",
+     "../browser/ppapi_plugin_sandboxed_process_launcher_delegate_unittest.cc",
+     "../browser/prerender/prerender_host_registry_unittest.cc",
+     "../browser/prerender/prerender_host_unittest.cc",
+@@ -2870,8 +2869,8 @@ test("content_unittests") {
+     deps += [ "//ui/events:test_support" ]
+   }
+ 
+-  if (!is_win && !is_mac) {
+-    sources -= [ "../browser/plugin_list_unittest.cc" ]
++  if (enable_plugins && (is_win || is_mac)) {
++    sources += [ "../browser/plugin_list_unittest.cc" ]
+   }
+ 
+   if (use_ozone) {
+diff --git a/sandbox/policy/win/sandbox_win.cc b/sandbox/policy/win/sandbox_win.cc
+index e4e7cfe65b87ef3bc6b88073dc384a50fd8256ea..0f89e8b8e971fe77cc537cb2e92b54f1d988bc2a 100644
+--- a/sandbox/policy/win/sandbox_win.cc
++++ b/sandbox/policy/win/sandbox_win.cc
+@@ -38,6 +38,7 @@
+ #include "base/win/sid.h"
+ #include "base/win/win_util.h"
+ #include "base/win/windows_version.h"
++#include "ppapi/buildflags/buildflags.h"
+ #include "printing/buildflags/buildflags.h"
+ #include "sandbox/features.h"
+ #include "sandbox/policy/features.h"
+@@ -1216,8 +1217,10 @@ std::string SandboxWin::GetSandboxTypeInEnglish(Sandbox sandbox_type) {
+       return "Utility";
+     case Sandbox::kGpu:
+       return "GPU";
++#if BUILDFLAG(ENABLE_PLUGINS)
+     case Sandbox::kPpapi:
+       return "PPAPI";
++#endif
+     case Sandbox::kNetwork:
+       return "Network";
+     case Sandbox::kCdm:

patches/config.json

@@ -19,5 +19,15 @@
 
   "src/electron/patches/Mantle": "src/third_party/squirrel.mac/vendor/Mantle",
 
-  "src/electron/patches/ReactiveObjC": "src/third_party/squirrel.mac/vendor/ReactiveObjC"
+  "src/electron/patches/ReactiveObjC": "src/third_party/squirrel.mac/vendor/ReactiveObjC",
+
+  "src/electron/patches/angle": "src/third_party/angle",
+
+  "src/electron/patches/sqlite": "src/third_party/sqlite/src",
+
+  "src/electron/patches/pdfium": "src/third_party/pdfium",
+
+  "src/electron/patches/ffmpeg": "src/third_party/ffmpeg",
+
+  "src/electron/patches/libaom": "src/third_party/libaom/source/libaom"
 }

patches/ffmpeg/.patches

@@ -0,0 +1 @@
+cherry-pick-c2c8cac2131b.patch

patches/ffmpeg/cherry-pick-c2c8cac2131b.patch

@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Thu, 28 Jul 2022 14:42:43 +0200
+Subject: avformat/mov: Check count sums in build_open_gop_key_points()
+
+Fixes: ffmpeg.md
+Fixes: Out of array access
+Fixes: CVE-2022-2566
+
+Bug: 1348283
+Found-by: Andy Nguyen <theflow@google.com>
+Found-by: 3pvd <3pvd@google.com>
+Change-Id: I6821c87acce5a62cd9a5b829c17f56ae6418116a
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+(cherry picked from commit 64d7d8d0e5035087ebe24a65845b36f78e7fad92)
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/third_party/ffmpeg/+/3890391
+Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org>
+
+diff --git a/libavformat/mov.c b/libavformat/mov.c
+index 124c8e907f2e0cb5777b5433ccdb17ac52f0b6eb..595babcd4bfb1298d2928b1f4c9b40b2d09971e9 100644
+--- a/libavformat/mov.c
++++ b/libavformat/mov.c
+@@ -3943,8 +3943,11 @@ static int build_open_gop_key_points(AVStream *st)
+ 
+     /* Build an unrolled index of the samples */
+     sc->sample_offsets_count = 0;
+-    for (uint32_t i = 0; i < sc->ctts_count; i++)
++    for (uint32_t i = 0; i < sc->ctts_count; i++) {
++        if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count)
++            return AVERROR(ENOMEM);
+         sc->sample_offsets_count += sc->ctts_data[i].count;
++    }
+     av_freep(&sc->sample_offsets);
+     sc->sample_offsets = av_calloc(sc->sample_offsets_count, sizeof(*sc->sample_offsets));
+     if (!sc->sample_offsets)
+@@ -3963,8 +3966,11 @@ static int build_open_gop_key_points(AVStream *st)
+     /* Build a list of open-GOP key samples */
+     sc->open_key_samples_count = 0;
+     for (uint32_t i = 0; i < sc->sync_group_count; i++)
+-        if (sc->sync_group[i].index == cra_index)
++        if (sc->sync_group[i].index == cra_index) {
++            if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count)
++                return AVERROR(ENOMEM);
+             sc->open_key_samples_count += sc->sync_group[i].count;
++        }
+     av_freep(&sc->open_key_samples);
+     sc->open_key_samples = av_calloc(sc->open_key_samples_count, sizeof(*sc->open_key_samples));
+     if (!sc->open_key_samples)
+@@ -3975,6 +3981,8 @@ static int build_open_gop_key_points(AVStream *st)
+         if (sg->index == cra_index)
+             for (uint32_t j = 0; j < sg->count; j++)
+                 sc->open_key_samples[k++] = sample_id;
++        if (sg->count > INT_MAX - sample_id)
++            return AVERROR_PATCHWELCOME;
+         sample_id += sg->count;
+     }
+ 

patches/libaom/.patches

@@ -0,0 +1 @@
+use_non_normative_scaler_for_non_optimized_ratio.patch

patches/libaom/use_non_normative_scaler_for_non_optimized_ratio.patch

@@ -0,0 +1,96 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jerome Jiang <jianj@google.com>
+Date: Tue, 30 Aug 2022 14:45:28 -0400
+Subject: Use non normative scaler for non optimized ratio
+
+There are only optimized scalers for 1/4, 1/2 and 3/4 scaling ratio.
+SSSE3 also has 2x upscaling optimization.
+Use non normative scalers for all other scaling ratios.
+
+Bug: chromium:1346938
+Bug: chromium:1338114
+Change-Id: I2a01717b56c53c42906440d5a3f95ca2c00dc571
+(cherry picked from commit ff7b753a63a536423a91b64a066bd385c52ceacc)
+
+diff --git a/av1/common/resize.c b/av1/common/resize.c
+index a3c3c0e5160940974fbbbc84d7011fb4bd26f67e..322363fa1e136ce3b77498b9c20b63d27d339471 100644
+--- a/av1/common/resize.c
++++ b/av1/common/resize.c
+@@ -1366,15 +1366,20 @@ YV12_BUFFER_CONFIG *av1_realloc_and_scale_if_required(
+       aom_internal_error(cm->error, AOM_CODEC_MEM_ERROR,
+                          "Failed to allocate scaled buffer");
+ 
++    const bool has_optimized_scaler = av1_has_optimized_scaler(
++        unscaled->y_crop_width, unscaled->y_crop_height, scaled_width,
++        scaled_height);
++
+ #if CONFIG_AV1_HIGHBITDEPTH
+-    if (use_optimized_scaler && cm->seq_params->bit_depth == AOM_BITS_8) {
++    if (use_optimized_scaler && has_optimized_scaler &&
++        cm->seq_params->bit_depth == AOM_BITS_8) {
+       av1_resize_and_extend_frame(unscaled, scaled, filter, phase, num_planes);
+     } else {
+       av1_resize_and_extend_frame_nonnormative(
+           unscaled, scaled, (int)cm->seq_params->bit_depth, num_planes);
+     }
+ #else
+-    if (use_optimized_scaler) {
++    if (use_optimized_scaler && has_optimized_scaler) {
+       av1_resize_and_extend_frame(unscaled, scaled, filter, phase, num_planes);
+     } else {
+       av1_resize_and_extend_frame_nonnormative(
+diff --git a/av1/common/resize.h b/av1/common/resize.h
+index 75abe6274ee73a202bddd14962f1a4ae8083ce94..9bc23b3ffacd4121bf32dd96bae82ba5c799b1ea 100644
+--- a/av1/common/resize.h
++++ b/av1/common/resize.h
+@@ -105,6 +105,24 @@ static INLINE int av1_superres_scaled(const AV1_COMMON *cm) {
+   return !(cm->width == cm->superres_upscaled_width);
+ }
+ 
++// There's SIMD optimizations for 1/4, 1/2 and 3/4 downscaling.
++// SSSE3 also has optimizations for 2x upscaling.
++// Use non normative scalers for other scaling ratios.
++static INLINE bool av1_has_optimized_scaler(const int src_width,
++                                            const int src_height,
++                                            const int dst_width,
++                                            const int dst_height) {
++  const bool has_optimized_scaler =
++      (dst_width * 4 == src_width && dst_height * 4 == src_height) ||
++      (dst_width * 2 == src_width && dst_height * 2 == src_height) ||
++      (dst_width * 4 == src_width * 3 && dst_height * 4 == src_height * 3);
++#if HAVE_SSSE3
++  return has_optimized_scaler ||
++         (dst_width == src_width * 2 && dst_height == src_height * 2);
++#endif
++  return has_optimized_scaler;
++}
++
+ #define UPSCALE_NORMATIVE_TAPS 8
+ extern const int16_t av1_resize_filter_normative[1 << RS_SUBPEL_BITS]
+                                                 [UPSCALE_NORMATIVE_TAPS];
+diff --git a/av1/encoder/encoder_utils.c b/av1/encoder/encoder_utils.c
+index fd8be7bf18e6a138bf20c25370c635cf3b302e10..cebea60eee37777b175f75d863f8cb94410a065a 100644
+--- a/av1/encoder/encoder_utils.c
++++ b/av1/encoder/encoder_utils.c
+@@ -733,15 +733,19 @@ void av1_scale_references(AV1_COMP *cpi, const InterpFilter filter,
+             aom_internal_error(cm->error, AOM_CODEC_MEM_ERROR,
+                                "Failed to allocate frame buffer");
+           }
++          const bool has_optimized_scaler = av1_has_optimized_scaler(
++              cm->width, cm->height, new_fb->buf.y_crop_width,
++              new_fb->buf.y_crop_height);
+ #if CONFIG_AV1_HIGHBITDEPTH
+-          if (use_optimized_scaler && cm->seq_params->bit_depth == AOM_BITS_8)
++          if (use_optimized_scaler && has_optimized_scaler &&
++              cm->seq_params->bit_depth == AOM_BITS_8)
+             av1_resize_and_extend_frame(ref, &new_fb->buf, filter, phase,
+                                         num_planes);
+           else
+             av1_resize_and_extend_frame_nonnormative(
+                 ref, &new_fb->buf, (int)cm->seq_params->bit_depth, num_planes);
+ #else
+-          if (use_optimized_scaler)
++          if (use_optimized_scaler && has_optimized_scaler)
+             av1_resize_and_extend_frame(ref, &new_fb->buf, filter, phase,
+                                         num_planes);
+           else

patches/node/.patches

@@ -44,3 +44,4 @@ process_fix_hang_after_note_exit_3521.patch
 feat_add_uv_loop_interrupt_on_io_change_option_to_uv_loop_configure.patch
 fix_preserve_proper_method_names_as-is_in_error_stack.patch
 macos_avoid_posix_spawnp_cwd_bug_3597.patch
+buffer_fix_atob_input_validation.patch

patches/node/buffer_fix_atob_input_validation.patch

@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shelley Vohr <shelley.vohr@gmail.com>
+Date: Tue, 23 Aug 2022 11:13:45 +0200
+Subject: buffer: fix `atob` input validation
+
+This patch combines:
+
+* https://github.com/nodejs/node/pull/42539
+* https://github.com/nodejs/node/pull/42662
+
+To bring the Node.js implementation of atob into alignment with the
+WHATWG spec.
+
+diff --git a/lib/buffer.js b/lib/buffer.js
+index 2d0057544395bc4aabff891fb30bfb9932a441f7..565753f76663611f0c069321b938c465b46f4ec8 100644
+--- a/lib/buffer.js
++++ b/lib/buffer.js
+@@ -23,8 +23,10 @@
+ 
+ const {
+   Array,
++  ArrayFrom,
+   ArrayIsArray,
+   ArrayPrototypeForEach,
++  ArrayPrototypeIndexOf,
+   Error,
+   MathFloor,
+   MathMin,
+@@ -1227,8 +1229,25 @@ function btoa(input) {
+   return buf.toString('base64');
+ }
+ 
+-const kBase64Digits =
+-  'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
++// Refs: https://infra.spec.whatwg.org/#forgiving-base64-decode
++const kForgivingBase64AllowedChars = [
++  // ASCII whitespace
++  // Refs: https://infra.spec.whatwg.org/#ascii-whitespace
++  0x09, 0x0A, 0x0C, 0x0D, 0x20,
++
++  // Uppercase letters
++  ...ArrayFrom({ length: 26 }, (_, i) => StringPrototypeCharCodeAt('A') + i),
++
++  // Lowercase letters
++  ...ArrayFrom({ length: 26 }, (_, i) => StringPrototypeCharCodeAt('a') + i),
++
++  // Decimal digits
++  ...ArrayFrom({ length: 10 }, (_, i) => StringPrototypeCharCodeAt('0') + i),
++
++  0x2B, // +
++  0x2F, // /
++  0x3D, // =
++];
+ 
+ function atob(input) {
+   // The implementation here has not been performance optimized in any way and
+@@ -1237,11 +1256,31 @@ function atob(input) {
+   if (arguments.length === 0) {
+     throw new ERR_MISSING_ARGS('input');
+   }
++
+   input = `${input}`;
++  let nonAsciiWhitespaceCharCount = 0;
++
+   for (let n = 0; n < input.length; n++) {
+-    if (!kBase64Digits.includes(input[n]))
++    const index = ArrayPrototypeIndexOf(
++      kForgivingBase64AllowedChars,
++      StringPrototypeCharCodeAt(input, n));
++
++    if (index > 4) {
++      // The first 5 elements of `kForgivingBase64AllowedChars` are
++      // ASCII whitespace char codes.
++      nonAsciiWhitespaceCharCount++;
++    } else if (index === -1) {
+       throw lazyDOMException('Invalid character', 'InvalidCharacterError');
++    }
+   }
++
++  // See #3 - https://infra.spec.whatwg.org/#forgiving-base64
++  if (nonAsciiWhitespaceCharCount % 4 === 1) {
++    throw lazyDOMException(
++      'The string to be decoded is not correctly encoded.',
++      'InvalidCharacterError');
++  }
++
+   return Buffer.from(input, 'base64').toString('latin1');
+ }
+ 

patches/node/feat_add_uv_loop_interrupt_on_io_change_option_to_uv_loop_configure.patch

@@ -136,7 +136,7 @@ index 7cd3a2a954ff7d70e6ba7a6f7538648841bc54b2..f89b7158218be60ac10e61484a2d5e5e
  
  
 diff --git a/deps/uv/src/unix/loop.c b/deps/uv/src/unix/loop.c
-index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..353143e5ebecae598425dc036f4458bb7c43bb0b 100644
+index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..46fc03264b6cc1a3a4d8faf5ec5a754fc07c9b6d 100644
 --- a/deps/uv/src/unix/loop.c
 +++ b/deps/uv/src/unix/loop.c
 @@ -217,6 +217,11 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
@@ -151,7 +151,7 @@ index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..353143e5ebecae598425dc036f4458bb
    if (option != UV_LOOP_BLOCK_SIGNAL)
      return UV_ENOSYS;
  
-@@ -226,3 +231,37 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
+@@ -226,3 +231,40 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
    loop->flags |= UV_LOOP_BLOCK_SIGPROF;
    return 0;
  }
@@ -183,6 +183,9 @@ index a88e71c339351f2ebcdd6c3f933fc3b1122910ed..353143e5ebecae598425dc036f4458bb
 +  if (r == len)
 +    return;
 +
++  if (!uv_loop_alive(loop))
++    return;
++
 +  if (r == -1)
 +    if (errno == EAGAIN || errno == EWOULDBLOCK)
 +      return;

patches/node/fix_crash_caused_by_gethostnamew_on_windows_7.patch

@@ -6,7 +6,7 @@ Subject: fix: crash caused by GetHostNameW on Windows 7
 Backported from https://github.com/libuv/libuv/pull/3285.
 
 diff --git a/deps/uv/src/win/util.c b/deps/uv/src/win/util.c
-index 33e874ac442f88b58d2b68c8ec9764f6f664552e..2d4cc0aaa02e61bf359e80eca27527efb49fd85e 100644
+index 33e874ac442f88b58d2b68c8ec9764f6f664552e..37ece5e2867ab836492a8b7faa0aa5e1b8e562f0 100644
 --- a/deps/uv/src/win/util.c
 +++ b/deps/uv/src/win/util.c
 @@ -37,6 +37,7 @@
@@ -166,3 +166,17 @@ index 33e874ac442f88b58d2b68c8ec9764f6f664552e..2d4cc0aaa02e61bf359e80eca27527ef
  int uv_os_gethostname(char* buffer, size_t* size) {
    WCHAR buf[UV_MAXHOSTNAMESIZE];
    size_t len;
+@@ -1674,10 +1803,10 @@ int uv_os_gethostname(char* buffer, size_t* size) {
+ 
+   uv__once_init(); /* Initialize winsock */
+ 
+-  if (pGetHostNameW == NULL)
+-    return UV_ENOSYS;
++  uv_sGetHostNameW gethostnamew =
++      pGetHostNameW == NULL ? uv__gethostnamew_nt60 : pGetHostNameW;
+ 
+-  if (pGetHostNameW(buf, UV_MAXHOSTNAMESIZE) != 0)
++  if (gethostnamew(buf, UV_MAXHOSTNAMESIZE) != 0)
+     return uv_translate_sys_error(WSAGetLastError());
+ 
+   convert_result = uv__convert_utf16_to_utf8(buf, -1, &utf8_str);

patches/node/fix_suppress_clang_-wdeprecated-declarations_in_libuv.patch

@@ -6,7 +6,7 @@ Subject: fix: suppress clang -Wdeprecated-declarations in libuv
 Should be upstreamed.
 
 diff --git a/deps/uv/src/win/util.c b/deps/uv/src/win/util.c
-index 2d4cc0aaa02e61bf359e80eca27527efb49fd85e..aaa16052e2a9c7d1dca82763c41c0890371f1471 100644
+index 37ece5e2867ab836492a8b7faa0aa5e1b8e562f0..d50296728f7e0810064647125a469f3ed714f8ea 100644
 --- a/deps/uv/src/win/util.c
 +++ b/deps/uv/src/win/util.c
 @@ -1950,10 +1950,17 @@ int uv_os_uname(uv_utsname_t* buffer) {

patches/pdfium/.patches

@@ -0,0 +1,3 @@
+cherry-pick-a66438897056.patch
+cherry-pick-497f077a1d46.patch
+cherry-pick-7f0bb5197ed1.patch

patches/pdfium/cherry-pick-497f077a1d46.patch

@@ -0,0 +1,374 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Sepez <tsepez@chromium.org>
+Date: Thu, 8 Sep 2022 23:05:34 +0000
+Subject: Return retained const objects from SearchNameNodeByNameInternal()
+
+Cherry-pick of d51720c9bb55d1163ab4fdcdc6981e753aa2354d + manual
+conflict resolution.
+
+Bug: chromium:1358075
+Change-Id: Ibb20a6feaf79f7b351f22c607c306da40026d53e
+Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/97739
+Auto-Submit: Tom Sepez <tsepez@chromium.org>
+Reviewed-by: Lei Zhang <thestig@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+Commit-Queue: Tom Sepez <tsepez@chromium.org>
+
+diff --git a/core/fpdfapi/parser/cpdf_array.h b/core/fpdfapi/parser/cpdf_array.h
+index 223cd59ab7cb6cc2c08071118d1fbb3241904c6b..a2c067878847cc8ed17eb78bee416716f08a338b 100644
+--- a/core/fpdfapi/parser/cpdf_array.h
++++ b/core/fpdfapi/parser/cpdf_array.h
+@@ -194,4 +194,8 @@ inline RetainPtr<CPDF_Array> ToArray(RetainPtr<CPDF_Object> obj) {
+   return RetainPtr<CPDF_Array>(ToArray(obj.Get()));
+ }
+ 
++inline RetainPtr<const CPDF_Array> ToArray(RetainPtr<const CPDF_Object> obj) {
++  return RetainPtr<const CPDF_Array>(ToArray(obj.Get()));
++}
++
+ #endif  // CORE_FPDFAPI_PARSER_CPDF_ARRAY_H_
+diff --git a/core/fpdfapi/parser/cpdf_dictionary.h b/core/fpdfapi/parser/cpdf_dictionary.h
+index c7ccdc6eef50ddb93585975fb613ce442199e0ee..658ed6586959b5c2165589c9633060f86825c535 100644
+--- a/core/fpdfapi/parser/cpdf_dictionary.h
++++ b/core/fpdfapi/parser/cpdf_dictionary.h
+@@ -170,4 +170,9 @@ inline RetainPtr<CPDF_Dictionary> ToDictionary(RetainPtr<CPDF_Object> obj) {
+   return RetainPtr<CPDF_Dictionary>(ToDictionary(obj.Get()));
+ }
+ 
++inline RetainPtr<const CPDF_Dictionary> ToDictionary(
++    RetainPtr<const CPDF_Object> obj) {
++  return RetainPtr<const CPDF_Dictionary>(ToDictionary(obj.Get()));
++}
++
+ #endif  // CORE_FPDFAPI_PARSER_CPDF_DICTIONARY_H_
+diff --git a/core/fpdfapi/parser/cpdf_number.h b/core/fpdfapi/parser/cpdf_number.h
+index 864bbb2186f0c6208db9942121d2f80b214d46a1..0ca1130ec5a0f595054ff3e4d3d73c5e57f94e6c 100644
+--- a/core/fpdfapi/parser/cpdf_number.h
++++ b/core/fpdfapi/parser/cpdf_number.h
+@@ -49,4 +49,12 @@ inline const CPDF_Number* ToNumber(const CPDF_Object* obj) {
+   return obj ? obj->AsNumber() : nullptr;
+ }
+ 
++inline RetainPtr<CPDF_Number> ToNumber(RetainPtr<CPDF_Object> obj) {
++  return RetainPtr<CPDF_Number>(ToNumber(obj.Get()));
++}
++
++inline RetainPtr<const CPDF_Number> ToNumber(RetainPtr<const CPDF_Object> obj) {
++  return RetainPtr<const CPDF_Number>(ToNumber(obj.Get()));
++}
++
+ #endif  // CORE_FPDFAPI_PARSER_CPDF_NUMBER_H_
+diff --git a/core/fpdfapi/parser/cpdf_stream.h b/core/fpdfapi/parser/cpdf_stream.h
+index 497db20cfcf98792bef6cb3b4bef1a4c0b1b1bff..171d93eb28e26baf1e51f4fafd4c83e39798f88b 100644
+--- a/core/fpdfapi/parser/cpdf_stream.h
++++ b/core/fpdfapi/parser/cpdf_stream.h
+@@ -92,4 +92,8 @@ inline RetainPtr<CPDF_Stream> ToStream(RetainPtr<CPDF_Object> obj) {
+   return RetainPtr<CPDF_Stream>(ToStream(obj.Get()));
+ }
+ 
++inline RetainPtr<const CPDF_Stream> ToStream(RetainPtr<const CPDF_Object> obj) {
++  return RetainPtr<const CPDF_Stream>(ToStream(obj.Get()));
++}
++
+ #endif  // CORE_FPDFAPI_PARSER_CPDF_STREAM_H_
+diff --git a/core/fpdfdoc/cpdf_dest.cpp b/core/fpdfdoc/cpdf_dest.cpp
+index f3b11523918258e7702bda360129857165abc945..fcc09d9e580832678980987489d58ac3c7c0b9bf 100644
+--- a/core/fpdfdoc/cpdf_dest.cpp
++++ b/core/fpdfdoc/cpdf_dest.cpp
+@@ -41,9 +41,11 @@ CPDF_Dest CPDF_Dest::Create(CPDF_Document* pDoc, const CPDF_Object* pDest) {
+   if (!pDest)
+     return CPDF_Dest(nullptr);
+ 
+-  if (pDest->IsString() || pDest->IsName())
+-    return CPDF_Dest(CPDF_NameTree::LookupNamedDest(pDoc, pDest->GetString()));
+-
++  if (pDest->IsString() || pDest->IsName()) {
++    // TODO(tsepez): make CPDF_Dest constructor take retained args.
++    return CPDF_Dest(
++        CPDF_NameTree::LookupNamedDest(pDoc, pDest->GetString()).Get());
++  }
+   return CPDF_Dest(pDest->AsArray());
+ }
+ 
+diff --git a/core/fpdfdoc/cpdf_nametree.cpp b/core/fpdfdoc/cpdf_nametree.cpp
+index 09d4a873fbd9e1151ddbe4f943903d796b18dbe1..2dfecbb5eeb95525c0a83023ee85b722588f3489 100644
+--- a/core/fpdfdoc/cpdf_nametree.cpp
++++ b/core/fpdfdoc/cpdf_nametree.cpp
+@@ -170,7 +170,7 @@ bool UpdateNodesAndLimitsUponDeletion(CPDF_Dictionary* pNode,
+ // will be the index of |csName| in |ppFind|. If |csName| is not found, |ppFind|
+ // will be the leaf array that |csName| should be added to, and |pFindIndex|
+ // will be the index that it should be added at.
+-CPDF_Object* SearchNameNodeByNameInternal(
++RetainPtr<const CPDF_Object> SearchNameNodeByNameInternal(
+     const RetainPtr<CPDF_Dictionary>& pNode,
+     const WideString& csName,
+     int nLevel,
+@@ -217,7 +217,7 @@ CPDF_Object* SearchNameNodeByNameInternal(
+         continue;
+ 
+       *nIndex += i;
+-      return pNames->GetDirectObjectAt(i * 2 + 1);
++      return pdfium::WrapRetain(pNames->GetDirectObjectAt(i * 2 + 1));
+     }
+     *nIndex += dwCount;
+     return nullptr;
+@@ -233,7 +233,7 @@ CPDF_Object* SearchNameNodeByNameInternal(
+     if (!pKid)
+       continue;
+ 
+-    CPDF_Object* pFound = SearchNameNodeByNameInternal(
++    RetainPtr<const CPDF_Object> pFound = SearchNameNodeByNameInternal(
+         pKid, csName, nLevel + 1, nIndex, ppFind, pFindIndex);
+     if (pFound)
+       return pFound;
+@@ -243,10 +243,11 @@ CPDF_Object* SearchNameNodeByNameInternal(
+ 
+ // Wrapper for SearchNameNodeByNameInternal() so callers do not need to know
+ // about the details.
+-CPDF_Object* SearchNameNodeByName(const RetainPtr<CPDF_Dictionary>& pNode,
+-                                  const WideString& csName,
+-                                  RetainPtr<CPDF_Array>* ppFind,
+-                                  int* pFindIndex) {
++RetainPtr<const CPDF_Object> SearchNameNodeByName(
++    const RetainPtr<CPDF_Dictionary>& pNode,
++    const WideString& csName,
++    RetainPtr<CPDF_Array>* ppFind,
++    int* pFindIndex) {
+   size_t nIndex = 0;
+   return SearchNameNodeByNameInternal(pNode, csName, 0, &nIndex, ppFind,
+                                       pFindIndex);
+@@ -344,24 +345,25 @@ size_t CountNamesInternal(CPDF_Dictionary* pNode, int nLevel) {
+   return nCount;
+ }
+ 
+-CPDF_Array* GetNamedDestFromObject(CPDF_Object* obj) {
+-  if (!obj)
+-    return nullptr;
+-  CPDF_Array* array = obj->AsArray();
++RetainPtr<const CPDF_Array> GetNamedDestFromObject(
++    RetainPtr<const CPDF_Object> obj) {
++  RetainPtr<const CPDF_Array> array = ToArray(obj);
+   if (array)
+     return array;
+-  CPDF_Dictionary* dict = obj->AsDictionary();
++  RetainPtr<const CPDF_Dictionary> dict = ToDictionary(obj);
+   if (dict)
+-    return dict->GetArrayFor("D");
++    return pdfium::WrapRetain(dict->GetArrayFor("D"));
+   return nullptr;
+ }
+ 
+-CPDF_Array* LookupOldStyleNamedDest(CPDF_Document* pDoc,
+-                                    const ByteString& name) {
+-  CPDF_Dictionary* pDests = pDoc->GetRoot()->GetDictFor("Dests");
++RetainPtr<const CPDF_Array> LookupOldStyleNamedDest(CPDF_Document* pDoc,
++                                                    const ByteString& name) {
++  const CPDF_Dictionary* pDests = pDoc->GetRoot()->GetDictFor("Dests");
+   if (!pDests)
+     return nullptr;
+-  return GetNamedDestFromObject(pDests->GetDirectObjectFor(name));
++  // TODO(tsepez): return const retained objects from CPDF object getters.
++  return GetNamedDestFromObject(
++      pdfium::WrapRetain(pDests->GetDirectObjectFor(name)));
+ }
+ 
+ }  // namespace
+@@ -424,9 +426,10 @@ std::unique_ptr<CPDF_NameTree> CPDF_NameTree::CreateForTesting(
+ }
+ 
+ // static
+-CPDF_Array* CPDF_NameTree::LookupNamedDest(CPDF_Document* pDoc,
+-                                           const ByteString& name) {
+-  CPDF_Array* dest_array = nullptr;
++RetainPtr<const CPDF_Array> CPDF_NameTree::LookupNamedDest(
++    CPDF_Document* pDoc,
++    const ByteString& name) {
++  RetainPtr<const CPDF_Array> dest_array;
+   std::unique_ptr<CPDF_NameTree> name_tree = Create(pDoc, "Dests");
+   if (name_tree)
+     dest_array = name_tree->LookupNewStyleNamedDest(name);
+@@ -526,10 +529,12 @@ CPDF_Object* CPDF_NameTree::LookupValueAndName(size_t nIndex,
+   return result.value().value;
+ }
+ 
+-CPDF_Object* CPDF_NameTree::LookupValue(const WideString& csName) const {
++RetainPtr<const CPDF_Object> CPDF_NameTree::LookupValue(
++    const WideString& csName) const {
+   return SearchNameNodeByName(m_pRoot, csName, nullptr, nullptr);
+ }
+ 
+-CPDF_Array* CPDF_NameTree::LookupNewStyleNamedDest(const ByteString& sName) {
++RetainPtr<const CPDF_Array> CPDF_NameTree::LookupNewStyleNamedDest(
++    const ByteString& sName) {
+   return GetNamedDestFromObject(LookupValue(PDF_DecodeText(sName.raw_span())));
+ }
+diff --git a/core/fpdfdoc/cpdf_nametree.h b/core/fpdfdoc/cpdf_nametree.h
+index e27f5b13cd76052e1de533b94f85ae505aa56339..30371b42ac622b53b79e180789a491a917c3f263 100644
+--- a/core/fpdfdoc/cpdf_nametree.h
++++ b/core/fpdfdoc/cpdf_nametree.h
+@@ -38,14 +38,14 @@ class CPDF_NameTree {
+   static std::unique_ptr<CPDF_NameTree> CreateForTesting(
+       CPDF_Dictionary* pRoot);
+ 
+-  static CPDF_Array* LookupNamedDest(CPDF_Document* doc,
+-                                     const ByteString& name);
++  static RetainPtr<const CPDF_Array> LookupNamedDest(CPDF_Document* doc,
++                                                     const ByteString& name);
+ 
+   bool AddValueAndName(RetainPtr<CPDF_Object> pObj, const WideString& name);
+   bool DeleteValueAndName(size_t nIndex);
+ 
+   CPDF_Object* LookupValueAndName(size_t nIndex, WideString* csName) const;
+-  CPDF_Object* LookupValue(const WideString& csName) const;
++  RetainPtr<const CPDF_Object> LookupValue(const WideString& csName) const;
+ 
+   size_t GetCount() const;
+   CPDF_Dictionary* GetRootForTesting() const { return m_pRoot.Get(); }
+@@ -53,7 +53,7 @@ class CPDF_NameTree {
+  private:
+   explicit CPDF_NameTree(CPDF_Dictionary* pRoot);
+ 
+-  CPDF_Array* LookupNewStyleNamedDest(const ByteString& name);
++  RetainPtr<const CPDF_Array> LookupNewStyleNamedDest(const ByteString& name);
+ 
+   const RetainPtr<CPDF_Dictionary> m_pRoot;
+ };
+diff --git a/core/fpdfdoc/cpdf_nametree_unittest.cpp b/core/fpdfdoc/cpdf_nametree_unittest.cpp
+index 36617e74d438985b17a889043f2e5ac73836bb3a..e144033bfd66448e45267788d66e577ab366b964 100644
+--- a/core/fpdfdoc/cpdf_nametree_unittest.cpp
++++ b/core/fpdfdoc/cpdf_nametree_unittest.cpp
+@@ -120,7 +120,7 @@ TEST(cpdf_nametree, GetUnicodeNameWithBOM) {
+   EXPECT_STREQ(L"1", stored_name.c_str());
+ 
+   // Check that the correct value object can be obtained by looking up "1".
+-  const CPDF_Number* pNumber = ToNumber(name_tree->LookupValue(L"1"));
++  RetainPtr<const CPDF_Number> pNumber = ToNumber(name_tree->LookupValue(L"1"));
+   ASSERT_TRUE(pNumber);
+   EXPECT_EQ(100, pNumber->GetInteger());
+ }
+@@ -140,7 +140,8 @@ TEST(cpdf_nametree, GetFromTreeWithLimitsArrayWith4Items) {
+   std::unique_ptr<CPDF_NameTree> name_tree =
+       CPDF_NameTree::CreateForTesting(pRootDict.Get());
+ 
+-  const CPDF_Number* pNumber = ToNumber(name_tree->LookupValue(L"9.txt"));
++  RetainPtr<const CPDF_Number> pNumber =
++      ToNumber(name_tree->LookupValue(L"9.txt"));
+   ASSERT_TRUE(pNumber);
+   EXPECT_EQ(999, pNumber->GetInteger());
+   CheckLimitsArray(pKid1, "1.txt", "9.txt");
+diff --git a/fpdfsdk/fpdf_view.cpp b/fpdfsdk/fpdf_view.cpp
+index 161340b8a1b406987b62934d9ad6a67ec49d4bb5..b89efdd063d6c81a38536686965f7bdf8f4da244 100644
+--- a/fpdfsdk/fpdf_view.cpp
++++ b/fpdfsdk/fpdf_view.cpp
+@@ -1050,7 +1050,9 @@ FPDF_GetNamedDestByName(FPDF_DOCUMENT document, FPDF_BYTESTRING name) {
+     return nullptr;
+ 
+   ByteString dest_name(name);
+-  return FPDFDestFromCPDFArray(CPDF_NameTree::LookupNamedDest(pDoc, dest_name));
++  // TODO(tsepez): murky ownership, should caller get a reference?
++  return FPDFDestFromCPDFArray(
++      CPDF_NameTree::LookupNamedDest(pDoc, dest_name).Get());
+ }
+ 
+ #ifdef PDF_ENABLE_V8
+diff --git a/fxjs/cjs_document.cpp b/fxjs/cjs_document.cpp
+index a0bcf868157446cd664eab2717a1adff4e6155b5..991c3aa4a3a41cd58bf22b37626658750831691c 100644
+--- a/fxjs/cjs_document.cpp
++++ b/fxjs/cjs_document.cpp
+@@ -1395,12 +1395,13 @@ CJS_Result CJS_Document::gotoNamedDest(
+     return CJS_Result::Failure(JSMessage::kBadObjectError);
+ 
+   CPDF_Document* pDocument = m_pFormFillEnv->GetPDFDocument();
+-  CPDF_Array* dest_array = CPDF_NameTree::LookupNamedDest(
++  RetainPtr<const CPDF_Array> dest_array = CPDF_NameTree::LookupNamedDest(
+       pDocument, pRuntime->ToByteString(params[0]));
+   if (!dest_array)
+     return CJS_Result::Failure(JSMessage::kBadObjectError);
+ 
+-  CPDF_Dest dest(dest_array);
++  // TODO(tsepez): make CPDF_Dest constructor take retained argument.
++  CPDF_Dest dest(dest_array.Get());
+   const CPDF_Array* arrayObject = dest.GetArray();
+   std::vector<float> scrollPositionArray;
+   if (arrayObject) {
+diff --git a/testing/resources/javascript/bug_1358075.in b/testing/resources/javascript/bug_1358075.in
+new file mode 100644
+index 0000000000000000000000000000000000000000..b503bf2d81eb3ca9adaa108c5075c04fa1c69f89
+--- /dev/null
++++ b/testing/resources/javascript/bug_1358075.in
+@@ -0,0 +1,39 @@
++{{header}}
++{{object 1 0}} <<
++  /Pages 1 0 R
++  /OpenAction 2 0 R
++  /Names <<
++    /Dests 3 0 R
++  >>
++>>
++endobj
++{{object 2 0}} <<
++  /Type /Action
++  /S /JavaScript
++  /JS (
++        this.gotoNamedDest\("2"\);
++        app.alert\("completed"\);
++  )
++>>
++endobj
++{{object 3 0}} <<
++  /Kids 4 0 R
++>>
++endobj
++{{object 4 0}} [
++  (1)
++  (3)
++  <<
++    /Kids [
++      <<
++        /Limits 4 0 R
++        /Names [(2) []]
++      >>
++    ]
++  >>
++]
++endobj
++{{xref}}
++{{trailer}}
++{{startxref}}
++%%EOF
+diff --git a/testing/resources/javascript/bug_1358075_expected.txt b/testing/resources/javascript/bug_1358075_expected.txt
+new file mode 100644
+index 0000000000000000000000000000000000000000..13d460b3b9aa905cec757ab821b980f379772565
+--- /dev/null
++++ b/testing/resources/javascript/bug_1358075_expected.txt
+@@ -0,0 +1 @@
++Alert: completed
+diff --git a/xfa/fxfa/cxfa_ffdoc.cpp b/xfa/fxfa/cxfa_ffdoc.cpp
+index 691248d2709508fc4aff096c80c535a2863bc851..5693d231122ed953c863f4a2333c5ee782bcd68e 100644
+--- a/xfa/fxfa/cxfa_ffdoc.cpp
++++ b/xfa/fxfa/cxfa_ffdoc.cpp
+@@ -279,7 +279,8 @@ RetainPtr<CFX_DIBitmap> CXFA_FFDoc::GetPDFNamedImage(WideStringView wsName,
+   if (count == 0)
+     return nullptr;
+ 
+-  CPDF_Object* pObject = name_tree->LookupValue(WideString(wsName));
++  RetainPtr<const CPDF_Object> pObject =
++      name_tree->LookupValue(WideString(wsName));
+   if (!pObject) {
+     for (size_t i = 0; i < count; ++i) {
+       WideString wsTemp;
+@@ -291,11 +292,12 @@ RetainPtr<CFX_DIBitmap> CXFA_FFDoc::GetPDFNamedImage(WideStringView wsName,
+     }
+   }
+ 
+-  CPDF_Stream* pStream = ToStream(pObject);
++  RetainPtr<const CPDF_Stream> pStream = ToStream(pObject);
+   if (!pStream)
+     return nullptr;
+ 
+-  auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
++  // TODO(tsepez): make CPDF_StreamAcc constructor take retained argument.
++  auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream.Get());
+   pAcc->LoadAllDataFiltered();
+ 
+   auto pImageFileRead =

patches/pdfium/cherry-pick-7f0bb5197ed1.patch

@@ -0,0 +1,30 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Sepez <tsepez@chromium.org>
+Date: Thu, 8 Sep 2022 23:45:54 +0000
+Subject: Avoid de-referencing end() in GetNextAvailContentHeight().
+
+Add the same HasCurrentViewRecord() check as in other methods.
+
+Bug: chromium:1355682
+Change-Id: I466f386f037801daa82ead30239f34e025748748
+Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/96910
+Reviewed-by: Lei Zhang <thestig@chromium.org>
+Auto-Submit: Tom Sepez <tsepez@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+(cherry picked from commit 0d76a139d7ffbbdfb0ef5f5e714597a25f9767c4)
+Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/97738
+Commit-Queue: Tom Sepez <tsepez@chromium.org>
+
+diff --git a/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp b/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
+index a8efdb7dfa740bd9f3e70aeadc3c8d4ccb12587f..295854f655807ce706cc76d4786ad3c57564736e 100644
+--- a/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
++++ b/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
+@@ -1551,6 +1551,8 @@ void CXFA_ViewLayoutProcessor::ProcessLastPageSet() {
+ }
+ 
+ bool CXFA_ViewLayoutProcessor::GetNextAvailContentHeight(float fChildHeight) {
++  if (!HasCurrentViewRecord())
++    return false;
+   CXFA_Node* pCurContentNode =
+       GetCurrentViewRecord()->pCurContentArea->GetFormNode();
+   if (!pCurContentNode)

patches/pdfium/cherry-pick-a66438897056.patch

@@ -0,0 +1,127 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Sepez <tsepez@chromium.org>
+Date: Thu, 8 Sep 2022 21:45:44 +0000
+Subject: Enforce maximum legal object number during linearized parses.
+
+- Watch for overflow of object numbers.
+- Re-validate CPDF_Object pointer after notification in CPDF_FormField.
+
+Bug: chromium:1358090
+Change-Id: I1effd8f47277d177c804dd14b20b101e71780067
+Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/97130
+Reviewed-by: Lei Zhang <thestig@chromium.org>
+Commit-Queue: Tom Sepez <tsepez@chromium.org>
+(cherry picked from commit 81ab3354f79765438bad0e9d683adcfce96727fa)
+Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/97733
+Auto-Submit: Tom Sepez <tsepez@chromium.org>
+Commit-Queue: Lei Zhang <thestig@chromium.org>
+
+diff --git a/core/fpdfapi/parser/cpdf_hint_tables.cpp b/core/fpdfapi/parser/cpdf_hint_tables.cpp
+index 3445e90c9f68bc2386272b4d72f72d90c10bf7ec..0f2632c6d4a5dd7e6cd18c7d2bdc370b68e5bcb9 100644
+--- a/core/fpdfapi/parser/cpdf_hint_tables.cpp
++++ b/core/fpdfapi/parser/cpdf_hint_tables.cpp
+@@ -13,6 +13,7 @@
+ #include "core/fpdfapi/parser/cpdf_dictionary.h"
+ #include "core/fpdfapi/parser/cpdf_document.h"
+ #include "core/fpdfapi/parser/cpdf_linearized_header.h"
++#include "core/fpdfapi/parser/cpdf_parser.h"
+ #include "core/fpdfapi/parser/cpdf_read_validator.h"
+ #include "core/fpdfapi/parser/cpdf_stream.h"
+ #include "core/fpdfapi/parser/cpdf_stream_acc.h"
+@@ -101,7 +102,7 @@ bool CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
+ 
+   // Item 1: The least number of objects in a page.
+   const uint32_t dwObjLeastNum = hStream->GetBits(32);
+-  if (!dwObjLeastNum)
++  if (!dwObjLeastNum || dwObjLeastNum >= CPDF_Parser::kMaxObjectNumber)
+     return false;
+ 
+   // Item 2: The location of the first page's page object.
+@@ -164,7 +165,7 @@ bool CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
+   m_PageInfos[nFirstPageNum].set_start_obj_num(
+       m_pLinearized->GetFirstPageObjNum());
+   // The object number of remaining pages starts from 1.
+-  uint32_t dwStartObjNum = 1;
++  FX_SAFE_UINT32 dwStartObjNum = 1;
+   for (uint32_t i = 0; i < nPages; ++i) {
+     FX_SAFE_UINT32 safeDeltaObj = hStream->GetBits(dwDeltaObjectsBits);
+     safeDeltaObj += dwObjLeastNum;
+@@ -173,8 +174,12 @@ bool CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
+     m_PageInfos[i].set_objects_count(safeDeltaObj.ValueOrDie());
+     if (i == nFirstPageNum)
+       continue;
+-    m_PageInfos[i].set_start_obj_num(dwStartObjNum);
++    m_PageInfos[i].set_start_obj_num(dwStartObjNum.ValueOrDie());
+     dwStartObjNum += m_PageInfos[i].objects_count();
++    if (!dwStartObjNum.IsValid() ||
++        dwStartObjNum.ValueOrDie() >= CPDF_Parser::kMaxObjectNumber) {
++      return false;
++    }
+   }
+   hStream->ByteAlign();
+ 
+diff --git a/core/fpdfdoc/cpdf_formfield.cpp b/core/fpdfdoc/cpdf_formfield.cpp
+index e882098fa36058d5454475743a7e4f34186469b4..c27576e494568f66d82a7b77f81afc265ab2aea6 100644
+--- a/core/fpdfdoc/cpdf_formfield.cpp
++++ b/core/fpdfdoc/cpdf_formfield.cpp
+@@ -178,14 +178,15 @@ bool CPDF_FormField::ResetField() {
+     case kRichText:
+     case kFile:
+     default: {
+-      const CPDF_Object* pDV = GetDefaultValueObject();
+       WideString csDValue;
+-      if (pDV)
+-        csDValue = pDV->GetUnicodeText();
+-
+       WideString csValue;
+       {
+-        // Limit the scope of |pV| because it may get invalidated below.
++        // Limit scope of |pDV| and |pV| because they may get invalidated
++        // during notification below.
++        const CPDF_Object* pDV = GetDefaultValueObject();
++        if (pDV)
++          csDValue = pDV->GetUnicodeText();
++
+         const CPDF_Object* pV = GetValueObject();
+         if (pV)
+           csValue = pV->GetUnicodeText();
+@@ -195,21 +196,26 @@ bool CPDF_FormField::ResetField() {
+       if (!bHasRV && (csDValue == csValue))
+         return false;
+ 
+-      if (!NotifyBeforeValueChange(csDValue)) {
++      if (!NotifyBeforeValueChange(csDValue))
+         return false;
+-      }
+-      if (pDV) {
+-        RetainPtr<CPDF_Object> pClone = pDV->Clone();
+-        if (!pClone)
+-          return false;
+-
+-        m_pDict->SetFor(pdfium::form_fields::kV, std::move(pClone));
+-        if (bHasRV) {
+-          m_pDict->SetFor("RV", pDV->Clone());
++
++      {
++        // Limit scope of |pDV| because it may get invalidated during
++        // notification below.
++        const CPDF_Object* pDV = GetDefaultValueObject();
++        if (pDV) {
++          RetainPtr<CPDF_Object> pClone = pDV->Clone();
++          if (!pClone)
++            return false;
++
++          m_pDict->SetFor(pdfium::form_fields::kV, std::move(pClone));
++          if (bHasRV) {
++            m_pDict->SetFor("RV", pDV->Clone());
++          }
++        } else {
++          m_pDict->RemoveFor(pdfium::form_fields::kV);
++          m_pDict->RemoveFor("RV");
+         }
+-      } else {
+-        m_pDict->RemoveFor(pdfium::form_fields::kV);
+-        m_pDict->RemoveFor("RV");
+       }
+       NotifyAfterValueChange();
+       break;

patches/sqlite/.patches

@@ -0,0 +1 @@
+utf-8_q_simplify_20the_20logic_20that_20converts_20the_20_1_20.patch

patches/sqlite/utf-8_q_simplify_20the_20logic_20that_20converts_20the_20_1_20.patch

@@ -0,0 +1,187 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Wed, 20 Jul 2022 17:01:18 +0000
+Subject: Simplify the logic that converts the "1" expression in "ORDER BY 1"
+ into a copy of the expression that defines the first output column.
+
+FossilOrigin-Name: 449935914c3f64e37bbfb9842e868927222fa3d5315c123a32818e67fcfbbf60
+
+diff --git a/amalgamation/sqlite3.c b/amalgamation/sqlite3.c
+index 4f3bbab24a2ddc9ae772e6ede9cb54891102f3dc..0368982346f2e97b0ea86c21a585012af50166d3 100644
+--- a/amalgamation/sqlite3.c
++++ b/amalgamation/sqlite3.c
+@@ -454,7 +454,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+@@ -100475,33 +100475,23 @@ static void resolveAlias(
+     sqlite3ExprDelete(db, pDup);
+     pDup = 0;
+   }else{
++    Expr temp;
+     incrAggFunctionDepth(pDup, nSubquery);
+     if( pExpr->op==TK_COLLATE ){
+       assert( !ExprHasProperty(pExpr, EP_IntValue) );
+       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
+     }
+-
+-    /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
+-    ** prevents ExprDelete() from deleting the Expr structure itself,
+-    ** allowing it to be repopulated by the memcpy() on the following line.
+-    ** The pExpr->u.zToken might point into memory that will be freed by the
+-    ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
+-    ** make a copy of the token before doing the sqlite3DbFree().
+-    */
+-    ExprSetProperty(pExpr, EP_Static);
+-    sqlite3ExprDelete(db, pExpr);
+-    memcpy(pExpr, pDup, sizeof(*pExpr));
+-    if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
+-      assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
+-      pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
+-      pExpr->flags |= EP_MemToken;
+-    }
++    memcpy(&temp, pDup, sizeof(Expr));
++    memcpy(pDup, pExpr, sizeof(Expr));
++    memcpy(pExpr, &temp, sizeof(Expr));
+     if( ExprHasProperty(pExpr, EP_WinFunc) ){
+       if( ALWAYS(pExpr->y.pWin!=0) ){
+         pExpr->y.pWin->pOwner = pExpr;
+       }
+     }
+-    sqlite3DbFree(db, pDup);
++    sqlite3ParserAddCleanup(pParse,
++      (void(*)(sqlite3*,void*))sqlite3ExprDelete,
++      pDup);
+   }
+ }
+ 
+diff --git a/amalgamation/sqlite3.h b/amalgamation/sqlite3.h
+index d7f21648941f0660807bf36ddd184a9a265d3141..4f731b7af261a6324c983a86633735e43fc5957a 100644
+--- a/amalgamation/sqlite3.h
++++ b/amalgamation/sqlite3.h
+@@ -148,7 +148,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+diff --git a/amalgamation_dev/sqlite3.c b/amalgamation_dev/sqlite3.c
+index c04763e6a395cbf766a84a055ae770015c60d593..4b7a61158cb98c125790091369d933b7d0bf1049 100644
+--- a/amalgamation_dev/sqlite3.c
++++ b/amalgamation_dev/sqlite3.c
+@@ -454,7 +454,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+@@ -100488,33 +100488,23 @@ static void resolveAlias(
+     sqlite3ExprDelete(db, pDup);
+     pDup = 0;
+   }else{
++    Expr temp;
+     incrAggFunctionDepth(pDup, nSubquery);
+     if( pExpr->op==TK_COLLATE ){
+       assert( !ExprHasProperty(pExpr, EP_IntValue) );
+       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
+     }
+-
+-    /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
+-    ** prevents ExprDelete() from deleting the Expr structure itself,
+-    ** allowing it to be repopulated by the memcpy() on the following line.
+-    ** The pExpr->u.zToken might point into memory that will be freed by the
+-    ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
+-    ** make a copy of the token before doing the sqlite3DbFree().
+-    */
+-    ExprSetProperty(pExpr, EP_Static);
+-    sqlite3ExprDelete(db, pExpr);
+-    memcpy(pExpr, pDup, sizeof(*pExpr));
+-    if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
+-      assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
+-      pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
+-      pExpr->flags |= EP_MemToken;
+-    }
++    memcpy(&temp, pDup, sizeof(Expr));
++    memcpy(pDup, pExpr, sizeof(Expr));
++    memcpy(pExpr, &temp, sizeof(Expr));
+     if( ExprHasProperty(pExpr, EP_WinFunc) ){
+       if( ALWAYS(pExpr->y.pWin!=0) ){
+         pExpr->y.pWin->pOwner = pExpr;
+       }
+     }
+-    sqlite3DbFree(db, pDup);
++    sqlite3ParserAddCleanup(pParse,
++      (void(*)(sqlite3*,void*))sqlite3ExprDelete,
++      pDup);
+   }
+ }
+ 
+diff --git a/amalgamation_dev/sqlite3.h b/amalgamation_dev/sqlite3.h
+index d7f21648941f0660807bf36ddd184a9a265d3141..4f731b7af261a6324c983a86633735e43fc5957a 100644
+--- a/amalgamation_dev/sqlite3.h
++++ b/amalgamation_dev/sqlite3.h
+@@ -148,7 +148,7 @@ extern "C" {
+ */
+ #define SQLITE_VERSION        "3.38.1"
+ #define SQLITE_VERSION_NUMBER 3038001
+-#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547a8cbc"
++#define SQLITE_SOURCE_ID      "2022-03-12 13:37:29 38c210fdd258658321c85ec9c01a072fda3ada94540e3239d29b34dc547aalt1"
+ 
+ /*
+ ** CAPI3REF: Run-Time Library Version Numbers
+diff --git a/src/resolve.c b/src/resolve.c
+index 480694f6f5756dba81212f64f2a0fd260a9a5ef8..c50f191c194225d7d3d9426dc7329bc0f769ea9d 100644
+--- a/src/resolve.c
++++ b/src/resolve.c
+@@ -85,33 +85,23 @@ static void resolveAlias(
+     sqlite3ExprDelete(db, pDup);
+     pDup = 0;
+   }else{
++    Expr temp;
+     incrAggFunctionDepth(pDup, nSubquery);
+     if( pExpr->op==TK_COLLATE ){
+       assert( !ExprHasProperty(pExpr, EP_IntValue) );
+       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
+     }
+-
+-    /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This 
+-    ** prevents ExprDelete() from deleting the Expr structure itself,
+-    ** allowing it to be repopulated by the memcpy() on the following line.
+-    ** The pExpr->u.zToken might point into memory that will be freed by the
+-    ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
+-    ** make a copy of the token before doing the sqlite3DbFree().
+-    */
+-    ExprSetProperty(pExpr, EP_Static);
+-    sqlite3ExprDelete(db, pExpr);
+-    memcpy(pExpr, pDup, sizeof(*pExpr));
+-    if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
+-      assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
+-      pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
+-      pExpr->flags |= EP_MemToken;
+-    }
++    memcpy(&temp, pDup, sizeof(Expr));
++    memcpy(pDup, pExpr, sizeof(Expr));
++    memcpy(pExpr, &temp, sizeof(Expr));
+     if( ExprHasProperty(pExpr, EP_WinFunc) ){
+       if( ALWAYS(pExpr->y.pWin!=0) ){
+         pExpr->y.pWin->pOwner = pExpr;
+       }
+     }
+-    sqlite3DbFree(db, pDup);
++    sqlite3ParserAddCleanup(pParse,
++      (void(*)(sqlite3*,void*))sqlite3ExprDelete,
++      pDup);
+   }
+ }
+ 

patches/v8/.patches

@@ -7,3 +7,6 @@ do_not_export_private_v8_symbols_on_windows.patch
 fix_build_deprecated_attribute_for_older_msvc_versions.patch
 fix_disable_implies_dcheck_for_node_stream_array_buffers.patch
 revert_fix_cppgc_removed_deleted_cstors_in_cppheapcreateparams.patch
+cherry-pick-3704cf78f471.patch
+cherry-pick-2f6a2939514f.patch
+cherry-pick-8b040cb69e96.patch

patches/v8/cherry-pick-2f6a2939514f.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tobias Tebbi <tebbi@chromium.org>
+Date: Thu, 1 Sep 2022 15:35:33 +0200
+Subject: Merged: [compiler] fix typing of [[DateValue]]
+
+Bug: chromium:1356308
+(cherry picked from commit ae329407989f1e4689baba7a7827863057d688a9)
+
+Change-Id: I1e132e96325296d180488774ef183daa36dc22c7
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3915224
+Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
+Cr-Commit-Position: refs/branch-heads/10.6@{#25}
+Cr-Branched-From: 41bc7435693fbce8ef86753cd9239e30550a3e2d-refs/heads/10.6.194@{#1}
+Cr-Branched-From: d5f29b929ce7746409201d77f44048f3e9529b40-refs/heads/main@{#82548}
+
+diff --git a/src/compiler/type-cache.h b/src/compiler/type-cache.h
+index 6442b6f6b0ee39bf1a820168e9dd924e81bc0cb3..a34d094edaa4cb7dd7ac692e4a11d7c890744d7c 100644
+--- a/src/compiler/type-cache.h
++++ b/src/compiler/type-cache.h
+@@ -131,9 +131,10 @@ class V8_EXPORT_PRIVATE TypeCache final {
+   Type const kStringLengthType = CreateRange(0.0, String::kMaxLength);
+ 
+   // A time value always contains a tagged number in the range
+-  // [-kMaxTimeInMs, kMaxTimeInMs].
+-  Type const kTimeValueType =
+-      CreateRange(-DateCache::kMaxTimeInMs, DateCache::kMaxTimeInMs);
++  // [-kMaxTimeInMs, kMaxTimeInMs] or -0.
++  Type const kTimeValueType = Type::Union(
++      CreateRange(-DateCache::kMaxTimeInMs, DateCache::kMaxTimeInMs),
++      Type::MinusZero(), zone());
+ 
+   // The JSDate::day property always contains a tagged number in the range
+   // [1, 31] or NaN.

patches/v8/cherry-pick-3704cf78f471.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dominik=20Inf=C3=BChr?= <dinfuehr@chromium.org>
+Date: Thu, 8 Sep 2022 16:27:54 +0200
+Subject: Merged: [heap] Fix aborting compaction with map space compaction
+
+Revision: 3ec02e314cfca04e7457a60363af98b9c9957b16
+
+BUG=chromium:1359294,v8:12578
+NOTRY=true
+NOPRESUBMIT=true
+NOTREECHECKS=true
+R=mlippautz@chromium.org
+
+Change-Id: I04093833a1bfef4269eb578fa5a002872015199e
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3882977
+Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
+Cr-Commit-Position: refs/branch-heads/10.4@{#43}
+Cr-Branched-From: b1413ed7c71ababe05d590de4b5c4ed97b68693e-refs/heads/10.4.132@{#1}
+Cr-Branched-From: 9d0a09368569234a1d1094975e2e92591922cd08-refs/heads/main@{#80972}
+
+diff --git a/src/heap/mark-compact.cc b/src/heap/mark-compact.cc
+index ef0b67ca2b62745e3d9102a8c73b5841d782e21b..1fef50f691e9dfd44b30cf27e6cdf389f5d89d45 100644
+--- a/src/heap/mark-compact.cc
++++ b/src/heap/mark-compact.cc
+@@ -1943,7 +1943,7 @@ class EvacuateRecordOnlyVisitor final : public HeapObjectVisitor {
+     // Instead of calling object.IterateBodyFast(cage_base(), &visitor) here
+     // we can shortcut and use the precomputed size value passed to the visitor.
+     DCHECK_EQ(object.SizeFromMap(map), size);
+-    object.IterateBodyFast(map, size, &visitor);
++    object.IterateFast(map, size, &visitor);
+     return true;
+   }
+ 

patches/v8/cherry-pick-8b040cb69e96.patch

@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jakob Kummerow <jkummerow@chromium.org>
+Date: Fri, 23 Sep 2022 13:13:37 +0200
+Subject: Fix a register reuse corner case
+
+Fixed: chromium:1366399
+(cherry picked from commit 6c214db445827707d65be08d177c9a4257a03a7b)
+
+Change-Id: I72cf30cbd31a21acb44b524a194acfb89d8fecbc
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925795
+Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
+Cr-Commit-Position: refs/branch-heads/10.6@{#29}
+Cr-Branched-From: 41bc7435693fbce8ef86753cd9239e30550a3e2d-refs/heads/10.6.194@{#1}
+Cr-Branched-From: d5f29b929ce7746409201d77f44048f3e9529b40-refs/heads/main@{#82548}
+
+diff --git a/src/wasm/baseline/liftoff-compiler.cc b/src/wasm/baseline/liftoff-compiler.cc
+index 34b51e37c650274ec89a1930c4a9d9443f9838a2..508a91ecb8aa068b942fe445e186267832378cef 100644
+--- a/src/wasm/baseline/liftoff-compiler.cc
++++ b/src/wasm/baseline/liftoff-compiler.cc
+@@ -1417,9 +1417,11 @@ class LiftoffCompiler {
+         __ MergeFullStackWith(c->label_state, *__ cache_state());
+         __ emit_jump(c->label.get());
+       }
+-      // Merge the else state into the end state.
++      // Merge the else state into the end state. Set this state as the current
++      // state first so helper functions know which registers are in use.
+       __ bind(c->else_state->label.get());
+-      __ MergeFullStackWith(c->label_state, c->else_state->state);
++      __ cache_state()->Steal(c->else_state->state);
++      __ MergeFullStackWith(c->label_state, *__ cache_state());
+       __ cache_state()->Steal(c->label_state);
+     } else if (c->reachable()) {
+       // No merge yet at the end of the if, but we need to create a merge for
+@@ -1431,9 +1433,11 @@ class LiftoffCompiler {
+                                c->stack_depth + c->num_exceptions);
+       __ MergeFullStackWith(c->label_state, *__ cache_state());
+       __ emit_jump(c->label.get());
+-      // Merge the else state into the end state.
++      // Merge the else state into the end state. Set this state as the current
++      // state first so helper functions know which registers are in use.
+       __ bind(c->else_state->label.get());
+-      __ MergeFullStackWith(c->label_state, c->else_state->state);
++      __ cache_state()->Steal(c->else_state->state);
++      __ MergeFullStackWith(c->label_state, *__ cache_state());
+       __ cache_state()->Steal(c->label_state);
+     } else {
+       // No merge needed, just continue with the else state.

patches/webrtc/.patches

@@ -1 +1,2 @@
 add_thread_local_to_x_error_trap_cc.patch
+cherry-pick-06aea31d10f8.patch

patches/webrtc/cherry-pick-06aea31d10f8.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Henrik=20Bostr=C3=B6m?= <hbos@webrtc.org>
+Date: Wed, 13 Jul 2022 11:10:14 +0200
+Subject: Disallow invalid arguments in RestoreEncodingLayers.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Changing DCHECK into CHECK for good measure.
+
+(cherry picked from commit 2b1f509f3a05035a17917061a71b16114e8c72dc)
+
+No-Try: True
+Bug: chromium:1343889
+Change-Id: I2cede85dc2d2a4238739f73afe25275047f4aa50
+Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/268460
+Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org>
+Commit-Queue: Henrik Boström <hbos@webrtc.org>
+Cr-Original-Commit-Position: refs/heads/main@{#37511}
+Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/269242
+Cr-Commit-Position: refs/branch-heads/5112@{#8}
+Cr-Branched-From: a976a871159f85f975fbd6f170d0a8f00a4aee49-refs/heads/main@{#37168}
+
+diff --git a/pc/rtp_sender.cc b/pc/rtp_sender.cc
+index 58fef4041ecfcef3a76fcfb296c923355f68625c..3604d198e8fabf8a689746f073b6783fc827e7c5 100644
+--- a/pc/rtp_sender.cc
++++ b/pc/rtp_sender.cc
+@@ -75,8 +75,8 @@ RtpParameters RestoreEncodingLayers(
+     const RtpParameters& parameters,
+     const std::vector<std::string>& removed_rids,
+     const std::vector<RtpEncodingParameters>& all_layers) {
+-  RTC_DCHECK_EQ(parameters.encodings.size() + removed_rids.size(),
+-                all_layers.size());
++  RTC_CHECK_EQ(parameters.encodings.size() + removed_rids.size(),
++               all_layers.size());
+   RtpParameters result(parameters);
+   result.encodings.clear();
+   size_t index = 0;

script/check-symlinks.js

@@ -2,13 +2,14 @@ const fs = require('fs');
 const path = require('path');
 
 const utils = require('./lib/utils');
+const branding = require('../shell/app/BRANDING.json');
 
 if (process.platform !== 'darwin') {
   console.log('Not checking symlinks on non-darwin platform');
   process.exit(0);
 }
 
-const appPath = path.resolve(__dirname, '..', '..', 'out', utils.getOutDir(), 'Electron.app');
+const appPath = path.resolve(__dirname, '..', '..', 'out', utils.getOutDir(), `${branding.product_name}.app`);
 const visited = new Set();
 const traverse = (p) => {
   if (visited.has(p)) return;

script/release/ci-release-build.js

@@ -2,11 +2,10 @@ if (!process.env.CI) require('dotenv-safe').load();
 
 const assert = require('assert');
 const got = require('got');
+const { Octokit } = require('@octokit/rest');
 
 const BUILD_APPVEYOR_URL = 'https://ci.appveyor.com/api/builds';
 const CIRCLECI_PIPELINE_URL = 'https://circleci.com/api/v2/project/gh/electron/electron/pipeline';
-const VSTS_URL = 'https://github.visualstudio.com/electron/_apis/build';
-const DEVOPS_URL = 'https://dev.azure.com/electron-ci/electron/_apis/build';
 const CIRCLECI_WAIT_TIME = process.env.CIRCLECI_WAIT_TIME || 30000;
 
 const appVeyorJobs = {
@@ -25,13 +24,7 @@ const circleCIPublishIndividualArches = {
   'linux-publish': ['arm', 'arm64', 'x64']
 };
 
-const vstsArmJobs = [
-  'electron-arm-testing',
-  'electron-osx-arm64-testing',
-  'electron-mas-arm64-testing',
-  'electron-arm64-testing',
-  'electron-woa-testing'
-];
+const GHAJobs = ['electron-woa-testing'];
 
 let jobRequestedCount = 0;
 
@@ -247,75 +240,28 @@ function buildCircleCI (targetBranch, options) {
   }
 }
 
-async function buildVSTS (targetBranch, options) {
-  assert(options.armTest, `${options.ci} only works with the --armTest option.`);
-  assert(vstsArmJobs.includes(options.job), `Unknown VSTS CI arm test job name: ${options.job}. Valid values are: ${vstsArmJobs}.`);
+async function buildGHA (targetBranch, options) {
+  const { GHA_TOKEN } = process.env;
+  assert(GHA_TOKEN, `${options.ci} requires the $GHA_TOKEN environment variable to be provided`);
 
-  console.log(`Triggering VSTS to run build on branch: ${targetBranch}.`);
-  const environmentVariables = {};
+  const octokit = new Octokit({ auth: GHA_TOKEN });
 
-  if (options.circleBuildNum) {
-    environmentVariables.CIRCLE_BUILD_NUM = options.circleBuildNum;
-  } else if (options.appveyorJobId) {
-    environmentVariables.APPVEYOR_JOB_ID = options.appveyorJobId;
-  }
+  assert(GHAJobs.includes(options.job), `Unknown GitHub Actions arm test job name: ${options.job}. Valid values are: ${GHAJobs}.`);
+  assert(options.commit !== null, 'commit is a required option for GitHub Actions');
 
-  let vstsURL = VSTS_URL;
-  let vstsToken = process.env.VSTS_TOKEN;
-  assert(vstsToken, `${options.ci} requires the $VSTS_TOKEN environment variable to be provided`);
-  if (options.ci === 'DevOps') {
-    vstsURL = DEVOPS_URL;
-    vstsToken = process.env.DEVOPS_TOKEN;
-  }
-  const requestOpts = {
-    url: `${vstsURL}/definitions?api-version=4.1`,
-    auth: {
-      user: '',
-      password: vstsToken
-    },
-    headers: {
-      'Content-Type': 'application/json'
-    }
-  };
+  console.log(`Triggering GitHub Actions to run build on branch: ${targetBranch}.`);
 
   jobRequestedCount++;
 
   try {
-    const vstsResponse = await makeRequest(requestOpts, true);
-    const buildToRun = vstsResponse.value.find(build => build.name === options.job);
-    callVSTSBuild(buildToRun, targetBranch, environmentVariables, vstsURL, vstsToken);
+    const response = await octokit.request('POST /repos/electron/electron/actions/workflows/electron_woa_testing.yml/dispatches', {
+      ref: targetBranch,
+      inputs: {
+        appveyor_job_id: `${options.appveyorJobId}`
+      }
+    });
   } catch (err) {
-    console.log('Problem calling VSTS to get build definitions: ', err);
-  }
-}
-
-async function callVSTSBuild (build, targetBranch, environmentVariables, vstsURL, vstsToken) {
-  const buildBody = {
-    definition: build,
-    sourceBranch: targetBranch,
-    priority: 'high'
-  };
-  if (Object.keys(environmentVariables).length !== 0) {
-    buildBody.parameters = JSON.stringify(environmentVariables);
-  }
-  const requestOpts = {
-    url: `${vstsURL}/builds?api-version=4.1`,
-    auth: {
-      user: '',
-      password: vstsToken
-    },
-    headers: {
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify(buildBody),
-    method: 'POST'
-  };
-
-  try {
-    const { _links } = await makeRequest(requestOpts, true);
-    console.log(`VSTS release build request for ${build.name} successful. Check ${_links.web.href} for status.`);
-  } catch (err) {
-    console.log(`Could not call VSTS for job ${build.name}: `, err);
+    console.log('Problem calling GitHub Actions to get build definitions: ', err);
   }
 }
 
@@ -330,9 +276,8 @@ function runRelease (targetBranch, options) {
         buildAppVeyor(targetBranch, options);
         break;
       }
-      case 'DevOps':
-      case 'VSTS': {
-        buildVSTS(targetBranch, options);
+      case 'GHA': {
+        buildGHA(targetBranch, options);
         break;
       }
       default: {
@@ -351,13 +296,13 @@ module.exports = runRelease;
 
 if (require.main === module) {
   const args = require('minimist')(process.argv.slice(2), {
-    boolean: ['ghRelease', 'armTest']
+    boolean: ['ghRelease']
   });
   const targetBranch = args._[0];
   if (args._.length < 1) {
     console.log(`Trigger CI to build release builds of electron.
-    Usage: ci-release-build.js [--job=CI_JOB_NAME] [--arch=INDIVIDUAL_ARCH] [--ci=CircleCI|AppVeyor|VSTS|DevOps]
-    [--ghRelease] [--armTest] [--circleBuildNum=xxx] [--appveyorJobId=xxx] [--commit=sha] TARGET_BRANCH
+    Usage: ci-release-build.js [--job=CI_JOB_NAME] [--arch=INDIVIDUAL_ARCH] [--ci=CircleCI|AppVeyor|GHA]
+    [--ghRelease] [--circleBuildNum=xxx] [--appveyorJobId=xxx] [--commit=sha] TARGET_BRANCH
     `);
     process.exit(0);
   }

shell/app/electron_crash_reporter_client.cc

@@ -190,7 +190,9 @@ bool ElectronCrashReporterClient::GetShouldCompressUploads() {
 
 void ElectronCrashReporterClient::GetProcessSimpleAnnotations(
     std::map<std::string, std::string>* annotations) {
-  *annotations = global_annotations_;
+  for (auto&& pair : global_annotations_) {
+    (*annotations)[pair.first] = pair.second;
+  }
   (*annotations)["prod"] = ELECTRON_PRODUCT_NAME;
   (*annotations)["ver"] = ELECTRON_VERSION_STRING;
 }

shell/browser/api/electron_api_app.cc

@@ -1152,7 +1152,9 @@ bool App::Relaunch(gin::Arguments* js_args) {
 
   gin_helper::Dictionary options;
   if (js_args->GetNext(&options)) {
-    if (options.Get("execPath", &exec_path) || options.Get("args", &args))
+    bool has_exec_path = options.Get("execPath", &exec_path);
+    bool has_args = options.Get("args", &args);
+    if (has_exec_path || has_args)
       override_argv = true;
   }
 

shell/browser/api/electron_api_data_pipe_holder.cc

@@ -88,8 +88,11 @@ class DataPipeReader {
     if (result == MOJO_RESULT_OK) {  // success
       remaining_size_ -= length;
       head_ += length;
-      if (remaining_size_ == 0)
+      if (remaining_size_ == 0) {
         OnSuccess();
+      } else {
+        handle_watcher_.ArmOrNotify();
+      }
     } else if (result == MOJO_RESULT_SHOULD_WAIT) {  // IO pending
       handle_watcher_.ArmOrNotify();
     } else {  // error

shell/browser/api/electron_api_desktop_capturer.cc

@@ -4,6 +4,7 @@
 
 #include "shell/browser/api/electron_api_desktop_capturer.h"
 
+#include <map>
 #include <memory>
 #include <utility>
 #include <vector>
@@ -24,12 +25,125 @@
 #include "third_party/webrtc/modules/desktop_capture/desktop_capture_options.h"
 #include "third_party/webrtc/modules/desktop_capture/desktop_capturer.h"
 
+#if defined(USE_OZONE)
+#include "ui/ozone/buildflags.h"
+#if BUILDFLAG(OZONE_PLATFORM_X11)
+#define USE_OZONE_PLATFORM_X11
+#endif
+#endif
+
 #if BUILDFLAG(IS_WIN)
 #include "third_party/webrtc/modules/desktop_capture/win/dxgi_duplicator_controller.h"
 #include "third_party/webrtc/modules/desktop_capture/win/screen_capturer_win_directx.h"
 #include "ui/display/win/display_info.h"
+#elif BUILDFLAG(IS_LINUX)
+#if defined(USE_OZONE_PLATFORM_X11)
+#include "base/logging.h"
+#include "ui/base/x/x11_display_util.h"
+#include "ui/base/x/x11_util.h"
+#include "ui/display/util/edid_parser.h"  // nogncheck
+#include "ui/gfx/x/randr.h"
+#include "ui/gfx/x/x11_atom_cache.h"
+#include "ui/gfx/x/xproto_util.h"
+#endif  // defined(USE_OZONE_PLATFORM_X11)
 #endif  // BUILDFLAG(IS_WIN)
 
+#if BUILDFLAG(IS_LINUX)
+// Private function in ui/base/x/x11_display_util.cc
+std::map<x11::RandR::Output, int> GetMonitors(int version,
+                                              x11::RandR* randr,
+                                              x11::Window window) {
+  std::map<x11::RandR::Output, int> output_to_monitor;
+  if (version >= 105) {
+    if (auto reply = randr->GetMonitors({window}).Sync()) {
+      for (size_t monitor = 0; monitor < reply->monitors.size(); monitor++) {
+        for (x11::RandR::Output output : reply->monitors[monitor].outputs)
+          output_to_monitor[output] = monitor;
+      }
+    }
+  }
+  return output_to_monitor;
+}
+// Get the EDID data from the |output| and stores to |edid|.
+// Private function in ui/base/x/x11_display_util.cc
+std::vector<uint8_t> GetEDIDProperty(x11::RandR* randr,
+                                     x11::RandR::Output output) {
+  constexpr const char kRandrEdidProperty[] = "EDID";
+  auto future = randr->GetOutputProperty(x11::RandR::GetOutputPropertyRequest{
+      .output = output,
+      .property = x11::GetAtom(kRandrEdidProperty),
+      .long_length = 128});
+  auto response = future.Sync();
+  std::vector<uint8_t> edid;
+  if (response && response->format == 8 && response->type != x11::Atom::None)
+    edid = std::move(response->data);
+  return edid;
+}
+
+// Find the mapping from monitor name atom to the display identifier
+// that the screen API uses. Based on the logic in BuildDisplaysFromXRandRInfo
+// in ui/base/x/x11_display_util.cc
+std::map<int32_t, uint32_t> MonitorAtomIdToDisplayId() {
+  auto* connection = x11::Connection::Get();
+  auto& randr = connection->randr();
+  auto x_root_window = ui::GetX11RootWindow();
+  int version = ui::GetXrandrVersion();
+
+  std::map<int32_t, uint32_t> monitor_atom_to_display;
+
+  auto resources = randr.GetScreenResourcesCurrent({x_root_window}).Sync();
+  if (!resources) {
+    LOG(ERROR) << "XRandR returned no displays; don't know how to map ids";
+    return monitor_atom_to_display;
+  }
+
+  std::map<x11::RandR::Output, int> output_to_monitor =
+      GetMonitors(version, &randr, x_root_window);
+  auto monitors_reply = randr.GetMonitors({x_root_window}).Sync();
+
+  for (size_t i = 0; i < resources->outputs.size(); i++) {
+    x11::RandR::Output output_id = resources->outputs[i];
+    auto output_info =
+        randr.GetOutputInfo({output_id, resources->config_timestamp}).Sync();
+    if (!output_info)
+      continue;
+
+    if (output_info->connection != x11::RandR::RandRConnection::Connected)
+      continue;
+
+    if (output_info->crtc == static_cast<x11::RandR::Crtc>(0))
+      continue;
+
+    auto crtc =
+        randr.GetCrtcInfo({output_info->crtc, resources->config_timestamp})
+            .Sync();
+    if (!crtc)
+      continue;
+    display::EdidParser edid_parser(
+        GetEDIDProperty(&randr, static_cast<x11::RandR::Output>(output_id)));
+    auto output_32 = static_cast<uint32_t>(output_id);
+    int64_t display_id =
+        output_32 > 0xff ? 0 : edid_parser.GetIndexBasedDisplayId(output_32);
+    // It isn't ideal, but if we can't parse the EDID data, fall back on the
+    // display number.
+    if (!display_id)
+      display_id = i;
+
+    // Find the mapping between output identifier and the monitor name atom
+    // Note this isn't the atom string, but the numeric atom identifier,
+    // since this is what the WebRTC system uses as the display identifier
+    auto output_monitor_iter = output_to_monitor.find(output_id);
+    if (output_monitor_iter != output_to_monitor.end()) {
+      x11::Atom atom =
+          monitors_reply->monitors[output_monitor_iter->second].name;
+      monitor_atom_to_display[static_cast<int32_t>(atom)] = display_id;
+    }
+  }
+
+  return monitor_atom_to_display;
+}
+#endif
+
 namespace gin {
 
 template <>
@@ -181,10 +295,22 @@ void DesktopCapturer::UpdateSourcesList(DesktopMediaList* list) {
     for (auto& source : screen_sources) {
       source.display_id = base::NumberToString(source.media_list_source.id.id);
     }
+#elif BUILDFLAG(IS_LINUX)
+#if defined(USE_OZONE_PLATFORM_X11)
+    // On Linux, with X11, the source id is the numeric value of the
+    // display name atom and the display id is either the EDID or the
+    // loop index when that display was found (see
+    // BuildDisplaysFromXRandRInfo in ui/base/x/x11_display_util.cc)
+    std::map<int32_t, uint32_t> monitor_atom_to_display_id =
+        MonitorAtomIdToDisplayId();
+    for (auto& source : screen_sources) {
+      auto display_id_iter =
+          monitor_atom_to_display_id.find(source.media_list_source.id.id);
+      if (display_id_iter != monitor_atom_to_display_id.end())
+        source.display_id = base::NumberToString(display_id_iter->second);
+    }
+#endif  // defined(USE_OZONE_PLATFORM_X11)
 #endif  // BUILDFLAG(IS_WIN)
-    // TODO(ajmacd): Add Linux support. The IDs across APIs differ but Chrome
-    // only supports capturing the entire desktop on Linux. Revisit this if
-    // individual screen support is added.
     std::move(screen_sources.begin(), screen_sources.end(),
               std::back_inserter(captured_sources_));
   }

shell/browser/api/electron_api_menu_mac.mm

@@ -134,7 +134,7 @@ void MenuMac::PopupOnUI(const base::WeakPtr<NativeWindow>& native_window,
   if (!item) {
     CGFloat windowBottom = CGRectGetMinY([view window].frame);
     CGFloat lowestMenuPoint = windowBottom + position.y - [menu size].height;
-    CGFloat screenBottom = CGRectGetMinY([view window].screen.frame);
+    CGFloat screenBottom = CGRectGetMinY([view window].screen.visibleFrame);
     CGFloat distanceFromBottom = lowestMenuPoint - screenBottom;
     if (distanceFromBottom < 0)
       position.y = position.y - distanceFromBottom + 4;
@@ -143,7 +143,7 @@ void MenuMac::PopupOnUI(const base::WeakPtr<NativeWindow>& native_window,
   // Place the menu left of cursor if it is overflowing off right of screen.
   CGFloat windowLeft = CGRectGetMinX([view window].frame);
   CGFloat rightmostMenuPoint = windowLeft + position.x + [menu size].width;
-  CGFloat screenRight = CGRectGetMaxX([view window].screen.frame);
+  CGFloat screenRight = CGRectGetMaxX([view window].screen.visibleFrame);
   if (rightmostMenuPoint > screenRight)
     position.x = position.x - [menu size].width;
 

shell/browser/api/electron_api_web_contents.cc

@@ -144,6 +144,10 @@
 #include "shell/browser/osr/osr_web_contents_view.h"
 #endif
 
+#if BUILDFLAG(IS_WIN)
+#include "shell/browser/native_window_views.h"
+#endif
+
 #if !BUILDFLAG(IS_MAC)
 #include "ui/aura/window.h"
 #else
@@ -175,7 +179,7 @@
 #if BUILDFLAG(IS_WIN)
 #include "printing/backend/win_helper.h"
 #endif
-#endif
+#endif  // BUILDFLAG(ENABLE_PRINTING)
 
 #if BUILDFLAG(ENABLE_PICTURE_IN_PICTURE)
 #include "chrome/browser/picture_in_picture/picture_in_picture_window_manager.h"
@@ -676,10 +680,8 @@ WebContents::WebContents(v8::Isolate* isolate,
   auto session = Session::CreateFrom(isolate, GetBrowserContext());
   session_.Reset(isolate, session.ToV8());
 
-  absl::optional<std::string> user_agent_override =
-      GetBrowserContext()->GetUserAgentOverride();
-  if (user_agent_override)
-    SetUserAgent(*user_agent_override);
+  SetUserAgent(GetBrowserContext()->GetUserAgent());
+
   web_contents->SetUserData(kElectronApiWebContentsKey,
                             std::make_unique<UserDataLink>(GetWeakPtr()));
   InitZoomController(web_contents, gin::Dictionary::CreateEmpty(isolate));
@@ -885,10 +887,7 @@ void WebContents::InitWithSessionAndOptions(
 
   AutofillDriverFactory::CreateForWebContents(web_contents());
 
-  absl::optional<std::string> user_agent_override =
-      GetBrowserContext()->GetUserAgentOverride();
-  if (user_agent_override)
-    SetUserAgent(*user_agent_override);
+  SetUserAgent(GetBrowserContext()->GetUserAgent());
 
   if (IsGuest()) {
     NativeWindow* owner_window = nullptr;
@@ -1329,7 +1328,7 @@ void WebContents::EnterFullscreenModeForTab(
   auto callback =
       base::BindRepeating(&WebContents::OnEnterFullscreenModeForTab,
                           base::Unretained(this), requesting_frame, options);
-  permission_helper->RequestFullscreenPermission(callback);
+  permission_helper->RequestFullscreenPermission(requesting_frame, callback);
 }
 
 void WebContents::OnEnterFullscreenModeForTab(
@@ -1345,6 +1344,8 @@ void WebContents::OnEnterFullscreenModeForTab(
     return;
   }
 
+  owner_window()->set_fullscreen_transition_type(
+      NativeWindow::FullScreenTransitionType::HTML);
   exclusive_access_manager_->fullscreen_controller()->EnterFullscreenModeForTab(
       requesting_frame, options.display_id);
 
@@ -1396,11 +1397,6 @@ bool WebContents::HandleContextMenu(content::RenderFrameHost& render_frame_host,
   return true;
 }
 
-bool WebContents::OnGoToEntryOffset(int offset) {
-  GoToOffset(offset);
-  return false;
-}
-
 void WebContents::FindReply(content::WebContents* web_contents,
                             int request_id,
                             int number_of_matches,
@@ -2432,6 +2428,15 @@ void WebContents::OpenDevTools(gin::Arguments* args) {
       !owner_window()) {
     state = "detach";
   }
+
+#if BUILDFLAG(IS_WIN)
+  auto* win = static_cast<NativeWindowViews*>(owner_window());
+  // Force a detached state when WCO is enabled to match Chrome
+  // behavior and prevent occlusion of DevTools.
+  if (win && win->IsWindowControlsOverlayEnabled())
+    state = "detach";
+#endif
+
   bool activate = true;
   if (args && args->Length() == 1) {
     gin_helper::Dictionary options;
@@ -3524,12 +3529,15 @@ void WebContents::EnumerateDirectory(
 
 bool WebContents::IsFullscreenForTabOrPending(
     const content::WebContents* source) {
-  bool transition_fs = owner_window()
-                           ? owner_window()->fullscreen_transition_state() !=
-                                 NativeWindow::FullScreenTransitionState::NONE
-                           : false;
+  if (!owner_window())
+    return html_fullscreen_;
 
-  return html_fullscreen_ || transition_fs;
+  bool in_transition = owner_window()->fullscreen_transition_state() !=
+                       NativeWindow::FullScreenTransitionState::NONE;
+  bool is_html_transition = owner_window()->fullscreen_transition_type() ==
+                            NativeWindow::FullScreenTransitionType::HTML;
+
+  return html_fullscreen_ || (in_transition && is_html_transition);
 }
 
 bool WebContents::TakeFocus(content::WebContents* source, bool reverse) {

shell/browser/api/electron_api_web_contents.h

@@ -552,7 +552,6 @@ class WebContents : public ExclusiveAccessContext,
       content::RenderWidgetHost* render_widget_host) override;
   bool HandleContextMenu(content::RenderFrameHost& render_frame_host,
                          const content::ContextMenuParams& params) override;
-  bool OnGoToEntryOffset(int offset) override;
   void FindReply(content::WebContents* web_contents,
                  int request_id,
                  int number_of_matches,

shell/browser/api/electron_api_web_frame_main.cc

@@ -291,6 +291,12 @@ GURL WebFrameMain::URL() const {
   return render_frame_->GetLastCommittedURL();
 }
 
+std::string WebFrameMain::Origin() const {
+  if (!CheckRenderFrame())
+    return std::string();
+  return render_frame_->GetLastCommittedOrigin().Serialize();
+}
+
 blink::mojom::PageVisibilityState WebFrameMain::VisibilityState() const {
   if (!CheckRenderFrame())
     return blink::mojom::PageVisibilityState::kHidden;
@@ -380,6 +386,7 @@ v8::Local<v8::ObjectTemplate> WebFrameMain::FillObjectTemplate(
       .SetProperty("processId", &WebFrameMain::ProcessID)
       .SetProperty("routingId", &WebFrameMain::RoutingID)
       .SetProperty("url", &WebFrameMain::URL)
+      .SetProperty("origin", &WebFrameMain::Origin)
       .SetProperty("visibilityState", &WebFrameMain::VisibilityState)
       .SetProperty("top", &WebFrameMain::Top)
       .SetProperty("parent", &WebFrameMain::Parent)

shell/browser/api/electron_api_web_frame_main.h

@@ -108,6 +108,7 @@ class WebFrameMain : public gin::Wrappable<WebFrameMain>,
   int ProcessID() const;
   int RoutingID() const;
   GURL URL() const;
+  std::string Origin() const;
   blink::mojom::PageVisibilityState VisibilityState() const;
 
   content::RenderFrameHost* Top() const;

shell/browser/electron_browser_client.cc

@@ -49,6 +49,7 @@
 #include "content/public/browser/tts_controller.h"
 #include "content/public/browser/tts_platform.h"
 #include "content/public/browser/url_loader_request_interceptor.h"
+#include "content/public/browser/weak_document_ptr.h"
 #include "content/public/common/content_descriptors.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
@@ -997,7 +998,7 @@ void ElectronBrowserClient::WebNotificationAllowed(
     return;
   }
   permission_helper->RequestWebNotificationPermission(
-      base::BindOnce(std::move(callback), web_contents->IsAudioMuted()));
+      rfh, base::BindOnce(std::move(callback), web_contents->IsAudioMuted()));
 }
 
 void ElectronBrowserClient::RenderProcessHostDestroyed(
@@ -1032,6 +1033,7 @@ void OnOpenExternal(const GURL& escaped_url, bool allowed) {
 
 void HandleExternalProtocolInUI(
     const GURL& url,
+    content::WeakDocumentPtr document_ptr,
     content::WebContents::OnceGetter web_contents_getter,
     bool has_user_gesture) {
   content::WebContents* web_contents = std::move(web_contents_getter).Run();
@@ -1043,9 +1045,18 @@ void HandleExternalProtocolInUI(
   if (!permission_helper)
     return;
 
+  content::RenderFrameHost* rfh = document_ptr.AsRenderFrameHostIfValid();
+  if (!rfh) {
+    // If the render frame host is not valid it means it was a top level
+    // navigation and the frame has already been disposed of.  In this case we
+    // take the current main frame and declare it responsible for the
+    // transition.
+    rfh = web_contents->GetMainFrame();
+  }
+
   GURL escaped_url(net::EscapeExternalHandlerValue(url.spec()));
   auto callback = base::BindOnce(&OnOpenExternal, escaped_url);
-  permission_helper->RequestOpenExternalPermission(std::move(callback),
+  permission_helper->RequestOpenExternalPermission(rfh, std::move(callback),
                                                    has_user_gesture, url);
 }
 
@@ -1065,6 +1076,9 @@ bool ElectronBrowserClient::HandleExternalProtocol(
   base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&HandleExternalProtocolInUI, url,
+                     initiator_document
+                         ? initiator_document->GetWeakDocumentPtr()
+                         : content::WeakDocumentPtr(),
                      std::move(web_contents_getter), has_user_gesture));
   return true;
 }
@@ -1497,9 +1511,6 @@ bool ElectronBrowserClient::WillCreateURLLoaderFactory(
       std::move(proxied_receiver), std::move(target_factory_remote),
       std::move(header_client_receiver), type);
 
-  if (bypass_redirect_checks)
-    *bypass_redirect_checks = true;
-
   return true;
 }
 

shell/browser/electron_browser_context.cc

@@ -308,11 +308,6 @@ std::string ElectronBrowserContext::GetUserAgent() const {
   return user_agent_.value_or(ElectronBrowserClient::Get()->GetUserAgent());
 }
 
-absl::optional<std::string> ElectronBrowserContext::GetUserAgentOverride()
-    const {
-  return user_agent_;
-}
-
 predictors::PreconnectManager* ElectronBrowserContext::GetPreconnectManager() {
   if (!preconnect_manager_.get()) {
     preconnect_manager_ =

shell/browser/electron_browser_context.h

@@ -85,7 +85,6 @@ class ElectronBrowserContext : public content::BrowserContext {
 
   void SetUserAgent(const std::string& user_agent);
   std::string GetUserAgent() const;
-  absl::optional<std::string> GetUserAgentOverride() const;
   bool CanUseHttpCache() const;
   int GetMaxCacheSize() const;
   ResolveProxyHelper* GetResolveProxyHelper();

shell/browser/electron_browser_main_parts.cc

@@ -17,6 +17,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/icon_manager.h"
+#include "chrome/browser/ui/color/chrome_color_mixers.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "components/os_crypt/key_storage_config_linux.h"
@@ -89,6 +90,7 @@
 #endif
 
 #if BUILDFLAG(IS_MAC)
+#include "components/os_crypt/keychain_password_mac.h"
 #include "services/device/public/cpp/geolocation/geolocation_manager.h"
 #include "shell/browser/ui/cocoa/views_delegate_mac.h"
 #else
@@ -222,6 +224,9 @@ int ElectronBrowserMainParts::PreEarlyInitialization() {
   ui::OzonePlatform::PreEarlyInitialization();
 #endif
 
+  ui::ColorProviderManager::Get().AppendColorProviderInitializer(
+      base::BindRepeating(AddChromeColorMixers));
+
   return GetExitCode();
 }
 
@@ -477,6 +482,9 @@ void ElectronBrowserMainParts::WillRunMainMessageLoop(
 }
 
 void ElectronBrowserMainParts::PostCreateMainMessageLoop() {
+#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC)
+  std::string app_name = electron::Browser::Get()->GetName();
+#endif
 #if BUILDFLAG(IS_LINUX)
   auto shutdown_cb =
       base::BindOnce(base::RunLoop::QuitCurrentWhenIdleClosureDeprecated());
@@ -487,7 +495,6 @@ void ElectronBrowserMainParts::PostCreateMainMessageLoop() {
   // Set up crypt config. This needs to be done before anything starts the
   // network service, as the raw encryption key needs to be shared with the
   // network service for encrypted cookie storage.
-  std::string app_name = electron::Browser::Get()->GetName();
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
   std::unique_ptr<os_crypt::Config> config =
@@ -504,6 +511,10 @@ void ElectronBrowserMainParts::PostCreateMainMessageLoop() {
   base::PathService::Get(chrome::DIR_USER_DATA, &config->user_data_path);
   OSCrypt::SetConfig(std::move(config));
 #endif
+#if BUILDFLAG(IS_MAC)
+  KeychainPassword::GetServiceName() = app_name + " Safe Storage";
+  KeychainPassword::GetAccountName() = app_name;
+#endif
 #if BUILDFLAG(IS_POSIX)
   // Exit in response to SIGINT, SIGTERM, etc.
   InstallShutdownSignalHandlers(

shell/browser/electron_download_manager_delegate.cc

@@ -31,6 +31,16 @@
 #include "shell/common/gin_converters/file_path_converter.h"
 #include "shell/common/options_switches.h"
 
+#if BUILDFLAG(IS_WIN)
+#include <vector>
+
+#include "base/i18n/case_conversion.h"
+#include "base/win/registry.h"
+#include "ui/base/l10n/l10n_util.h"
+#include "ui/shell_dialogs/execute_select_file_win.h"
+#include "ui/strings/grit/ui_strings.h"
+#endif  // BUILDFLAG(IS_WIN)
+
 namespace electron {
 
 namespace {
@@ -63,6 +73,116 @@ base::FilePath CreateDownloadPath(const GURL& url,
   return download_path.Append(generated_name);
 }
 
+#if BUILDFLAG(IS_WIN)
+// Get the file type description from the registry. This will be "Text Document"
+// for .txt files, "JPEG Image" for .jpg files, etc. If the registry doesn't
+// have an entry for the file type, we return false, true if the description was
+// found. 'file_ext' must be in form ".txt".
+// Modified from ui/shell_dialogs/select_file_dialog_win.cc
+bool GetRegistryDescriptionFromExtension(const std::string& file_ext,
+                                         std::string* reg_description) {
+  DCHECK(reg_description);
+  base::win::RegKey reg_ext(HKEY_CLASSES_ROOT,
+                            base::UTF8ToWide(file_ext).c_str(), KEY_READ);
+  std::wstring reg_app;
+  if (reg_ext.ReadValue(nullptr, &reg_app) == ERROR_SUCCESS &&
+      !reg_app.empty()) {
+    base::win::RegKey reg_link(HKEY_CLASSES_ROOT, reg_app.c_str(), KEY_READ);
+    std::wstring description;
+    if (reg_link.ReadValue(nullptr, &description) == ERROR_SUCCESS) {
+      *reg_description = base::WideToUTF8(description);
+      return true;
+    }
+  }
+  return false;
+}
+
+// Set up a filter for a Save/Open dialog, |ext_desc| as the text descriptions
+// of the |file_ext| types (optional), and (optionally) the default 'All Files'
+// view. The purpose of the filter is to show only files of a particular type in
+// a Windows Save/Open dialog box. The resulting filter is returned. The filters
+// created here are:
+//   1. only files that have 'file_ext' as their extension
+//   2. all files (only added if 'include_all_files' is true)
+// If a description is not provided for a file extension, it will be retrieved
+// from the registry. If the file extension does not exist in the registry, a
+// default description will be created (e.g. "qqq" yields "QQQ File").
+// Modified from ui/shell_dialogs/select_file_dialog_win.cc
+file_dialog::Filters FormatFilterForExtensions(
+    const std::vector<std::string>& file_ext,
+    const std::vector<std::string>& ext_desc,
+    bool include_all_files,
+    bool keep_extension_visible) {
+  const std::string all_ext = "*";
+  const std::string all_desc =
+      l10n_util::GetStringUTF8(IDS_APP_SAVEAS_ALL_FILES);
+
+  DCHECK(file_ext.size() >= ext_desc.size());
+
+  if (file_ext.empty())
+    include_all_files = true;
+
+  file_dialog::Filters result;
+  result.reserve(file_ext.size() + 1);
+
+  for (size_t i = 0; i < file_ext.size(); ++i) {
+    std::string ext = file_ext[i];
+    std::string desc;
+    if (i < ext_desc.size())
+      desc = ext_desc[i];
+
+    if (ext.empty()) {
+      // Force something reasonable to appear in the dialog box if there is no
+      // extension provided.
+      include_all_files = true;
+      continue;
+    }
+
+    if (desc.empty()) {
+      DCHECK(ext.find('.') != std::string::npos);
+      std::string first_extension = ext.substr(ext.find('.'));
+      size_t first_separator_index = first_extension.find(';');
+      if (first_separator_index != std::string::npos)
+        first_extension = first_extension.substr(0, first_separator_index);
+
+      // Find the extension name without the preceeding '.' character.
+      std::string ext_name = first_extension;
+      size_t ext_index = ext_name.find_first_not_of('.');
+      if (ext_index != std::string::npos)
+        ext_name = ext_name.substr(ext_index);
+
+      if (!GetRegistryDescriptionFromExtension(first_extension, &desc)) {
+        // The extension doesn't exist in the registry. Create a description
+        // based on the unknown extension type (i.e. if the extension is .qqq,
+        // then we create a description "QQQ File").
+        desc = l10n_util::GetStringFUTF8(
+            IDS_APP_SAVEAS_EXTENSION_FORMAT,
+            base::i18n::ToUpper(base::UTF8ToUTF16(ext_name)));
+        include_all_files = true;
+      }
+      if (desc.empty())
+        desc = "*." + ext_name;
+    } else if (keep_extension_visible) {
+      // Having '*' in the description could cause the windows file dialog to
+      // not include the file extension in the file dialog. So strip out any '*'
+      // characters if `keep_extension_visible` is set.
+      base::ReplaceChars(desc, "*", base::StringPiece(), &desc);
+    }
+
+    // Remove the preceeding '.' character from the extension.
+    size_t ext_index = ext.find_first_not_of('.');
+    if (ext_index != std::string::npos)
+      ext = ext.substr(ext_index);
+    result.push_back({desc, {ext}});
+  }
+
+  if (include_all_files)
+    result.push_back({all_desc, {all_ext}});
+
+  return result;
+}
+#endif  // BUILDFLAG(IS_WIN)
+
 }  // namespace
 
 ElectronDownloadManagerDelegate::ElectronDownloadManagerDelegate(
@@ -131,6 +251,16 @@ void ElectronDownloadManagerDelegate::OnDownloadPathGenerated(
     const bool offscreen = !web_preferences || web_preferences->IsOffscreen();
     settings.force_detached = offscreen;
 
+#if BUILDFLAG(IS_WIN)
+    if (settings.filters.empty()) {
+      const std::wstring extension = settings.default_path.FinalExtension();
+      if (!extension.empty()) {
+        settings.filters = FormatFilterForExtensions(
+            {base::WideToUTF8(extension)}, {""}, true, true);
+      }
+    }
+#endif  // BUILDFLAG(IS_WIN)
+
     v8::Isolate* isolate = JavascriptEnvironment::GetIsolate();
     v8::HandleScope scope(isolate);
     gin_helper::Promise<gin_helper::Dictionary> dialog_promise(isolate);

shell/browser/native_browser_view_mac.mm

@@ -262,9 +262,21 @@ void NativeBrowserViewMac::SetBounds(const gfx::Rect& bounds) {
   auto* view = iwc_view->GetNativeView().GetNativeNSView();
   auto* superview = view.superview;
   const auto superview_height = superview ? superview.frame.size.height : 0;
+
+  // We need to use the content rect to calculate the titlebar height if the
+  // superview is an framed NSWindow, otherwise it will be offset incorrectly by
+  // the height of the titlebar.
+  auto titlebar_height = 0;
+  if (auto* win = [superview window]) {
+    const auto content_rect_height =
+        [win contentRectForFrameRect:superview.frame].size.height;
+    titlebar_height = superview_height - content_rect_height;
+  }
+
+  auto new_height =
+      superview_height - bounds.y() - bounds.height() + titlebar_height;
   view.frame =
-      NSMakeRect(bounds.x(), superview_height - bounds.y() - bounds.height(),
-                 bounds.width(), bounds.height());
+      NSMakeRect(bounds.x(), new_height, bounds.width(), bounds.height());
 
   // Ensure draggable regions are properly updated to reflect new bounds.
   UpdateDraggableRegions(draggable_regions_);
@@ -275,12 +287,23 @@ gfx::Rect NativeBrowserViewMac::GetBounds() {
   if (!iwc_view)
     return gfx::Rect();
   NSView* view = iwc_view->GetNativeView().GetNativeNSView();
-  const int superview_height =
-      (view.superview) ? view.superview.frame.size.height : 0;
-  return gfx::Rect(
-      view.frame.origin.x,
-      superview_height - view.frame.origin.y - view.frame.size.height,
-      view.frame.size.width, view.frame.size.height);
+  auto* superview = view.superview;
+  const int superview_height = superview ? superview.frame.size.height : 0;
+
+  // We need to use the content rect to calculate the titlebar height if the
+  // superview is an framed NSWindow, otherwise it will be offset incorrectly by
+  // the height of the titlebar.
+  auto titlebar_height = 0;
+  if (auto* win = [superview window]) {
+    const auto content_rect_height =
+        [win contentRectForFrameRect:superview.frame].size.height;
+    titlebar_height = superview_height - content_rect_height;
+  }
+
+  auto new_height = superview_height - view.frame.origin.y -
+                    view.frame.size.height + titlebar_height;
+  return gfx::Rect(view.frame.origin.x, new_height, view.frame.size.width,
+                   view.frame.size.height);
 }
 
 void NativeBrowserViewMac::SetBackgroundColor(SkColor color) {

shell/browser/native_window.cc

@@ -719,8 +719,10 @@ std::string NativeWindow::GetAccessibleTitle() {
 }
 
 void NativeWindow::HandlePendingFullscreenTransitions() {
-  if (pending_transitions_.empty())
+  if (pending_transitions_.empty()) {
+    set_fullscreen_transition_type(FullScreenTransitionType::NONE);
     return;
+  }
 
   bool next_transition = pending_transitions_.front();
   pending_transitions_.pop();