check was in the wrong place

This reverts commit a09003c6fb2c55d1fb1cb303b621c0f4c2f5376c.

.devcontainer/README.md

@@ -25,9 +25,19 @@ Codespaces doesn't lean very well into gclient based checkouts, the directory st
 /workspaces/electron
 ```
 
-## Goma
+## Reclient
 
-If you are a maintainer [with Goma access](../docs/development/goma.md) it should be automatically configured and authenticated when you spin up a new codespaces instance.  You can validate this by checking `e d goma_auth info` or by checking that your build-tools configuration has a goma mode of `cluster`.
+If you are a maintainer [with Reclient access](../docs/development/reclient.md) you'll need to ensure you're authenticated when you spin up a new codespaces instance.  You can validate this by checking `e d rbe info` - your build-tools configuration should have `Access` type `Cache & Execute`:
+
+```console
+Authentication Status: Authenticated
+Since:     2024-05-28 10:29:33 +0200 CEST
+Expires:   2024-08-26 10:29:33 +0200 CEST
+...
+Access:    Cache & Execute
+```
+
+To authenticate if you're not logged in, run `e d rbe login` and follow the link to authenticate.
 
 ## Running Electron
 

.devcontainer/on-create-command.sh

@@ -59,7 +59,6 @@ if [ ! -f $buildtools/configs/evm.testing.json ]; then
             \"\$schema\": \"file:///home/builduser/.electron_build_tools/evm-config.schema.json\",
             \"configValidationLevel\": \"strict\",
             \"reclient\": \"$1\",
-            \"goma\": \"none\",
             \"preserveXcode\": 5
         }
     " >$buildtools/configs/evm.testing.json

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -26,7 +26,8 @@ body:
     required: true
 - type: dropdown
   attributes:
-    label: What operating system are you using?
+    label: What operating system(s) are you using?
+    multiple: true
     options:
       - Windows
       - macOS

.github/actions/build-electron/action.yml

@@ -90,7 +90,6 @@ runs:
         fi
         sed $SEDOPTION '/.*builtins-pgo/d' out/Default/mksnapshot_args
         sed $SEDOPTION '/--turbo-profiling-input/d' out/Default/mksnapshot_args
-        sed $SEDOPTION '/The gn arg use_goma=true .*/d' out/Default/mksnapshot_args
 
         if [ "`uname`" = "Linux" ]; then
           if [ "${{ inputs.target-arch }}" = "arm" ]; then
@@ -217,4 +216,4 @@ runs:
       uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
       with:
         name: src_artifacts_${{ env.ARTIFACT_KEY }}
-        path: ./src_artifacts_${{ inputs.artifact-platform }}_${{ inputs.target-arch }}
+        path: ./src_artifacts_${{ inputs.artifact-platform }}_${{ inputs.target-arch }}

.github/actions/fix-sync-macos/action.yml

@@ -58,4 +58,4 @@ runs:
         cp .git/config .git/config.backup
         git remote remove origin
         mv .git/config.backup .git/config
-        git fetch
+        git fetch

.github/actions/install-build-tools/action.yml

@@ -8,4 +8,4 @@ runs:
     run: |
       export BUILD_TOOLS_SHA=d5b87591842be19058e8d75d2c5b7f1fabe9f450
       npm i -g @electron/build-tools
-      e auto-update disable
+      e auto-update disable

.github/actions/restore-cache-aks/action.yml

@@ -33,4 +33,4 @@ runs:
       fi
 
       echo "Wiping Electron Directory"
-      rm -rf src/electron
+      rm -rf src/electron

.github/workflows/build.yml

@@ -242,4 +242,4 @@ jobs:
       gn-build-type: testing
       generate-symbols: false
       upload-to-storage: '0'
-    secrets: inherit
+    secrets: inherit

.github/workflows/issue-opened.yml

@@ -35,9 +35,10 @@ jobs:
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
-      - run: npm install mdast-util-from-markdown@2.0.0 unist-util-select@5.1.0 semver@7.6.0
+      - run: npm install @electron/fiddle-core@1.3.3 mdast-util-from-markdown@2.0.0 unist-util-select@5.1.0 semver@7.6.0
       - name: Add labels
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        id: add-labels
         env:
           ISSUE_BODY: ${{ github.event.issue.body }}
         with:
@@ -71,6 +72,15 @@ jobs:
                 } catch {}
 
                 if (labelExists) {
+                  // Check if it's an unsupported major
+                  const { ElectronVersions } = await import('${{ github.workspace }}/node_modules/@electron/fiddle-core/dist/index.js');
+                  const versions = await ElectronVersions.create(undefined, { ignoreCache: true });
+
+                  if (!versions.supportedMajors.includes(major)) {
+                    core.setOutput('unsupportedMajor', true);
+                    labels.push('blocked/need-info ❌');
+                  }
+
                   labels.push(versionLabel);
                 }
               }
@@ -89,3 +99,17 @@ jobs:
                 labels,
               });
             }
+      - name: Create unsupported major comment
+        if: ${{ steps.add-labels.outputs.unsupportedMajor }}
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
+        with:
+          actions: 'create-comment'
+          token: ${{ steps.generate-token.outputs.token }}
+          body: |
+            <!-- end-of-life -->
+
+            Hello @${{ github.event.issue.user.login }}. Thanks for reporting this and helping to make Electron better!
+            
+            The version of Electron reported in this issue has reached end-of-life and is [no longer supported](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#timeline). If you're still experiencing this issue on a [supported version](https://www.electronjs.org/releases/stable) of Electron, please update this issue to reflect that version of Electron.
+
+            Now adding the https://github.com/electron/electron/labels/blocked%2Fneed-info%20%E2%9D%8C label for this reason. This issue will be closed in 10 days if the above is not addressed.

.github/workflows/linux-publish.yml

@@ -83,4 +83,4 @@ jobs:
       generate-symbols: true
       strip-binaries: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
-    secrets: inherit
+    secrets: inherit

.github/workflows/macos-publish.yml

@@ -66,4 +66,4 @@ jobs:
       gn-build-type: release
       generate-symbols: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
-    secrets: inherit
+    secrets: inherit

.github/workflows/non-maintainer-dependency-change.yml

@@ -0,0 +1,37 @@
+name: Check for Non-Maintainer Dependency Change
+
+on:
+  pull_request_target:
+    paths:
+      - 'yarn.lock'
+      - 'spec/yarn.lock'
+
+permissions: {}
+
+jobs:
+  check-for-non-maintainer-dependency-change:
+    name: Check for non-maintainer dependency change
+    if: ${{ !contains(fromJSON('["MEMBER", "OWNER"]'), github.event.pull_request.author_association) && github.event.pull_request.user.type != 'Bot' && !github.event.pull_request.draft }}
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for existing review
+        id: check-for-review
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          set -eo pipefail
+          REVIEW_COUNT=$(gh pr view $PR_URL --json reviews | jq '[ .reviews[] | select(.author.login == "github-actions") | select(.body | startswith("<!-- no-dependency-change -->")) ] | length')
+          if [[ $REVIEW_COUNT -eq 0 ]]; then
+            echo "SHOULD_REVIEW=1" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Request changes
+        if: ${{ steps.check-for-review.outputs.SHOULD_REVIEW }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          printf "<!-- no-dependency-change -->\n\nHello @${{ github.event.pull_request.user.login }}! It looks like this pull request touches one of our dependency files, and per [our contribution policy](https://github.com/electron/electron/blob/main/CONTRIBUTING.md#dependencies-upgrades-policy) we do not accept these types of changes in PRs." | gh pr review $PR_URL -r --body-file=-

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -100,4 +100,4 @@ jobs:
       test-runs-on: ${{ inputs.test-runs-on }}
       test-container: ${{ inputs.test-container }}
       gn-build-type: ${{ inputs.gn-build-type }}
-    secrets: inherit
+    secrets: inherit

.github/workflows/pipeline-electron-build-and-test.yml

@@ -97,4 +97,4 @@ jobs:
       test-runs-on: ${{ inputs.test-runs-on }}
       test-container: ${{ inputs.test-container }}
       is-asan: ${{ inputs.is-asan}}
-    secrets: inherit
+    secrets: inherit

.github/workflows/pipeline-electron-docs-only.yml

@@ -40,4 +40,4 @@ jobs:
             if [ "$out" != "base.js" ]; then
             node script/yarn webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
             fi
-        done
+        done

.github/workflows/pipeline-segment-electron-build.yml

@@ -84,7 +84,7 @@ jobs:
         fetch-depth: 0
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'macos' }}
-      uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8
+      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b
       with:
         node-version: 20.11.x
         cache: yarn
@@ -208,4 +208,4 @@ jobs:
         is-release: '${{ inputs.is-release }}'
         generate-symbols: '${{ inputs.generate-symbols }}'
         upload-to-storage: '${{ inputs.upload-to-storage }}'
-        step-suffix: '(mas)'
+        step-suffix: '(mas)'

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -138,4 +138,4 @@ jobs:
         while [ -f /var/.ssh-lock ]
         do
           sleep 60
-        done
+        done

.github/workflows/pipeline-segment-electron-test.yml

@@ -125,12 +125,12 @@ jobs:
         echo "DISABLE_CRASH_REPORTER_TESTS=true" >> $GITHUB_ENV
         echo "IS_ASAN=true" >> $GITHUB_ENV
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
       with:
         name: generated_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./generated_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
       with:
         name: src_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
@@ -187,10 +187,17 @@ jobs:
             runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
           fi
         fi
+    - name: Upload Test Artifacts
+      if: always() && !cancelled()
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
+      with:
+        name: test_artifacts_${{ env.ARTIFACT_KEY }}
+        path: src/electron/spec/artifacts
+        if-no-files-found: ignore
     - name: Wait for active SSH sessions
       if: always() && !cancelled()
       run: |
         while [ -f /var/.ssh-lock ]
         do
           sleep 60
-        done
+        done

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -71,12 +71,12 @@ jobs:
     - name: Add Depot Tools to PATH
       run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
@@ -135,12 +135,12 @@ jobs:
     - name: Add Depot Tools to PATH
       run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
@@ -152,7 +152,7 @@ jobs:
         unzip -:o dist.zip
     - name: Setup Linux for Headless Testing
       run: sh -e /etc/init.d/xvfb start
-    - name: Run Node.js Tests
+    - name: Run Nan Tests
       run: |
         cd src
         node electron/script/nan-spec-runner.js
@@ -162,4 +162,4 @@ jobs:
         while [ -f /var/.ssh-lock ]
         do
           sleep 60
-        done
+        done

.github/workflows/scorecards.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
 
@@ -42,7 +42,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: SARIF file
           path: results.sarif
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f079b8493333aace61c81488f8bd40919487bd9f # v3.25.7
+        uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
         with:
           sarif_file: results.sarif

.github/workflows/semantic.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: semantic-pull-request
-        uses: amannn/action-semantic-pull-request@cfb60706e18bc85e8aec535e3c577abe8f70378e # v5.5.2
+        uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/update_appveyor_image.yml

@@ -19,7 +19,7 @@ jobs:
       with:
         creds: ${{ secrets.APPVEYOR_UPDATER_GH_APP_CREDS }}
     - name: Checkout
-      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         fetch-depth: 0
         token: ${{ steps.generate-token.outputs.token }}
@@ -39,7 +39,7 @@ jobs:
         fi
     - name: (Optionally) Update Appveyor Image
       if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      uses: mikefarah/yq@557dcb87b8efe786f89a12c09e9046b4753ab72e # v4.44.1
+      uses: mikefarah/yq@f15500b20a1c991c8729870ba60a4dc3524b6a94 # v4.44.2
       with:
         cmd: |
           yq '.image = "${{ env.APPVEYOR_IMAGE_VERSION }}"' "appveyor.yml" > "appveyor2.yml"

.nvmrc

@@ -1 +1 @@
-16
+20

appveyor-woa.yml

@@ -149,7 +149,7 @@ for:
       - gn desc out/Default v8:run_mksnapshot_default args > out/Default/default_mksnapshot_args
       # Remove unused args from mksnapshot_args
       - ps: >-
-          Get-Content out/Default/default_mksnapshot_args | Where-Object { -not $_.Contains('--turbo-profiling-input') -And -not $_.Contains('builtins-pgo') -And -not $_.Contains('The gn arg use_goma=true') } | Set-Content out/Default/mksnapshot_args
+          Get-Content out/Default/default_mksnapshot_args | Where-Object { -not $_.Contains('--turbo-profiling-input') -And -not $_.Contains('builtins-pgo') } | Set-Content out/Default/mksnapshot_args
       - autoninja -C out/Default electron:electron_mksnapshot_zip
       - cd out\Default
       - 7z a mksnapshot.zip mksnapshot_args gen\v8\embedded.S

appveyor.yml

@@ -147,7 +147,7 @@ for:
       - gn desc out/Default v8:run_mksnapshot_default args > out/Default/default_mksnapshot_args
       # Remove unused args from mksnapshot_args
       - ps: >-
-          Get-Content out/Default/default_mksnapshot_args | Where-Object { -not $_.Contains('--turbo-profiling-input') -And -not $_.Contains('builtins-pgo') -And -not $_.Contains('The gn arg use_goma=true') } | Set-Content out/Default/mksnapshot_args
+          Get-Content out/Default/default_mksnapshot_args | Where-Object { -not $_.Contains('--turbo-profiling-input') -And -not $_.Contains('builtins-pgo') } | Set-Content out/Default/mksnapshot_args
       - autoninja -C out/Default electron:electron_mksnapshot_zip
       - cd out\Default
       - 7z a mksnapshot.zip mksnapshot_args gen\v8\embedded.S

chromium_src/BUILD.gn

@@ -14,6 +14,8 @@ import("//third_party/widevine/cdm/widevine.gni")
 static_library("chrome") {
   visibility = [ "//electron:electron_lib" ]
   sources = [
+    "//ash/style/rounded_rect_cutout_path_builder.cc",
+    "//ash/style/rounded_rect_cutout_path_builder.h",
     "//chrome/browser/app_mode/app_mode_utils.cc",
     "//chrome/browser/app_mode/app_mode_utils.h",
     "//chrome/browser/browser_features.cc",

docs/api/app.md

@@ -1489,6 +1489,38 @@ This method can only be called after app is ready.
 
 Returns `Promise<string>` - Resolves with the proxy information for `url` that will be used when attempting to make requests using [Net](net.md) in the [utility process](../glossary.md#utility-process).
 
+### `app.setClientCertRequestPasswordHandler(handler)`  _Linux_
+
+* `handler` Function\<Promise\<string\>\>
+  * `clientCertRequestParams` Object
+    * `hostname` string - the hostname of the site requiring a client certificate
+    * `tokenName` string - the token (or slot) name of the cryptographic device
+    * `isRetry` boolean - whether there have been previous failed attempts at prompting the password
+
+  Returns `Promise<string>` - Resolves with the password
+
+The handler is called when a password is needed to unlock a client certificate for
+`hostname`.
+
+```js
+const { app } = require('electron')
+
+async function passwordPromptUI (text) {
+  return new Promise((resolve, reject) => {
+    // display UI to prompt user for password
+    // ...
+    // ...
+    resolve('the password')
+  })
+}
+
+app.setClientCertRequestPasswordHandler(async ({ hostname, tokenName, isRetry }) => {
+  const text = `Please sign in to ${tokenName} to authenticate to ${hostname} with your certificate`
+  const password = await passwordPromptUI(text)
+  return password
+})
+```
+
 ## Properties
 
 ### `app.accessibilitySupportEnabled` _macOS_ _Windows_

docs/api/dock.md

@@ -80,4 +80,4 @@ Returns `Menu | null` - The application's [dock menu][dock-menu].
 
 Sets the `image` associated with this dock icon.
 
-[dock-menu]: https://developer.apple.com/macos/human-interface-guidelines/menus/dock-menus/
+[dock-menu]: https://developer.apple.com/design/human-interface-guidelines/dock-menus

docs/api/net.md

@@ -130,7 +130,7 @@ won't be able to connect to remote sites. However, a return value of
 whether a particular connection attempt to a particular remote site
 will be successful.
 
-#### `net.resolveHost(host, [options])`
+### `net.resolveHost(host, [options])`
 
 * `host` string - Hostname to resolve.
 * `options` Object (optional)

docs/api/view.md

@@ -94,6 +94,12 @@ Examples of valid `color` values:
 
 **Note:** Hex format with alpha takes `AARRGGBB` or `ARGB`, _not_ `RRGGBBAA` or `RGB`.
 
+#### `view.setBorderRadius(radius)`
+
+* `radius` Integer - Border radius size in pixels.
+
+**Note:** The area cutout of the view's border still captures clicks.
+
 #### `view.setVisible(visible)`
 
 * `visible` boolean - If false, the view will be hidden from display.

docs/api/web-contents.md

@@ -1566,7 +1566,7 @@ If you would like the page to stay hidden, you should ensure that `stayHidden` i
 #### `contents.isBeingCaptured()`
 
 Returns `boolean` - Whether this page is being captured. It returns true when the capturer count
-is large then 0.
+is greater than 0.
 
 #### `contents.getPrintersAsync()`
 

docs/development/goma.md

@@ -1,6 +0,0 @@
-# Goma
-
-> Goma is a distributed compiler service for open-source projects such as
-> Chromium and Android.
-
-Electron's deployment of Goma is deprecated and we are gradually shifting all usage to the [reclient](reclient.md) system. At some point in 2024 the Goma backend will be shutdown.

filenames.gni

@@ -362,6 +362,8 @@ filenames = {
     "shell/browser/electron_browser_context.h",
     "shell/browser/electron_browser_main_parts.cc",
     "shell/browser/electron_browser_main_parts.h",
+    "shell/browser/electron_crypto_module_delegate_nss.cc",
+    "shell/browser/electron_crypto_module_delegate_nss.h",
     "shell/browser/electron_download_manager_delegate.cc",
     "shell/browser/electron_download_manager_delegate.h",
     "shell/browser/electron_gpu_client.cc",

lib/browser/api/app.ts

@@ -111,3 +111,19 @@ for (const name of events) {
     webContents.emit(name, event, ...args);
   });
 }
+
+app._clientCertRequestPasswordHandler = null;
+app.setClientCertRequestPasswordHandler = function (handler: (params: Electron.ClientCertRequestParams) => Promise<string>) {
+  app._clientCertRequestPasswordHandler = handler;
+};
+
+app.on('-client-certificate-request-password', async (event: Electron.Event<Electron.ClientCertRequestParams>, callback: (password: string) => void) => {
+  event.preventDefault();
+  const { hostname, tokenName, isRetry } = event;
+  if (!app._clientCertRequestPasswordHandler) {
+    callback('');
+    return;
+  }
+  const password = await app._clientCertRequestPasswordHandler({ hostname, tokenName, isRetry });
+  callback(password);
+});

package.json

@@ -9,7 +9,7 @@
     "@electron/docs-parser": "^1.2.0",
     "@electron/fiddle-core": "^1.0.4",
     "@electron/github-app-auth": "^2.0.0",
-    "@electron/lint-roller": "^2.3.0",
+    "@electron/lint-roller": "^2.2.0",
     "@electron/typescript-definitions": "^8.15.2",
     "@octokit/rest": "^19.0.7",
     "@primer/octicons": "^10.0.0",

patches/chromium/.patches

@@ -130,3 +130,5 @@ fix_font_face_resolution_when_renderer_is_blocked.patch
 feat_enable_passing_exit_code_on_service_process_crash.patch
 chore_remove_reference_to_chrome_browser_themes.patch
 feat_enable_customizing_symbol_color_in_framecaptionbutton.patch
+x11_use_localized_display_label_only_for_browser_process.patch
+fix_workaround_frame_eviction_bug.patch

patches/chromium/fix_workaround_frame_eviction_bug.patch

@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: George Xu <george.xu@slack-corp.com>
+Date: Mon, 24 Jun 2024 15:07:24 -0700
+Subject: fix: workaround frame eviction bug
+
+Electron window contents are disappearing after several minutes when using the background throttling feature on Windows.
+
+This is due to a bug in `disable_hidden.patch`- a detailed writeup can be found in the linked issue.
+
+https://github.com/electron/electron/issues/42378
+
+diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
+index 2db3239303d59677384cfb6eeb5cdd101c7d6d5c..f82ddb44196a70d79af933cb6ad826b8323cd5ce 100644
+--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
++++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
+@@ -570,7 +570,7 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
+   // OnShowWithPageVisibility will not call NotifyHostAndDelegateOnWasShown,
+   // which updates `visibility_`, unless the host is hidden. Make sure no update
+   // is needed.
+-  if (host_->is_hidden() || visibility_ == Visibility::VISIBLE)
++  if (host_->is_hidden() || host()->disable_hidden_ || visibility_ == Visibility::VISIBLE)
+     OnShowWithPageVisibility(page_visibility);
+ }
+ 
+@@ -588,7 +588,7 @@ void RenderWidgetHostViewAura::EnsurePlatformVisibility(
+ void RenderWidgetHostViewAura::NotifyHostAndDelegateOnWasShown(
+     blink::mojom::RecordContentToVisibleTimeRequestPtr tab_switch_start_state) {
+   CHECK(delegated_frame_host_) << "Cannot be invoked during destruction.";
+-  CHECK(host_->is_hidden());
++  CHECK(host_->is_hidden() || host()->disable_hidden_);
+   CHECK_NE(visibility_, Visibility::VISIBLE);
+ 
+   visibility_ = Visibility::VISIBLE;
+diff --git a/content/browser/renderer_host/render_widget_host_view_base.cc b/content/browser/renderer_host/render_widget_host_view_base.cc
+index ad42e2d94ab498dd30968e62aebd62e14f8161ab..66623189c7ad951646d49d7619b63bbb2a35036d 100644
+--- a/content/browser/renderer_host/render_widget_host_view_base.cc
++++ b/content/browser/renderer_host/render_widget_host_view_base.cc
+@@ -1132,7 +1132,7 @@ void RenderWidgetHostViewBase::OnShowWithPageVisibility(
+   const bool web_contents_is_visible =
+       page_visibility == PageVisibilityState::kVisible;
+ 
+-  if (host_->is_hidden()) {
++  if (host_->is_hidden() || host()->disable_hidden_) {
+     // If the WebContents is becoming visible, ask the compositor to report the
+     // visibility time for metrics. Otherwise the widget is being rendered even
+     // though the WebContents is hidden or occluded, for example due to being

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -17,20 +17,10 @@ Upstreams:
 - https://github.com/nodejs/node/pull/39136
 
 diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
-index 67cd4f2adf15e7d8511f561c54163b1842e971af..7e0e1a62289289b8362870ba4869c97494b9298a 100644
+index 67cd4f2adf15e7d8511f561c54163b1842e971af..88471fd6bc0b8a810bb55464cd2d1933d11a8623 100644
 --- a/src/crypto/crypto_cipher.cc
 +++ b/src/crypto/crypto_cipher.cc
-@@ -28,7 +28,8 @@ using v8::Value;
- namespace crypto {
- namespace {
- bool IsSupportedAuthenticatedMode(const EVP_CIPHER* cipher) {
--  switch (EVP_CIPHER_mode(cipher)) {
-+  const int mode = EVP_CIPHER_mode(cipher);
-+  switch (mode) {
-   case EVP_CIPH_CCM_MODE:
-   case EVP_CIPH_GCM_MODE:
- #ifndef OPENSSL_NO_OCB
-@@ -1088,7 +1089,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -1088,7 +1088,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
      if (EVP_PKEY_decrypt_init(ctx.get()) <= 0) {
        return ThrowCryptoError(env, ERR_get_error());
      }
@@ -39,7 +29,7 @@ index 67cd4f2adf15e7d8511f561c54163b1842e971af..7e0e1a62289289b8362870ba4869c974
      int rsa_pkcs1_implicit_rejection =
          EVP_PKEY_CTX_ctrl_str(ctx.get(), "rsa_pkcs1_implicit_rejection", "1");
      // From the doc -2 means that the option is not supported.
-@@ -1104,6 +1105,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -1104,6 +1104,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
            "RSA_PKCS1_PADDING is no longer supported for private decryption,"
            " this can be reverted with --security-revert=CVE-2023-46809");
      }
@@ -48,7 +38,7 @@ index 67cd4f2adf15e7d8511f561c54163b1842e971af..7e0e1a62289289b8362870ba4869c974
  
    const EVP_MD* digest = nullptr;
 diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
-index ee1c7931a5c83eec00fe05807ddb97572fe70cc9..8e297e57fdbc9fd42beb6e4a33cc91b9dd7316b8 100644
+index ee1c7931a5c83eec00fe05807ddb97572fe70cc9..008fa0c04c3dadfe69f87728840f9326a150c7b3 100644
 --- a/src/crypto/crypto_common.cc
 +++ b/src/crypto/crypto_common.cc
 @@ -158,7 +158,7 @@ const char* GetClientHelloALPN(const SSLPointer& ssl) {
@@ -86,18 +76,7 @@ index ee1c7931a5c83eec00fe05807ddb97572fe70cc9..8e297e57fdbc9fd42beb6e4a33cc91b9
  }
  
  const char* GetServerName(SSL* ssl) {
-@@ -206,7 +210,10 @@ const char* GetServerName(SSL* ssl) {
- }
- 
- bool SetGroups(SecureContext* sc, const char* groups) {
-+#ifndef OPENSSL_IS_BORINGSSL
-   return SSL_CTX_set1_groups_list(sc->ctx().get(), groups) == 1;
-+#endif
-+  return SSL_CTX_set1_curves_list(sc->ctx().get(), groups) == 1;
- }
- 
- // When adding or removing errors below, please also update the list in the API
-@@ -1044,14 +1051,14 @@ MaybeLocal<Array> GetClientHelloCiphers(
+@@ -1044,14 +1048,14 @@ MaybeLocal<Array> GetClientHelloCiphers(
      Environment* env,
      const SSLPointer& ssl) {
    EscapableHandleScope scope(env->isolate());
@@ -143,7 +122,7 @@ index 6e5bbe07d0c337b36f3157c2e6404fdc91849fd1..7ec682833213de9054a8c30751436d12
    DHPointer dh;
    {
 diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
-index b4447102a8478639a5aa774e583834d79808603f..ecf938d51ccdbfcb825d44c5ed4ea1229cb05389 100644
+index b4447102a8478639a5aa774e583834d79808603f..fa507b6d3c04691f44b3302058d2007a966306db 100644
 --- a/src/crypto/crypto_dh.cc
 +++ b/src/crypto/crypto_dh.cc
 @@ -154,13 +154,11 @@ bool DiffieHellman::Init(BignumPointer&& bn_p, int g) {
@@ -197,21 +176,11 @@ index b4447102a8478639a5aa774e583834d79808603f..ecf938d51ccdbfcb825d44c5ed4ea122
    V("modp5", BN_get_rfc3526_prime_1536);
    V("modp14", BN_get_rfc3526_prime_2048);
    V("modp15", BN_get_rfc3526_prime_3072);
-@@ -559,15 +556,21 @@ EVPKeyCtxPointer DhKeyGenTraits::Setup(DhKeyPairGenConfig* params) {
-       return EVPKeyCtxPointer();
-     }
- 
-+#ifndef OPENSSL_IS_BORINGSSL
-     prime_fixed_value->release();
-     bn_g.release();
- 
+@@ -565,9 +562,11 @@ EVPKeyCtxPointer DhKeyGenTraits::Setup(DhKeyPairGenConfig* params) {
      key_params = EVPKeyPointer(EVP_PKEY_new());
      CHECK(key_params);
      CHECK_EQ(EVP_PKEY_assign_DH(key_params.get(), dh.release()), 1);
 -  } else if (int* prime_size = std::get_if<int>(&params->params.prime)) {
-+#else
-+    return EVPKeyCtxPointer();
-+#endif
 +  } else if (std::get_if<int>(&params->params.prime)) {
      EVPKeyCtxPointer param_ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_DH, nullptr));
      EVP_PKEY* raw_params = nullptr;
@@ -220,7 +189,7 @@ index b4447102a8478639a5aa774e583834d79808603f..ecf938d51ccdbfcb825d44c5ed4ea122
      if (!param_ctx ||
          EVP_PKEY_paramgen_init(param_ctx.get()) <= 0 ||
          EVP_PKEY_CTX_set_dh_paramgen_prime_len(
-@@ -581,6 +584,9 @@ EVPKeyCtxPointer DhKeyGenTraits::Setup(DhKeyPairGenConfig* params) {
+@@ -581,6 +580,9 @@ EVPKeyCtxPointer DhKeyGenTraits::Setup(DhKeyPairGenConfig* params) {
      }
  
      key_params = EVPKeyPointer(raw_params);
@@ -392,19 +361,6 @@ index 3b3724d6c7156b87555be31470e75b1cf28b5e3f..910c69b6d1d17ef25201dbb39d3d074f
  #if OPENSSL_VERSION_MAJOR >= 3
    // We declare another alias here to avoid having to include crypto_util.h
    using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
-diff --git a/src/node_metadata.cc b/src/node_metadata.cc
-index 844c5ac2c2b948b3be35cb3e447717a510a463a6..72a75ee0bf391ea508441f49413f85c5b735b259 100644
---- a/src/node_metadata.cc
-+++ b/src/node_metadata.cc
-@@ -21,7 +21,7 @@
- #include <zlib.h>
- #endif  // NODE_BUNDLED_ZLIB
- 
--#if HAVE_OPENSSL
-+#if HAVE_OPENSSL && !defined(OPENSSL_IS_BORINGSSL)
- #include <openssl/opensslv.h>
- #if NODE_OPENSSL_HAS_QUIC
- #include <openssl/quic.h>
 diff --git a/src/node_metadata.h b/src/node_metadata.h
 index cf051585e779e2b03bd7b95fe5008b89cc7f8162..9de49c6828468fdf846dcd4ad445390f14446099 100644
 --- a/src/node_metadata.h

script/actions/move-artifacts.sh

@@ -88,4 +88,4 @@ mv_if_exist src/cross-arch-snapshots
 cp_if_exist src/out/electron_ninja_log
 cp_if_exist src/out/Default/.ninja_log
 
-move_src_dirs_if_exist
+move_src_dirs_if_exist

script/actions/restore-artifacts.sh

@@ -37,4 +37,4 @@ mv_if_exist cross-arch-snapshots src
 echo Restoring artifacts from $SRC_ARTIFACTS
 
 # Restore src artifacts
-untar_if_exist src_artifacts.tar
+untar_if_exist src_artifacts.tar

script/actions/run-tests.sh

@@ -4,4 +4,4 @@ set -euo pipefail
 export DISPLAY=:99
 Xvfb :99 -screen 0 1024x768x16 -ac &
 XVFB_PID=$!
-node "$@"
+node "$@"

script/generate-deps-hash.js

@@ -36,12 +36,10 @@ addAllFiles(path.resolve(__dirname, '../patches'));
 // Create Hash
 const hasher = crypto.createHash('SHA256');
 const addToHashAndLog = (s) => {
-  console.log('Hashing:', s);
   return hasher.update(s);
 };
 addToHashAndLog(`HASH_VERSION:${HASH_VERSIONS[process.platform] || FALLBACK_HASH_VERSION}`);
 for (const file of filesToHash) {
-  console.log('Hashing Content:', file, crypto.createHash('SHA256').update(fs.readFileSync(file)).digest('hex'));
   hasher.update(fs.readFileSync(file));
 }
 

script/lint.js

@@ -256,8 +256,10 @@ const LINTERS = [{
 
     const allOk = filenames.length > 0 && filenames.map(f => {
       const patchText = fs.readFileSync(f, 'utf8');
-      const subjectAndDescription = /Subject: (.*?)\n\n([\s\S]*?)\s*(?=diff)/ms.exec(patchText);
-      if (!subjectAndDescription[2]) {
+
+      const regex = /Subject: (.*?)\n\n([\s\S]*?)\s*(?=diff)/ms;
+      const subjectAndDescription = regex.exec(patchText);
+      if (!subjectAndDescription?.[2]) {
         console.warn(`Patch file '${f}' has no description. Every patch must contain a justification for why the patch exists and the plan for its removal.`);
         return false;
       }

script/node-disabled-tests.json

@@ -4,6 +4,8 @@
   "parallel/test-bootstrap-modules",
   "parallel/test-child-process-fork-exec-path",
   "parallel/test-code-cache",
+  "parallel/test-cluster-primary-error",
+  "parallel/test-cluster-primary-kill",
   "parallel/test-crypto-aes-wrap",
   "parallel/test-crypto-authenticated-stream",
   "parallel/test-crypto-des3-wrap",

script/release/ci-release-build.js

@@ -21,8 +21,8 @@ const appVeyorJobs = {
 };
 
 const ghActionsPublishWorkflows = [
-  'macos-publish',
-  'linux-publish'
+  'linux-publish',
+  'macos-publish'
 ];
 
 let jobRequestedCount = 0;
@@ -81,7 +81,7 @@ async function githubActionsCall (targetBranch, workflowName, options) {
     }
 
     await octokit.request(`POST ${GH_ACTIONS_API_URL}/workflows/${workflowName}.yml/dispatches`, {
-      ref: buildRequest.branch,
+      ref: `refs/tags/${options.newVersion}`,
       inputs: {
         ...buildRequest.parameters
       },
@@ -220,7 +220,6 @@ function buildAppVeyor (targetBranch, options) {
   }
 }
 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
 function buildGHActions (targetBranch, options) {
   if (options.job) {
     assert(ghActionsPublishWorkflows.includes(options.job), `Unknown GitHub Actions workflow name: ${options.job}. Valid values are: ${ghActionsPublishWorkflows}.`);

script/release/prepare-release.js

@@ -142,9 +142,10 @@ async function pushRelease (branch) {
   }
 }
 
-async function runReleaseBuilds (branch) {
+async function runReleaseBuilds (branch, newVersion) {
   await ciReleaseBuild(branch, {
-    ghRelease: true
+    ghRelease: true,
+    newVersion
   });
 }
 
@@ -174,6 +175,8 @@ async function verifyNewVersion () {
     console.log(`${fail} Aborting release of ${newVersion}`);
     process.exit();
   }
+
+  return newVersion;
 }
 
 async function promptForVersion (version) {
@@ -209,10 +212,10 @@ async function prepareRelease (isBeta, notesOnly) {
     } else {
       const changes = await changesToRelease();
       if (changes) {
-        await verifyNewVersion();
+        const newVersion = await verifyNewVersion();
         await createRelease(currentBranch, isBeta);
         await pushRelease(currentBranch);
-        await runReleaseBuilds(currentBranch);
+        await runReleaseBuilds(currentBranch, newVersion);
       } else {
         console.log('There are no new changes to this branch since the last release, aborting release.');
         process.exit(1);

script/release/uploaders/upload.py

@@ -48,7 +48,7 @@ def main():
   if args.verbose:
     enable_verbose_mode()
   if args.upload_to_storage:
-    utcnow = datetime.datetime.now(datetime.UTC)
+    utcnow = datetime.datetime.utcnow()
     args.upload_timestamp = utcnow.strftime('%Y%m%d')
 
   build_version = get_electron_build_version()

shell/app/electron_main_delegate.h

@@ -30,10 +30,9 @@ class ElectronMainDelegate : public content::ContentMainDelegate {
   ElectronMainDelegate(const ElectronMainDelegate&) = delete;
   ElectronMainDelegate& operator=(const ElectronMainDelegate&) = delete;
 
-  base::StringPiece GetBrowserV8SnapshotFilename() override;
-
  protected:
   // content::ContentMainDelegate:
+  base::StringPiece GetBrowserV8SnapshotFilename() override;
   std::optional<int> BasicStartupComplete() override;
   void PreSandboxStartup() override;
   void SandboxInitialized(const std::string& process_type) override;

shell/browser/api/electron_api_auto_updater.h

@@ -36,7 +36,7 @@ class AutoUpdater : public gin::Wrappable<AutoUpdater>,
   AutoUpdater();
   ~AutoUpdater() override;
 
-  // Delegate implementations.
+  // auto_updater::Delegate:
   void OnError(const std::string& message) override;
   void OnError(const std::string& message,
                const int code,

shell/browser/api/electron_api_menu_mac.h

@@ -18,6 +18,7 @@ class MenuMac : public Menu {
   explicit MenuMac(gin::Arguments* args);
   ~MenuMac() override;
 
+  // Menu
   void PopupAt(BaseWindow* window,
                int x,
                int y,

shell/browser/api/electron_api_menu_views.h

@@ -21,6 +21,7 @@ class MenuViews : public Menu {
   ~MenuViews() override;
 
  protected:
+  // Menu
   void PopupAt(BaseWindow* window,
                int x,
                int y,

shell/browser/api/electron_api_session.cc

@@ -545,7 +545,8 @@ gin::WrapperInfo Session::kWrapperInfo = {gin::kEmbedderNativeGin};
 Session::Session(v8::Isolate* isolate, ElectronBrowserContext* browser_context)
     : isolate_(isolate),
       network_emulation_token_(base::UnguessableToken::Create()),
-      browser_context_(browser_context) {
+      browser_context_{
+          raw_ref<ElectronBrowserContext>::from_ptr(browser_context)} {
   // Observe DownloadManager to get download notifications.
   browser_context->GetDownloadManager()->AddObserver(this);
 
@@ -558,9 +559,8 @@ Session::Session(v8::Isolate* isolate, ElectronBrowserContext* browser_context)
       std::make_unique<UserDataLink>(weak_factory_.GetWeakPtr()));
 
 #if BUILDFLAG(ENABLE_BUILTIN_SPELLCHECKER)
-  SpellcheckService* service =
-      SpellcheckServiceFactory::GetForContext(browser_context_);
-  if (service) {
+  if (auto* service =
+          SpellcheckServiceFactory::GetForContext(browser_context)) {
     service->SetHunspellObserver(this);
   }
 #endif
@@ -574,9 +574,8 @@ Session::~Session() {
   browser_context()->GetDownloadManager()->RemoveObserver(this);
 
 #if BUILDFLAG(ENABLE_BUILTIN_SPELLCHECKER)
-  SpellcheckService* service =
-      SpellcheckServiceFactory::GetForContext(browser_context_);
-  if (service) {
+  if (auto* service =
+          SpellcheckServiceFactory::GetForContext(browser_context())) {
     service->SetHunspellObserver(nullptr);
   }
 #endif
@@ -641,7 +640,7 @@ v8::Local<v8::Promise> Session::ResolveHost(
   v8::Local<v8::Promise> handle = promise.GetHandle();
 
   auto fn = base::MakeRefCounted<ResolveHostFunction>(
-      browser_context_, std::move(host),
+      browser_context(), std::move(host),
       params ? std::move(params.value()) : nullptr,
       base::BindOnce(
           [](gin_helper::Promise<gin_helper::Dictionary> promise,
@@ -1244,7 +1243,7 @@ void Session::Preconnect(const gin_helper::Dictionary& options,
   DCHECK_GT(num_sockets_to_preconnect, 0);
   content::GetUIThreadTaskRunner({})->PostTask(
       FROM_HERE,
-      base::BindOnce(&StartPreconnectOnUI, base::Unretained(browser_context_),
+      base::BindOnce(&StartPreconnectOnUI, base::Unretained(browser_context()),
                      url, num_sockets_to_preconnect));
 }
 
@@ -1436,7 +1435,7 @@ v8::Local<v8::Promise> Session::ListWordsInSpellCheckerDictionary() {
   v8::Local<v8::Promise> handle = promise.GetHandle();
 
   SpellcheckService* spellcheck =
-      SpellcheckServiceFactory::GetForContext(browser_context_);
+      SpellcheckServiceFactory::GetForContext(browser_context());
 
   if (!spellcheck) {
     promise.RejectWithErrorMessage(
@@ -1464,7 +1463,7 @@ bool Session::AddWordToSpellCheckerDictionary(const std::string& word) {
     return false;
 
   SpellcheckService* service =
-      SpellcheckServiceFactory::GetForContext(browser_context_);
+      SpellcheckServiceFactory::GetForContext(browser_context());
   if (!service)
     return false;
 
@@ -1485,7 +1484,7 @@ bool Session::RemoveWordFromSpellCheckerDictionary(const std::string& word) {
     return false;
 
   SpellcheckService* service =
-      SpellcheckServiceFactory::GetForContext(browser_context_);
+      SpellcheckServiceFactory::GetForContext(browser_context());
   if (!service)
     return false;
 

shell/browser/api/electron_api_session.h

@@ -92,7 +92,9 @@ class Session : public gin::Wrappable<Session>,
       const base::FilePath& path,
       base::Value::Dict options = {});
 
-  ElectronBrowserContext* browser_context() const { return browser_context_; }
+  ElectronBrowserContext* browser_context() const {
+    return &browser_context_.get();
+  }
 
   // gin::Wrappable
   static gin::WrapperInfo kWrapperInfo;
@@ -216,7 +218,7 @@ class Session : public gin::Wrappable<Session>,
   // The client id to enable the network throttler.
   base::UnguessableToken network_emulation_token_;
 
-  const raw_ptr<ElectronBrowserContext> browser_context_;
+  const raw_ref<ElectronBrowserContext> browser_context_;
 
   base::WeakPtrFactory<Session> weak_factory_{this};
 };

shell/browser/api/electron_api_view.cc

@@ -10,6 +10,7 @@
 #include <string>
 #include <utility>
 
+#include "ash/style/rounded_rect_cutout_path_builder.h"
 #include "gin/data_object_builder.h"
 #include "gin/wrappable.h"
 #include "shell/browser/javascript_environment.h"
@@ -155,6 +156,7 @@ class JSLayoutManager : public views::LayoutManagerBase {
       : layout_callback_(std::move(layout_callback)) {}
   ~JSLayoutManager() override {}
 
+  // views::LayoutManagerBase
   views::ProposedLayout CalculateProposedLayout(
       const views::SizeBounds& size_bounds) const override {
     v8::Isolate* isolate = JavascriptEnvironment::GetIsolate();
@@ -337,6 +339,38 @@ void View::SetBackgroundColor(std::optional<WrappedSkColor> color) {
   view_->SetBackground(color ? views::CreateSolidBackground(*color) : nullptr);
 }
 
+void View::SetBorderRadius(int radius) {
+  border_radius_ = radius;
+  ApplyBorderRadius();
+}
+
+void View::ApplyBorderRadius() {
+  if (!border_radius_.has_value() || !view_)
+    return;
+
+  auto size = view_->bounds().size();
+
+  // Restrict border radius to the constraints set in the path builder class.
+  // If the constraints are exceeded, the builder will crash.
+  int radius;
+  {
+    float r = border_radius_.value() * 1.f;
+    r = std::min(r, size.width() / 2.f);
+    r = std::min(r, size.height() / 2.f);
+    r = std::max(r, 0.f);
+    radius = std::floor(r);
+  }
+
+  // RoundedRectCutoutPathBuilder has a minimum size of 32 x 32.
+  if (radius > 0 && size.width() >= 32 && size.height() >= 32) {
+    auto builder = ash::RoundedRectCutoutPathBuilder(gfx::SizeF(size));
+    builder.CornerRadius(radius);
+    view_->SetClipPath(builder.Build());
+  } else {
+    view_->SetClipPath(SkPath());
+  }
+}
+
 void View::SetVisible(bool visible) {
   if (!view_)
     return;
@@ -344,6 +378,7 @@ void View::SetVisible(bool visible) {
 }
 
 void View::OnViewBoundsChanged(views::View* observed_view) {
+  ApplyBorderRadius();
   Emit("bounds-changed");
 }
 
@@ -392,6 +427,7 @@ void View::BuildPrototype(v8::Isolate* isolate,
       .SetMethod("setBounds", &View::SetBounds)
       .SetMethod("getBounds", &View::GetBounds)
       .SetMethod("setBackgroundColor", &View::SetBackgroundColor)
+      .SetMethod("setBorderRadius", &View::SetBorderRadius)
       .SetMethod("setLayout", &View::SetLayout)
       .SetMethod("setVisible", &View::SetVisible);
 }

shell/browser/api/electron_api_view.h

@@ -37,6 +37,7 @@ class View : public gin_helper::EventEmitter<View>,
   void SetLayout(v8::Isolate* isolate, v8::Local<v8::Object> value);
   std::vector<v8::Local<v8::Value>> GetChildren();
   void SetBackgroundColor(std::optional<WrappedSkColor> color);
+  void SetBorderRadius(int radius);
   void SetVisible(bool visible);
 
   // views::ViewObserver
@@ -44,6 +45,7 @@ class View : public gin_helper::EventEmitter<View>,
   void OnViewIsDeleting(views::View* observed_view) override;
 
   views::View* view() const { return view_; }
+  std::optional<int> border_radius() const { return border_radius_; }
 
   // disable copy
   View(const View&) = delete;
@@ -58,9 +60,11 @@ class View : public gin_helper::EventEmitter<View>,
   void set_delete_view(bool should) { delete_view_ = should; }
 
  private:
+  void ApplyBorderRadius();
   void ReorderChildView(gin::Handle<View> child, size_t index);
 
   std::vector<v8::Global<v8::Object>> child_views_;
+  std::optional<int> border_radius_;
 
   bool delete_view_ = true;
   raw_ptr<views::View> view_ = nullptr;

shell/browser/api/electron_api_web_contents.h

@@ -170,7 +170,9 @@ class WebContents : public ExclusiveAccessContext,
   void Close(std::optional<gin_helper::Dictionary> options);
   base::WeakPtr<WebContents> GetWeakPtr() { return weak_factory_.GetWeakPtr(); }
 
+  // BackgroundThrottlingSource
   bool GetBackgroundThrottling() const override;
+
   void SetBackgroundThrottling(bool allowed);
   int GetProcessID() const;
   base::ProcessId GetOSProcessID() const;
@@ -345,6 +347,7 @@ class WebContents : public ExclusiveAccessContext,
                                           const base::FilePath& file_path);
   v8::Local<v8::Promise> GetProcessMemoryInfo(v8::Isolate* isolate);
 
+  // content::WebContentsDelegate:
   bool HandleContextMenu(content::RenderFrameHost& render_frame_host,
                          const content::ContextMenuParams& params) override;
 

shell/browser/api/electron_api_web_contents_view.cc

@@ -20,6 +20,8 @@
 #include "shell/common/options_switches.h"
 #include "third_party/skia/include/core/SkRegion.h"
 #include "ui/base/hit_test.h"
+#include "ui/gfx/geometry/rounded_corners_f.h"
+#include "ui/views/controls/webview/webview.h"
 #include "ui/views/layout/flex_layout_types.h"
 #include "ui/views/view_class_properties.h"
 #include "ui/views/widget/widget.h"
@@ -65,6 +67,25 @@ void WebContentsView::SetBackgroundColor(std::optional<WrappedSkColor> color) {
   }
 }
 
+void WebContentsView::SetBorderRadius(int radius) {
+  View::SetBorderRadius(radius);
+  ApplyBorderRadius();
+}
+
+void WebContentsView::ApplyBorderRadius() {
+  if (border_radius().has_value() && api_web_contents_ && view()->GetWidget()) {
+    auto* web_view = api_web_contents_->inspectable_web_contents()
+                         ->GetView()
+                         ->contents_web_view();
+
+    // WebView won't exist for offscreen rendering.
+    if (web_view) {
+      web_view->holder()->SetCornerRadii(
+          gfx::RoundedCornersF(border_radius().value()));
+    }
+  }
+}
+
 int WebContentsView::NonClientHitTest(const gfx::Point& point) {
   if (api_web_contents_) {
     gfx::Point local_point(point);
@@ -93,6 +114,7 @@ void WebContentsView::OnViewAddedToWidget(views::View* observed_view) {
   // because that's handled in the WebContents dtor called prior.
   api_web_contents_->SetOwnerWindow(native_window);
   native_window->AddDraggableRegionProvider(this);
+  ApplyBorderRadius();
 }
 
 void WebContentsView::OnViewRemovedFromWidget(views::View* observed_view) {
@@ -198,6 +220,7 @@ void WebContentsView::BuildPrototype(
   prototype->SetClassName(gin::StringToV8(isolate, "WebContentsView"));
   gin_helper::ObjectTemplateBuilder(isolate, prototype->PrototypeTemplate())
       .SetMethod("setBackgroundColor", &WebContentsView::SetBackgroundColor)
+      .SetMethod("setBorderRadius", &WebContentsView::SetBorderRadius)
       .SetProperty("webContents", &WebContentsView::GetWebContents);
 }
 

shell/browser/api/electron_api_web_contents_view.h

@@ -39,6 +39,7 @@ class WebContentsView : public View,
   // Public APIs.
   gin::Handle<WebContents> GetWebContents(v8::Isolate* isolate);
   void SetBackgroundColor(std::optional<WrappedSkColor> color);
+  void SetBorderRadius(int radius);
 
   int NonClientHitTest(const gfx::Point& point) override;
 
@@ -57,6 +58,8 @@ class WebContentsView : public View,
  private:
   static gin_helper::WrappableBase* New(gin_helper::Arguments* args);
 
+  void ApplyBorderRadius();
+
   // Keep a reference to v8 wrapper.
   v8::Global<v8::Value> web_contents_;
   raw_ptr<api::WebContents> api_web_contents_;

shell/browser/api/frame_subscriber.h

@@ -46,11 +46,12 @@ class FrameSubscriber : private content::WebContentsObserver,
   void AttachToHost(content::RenderWidgetHost* host);
   void DetachFromHost();
 
+  // content::WebContentsObserver
   void RenderFrameCreated(content::RenderFrameHost* render_frame_host) override;
   void PrimaryPageChanged(content::Page& page) override;
   void RenderViewDeleted(content::RenderViewHost* host) override;
 
-  // viz::mojom::FrameSinkVideoConsumer implementation.
+  // viz::mojom::FrameSinkVideoConsumer
   void OnFrameCaptured(
       ::media::mojom::VideoBufferHandlePtr data,
       ::media::mojom::VideoFrameInfoPtr info,

shell/browser/api/gpu_info_enumerator.h

@@ -30,6 +30,8 @@ class GPUInfoEnumerator final : public gpu::GPUInfo::Enumerator {
  public:
   GPUInfoEnumerator();
   ~GPUInfoEnumerator() override;
+
+  // gpu::GPUInfo::Enumerator
   void AddInt64(const char* name, int64_t value) override;
   void AddInt(const char* name, int value) override;
   void AddString(const char* name, const std::string& value) override;

shell/browser/api/gpuinfo_manager.h

@@ -31,6 +31,7 @@ class GPUInfoManager : private content::GpuDataManagerObserver {
   void FetchBasicInfo(gin_helper::Promise<base::Value> promise);
 
  private:
+  // content::GpuDataManagerObserver
   void OnGpuInfoUpdate() override;
 
   base::Value::Dict EnumerateGPUInfo(gpu::GPUInfo gpu_info) const;

shell/browser/browser_process_impl.h

@@ -51,7 +51,6 @@ class BrowserProcessImpl : public BrowserProcess {
 
   static void ApplyProxyModeFromCommandLine(ValueMapPrefStore* pref_store);
 
-  BuildState* GetBuildState() override;
   void PostEarlyInitialization();
   void PreCreateThreads();
   void PreMainMessageLoopRun();
@@ -68,6 +67,8 @@ class BrowserProcessImpl : public BrowserProcess {
   }
 #endif
 
+  // BrowserProcess
+  BuildState* GetBuildState() override;
   void EndSession() override {}
   void FlushLocalStateAndReply(base::OnceClosure reply) override {}
   bool IsShuttingDown() override;

shell/browser/electron_autofill_driver.h

@@ -30,6 +30,7 @@ class AutofillDriver : public mojom::ElectronAutofillDriver {
       mojo::PendingAssociatedReceiver<mojom::ElectronAutofillDriver>
           pending_receiver);
 
+  // mojom::ElectronAutofillDriver
   void ShowAutofillPopup(const gfx::RectF& bounds,
                          const std::vector<std::u16string>& values,
                          const std::vector<std::u16string>& labels) override;

shell/browser/electron_browser_client.cc

@@ -128,6 +128,7 @@
 
 #if BUILDFLAG(USE_NSS_CERTS)
 #include "net/ssl/client_cert_store_nss.h"
+#include "shell/browser/electron_crypto_module_delegate_nss.h"
 #elif BUILDFLAG(IS_WIN)
 #include "net/ssl/client_cert_store_win.h"
 #elif BUILDFLAG(IS_MAC)
@@ -783,7 +784,11 @@ ElectronBrowserClient::CreateClientCertStore(
     content::BrowserContext* browser_context) {
 #if BUILDFLAG(USE_NSS_CERTS)
   return std::make_unique<net::ClientCertStoreNSS>(
-      net::ClientCertStoreNSS::PasswordDelegateFactory());
+      base::BindRepeating([](const net::HostPortPair& server) {
+        crypto::CryptoModuleBlockingPasswordDelegate* delegate =
+            new ElectronNSSCryptoModuleDelegate(server);
+        return delegate;
+      }));
 #elif BUILDFLAG(IS_WIN)
   return std::make_unique<net::ClientCertStoreWin>();
 #elif BUILDFLAG(IS_MAC)

shell/browser/electron_browser_main_parts.cc

@@ -136,6 +136,8 @@ class LinuxUiGetterImpl : public ui::LinuxUiGetter {
  public:
   LinuxUiGetterImpl() = default;
   ~LinuxUiGetterImpl() override = default;
+
+  // ui::LinuxUiGetter
   ui::LinuxUiTheme* GetForWindow(aura::Window* window) override {
     return GetForProfile(nullptr);
   }

shell/browser/electron_crypto_module_delegate_nss.cc

@@ -0,0 +1,72 @@
+// Copyright (c) 2024 Switchboard
+// Use of this source code is governed by the MIT license that can be
+// found in the LICENSE file.
+
+#include "shell/browser/electron_crypto_module_delegate_nss.h"
+
+#include "crypto/nss_crypto_module_delegate.h"
+#include "shell/browser/api/electron_api_app.h"
+#include "shell/browser/javascript_environment.h"
+#include "shell/common/gin_converters/callback_converter.h"
+#include "shell/common/gin_helper/callback.h"
+#include "shell/common/v8_value_serializer.h"
+
+ElectronNSSCryptoModuleDelegate::ElectronNSSCryptoModuleDelegate(
+    const net::HostPortPair& server)
+    : server_(server),
+      event_(base::WaitableEvent::ResetPolicy::AUTOMATIC,
+             base::WaitableEvent::InitialState::NOT_SIGNALED) {}
+
+ElectronNSSCryptoModuleDelegate::~ElectronNSSCryptoModuleDelegate() = default;
+
+std::string ElectronNSSCryptoModuleDelegate::RequestPassword(
+    const std::string& token_name,
+    bool retry,
+    bool* cancelled) {
+  DCHECK(!event_.IsSignaled());
+  event_.Reset();
+
+  if (content::GetUIThreadTaskRunner({})->PostTask(
+          FROM_HERE,
+          base::BindOnce(
+              &ElectronNSSCryptoModuleDelegate::RequestPasswordOnUIThread, this,
+              token_name, retry))) {
+    base::ScopedAllowBaseSyncPrimitivesForTesting allow_wait;
+    event_.Wait();
+  }
+  *cancelled = cancelled_;
+  return password_;
+}
+
+void ElectronNSSCryptoModuleDelegate::RequestPasswordOnUIThread(
+    const std::string& token_name,
+    bool retry) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  v8::Isolate* isolate = electron::JavascriptEnvironment::GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+
+  gin::Handle<gin_helper::internal::Event> event =
+      gin_helper::internal::Event::New(isolate);
+  v8::Local<v8::Object> event_object = event.ToV8().As<v8::Object>();
+  gin_helper::Dictionary dict(isolate, event_object);
+  dict.Set("hostname", server_.host());
+  dict.Set("tokenName", token_name);
+  dict.Set("isRetry", retry);
+
+  electron::api::App::Get()->EmitWithoutEvent(
+      "-client-certificate-request-password", event_object,
+      base::BindOnce(&ElectronNSSCryptoModuleDelegate::OnPassword, this));
+
+  if (!event->GetDefaultPrevented()) {
+    password_ = "";
+    cancelled_ = true;
+    event_.Signal();
+  }
+}
+
+void ElectronNSSCryptoModuleDelegate::OnPassword(gin::Arguments* args) {
+  args->GetNext(&password_);
+  cancelled_ = password_.empty();
+  event_.Signal();
+}

shell/browser/electron_crypto_module_delegate_nss.h

@@ -0,0 +1,43 @@
+// Copyright (c) 2024 Switchboard
+// Use of this source code is governed by the MIT license that can be
+// found in the LICENSE file.
+
+#ifndef ELECTRON_SHELL_CRYPTO_MODULE_DELEGATE_NSS_H_
+#define ELECTRON_SHELL_CRYPTO_MODULE_DELEGATE_NSS_H_
+
+#include "base/synchronization/waitable_event.h"
+#include "base/threading/thread_restrictions.h"
+#include "crypto/nss_crypto_module_delegate.h"
+#include "net/base/host_port_pair.h"
+
+namespace gin {
+class Arguments;
+}
+
+class ElectronNSSCryptoModuleDelegate
+    : public crypto::CryptoModuleBlockingPasswordDelegate {
+ public:
+  explicit ElectronNSSCryptoModuleDelegate(const net::HostPortPair& server);
+  ElectronNSSCryptoModuleDelegate(const ElectronNSSCryptoModuleDelegate&) =
+      delete;
+  ElectronNSSCryptoModuleDelegate& operator=(
+      const ElectronNSSCryptoModuleDelegate&) = delete;
+
+  std::string RequestPassword(const std::string& token_name,
+                              bool retry,
+                              bool* cancelled) override;
+
+ private:
+  friend class base::RefCountedThreadSafe<ElectronNSSCryptoModuleDelegate>;
+  ~ElectronNSSCryptoModuleDelegate() override;
+
+  void RequestPasswordOnUIThread(const std::string& token_name, bool retry);
+  void OnPassword(gin::Arguments* args);
+
+  net::HostPortPair server_;
+  base::WaitableEvent event_;
+  std::string password_;
+  bool cancelled_ = false;
+};
+
+#endif  // ELECTRON_SHELL_CRYPTO_MODULE_DELEGATE_NSS_H_

shell/browser/electron_navigation_throttle.h

@@ -19,8 +19,8 @@ class ElectronNavigationThrottle : public content::NavigationThrottle {
   ElectronNavigationThrottle& operator=(const ElectronNavigationThrottle&) =
       delete;
 
+  // content::NavigationThrottle
   ElectronNavigationThrottle::ThrottleCheckResult WillStartRequest() override;
-
   ElectronNavigationThrottle::ThrottleCheckResult WillRedirectRequest()
       override;
 

shell/browser/electron_speech_recognition_manager_delegate.cc

@@ -16,33 +16,6 @@ ElectronSpeechRecognitionManagerDelegate::
 ElectronSpeechRecognitionManagerDelegate::
     ~ElectronSpeechRecognitionManagerDelegate() = default;
 
-void ElectronSpeechRecognitionManagerDelegate::OnRecognitionStart(
-    int session_id) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnAudioStart(int session_id) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnSoundStart(int session_id) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnSoundEnd(int session_id) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnAudioEnd(int session_id) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnRecognitionEnd(
-    int session_id) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnRecognitionResults(
-    int session_id,
-    const std::vector<media::mojom::WebSpeechRecognitionResultPtr>& results) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnRecognitionError(
-    int session_id,
-    const media::mojom::SpeechRecognitionError& error) {}
-
-void ElectronSpeechRecognitionManagerDelegate::OnAudioLevelsChange(
-    int session_id,
-    float volume,
-    float noise_volume) {}
-
 void ElectronSpeechRecognitionManagerDelegate::CheckRecognitionIsAllowed(
     int session_id,
     base::OnceCallback<void(bool ask_user, bool is_allowed)> callback) {
@@ -51,7 +24,7 @@ void ElectronSpeechRecognitionManagerDelegate::CheckRecognitionIsAllowed(
 
 content::SpeechRecognitionEventListener*
 ElectronSpeechRecognitionManagerDelegate::GetEventListener() {
-  return this;
+  return nullptr;
 }
 
 void ElectronSpeechRecognitionManagerDelegate::BindSpeechRecognitionContext(

shell/browser/electron_speech_recognition_manager_delegate.h

@@ -5,16 +5,13 @@
 #ifndef ELECTRON_SHELL_BROWSER_ELECTRON_SPEECH_RECOGNITION_MANAGER_DELEGATE_H_
 #define ELECTRON_SHELL_BROWSER_ELECTRON_SPEECH_RECOGNITION_MANAGER_DELEGATE_H_
 
-#include <vector>
-
 #include "content/public/browser/speech_recognition_event_listener.h"
 #include "content/public/browser/speech_recognition_manager_delegate.h"
 
 namespace electron {
 
 class ElectronSpeechRecognitionManagerDelegate
-    : public content::SpeechRecognitionManagerDelegate,
-      public content::SpeechRecognitionEventListener {
+    : public content::SpeechRecognitionManagerDelegate {
  public:
   ElectronSpeechRecognitionManagerDelegate();
   ~ElectronSpeechRecognitionManagerDelegate() override;
@@ -25,23 +22,6 @@ class ElectronSpeechRecognitionManagerDelegate
   ElectronSpeechRecognitionManagerDelegate& operator=(
       const ElectronSpeechRecognitionManagerDelegate&) = delete;
 
-  // content::SpeechRecognitionEventListener:
-  void OnRecognitionStart(int session_id) override;
-  void OnAudioStart(int session_id) override;
-  void OnSoundStart(int session_id) override;
-  void OnSoundEnd(int session_id) override;
-  void OnAudioEnd(int session_id) override;
-  void OnRecognitionEnd(int session_id) override;
-  void OnRecognitionResults(
-      int session_id,
-      const std::vector<media::mojom::WebSpeechRecognitionResultPtr>&) override;
-  void OnRecognitionError(
-      int session_id,
-      const media::mojom::SpeechRecognitionError& error) override;
-  void OnAudioLevelsChange(int session_id,
-                           float volume,
-                           float noise_volume) override;
-
   // content::SpeechRecognitionManagerDelegate:
   void CheckRecognitionIsAllowed(
       int session_id,

shell/browser/extensions/api/extension_action/extension_action_api.h

@@ -91,6 +91,8 @@ class ExtensionActionFunction : public ExtensionFunction {
  protected:
   ExtensionActionFunction();
   ~ExtensionActionFunction() override;
+
+  // ExtensionFunction
   ResponseAction Run() override;
 
   virtual ResponseAction RunExtensionAction() = 0;

shell/browser/extensions/api/management/electron_management_api_delegate.h

@@ -17,7 +17,7 @@ class ElectronManagementAPIDelegate : public extensions::ManagementAPIDelegate {
   ElectronManagementAPIDelegate();
   ~ElectronManagementAPIDelegate() override;
 
-  // ManagementAPIDelegate.
+  // extensions::ManagementAPIDelegate
   bool LaunchAppFunctionDelegate(
       const extensions::Extension* extension,
       content::BrowserContext* context) const override;

shell/browser/extensions/electron_extensions_browser_api_provider.h

@@ -21,6 +21,7 @@ class ElectronExtensionsBrowserAPIProvider
   ElectronExtensionsBrowserAPIProvider& operator=(
       const ElectronExtensionsBrowserAPIProvider&) = delete;
 
+  // ExtensionsBrowserAPIProvider
   void RegisterExtensionFunctions(ExtensionFunctionRegistry* registry) override;
 };
 

shell/browser/extensions/electron_kiosk_delegate.h

@@ -17,7 +17,7 @@ class ElectronKioskDelegate : public extensions::KioskDelegate {
   ElectronKioskDelegate();
   ~ElectronKioskDelegate() override;
 
-  // KioskDelegate overrides:
+  // extensions::KioskDelegate
   bool IsAutoLaunchedKioskApp(const extensions::ExtensionId& id) const override;
 };
 

shell/browser/native_window_views.cc

@@ -186,6 +186,7 @@ class NativeWindowClientView : public views::ClientView {
   NativeWindowClientView(const NativeWindowClientView&) = delete;
   NativeWindowClientView& operator=(const NativeWindowClientView&) = delete;
 
+  // views::ClientView
   views::CloseRequestResult OnWindowCloseRequested() override {
     window_->NotifyWindowCloseButtonClicked();
     return views::CloseRequestResult::kCannotClose;

shell/browser/net/asar/asar_file_validator.h

@@ -25,6 +25,7 @@ class AsarFileValidator : public mojo::FilteredDataSource::Filter {
   AsarFileValidator(const AsarFileValidator&) = delete;
   AsarFileValidator& operator=(const AsarFileValidator&) = delete;
 
+  // mojo::FilteredDataSource::Filter
   void OnRead(base::span<char> buffer,
               mojo::FileDataSource::ReadResult* result) override;
 

shell/browser/notifications/linux/notification_presenter_linux.h

@@ -16,6 +16,7 @@ class NotificationPresenterLinux : public NotificationPresenter {
   ~NotificationPresenterLinux() override;
 
  private:
+  // NotificationPresenter
   Notification* CreateNotificationObject(
       NotificationDelegate* delegate) override;
 };

shell/browser/notifications/mac/notification_presenter_mac.h

@@ -21,6 +21,7 @@ class NotificationPresenterMac : public NotificationPresenter {
   ~NotificationPresenterMac() override;
 
  private:
+  // NotificationPresenter
   Notification* CreateNotificationObject(
       NotificationDelegate* delegate) override;
 

shell/browser/notifications/platform_notification_service.cc

@@ -53,6 +53,7 @@ class NotificationDelegateImpl final : public electron::NotificationDelegate {
   NotificationDelegateImpl(const NotificationDelegateImpl&) = delete;
   NotificationDelegateImpl& operator=(const NotificationDelegateImpl&) = delete;
 
+  // electron::NotificationDelegate
   void NotificationDestroyed() override { delete this; }
 
   void NotificationClick() override {

shell/browser/notifications/win/notification_presenter_win.h

@@ -41,6 +41,7 @@ class NotificationPresenterWin : public NotificationPresenter {
   std::wstring SaveIconToFilesystem(const SkBitmap& icon, const GURL& origin);
 
  private:
+  // NotificationPresenter
   Notification* CreateNotificationObject(
       NotificationDelegate* delegate) override;
 

shell/browser/notifications/win/windows_toast_notification.h

@@ -120,12 +120,17 @@ class ToastEventHandler : public RuntimeClass<RuntimeClassFlags<ClassicCom>,
   ToastEventHandler(const ToastEventHandler&) = delete;
   ToastEventHandler& operator=(const ToastEventHandler&) = delete;
 
+  // DesktopToastActivatedEventHandler
   IFACEMETHODIMP Invoke(
       ABI::Windows::UI::Notifications::IToastNotification* sender,
       IInspectable* args) override;
+
+  // DesktopToastDismissedEventHandler
   IFACEMETHODIMP Invoke(
       ABI::Windows::UI::Notifications::IToastNotification* sender,
       ABI::Windows::UI::Notifications::IToastDismissedEventArgs* e) override;
+
+  // DesktopToastFailedEventHandler
   IFACEMETHODIMP Invoke(
       ABI::Windows::UI::Notifications::IToastNotification* sender,
       ABI::Windows::UI::Notifications::IToastFailedEventArgs* e) override;

shell/browser/osr/osr_host_display_client.h

@@ -63,6 +63,7 @@ class OffScreenHostDisplayClient : public viz::HostDisplayClient {
   void SetActive(bool active);
 
  private:
+  // viz::HostDisplayClient
 #if BUILDFLAG(IS_MAC)
   void OnDisplayReceivedCALayerParams(
       const gfx::CALayerParams& ca_layer_params) override;

shell/browser/osr/osr_render_widget_host_view.cc

@@ -135,6 +135,7 @@ class ElectronDelegatedFrameHostClient
   ElectronDelegatedFrameHostClient& operator=(
       const ElectronDelegatedFrameHostClient&) = delete;
 
+  // content::DelegatedFrameHostClient
   ui::Layer* DelegatedFrameHostGetLayer() const override {
     return view_->root_layer();
   }

shell/browser/osr/osr_render_widget_host_view.h

@@ -121,7 +121,6 @@ class OffScreenRenderWidgetHostView
 #endif  // BUILDFLAG(IS_MAC)
 
   // content::RenderWidgetHostViewBase:
-
   void UpdateFrameSinkIdRegistration() override;
   void InvalidateLocalSurfaceIdAndAllocationGroup() override;
   void ResetFallbackToFirstNavigationSurface() override;

shell/browser/serial/electron_serial_delegate.h

@@ -29,6 +29,7 @@ class ElectronSerialDelegate : public content::SerialDelegate,
   ElectronSerialDelegate(const ElectronSerialDelegate&) = delete;
   ElectronSerialDelegate& operator=(const ElectronSerialDelegate&) = delete;
 
+  // content::SerialDelegate:
   std::unique_ptr<content::SerialChooser> RunChooser(
       content::RenderFrameHost* frame,
       std::vector<blink::mojom::SerialPortFilterPtr> filters,

shell/browser/ui/file_dialog_linux.cc

@@ -137,6 +137,7 @@ class FileChooserDialog : public ui::SelectFileDialog::Listener {
     RunOpenDialogImpl(settings);
   }
 
+  // ui::SelectFileDialog::Listener
   void FileSelected(const ui::SelectedFileInfo& file,
                     int index,
                     void* params) override {

shell/browser/ui/inspectable_web_contents.cc

@@ -242,6 +242,7 @@ class InspectableWebContents::NetworkResourceLoader
     response_headers_ = response_head.headers;
   }
 
+  // network::SimpleURLLoaderStreamConsumer
   void OnDataReceived(base::StringPiece chunk,
                       base::OnceClosure resume) override {
     bool encoded = !base::IsStringUTF8(chunk);

shell/browser/ui/inspectable_web_contents_view.cc

@@ -84,14 +84,14 @@ InspectableWebContentsView::InspectableWebContentsView(
     auto* contents_web_view = new views::WebView(nullptr);
     contents_web_view->SetWebContents(
         inspectable_web_contents_->GetWebContents());
-    contents_web_view_ = contents_web_view;
+    contents_view_ = contents_web_view_ = contents_web_view;
   } else {
-    contents_web_view_ = new views::Label(u"No content under offscreen mode");
+    contents_view_ = new views::Label(u"No content under offscreen mode");
   }
 
   devtools_web_view_->SetVisible(false);
   AddChildView(devtools_web_view_.get());
-  AddChildView(contents_web_view_.get());
+  AddChildView(contents_view_.get());
 }
 
 InspectableWebContentsView::~InspectableWebContentsView() {
@@ -209,7 +209,7 @@ const std::u16string InspectableWebContentsView::GetTitle() {
 
 void InspectableWebContentsView::Layout(PassKey) {
   if (!devtools_web_view_->GetVisible()) {
-    contents_web_view_->SetBoundsRect(GetContentsBounds());
+    contents_view_->SetBoundsRect(GetContentsBounds());
     // Propagate layout call to all children, for example browser views.
     LayoutSuperclass<View>(this);
     return;
@@ -227,7 +227,7 @@ void InspectableWebContentsView::Layout(PassKey) {
   new_contents_bounds.set_x(GetMirroredXForRect(new_contents_bounds));
 
   devtools_web_view_->SetBoundsRect(new_devtools_bounds);
-  contents_web_view_->SetBoundsRect(new_contents_bounds);
+  contents_view_->SetBoundsRect(new_contents_bounds);
 
   // Propagate layout call to all children, for example browser views.
   LayoutSuperclass<View>(this);

shell/browser/ui/inspectable_web_contents_view.h

@@ -36,6 +36,8 @@ class InspectableWebContentsView : public views::View {
     return inspectable_web_contents_;
   }
 
+  views::WebView* contents_web_view() const { return contents_web_view_; }
+
   // The delegate manages its own life.
   void SetDelegate(InspectableWebContentsViewDelegate* delegate) {
     delegate_ = delegate;
@@ -67,8 +69,9 @@ class InspectableWebContentsView : public views::View {
 
   std::unique_ptr<views::Widget> devtools_window_;
   raw_ptr<views::WebView> devtools_window_web_view_ = nullptr;
-  raw_ptr<views::View> contents_web_view_ = nullptr;
   raw_ptr<views::WebView> devtools_web_view_ = nullptr;
+  raw_ptr<views::WebView> contents_web_view_ = nullptr;
+  raw_ptr<views::View> contents_view_ = nullptr;
 
   DevToolsContentsResizingStrategy strategy_;
   bool devtools_visible_ = false;

shell/browser/ui/message_box_gtk.cc

@@ -182,6 +182,7 @@ class GtkMessageBox : private NativeWindowObserver {
     Show();
   }
 
+  // NativeWindowObserver
   void OnWindowClosed() override {
     parent_->RemoveObserver(this);
     parent_ = nullptr;

shell/browser/ui/tray_icon_cocoa.h

@@ -21,6 +21,7 @@ class TrayIconCocoa : public TrayIcon {
   TrayIconCocoa();
   ~TrayIconCocoa() override;
 
+  // TrayIcon
   void SetImage(const gfx::Image& image) override;
   void SetPressedImage(const gfx::Image& image) override;
   void SetToolTip(const std::string& tool_tip) override;

shell/browser/ui/views/autofill_popup_view.h

@@ -73,6 +73,7 @@ class AutofillPopupView : public views::WidgetDelegateView,
 
   int GetSelectedLine() { return selected_line_.value_or(-1); }
 
+  // views::WidgetDelegateView implementation.
   void WriteDragDataForView(views::View*,
                             const gfx::Point&,
                             ui::OSExchangeData*) override;

shell/browser/ui/views/menu_model_adapter.h

@@ -21,6 +21,7 @@ class MenuModelAdapter : public views::MenuModelAdapter {
   MenuModelAdapter& operator=(const MenuModelAdapter&) = delete;
 
  protected:
+  // views::MenuModelAdapter
   bool GetAccelerator(int id, ui::Accelerator* accelerator) const override;
 
  private:

shell/browser/ui/views/submenu_button.h

@@ -34,9 +34,9 @@ class SubmenuButton : public views::MenuButton {
 
   char16_t accelerator() const { return accelerator_; }
 
+  // views::MenuButton:
   void GetAccessibleNodeData(ui::AXNodeData* node_data) override;
 
-  // views::MenuButton:
   void PaintButtonContents(gfx::Canvas* canvas) override;
 
  private:

shell/browser/ui/views/win_caption_button.h

@@ -35,7 +35,7 @@ class WinCaptionButton : public views::Button {
   WinCaptionButton(const WinCaptionButton&) = delete;
   WinCaptionButton& operator=(const WinCaptionButton&) = delete;
 
-  // // views::Button:
+  // views::Button:
   gfx::Size CalculatePreferredSize(
       const views::SizeBounds& available_size) const override;
   void OnPaintBackground(gfx::Canvas* canvas) override;

shell/browser/ui/win/electron_desktop_window_tree_host_win.h

@@ -29,6 +29,7 @@ class ElectronDesktopWindowTreeHostWin : public views::DesktopWindowTreeHostWin,
       const ElectronDesktopWindowTreeHostWin&) = delete;
 
  protected:
+  // views::DesktopWindowTreeHostWin:
   bool PreHandleMSG(UINT message,
                     WPARAM w_param,
                     LPARAM l_param,

shell/browser/webauthn/electron_authenticator_request_delegate.h

@@ -15,6 +15,7 @@ class ElectronWebAuthenticationDelegate
  public:
   ~ElectronWebAuthenticationDelegate() override;
 
+  // content::WebAuthenticationDelegate
   bool SupportsResidentKeys(
       content::RenderFrameHost* render_frame_host) override;
 };

shell/browser/window_list.cc

@@ -51,6 +51,9 @@ void WindowList::AddWindow(NativeWindow* window) {
   // Push |window| on the appropriate list instance.
   WindowVector& windows = GetInstance()->windows_;
   windows.push_back(window);
+
+  for (WindowListObserver& observer : GetObservers())
+    observer.OnWindowAdded(window);
 }
 
 // static
@@ -58,6 +61,9 @@ void WindowList::RemoveWindow(NativeWindow* window) {
   WindowVector& windows = GetInstance()->windows_;
   std::erase(windows, window);
 
+  for (WindowListObserver& observer : GetObservers())
+    observer.OnWindowRemoved(window);
+
   if (windows.empty()) {
     for (WindowListObserver& observer : GetObservers())
       observer.OnWindowAllClosed();

shell/browser/window_list_observer.h

@@ -13,6 +13,12 @@ class NativeWindow;
 
 class WindowListObserver : public base::CheckedObserver {
  public:
+  // Called immediately after a window is added to the list.
+  virtual void OnWindowAdded(NativeWindow* window) {}
+
+  // Called immediately after a window is removed from the list.
+  virtual void OnWindowRemoved(NativeWindow* window) {}
+
   // Called when a window close is cancelled by beforeunload handler.
   virtual void OnWindowCloseCancelled(NativeWindow* window) {}