fix: incorrect wco bounds in macOS fullscreen (#40219)

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '119.0.6045.0',
+    '119.0.6045.21',
   'node_version':
     'v18.18.0',
   'nan_version':

docs/api/app.md

@@ -1134,11 +1134,11 @@ indicates success while any other value indicates failure according to Chromium
     resolver will attempt to use the system's DNS settings to do DNS lookups
     itself. Enabled by default on macOS, disabled by default on Windows and
     Linux.
-  * `secureDnsMode` string (optional) - Can be "off", "automatic" or "secure".
-    Configures the DNS-over-HTTP mode. When "off", no DoH lookups will be
-    performed. When "automatic", DoH lookups will be performed first if DoH is
+  * `secureDnsMode` string (optional) - Can be 'off', 'automatic' or 'secure'.
+    Configures the DNS-over-HTTP mode. When 'off', no DoH lookups will be
+    performed. When 'automatic', DoH lookups will be performed first if DoH is
     available, and insecure DNS lookups will be performed as a fallback. When
-    "secure", only DoH lookups will be performed. Defaults to "automatic".
+    'secure', only DoH lookups will be performed. Defaults to 'automatic'.
   * `secureDnsServers` string[] (optional) - A list of DNS-over-HTTP
     server templates. See [RFC8484 § 3][] for details on the template format.
     Most servers support the POST method; the template for such servers is

docs/api/web-contents.md

@@ -1211,7 +1211,7 @@ Returns `string` - The user agent for this web page.
 
 * `css` string
 * `options` Object (optional)
-  * `cssOrigin` string (optional) - Can be either 'user' or 'author'. Sets the [cascade origin](https://www.w3.org/TR/css3-cascade/#cascade-origin) of the inserted stylesheet. Default is 'author'.
+  * `cssOrigin` string (optional) - Can be 'user' or 'author'. Sets the [cascade origin](https://www.w3.org/TR/css3-cascade/#cascade-origin) of the inserted stylesheet. Default is 'author'.
 
 Returns `Promise<string>` - A promise that resolves with a key for the inserted CSS that can later be used to remove the CSS via `contents.removeInsertedCSS(key)`.
 

docs/api/web-frame.md

@@ -113,7 +113,7 @@ webFrame.setSpellCheckProvider('en-US', {
 
 * `css` string
 * `options` Object (optional)
-  * `cssOrigin` string (optional) - Can be either 'user' or 'author'. Sets the [cascade origin](https://www.w3.org/TR/css3-cascade/#cascade-origin) of the inserted stylesheet. Default is 'author'.
+  * `cssOrigin` string (optional) - Can be 'user' or 'author'. Sets the [cascade origin](https://www.w3.org/TR/css3-cascade/#cascade-origin) of the inserted stylesheet. Default is 'author'.
 
 Returns `string` - A key for the inserted CSS that can later be used to remove
 the CSS via `webFrame.removeInsertedCSS(key)`.

docs/breaking-changes.md

@@ -103,6 +103,19 @@ win.webContents.on('render-process-gone', (event, details) => { /* ... */ })
 webview.addEventListener('render-process-gone', (event) => { /* ... */ })
 ```
 
+### Deprecated: `gpu-process-crashed` event on `app`
+
+The `gpu-process-crashed` event on `app` has been deprecated.
+Use the new `child-process-gone` event instead.
+
+```js
+// Deprecated
+app.on('gpu-process-crashed', (event, killed) => { /* ... */ })
+
+// Replace with
+app.on('child-process-gone', (event, details) => { /* ... */ })
+```
+
 ## Planned Breaking API Changes (27.0)
 
 ### Removed: macOS 10.13 / 10.14 support

patches/chromium/.patches

@@ -135,3 +135,4 @@ fix_activate_background_material_on_windows.patch
 fix_move_autopipsettingshelper_behind_branding_buildflag.patch
 revert_remove_the_allowaggressivethrottlingwithwebsocket_feature.patch
 fix_handle_no_top_level_aura_window_in_webcontentsimpl.patch
+ensure_messageports_get_gced_when_not_referenced.patch

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -33,10 +33,10 @@ index dcf02923c21e1c4c292eb800f6325e4bb764c823..8738860b44f179685198d2c0b9729fcc
            "//base",
            "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 157ee5cadc0a7bf97be0fc8bf34adb858beea1f1..20303e1712ff917a6c145ab9b1bd71524d998a7f 100644
+index 6d52b553b21b06a00c0853ce4f4cb02cf47fd7dd..4c1002ff33cc67fa4374fbfd4c016b28b077baa4 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4797,7 +4797,7 @@ static_library("browser") {
+@@ -4800,7 +4800,7 @@ static_library("browser") {
  
      # On Windows, the hashes are embedded in //chrome:chrome_initial rather
      # than here in :chrome_dll.
@@ -46,10 +46,10 @@ index 157ee5cadc0a7bf97be0fc8bf34adb858beea1f1..20303e1712ff917a6c145ab9b1bd7152
        sources += [ "certificate_viewer_stub.cc" ]
      }
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 6b98993d6737c22883bd9ddb31eda60060795e94..d1c6cce7ed68d1d523bd6683529e6ab003ace8e7 100644
+index c967801bade79f71859ad215e62030e6bb2d8ea6..94f6b4f7345a27b5b73e429ef43556223529d1bd 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -6899,7 +6899,6 @@ test("unit_tests") {
+@@ -6900,7 +6900,6 @@ test("unit_tests") {
  
      deps += [
        "//chrome:other_version",
@@ -57,7 +57,7 @@ index 6b98993d6737c22883bd9ddb31eda60060795e94..d1c6cce7ed68d1d523bd6683529e6ab0
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -6920,6 +6919,10 @@ test("unit_tests") {
+@@ -6921,6 +6920,10 @@ test("unit_tests") {
        "//ui/resources",
      ]
  

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index f9295c24641e9a7322f088c869d90423bcd36991..5ea6972f03fd450272de52c84f783be9113608bc 100644
+index 4f64b22c22880812318b095b8ae943489d8a3c07..eba5428f82966230252ac01c49a049e9775996b2 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -8101,6 +8101,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -8119,6 +8119,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,

patches/chromium/disable_color_correct_rendering.patch

@@ -81,7 +81,7 @@ index e4deb71ea3afa1ef9d6ddac9c61f5916ff608514..d2e6854ac2aaa3cc83c0b72ebc03193b
        !command_line->HasSwitch(switches::kUIDisablePartialSwap);
  
 diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
-index 3cc40e4b0183bf8f6861a6d1240df7d2972362a9..7468b1ec1b4c4e7f29baef2fc2decd2ec692351c 100644
+index 981c012dc8c3c8d1106c02570e75c7b065f6b814..02dbede2d9291a702dd3d692e849938e3f501761 100644
 --- a/content/browser/gpu/gpu_process_host.cc
 +++ b/content/browser/gpu/gpu_process_host.cc
 @@ -227,6 +227,7 @@ GpuTerminationStatus ConvertToGpuTerminationStatus(

patches/chromium/disable_hidden.patch

@@ -6,10 +6,10 @@ Subject: disable_hidden.patch
 Electron uses this to disable background throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 7a99c04fcf5bba1eafab94bd7d2b5ee9c58d4d85..80224052d4a3c195eabeadfb0d8863a2cf31b6e2 100644
+index d7b85d4a6adbe718fe5a219a5c273d05676c3ec6..b85d2f53e55131491c32eff5475cffa7c9d65e25 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -801,6 +801,9 @@ void RenderWidgetHostImpl::WasHidden() {
+@@ -807,6 +807,9 @@ void RenderWidgetHostImpl::WasHidden() {
      return;
    }
  

patches/chromium/ensure_messageports_get_gced_when_not_referenced.patch

@@ -0,0 +1,73 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Yoav Weiss <yoavweiss@chromium.org>
+Date: Mon, 9 Oct 2023 14:21:44 +0000
+Subject: Ensure MessagePorts get GCed when not referenced
+
+[1] regressed MessagePort memory and caused them to no longer be
+collected after not being referenced.
+This CL fixes that by turning the mutual pointers between attached
+MessagePorts to be WeakMembers.
+
+[1] https://chromium-review.googlesource.com/4919476
+
+Bug: 1487835
+Change-Id: Icd7eba09a217ad5d588958504d5c4794d7d8a295
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4919476
+Commit-Queue: Yoav Weiss <yoavweiss@chromium.org>
+Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1207067}
+
+diff --git a/third_party/blink/renderer/core/messaging/message_port.cc b/third_party/blink/renderer/core/messaging/message_port.cc
+index 0fd5bbf170efa02d3e710de3cb6733158faec858..15f5f0f6aa05d3b17adae87286c92df9cc26a712 100644
+--- a/third_party/blink/renderer/core/messaging/message_port.cc
++++ b/third_party/blink/renderer/core/messaging/message_port.cc
+@@ -162,8 +162,10 @@ MessagePortChannel MessagePort::Disentangle() {
+   DCHECK(!IsNeutered());
+   port_descriptor_.GiveDisentangledHandle(connector_->PassMessagePipe());
+   connector_ = nullptr;
+-  if (initially_entangled_port_) {
+-    initially_entangled_port_->OnEntangledPortDisconnected();
++  // Using a variable here places the WeakMember pointer on the stack, ensuring
++  // it doesn't get GCed while it's being used.
++  if (auto* entangled_port = initially_entangled_port_.Get()) {
++    entangled_port->OnEntangledPortDisconnected();
+   }
+   OnEntangledPortDisconnected();
+   return MessagePortChannel(std::move(port_descriptor_));
+@@ -340,7 +342,10 @@ bool MessagePort::Accept(mojo::Message* mojo_message) {
+   // lifetime of this function.
+   std::unique_ptr<scheduler::TaskAttributionTracker::TaskScope>
+       task_attribution_scope;
+-  if (initially_entangled_port_ && message.sender_origin &&
++  // Using a variable here places the WeakMember pointer on the stack, ensuring
++  // it doesn't get GCed while it's being used.
++  auto* entangled_port = initially_entangled_port_.Get();
++  if (entangled_port && message.sender_origin &&
+       message.sender_origin->IsSameOriginWith(context->GetSecurityOrigin()) &&
+       context->IsSameAgentCluster(message.sender_agent_cluster_id) &&
+       context->IsWindow()) {
+@@ -364,9 +369,9 @@ bool MessagePort::Accept(mojo::Message* mojo_message) {
+               ThreadScheduler::Current()->GetTaskAttributionTracker()) {
+         // Since `initially_entangled_port_` is not nullptr, neither should be
+         // its `post_message_task_container_`.
+-        CHECK(initially_entangled_port_->post_message_task_container_);
++        CHECK(entangled_port->post_message_task_container_);
+         scheduler::TaskAttributionInfo* parent_task =
+-            initially_entangled_port_->post_message_task_container_
++            entangled_port->post_message_task_container_
+                 ->GetAndDecrementPostMessageTask(message.parent_task_id);
+         task_attribution_scope = tracker->CreateTaskScope(
+             script_state, parent_task,
+diff --git a/third_party/blink/renderer/core/messaging/message_port.h b/third_party/blink/renderer/core/messaging/message_port.h
+index 98ed58a9a765f5101d9b421507bf25db4359d7e5..a178d15c11b1e5fb1ff74d182021fe39e9d9b107 100644
+--- a/third_party/blink/renderer/core/messaging/message_port.h
++++ b/third_party/blink/renderer/core/messaging/message_port.h
+@@ -195,7 +195,7 @@ class CORE_EXPORT MessagePort : public EventTarget,
+ 
+   // The entangled port. Only set on initial entanglement, and gets unset as
+   // soon as the ports are disentangled.
+-  Member<MessagePort> initially_entangled_port_;
++  WeakMember<MessagePort> initially_entangled_port_;
+ 
+   Member<PostMessageTaskContainer> post_message_task_container_;
+ };

patches/chromium/gpu_notify_when_dxdiag_request_fails.patch

@@ -40,7 +40,7 @@ index c57305681efb469d296c90df68b6cdbea927580d..6dda1a5465e08df64b539ee203b7c403
    // Called from BrowserMainLoop::PostCreateThreads().
    // TODO(content/browser/gpu/OWNERS): This should probably use a
 diff --git a/content/browser/gpu/gpu_data_manager_impl_private.cc b/content/browser/gpu/gpu_data_manager_impl_private.cc
-index ef2ff9a1dd1a2b18d9896cb7e9e8adb06bf2bd18..dbf021231b9373233e55c040ea2fdb2406b90647 100644
+index 5982540cdc27d7a983076af1a1ca76c996ec9082..11a888de262a8e185579fa83aabd6b5d9047985b 100644
 --- a/content/browser/gpu/gpu_data_manager_impl_private.cc
 +++ b/content/browser/gpu/gpu_data_manager_impl_private.cc
 @@ -1222,6 +1222,12 @@ void GpuDataManagerImplPrivate::TerminateInfoCollectionGpuProcess() {

patches/chromium/mas-cgdisplayusesforcetogray.patch

@@ -6,10 +6,10 @@ Subject: mas: avoid usage of CGDisplayUsesForceToGray
 Removes usage of the CGDisplayUsesForceToGray private API.
 
 diff --git a/ui/display/mac/screen_mac.mm b/ui/display/mac/screen_mac.mm
-index 074d92bd07e39d4f7d5561dae5cb09aa157b870a..6d92d63437ebf8ce68612e6fbbc1c767f23a7727 100644
+index 2653ce451ee21f55824f30ee19c7b46b4c29c75e..e9144eba98b3b038f48b0c431af3bc39678ebec6 100644
 --- a/ui/display/mac/screen_mac.mm
 +++ b/ui/display/mac/screen_mac.mm
-@@ -159,7 +159,17 @@ DisplayMac BuildDisplayForScreen(NSScreen* screen) {
+@@ -170,7 +170,17 @@ DisplayMac BuildDisplayForScreen(NSScreen* screen) {
      display.set_color_depth(Display::kDefaultBitsPerPixel);
      display.set_depth_per_component(Display::kDefaultBitsPerComponent);
    }

patches/chromium/refactor_expose_cursor_changes_to_the_webcontentsobserver.patch

@@ -30,10 +30,10 @@ index c4255d8dfc2e3c4f1f32506e4e9edbb90a74340a..142398a8adafc94e6724ee750b612a66
    // RenderWidgetHost on the primary main frame, and false otherwise.
    virtual bool IsWidgetForPrimaryMainFrame(RenderWidgetHostImpl*);
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 80224052d4a3c195eabeadfb0d8863a2cf31b6e2..11fde625a13a78dec5ae8245ada514e8ca6ab2c6 100644
+index b85d2f53e55131491c32eff5475cffa7c9d65e25..73d9f46fd52a9bda3322d1883207a56171507692 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -2122,6 +2122,9 @@ void RenderWidgetHostImpl::SetCursor(const ui::Cursor& cursor) {
+@@ -2128,6 +2128,9 @@ void RenderWidgetHostImpl::SetCursor(const ui::Cursor& cursor) {
    if (view_) {
      view_->UpdateCursor(cursor);
    }

patches/chromium/webview_fullscreen.patch

@@ -15,10 +15,10 @@ Note that we also need to manually update embedder's
 `api::WebContents::IsFullscreenForTabOrPending` value.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 5ea6972f03fd450272de52c84f783be9113608bc..72dc42e2919fcb7bdfb15512b1ff38ea48807c7f 100644
+index eba5428f82966230252ac01c49a049e9775996b2..710739875dd45e943c43647ff3346bd375d23232 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -7316,6 +7316,17 @@ void RenderFrameHostImpl::EnterFullscreen(
+@@ -7334,6 +7334,17 @@ void RenderFrameHostImpl::EnterFullscreen(
      }
    }
  

patches/chromium/worker_context_will_destroy.patch

@@ -26,7 +26,7 @@ index a4130ad4dc8158f8256b55fdd87f577687135626..3139aa65807cee23f0e8dbc85243566e
    // An empty URL is returned if the URL is not overriden.
    virtual GURL OverrideFlashEmbedWithHTML(const GURL& url);
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
-index cddb519c4c893607e56ea44e17e75783fb33d373..0a3a36d2650d7aa3edb50f37898be20500fc99e5 100644
+index 4ed1a50637e40df4d3a9c1a1cfb63ad948df413c..bc446fa9f6dcbaa618a06040dd215ac928388341 100644
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
 @@ -788,6 +788,12 @@ void RendererBlinkPlatformImpl::WillStopWorkerThread() {

patches/chromium/worker_feat_add_hook_to_notify_script_ready.patch

@@ -35,7 +35,7 @@ index 3139aa65807cee23f0e8dbc85243566ef9de89b9..19707edb1283f2432f3c0059f80fabd5
    // from the worker thread.
    virtual void WillDestroyWorkerContextOnWorkerThread(
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
-index 0a3a36d2650d7aa3edb50f37898be20500fc99e5..63fe14db69116258a874117232c193f4be7d8f83 100644
+index bc446fa9f6dcbaa618a06040dd215ac928388341..77a9172d12af687235f303f3d38912d9b96ba6a8 100644
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
 @@ -800,6 +800,12 @@ void RendererBlinkPlatformImpl::WorkerContextCreated(

patches/webrtc/.patches

@@ -1,3 +1,4 @@
 fix_fallback_to_x11_capturer_on_wayland.patch
 fix_mark_pipewire_capturer_as_failed_after_session_is_closed.patch
 fix_check_pipewire_init_before_creating_generic_capturer.patch
+pipewire_capturer_make_restore_tokens_re-usable_more_than_one_time.patch

patches/webrtc/pipewire_capturer_make_restore_tokens_re-usable_more_than_one_time.patch

@@ -0,0 +1,73 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jan Grulich <grulja@gmail.com>
+Date: Mon, 9 Oct 2023 18:54:31 +0200
+Subject: PipeWire capturer: make restore tokens re-usable more than one time
+
+Do not automatically remove all tokens once we attempt to use them. This
+mitigates an issue with Google Meet where an additional instance of a
+DesktopCapturer is created and destroyed right away, taking away the
+token we would use otherwise. Also save the token under same SourceId
+once we get a new (but could be same) token from the restored session.
+
+Bug: webrtc:15544
+Change-Id: I565b22f5bf6a4d8a3b7d6d757f9c1046c7a0557d
+Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/322621
+Commit-Queue: Jan Grulich <grulja@gmail.com>
+Reviewed-by: Alexander Cooper <alcooper@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#40892}
+
+diff --git a/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc b/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc
+index 5a67c18c1d1f62aa5e3162d9778ca665bac4a1bb..a5df76b0cdecd1e2e68f2f25c80c6b17de8bc808 100644
+--- a/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc
++++ b/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc
+@@ -82,8 +82,10 @@ void BaseCapturerPipeWire::OnScreenCastRequestResult(RequestResponse result,
+                       << static_cast<uint>(result);
+   } else if (ScreenCastPortal* screencast_portal = GetScreenCastPortal()) {
+     if (!screencast_portal->RestoreToken().empty()) {
++      const SourceId token_id =
++          selected_source_id_ ? selected_source_id_ : source_id_;
+       RestoreTokenManager::GetInstance().AddToken(
+-          source_id_, screencast_portal->RestoreToken());
++          token_id, screencast_portal->RestoreToken());
+     }
+   }
+ 
+@@ -138,7 +140,7 @@ void BaseCapturerPipeWire::Start(Callback* callback) {
+         ScreenCastPortal::PersistMode::kTransient);
+     if (selected_source_id_) {
+       screencast_portal->SetRestoreToken(
+-          RestoreTokenManager::GetInstance().TakeToken(selected_source_id_));
++          RestoreTokenManager::GetInstance().GetToken(selected_source_id_));
+     }
+   }
+ 
+diff --git a/modules/desktop_capture/linux/wayland/restore_token_manager.cc b/modules/desktop_capture/linux/wayland/restore_token_manager.cc
+index 5ca9b957a9e4f436bc09d4bc16019b169ae9ba9f..a17d9a49bb031efa340bfd61b4a6f8f5a86d09da 100644
+--- a/modules/desktop_capture/linux/wayland/restore_token_manager.cc
++++ b/modules/desktop_capture/linux/wayland/restore_token_manager.cc
+@@ -23,10 +23,8 @@ void RestoreTokenManager::AddToken(DesktopCapturer::SourceId id,
+   restore_tokens_.insert({id, token});
+ }
+ 
+-std::string RestoreTokenManager::TakeToken(DesktopCapturer::SourceId id) {
+-  std::string token = restore_tokens_[id];
+-  // Remove the token as it cannot be used anymore
+-  restore_tokens_.erase(id);
++std::string RestoreTokenManager::GetToken(DesktopCapturer::SourceId id) {
++  const std::string token = restore_tokens_[id];
+   return token;
+ }
+ 
+diff --git a/modules/desktop_capture/linux/wayland/restore_token_manager.h b/modules/desktop_capture/linux/wayland/restore_token_manager.h
+index 174bef121f74b7b2b529d681b86c4fb4218586ea..ad4f74790f2a5cfba304fc11d47c9924db9013d8 100644
+--- a/modules/desktop_capture/linux/wayland/restore_token_manager.h
++++ b/modules/desktop_capture/linux/wayland/restore_token_manager.h
+@@ -27,7 +27,7 @@ class RestoreTokenManager {
+   static RestoreTokenManager& GetInstance();
+ 
+   void AddToken(DesktopCapturer::SourceId id, const std::string& token);
+-  std::string TakeToken(DesktopCapturer::SourceId id);
++  std::string GetToken(DesktopCapturer::SourceId id);
+ 
+   // Returns a source ID which does not have any token associated with it yet.
+   DesktopCapturer::SourceId GetUnusedId();

shell/browser/api/electron_api_web_contents.cc

@@ -469,9 +469,16 @@ base::IDMap<WebContents*>& GetAllWebContents() {
 void OnCapturePageDone(gin_helper::Promise<gfx::Image> promise,
                        base::ScopedClosureRunner capture_handle,
                        const SkBitmap& bitmap) {
+  auto ui_task_runner = content::GetUIThreadTaskRunner({});
+  if (!ui_task_runner->RunsTasksInCurrentSequence()) {
+    ui_task_runner->PostTask(
+        FROM_HERE, base::BindOnce(&OnCapturePageDone, std::move(promise),
+                                  std::move(capture_handle), bitmap));
+    return;
+  }
+
   // Hack to enable transparency in captured image
   promise.Resolve(gfx::Image::CreateFrom1xBitmap(bitmap));
-
   capture_handle.RunAndReset();
 }
 
@@ -3462,22 +3469,16 @@ v8::Local<v8::Promise> WebContents::CapturePage(gin::Arguments* args) {
   }
 
   auto* const view = web_contents()->GetRenderWidgetHostView();
-  if (!view) {
+  if (!view || view->GetViewBounds().size().IsEmpty()) {
     promise.Resolve(gfx::Image());
     return handle;
   }
 
-#if !BUILDFLAG(IS_MAC)
-  // If the view's renderer is suspended this may fail on Windows/Linux -
-  // bail if so. See CopyFromSurface in
-  // content/public/browser/render_widget_host_view.h.
-  auto* rfh = web_contents()->GetPrimaryMainFrame();
-  if (rfh &&
-      rfh->GetVisibilityState() == blink::mojom::PageVisibilityState::kHidden) {
-    promise.Resolve(gfx::Image());
+  if (!view->IsSurfaceAvailableForCopy()) {
+    promise.RejectWithErrorMessage(
+        "Current display surface not available for capture");
     return handle;
   }
-#endif  // BUILDFLAG(IS_MAC)
 
   auto capture_handle = web_contents()->IncrementCapturerCount(
       rect.size(), stay_hidden, stay_awake);

shell/browser/native_window.cc

@@ -537,7 +537,7 @@ void NativeWindow::PreviewFile(const std::string& path,
 
 void NativeWindow::CloseFilePreview() {}
 
-gfx::Rect NativeWindow::GetWindowControlsOverlayRect() {
+absl::optional<gfx::Rect> NativeWindow::GetWindowControlsOverlayRect() {
   return overlay_rect_;
 }
 
@@ -665,6 +665,7 @@ void NativeWindow::NotifyWindowMoved() {
 }
 
 void NativeWindow::NotifyWindowEnterFullScreen() {
+  NotifyLayoutWindowControlsOverlay();
   for (NativeWindowObserver& observer : observers_)
     observer.OnWindowEnterFullScreen();
 }
@@ -690,6 +691,7 @@ void NativeWindow::NotifyWindowSheetEnd() {
 }
 
 void NativeWindow::NotifyWindowLeaveFullScreen() {
+  NotifyLayoutWindowControlsOverlay();
   for (NativeWindowObserver& observer : observers_)
     observer.OnWindowLeaveFullScreen();
 }
@@ -733,10 +735,10 @@ void NativeWindow::NotifyWindowSystemContextMenu(int x,
 }
 
 void NativeWindow::NotifyLayoutWindowControlsOverlay() {
-  gfx::Rect bounding_rect = GetWindowControlsOverlayRect();
-  if (!bounding_rect.IsEmpty()) {
+  auto bounding_rect = GetWindowControlsOverlayRect();
+  if (bounding_rect.has_value()) {
     for (NativeWindowObserver& observer : observers_)
-      observer.UpdateWindowControlsOverlay(bounding_rect);
+      observer.UpdateWindowControlsOverlay(bounding_rect.value());
   }
 }
 

shell/browser/native_window.h

@@ -286,7 +286,7 @@ class NativeWindow : public base::SupportsUserData,
     return weak_factory_.GetWeakPtr();
   }
 
-  virtual gfx::Rect GetWindowControlsOverlayRect();
+  virtual absl::optional<gfx::Rect> GetWindowControlsOverlayRect();
   virtual void SetWindowControlsOverlayRect(const gfx::Rect& overlay_rect);
 
   // Methods called by the WebContents.

shell/browser/native_window_mac.h

@@ -153,7 +153,7 @@ class NativeWindowMac : public NativeWindow,
   void CloseFilePreview() override;
   gfx::Rect ContentBoundsToWindowBounds(const gfx::Rect& bounds) const override;
   gfx::Rect WindowBoundsToContentBounds(const gfx::Rect& bounds) const override;
-  gfx::Rect GetWindowControlsOverlayRect() override;
+  absl::optional<gfx::Rect> GetWindowControlsOverlayRect() override;
   void NotifyWindowEnterFullScreen() override;
   void NotifyWindowLeaveFullScreen() override;
   void SetActive(bool is_key) override;

shell/browser/native_window_mac.mm

@@ -1899,23 +1899,33 @@ void NativeWindowMac::SetForwardMouseMessages(bool forward) {
   [window_ setAcceptsMouseMovedEvents:forward];
 }
 
-gfx::Rect NativeWindowMac::GetWindowControlsOverlayRect() {
-  if (titlebar_overlay_ && buttons_proxy_ &&
-      window_button_visibility_.value_or(true)) {
+absl::optional<gfx::Rect> NativeWindowMac::GetWindowControlsOverlayRect() {
+  if (!titlebar_overlay_)
+    return absl::nullopt;
+
+  // On macOS, when in fullscreen mode, window controls (the menu bar, title
+  // bar, and toolbar) are attached to a separate NSView that slides down from
+  // the top of the screen, independent of, and overlapping the WebContents.
+  // Disable WCO when in fullscreen, because this space is inaccessible to
+  // WebContents. https://crbug.com/915110.
+  if (IsFullscreen())
+    return gfx::Rect();
+
+  if (buttons_proxy_ && window_button_visibility_.value_or(true)) {
     NSRect buttons = [buttons_proxy_ getButtonsContainerBounds];
     gfx::Rect overlay;
     overlay.set_width(GetContentSize().width() - NSWidth(buttons));
-    if ([buttons_proxy_ useCustomHeight]) {
-      overlay.set_height(titlebar_overlay_height());
-    } else {
-      overlay.set_height(NSHeight(buttons));
-    }
+    overlay.set_height([buttons_proxy_ useCustomHeight]
+                           ? titlebar_overlay_height()
+                           : NSHeight(buttons));
 
     if (!base::i18n::IsRTL())
       overlay.set_x(NSMaxX(buttons));
+
     return overlay;
   }
-  return gfx::Rect();
+
+  return absl::nullopt;
 }
 
 // static

spec/api-browser-window-spec.ts

@@ -2224,7 +2224,22 @@ describe('BrowserWindow module', () => {
       expect(visible).to.equal('hidden');
     });
 
-    it('resolves after the window is hidden', async () => {
+    it('resolves when the window is occluded', async () => {
+      const w1 = new BrowserWindow({ show: false });
+      w1.loadFile(path.join(fixtures, 'pages', 'a.html'));
+      await once(w1, 'ready-to-show');
+      w1.show();
+
+      const w2 = new BrowserWindow({ show: false });
+      w2.loadFile(path.join(fixtures, 'pages', 'a.html'));
+      await once(w2, 'ready-to-show');
+      w2.show();
+
+      const visibleImage = await w1.capturePage();
+      expect(visibleImage.isEmpty()).to.equal(false);
+    });
+
+    it('resolves when the window is not visible', async () => {
       const w = new BrowserWindow({ show: false });
       w.loadFile(path.join(fixtures, 'pages', 'a.html'));
       await once(w, 'ready-to-show');
@@ -2233,21 +2248,10 @@ describe('BrowserWindow module', () => {
       const visibleImage = await w.capturePage();
       expect(visibleImage.isEmpty()).to.equal(false);
 
-      w.hide();
+      w.minimize();
 
       const hiddenImage = await w.capturePage();
-      const isEmpty = process.platform !== 'darwin';
-      expect(hiddenImage.isEmpty()).to.equal(isEmpty);
-    });
-
-    it('resolves after the window is hidden and capturer count is non-zero', async () => {
-      const w = new BrowserWindow({ show: false });
-      w.webContents.setBackgroundThrottling(false);
-      w.loadFile(path.join(fixtures, 'pages', 'a.html'));
-      await once(w, 'ready-to-show');
-
-      const image = await w.capturePage();
-      expect(image.isEmpty()).to.equal(false);
+      expect(hiddenImage.isEmpty()).to.equal(false);
     });
 
     it('preserves transparency', async () => {

spec/api-ipc-spec.ts

@@ -317,11 +317,7 @@ describe('ipc module', () => {
           await once(ipcMain, 'closed');
         });
 
-        // TODO(@vertedinde): This broke upstream in CL https://chromium-review.googlesource.com/c/chromium/src/+/4831380
-        // The behavior seems to be an intentional change, we need to either A) implement the task_container_ model in
-        // our renderer message ports or B) patch how we handle renderer message ports being garbage collected
-        // crbug: https://bugs.chromium.org/p/chromium/issues/detail?id=1487835
-        it.skip('is emitted when the other end of a port is garbage-collected', async () => {
+        it('is emitted when the other end of a port is garbage-collected', async () => {
           const w = new BrowserWindow({ show: false, webPreferences: { nodeIntegration: true, contextIsolation: false } });
           w.loadURL('about:blank');
           await w.webContents.executeJavaScript(`(${async function () {

spec/ts-smoke/electron/main.ts

@@ -429,6 +429,11 @@ win2.once('ready-to-show', () => {
 app.relaunch({ args: process.argv.slice(1).concat(['--relaunch']) });
 app.exit(0);
 
+app.configureHostResolver({ secureDnsMode: 'off' });
+
+// @ts-expect-error Invalid type value
+app.configureHostResolver({ secureDnsMode: 'foo' });
+
 // @ts-expect-error Removed API
 console.log(app.runningUnderRosettaTranslation);
 
@@ -1284,6 +1289,11 @@ win4.webContents.on('devtools-open-url', (event, url) => {
   console.log(url);
 });
 
+win4.webContents.insertCSS('body {}', { cssOrigin: 'user' });
+
+// @ts-expect-error Invalid type value
+win4.webContents.insertCSS('body {}', { cssOrigin: 'foo' });
+
 win4.loadURL('http://github.com');
 
 // @ts-expect-error Removed API