fix: user resizable transparent windows on win32 (#50298)

test: revert win32 frameless and transparent resizable expectations

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Justin Mayfield <tooker@gmail.com>

.claude/.gitignore

@@ -0,0 +1 @@
+settings.local.json

.claude/settings.json

@@ -0,0 +1,24 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(e sync)",
+      "Bash(e patches --list-targets:*)",
+      "Bash(git add:*)",
+      "Bash(git am:*)",
+      "Bash(git commit:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(e patches:*)",
+      "Bash(e sync:*)",
+      "Skill(electron-chromium-upgrade)",
+      "Read(*)",
+      "Bash(echo:*)",
+      "Bash(e build:*)",
+      "Bash(tee:*)",
+      "Bash(git diff:*)",
+      "Bash(git rev-parse:*)"
+    ],
+    "deny": [],
+    "ask": []
+  }
+}

.claude/skills/electron-chromium-upgrade/SKILL.md

@@ -0,0 +1,199 @@
+---
+name: electron-chromium-upgrade
+description: Guide for performing Chromium version upgrades in the Electron project. Use when working on the roller/chromium/main branch to fix patch conflicts during `e sync --3`. Covers the patch application workflow, conflict resolution, analyzing upstream Chromium changes, and proper commit formatting for patch fixes.
+---
+
+# Electron Chromium Upgrade: Phase One
+
+## Summary
+
+Run `e sync --3` repeatedly, fixing patch conflicts as they arise, until it succeeds. Then run `e patches all` and commit changes atomically.
+
+## Success Criteria
+
+Phase One is complete when:
+- `e sync --3` exits with code 0 (no patch failures)
+- `e patches all` has been run to export all changes
+- All changes are committed per the commit guidelines below
+
+Do not stop until these criteria are met.
+
+**CRITICAL** Do not delete or skip patches unless 100% certain the patch is no longer needed. Complicated conflicts or hard to resolve issues should be presented to the user after you have exhausted all other options. Do not delete the patch just because you can't solve it.
+
+## Context
+
+The `roller/chromium/main` branch is created by automation to update Electron's Chromium dependency SHA. No work has been done to handle breaking changes between the old and new versions.
+
+**Key directories:**
+- Current directory: Electron repo (always run `e` commands here)
+- `..` (parent): Chromium repo (where most patches apply)
+- `patches/`: Patch files organized by target
+- `docs/development/patches.md`: Patch system documentation
+
+## Workflow
+
+1. Delete the `.git/rr-cache` in both the `electron` and `..` folder to ensure no accidental rerere replays occur from before this upgrade phase attempt started
+2. Run `e sync --3` (the `--3` flag enables 3-way merge, always required)
+3. If succeeds → skip to step 6
+4. If patch fails:
+   - Identify target repo and patch from error output
+   - Analyze failure (see references/patch-analysis.md)
+   - Fix conflict in target repo's working directory
+   - Run `git am --continue` in affected repo
+   - Repeat until all patches for that repo apply
+   - IMPORTANT: Once `git am --continue` succeeds you MUST run `e patches {target}` to export fixes
+   - Return to step 1
+5. When `e sync --3` succeeds, run `e patches all`
+6. **Read `references/phase-one-commit-guidelines.md` NOW**, then commit changes following those instructions exactly.
+
+Before committing any Phase One changes, you MUST read `references/phase-one-commit-guidelines.md` and follow its instructions exactly.
+
+## Commands Reference
+
+| Command | Purpose |
+|---------|---------|
+| `e sync --3` | Clone deps and apply patches with 3-way merge |
+| `git am --continue` | Continue after resolving conflict (run in target repo) |
+| `e patches {target}` | Export commits from target repo to patch files |
+| `e patches all` | Export all patches from all targets |
+| `e patches --list-targets` | List targets and config paths |
+
+## Patch System Mental Model
+
+```
+patches/{target}/*.patch  →  [e sync --3]  →  target repo commits
+                          ←  [e patches]   ←
+```
+
+## When to Edit Patches
+
+| Situation | Action |
+|-----------|--------|
+| During active `git am` conflict | Fix in target repo, then `git am --continue` |
+| Modifying patch outside conflict | Edit `.patch` file directly |
+| Creating new patch (rare, avoid) | Commit in target repo, then `e patches {target}` |
+
+Fix existing patches 99% of the time rather than creating new ones.
+
+## Patch Fixing Rules
+
+1. **Preserve authorship**: Keep original author in TODO comments (from patch `From:` field)
+2. **Never change TODO assignees**: `TODO(name)` must retain original name
+3. **Update descriptions**: If upstream changed (e.g., `DCHECK` → `CHECK_IS_TEST`), update patch commit message to reflect current state
+
+## Final Deliverable
+
+After Phase One, write a summary of every change: what was fixed, why, reasoning, and Chromium CL links.
+
+# Electron Chromium Upgrade: Phase Two
+
+## Summary
+
+Run `e build -k 999` repeatedly, fixing build issues as they arise, until it succeeds. Then run `e start --version` to validate Electron launches and commit changes atomically.
+
+Run Phase Two immediately after Phase One is complete.
+
+## Success Criteria
+
+Phase Two is complete when:
+- `e build -k 999` exits with code 0 (no build failures)
+- `e start --version` has been run to check Electron launches
+- All changes are committed per the commit guidelines below
+
+Do not stop until these criteria are met. Do not delete code or features, never comment out code in order to take short cut. Make all existing code, logic and intention work.
+
+## Context
+
+The `roller/chromium/main` branch is created by automation to update Electron's Chromium dependency SHA. No work has been done to handle breaking changes between the old and new versions. Chromium APIs frequently are renamed or refactored. In every case the code in Electron must be updated to account for the change in Chromium, strongly avoid making changes to the code in chromium to fix Electrons build.
+
+**Key directories:**
+- Current directory: Electron repo (always run `e` commands here)
+- `..` (parent): Chromium repo (do not touch this code to fix build issues, just read it to obtain context)
+
+## Workflow
+
+1. Run `e build -k 999` (the `-k 999` flag is a flag to ninja to say "do not stop until you find that many errors" it is an attempt to get as much error
+  context as possible for each time we run build)
+2. If succeeds → skip to step 6
+3. If build fails:
+    - Identify underlying file in "electron" from the compilation error message
+    - Analyze failure
+    - Fix build issue by adapting Electron's code for the change in Chromium
+    - Run `e build -t {target_that_failed}.o` to build just the failed target we were specifically fixing
+        - You can identify the target_that_failed from the failure line in the build log. E.g. `FAILED: 2e506007-8d5d-4f38-bdd1-b5cd77999a77 "./obj/electron/chromium_src/chrome/process_singleton_posix.o" CXX obj/electron/chromium_src/chrome/process_singleton_posix.o` the target name is `obj/electron/chromium_src/chrome/process_singleton_posix.o`
+    - **Read `references/phase-two-commit-guidelines.md` NOW**, then commit changes following those instructions exactly.
+    - Return to step 1
+4. **CRITICAL**: After ANY commit (especially patch commits), immediately run `git status` in the electron repo
+    - Look for other modified `.patch` files that only have index/hunk header changes
+    - These are dependent patches affected by your fix
+    - Commit them immediately with: `git commit -am "chore: update patch hunk headers"`
+    - This prevents losing track of necessary updates
+5. Return to step 1
+6. When `e build` succeeds, run `e start --version`
+7. Check if you have any pending changes in the Chromium repo by running `git status`
+    - If you have changes follow the instructions below in "A. Patch Fixes" to correctly commit those modifications into the appropriate patch file
+
+Before committing any Phase Two changes, you MUST read `references/phase-two-commit-guidelines.md` and follow its instructions exactly.
+
+## Build Error Detection
+
+When monitoring `e build -k 999` output, filter for errors using this regex pattern:
+error:|FAILED:|fatal:|subcommand failed|build finished
+
+The build output is extremely verbose. Filtering is essential to catch errors quickly.
+
+## Commands Reference
+
+| Command | Purpose |
+|---------|---------|
+| `e build -k 999` | Builds Electron and won't stop until either all targets attempted or 999 errors found |
+| `e build -t {target}.o` | Build just one specific target to verify a fix |
+| `e start --version` | Validate Electron launches after successful build |
+
+## Two Types of Build Fixes
+
+### A. Patch Fixes (for files in chromium_src or patched Chromium files)
+
+When the error is in a file that Electron patches (check with `grep -l "filename" patches/chromium/*.patch`):
+
+1. Edit the file in the Chromium source tree (e.g., `/src/chrome/browser/...`)
+2. Create a fixup commit targeting the original patch commit:
+    ```bash
+    cd ..  # to chromium repo
+    git add <modified-file>
+    git commit --fixup=<original-patch-commit-hash>
+    GIT_SEQUENCE_EDITOR=: git rebase --autosquash --autostash -i <commit>^
+3. Export the updated patch: e patches chromium
+4. Commit the updated patch file in the electron repo following the `references/phase-one-commit-guidelines.md`, then commit changes following those instructions exactly. **READ THESE GUIDELINES BEFORE COMMITTING THESE CHANGES**
+
+To find the original patch commit to fixup: `git log --oneline | grep -i "keyword from patch name"`
+
+The base commit for rebase is the Chromium commit before patches were applied. Find it by checking the `refs/patches/upstream-head` ref.
+
+B. Electron Code Fixes (for files in shell/, electron/, etc.)
+
+When the error is in Electron's own source code:
+
+1. Edit files directly in the electron repo
+2. Commit directly (no patch export needed)
+
+Dependent Patch Updates
+
+IMPORTANT: When you modify a patch, other patches that apply to the same file may have their hunk headers invalidated. After committing a patch fix:
+
+1. Run git status in the electron repo
+2. Look for other modified .patch files with just index/hunk header changes
+3. Commit these with: git commit -m "chore: update patch hunk headers"
+
+# Critical: Read Before Committing
+
+- Before ANY Phase One commits: Read `references/phase-one-commit-guidelines.md`
+- Before ANY Phase Two commits: Read `references/phase-two-commit-guidelines.md`
+
+# Skill Directory Structure
+This skill has additional reference files in `references/`:
+- patch-analysis.md - How to analyze patch failures
+- phase-one-commit-guidelines.md - Commit format for Phase One
+- phase-two-commit-guidelines.md - Commit format for Phase Two
+
+Read these when referenced in the workflow steps.

.claude/skills/electron-chromium-upgrade/references/patch-analysis.md

@@ -0,0 +1,69 @@
+# Analyzing Patch Failures
+
+## Investigation Steps
+
+1. **Read the patch file** at `patches/{target}/{patch_name}.patch`
+
+2. **Examine current state** of the file in Chromium at mentioned line numbers
+
+3. **Check recent upstream changes:**
+   ```bash
+   cd ..  # or relevant target repo
+   git log --oneline -10 -- {file}
+   ```
+
+4. **Find Chromium CL** in commit messages:
+   ```
+   Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/{CL_NUMBER}
+   ```
+
+## Common Failure Patterns
+
+| Pattern | Cause | Solution |
+|---------|-------|----------|
+| Context lines don't match | Surrounding code changed | Update context in patch |
+| File not found | File renamed/moved | Update patch target path |
+| Function not found | Refactored upstream | Find new function name |
+| `DCHECK` → `CHECK_IS_TEST` | Macro change | Update to new macro |
+| Deleted code | Feature removed | Verify patch still needed |
+
+## Using Git Blame
+
+To find the CL that changed specific lines:
+
+```bash
+cd ..
+git blame -L {start},{end} -- {file}
+git log -1 {commit_sha}  # Look for Reviewed-on: line
+```
+
+## Verifying Patch Necessity
+
+Before deleting a patch, verify:
+1. The patched functionality was intentionally removed upstream
+2. Electron doesn't need the patch for other reasons
+3. No other code depends on the patched behavior
+
+When in doubt, keep the patch and adapt it.
+
+## Phase Two: Build-Time Patch Issues
+
+Sometimes patches that applied successfully in Phase One cause build errors in Phase Two. This can happen when:
+
+1. **Incomplete types**: A patch disables a header include, but new upstream code uses the type
+2. **Missing members**: A patch modifies a class, but upstream added new code referencing the original
+
+### Finding Which Patch Affects a File
+
+```bash
+grep -l "filename.cc" patches/chromium/*.patch
+```
+
+Matching Existing Patch Patterns
+
+When fixing build errors in patched files, examine the existing patch to understand its style:
+- Does it use #if 0 / #endif guards?
+- Does it use #if BUILDFLAG(...) conditionals?
+- What's the pattern for disabled functionality?
+
+Apply fixes consistent with the existing patch style.

.claude/skills/electron-chromium-upgrade/references/phase-one-commit-guidelines.md

@@ -0,0 +1,52 @@
+# Phase One Commit Guidelines
+
+Only follow these instructions if there are uncommitted changes to `patches/` after Phase One succeeds.
+
+Ignore other instructions about making commit messages, our guidelines are CRITICALLY IMPORTANT and must be followed.
+
+## Atomic Commits
+
+For each fix made to a patch, create a separate commit:
+
+```
+fix(patch-conflict): {concise title}
+
+{Brief explanation, 1-2 paragraphs max}
+
+Ref: {Chromium CL link}
+```
+
+IMPORTANT: Ensure that any changes made to patch content as a result of a change in Chromium is committed individually. Each change should have it's own commit message and it's own REF.
+
+IMPORTANT: Try really hard to find the CL reference per the instructions below. Each change you made should in theory have been in response to a change made in Chromium that you identified or can identify. Try for a while to identify and include the ref in the commit message. Do not give up easily.
+
+## Finding CL References
+
+Use `git log` or `git blame` on Chromium source files. Look for:
+
+```
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/XXXXXXX
+```
+
+If no CL found after searching: `Ref: Unable to locate CL`
+
+## Final Cleanup
+
+After all fix commits, stage remaining changes:
+
+```bash
+git add patches
+git commit -m "chore: update patch hunk headers"
+```
+
+## Example Commit
+
+```
+fix(patch-conflict): update web_contents_impl.cc context for navigation refactor
+
+The upstream navigation code was refactored to use NavigationRequest directly
+instead of going through NavigationController. Updated surrounding context
+to match new code structure.
+
+Ref: https://chromium-review.googlesource.com/c/chromium/src/+/1234567
+```

.claude/skills/electron-chromium-upgrade/references/phase-two-commit-guidelines.md

@@ -0,0 +1,82 @@
+# Phase Two Commit Guidelines
+
+Only follow these instructions if there are uncommitted changes in the Electron repo after any fixes are made during Phase Two that result a target that was failing, successfully building.
+
+Ignore other instructions about making commit messages, our guidelines are CRITICALLY IMPORTANT and must be followed.
+
+## Two Commit Types
+
+### For Electron Source Changes (shell/, electron/, etc.)
+
+```
+{CL-Number}: {concise description of API change}
+
+{Brief explanation of what upstream changed and how Electron was adapted}
+
+Ref: {Chromium CL link}
+```
+
+IMPORTANT: Ensure that any change made to electron as a result of a change in Chromium is committed individually. Each change should have it's own commit message and it's own REF. Logically grouped into commits that make sense rather than one giant commit.
+
+IMPORTANT: Try really hard to find the CL reference per the instructions below. Each change you made should in theory have been in response to a change made in Chromium that you identified or can identify. Try for a while to identify and include the ref in the commit message. Do not give up easily.
+
+You may include multiple "Ref" links if required.
+
+For a CL link in the format `https://chromium-review.googlesource.com/c/chromium/src/+/2958369` the "CL-Number" is `2958369`
+
+### For Patch Updates (patches/chromium/*.patch)
+
+Use the same fixup workflow as Phase One:
+1. Fix in Chromium source tree
+2. Fixup commit + rebase
+3. Export with `e patches chromium`
+4. Commit the patch file:
+
+```
+fix(patch-update): {concise description}
+
+{Brief explanation}
+
+Ref: {Chromium CL link}
+```
+
+## Dependent Patch Header Updates
+
+After any patch modification, check for other affected patches:
+
+```bash
+git status
+# If other .patch files show as modified with only hunk header changes:
+git add patches/
+git commit -m "chore: update patch hunk headers"
+```
+
+## Finding CL References
+
+Use git log or git blame on Chromium source files. Look for:
+
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/XXXXXXX
+
+If no CL found after searching: Ref: Unable to locate CL
+
+## Example Commits
+
+### Electron Source Fix
+
+fix: update GetPlugins to GetPluginsAsync for API change
+
+The upstream Chromium API changed:
+- Old: GetPlugins(callback) - took a callback
+- New: GetPluginsAsync(callback) - async version takes a callback
+
+Ref: https://chromium-review.googlesource.com/c/chromium/src/+/1234567
+
+### Patch Fix
+
+fix(patch-conflict): update picture-in-picture for gesture handling refactor
+
+Upstream added new gesture handling code that accesses live caption dialog.
+The live caption functionality is disabled in Electron's patch, so wrapped
+the new code in #if 0 guards to match existing pattern.
+
+Ref: https://chromium-review.googlesource.com/c/chromium/src/+/7654321

.devcontainer/on-create-command.sh

@@ -48,7 +48,8 @@ if [ ! -f $buildtools/configs/evm.testing.json ]; then
             \"gen\": {
                 \"args\": [
                     \"import(\\\"//electron/build/args/testing.gn\\\")\",
-                    \"use_remoteexec = true\"
+                    \"use_remoteexec = true\",
+                    \"use_siso=true\"
                 ],
                 \"out\": \"Testing\"
             },
@@ -58,7 +59,7 @@ if [ ! -f $buildtools/configs/evm.testing.json ]; then
             },
             \"\$schema\": \"file:///home/builduser/.electron_build_tools/evm-config.schema.json\",
             \"configValidationLevel\": \"strict\",
-            \"remoteBuild\": \"reclient\",
+            \"remoteBuild\": \"siso\",
             \"preserveSDK\": 5
         }
     " >$buildtools/configs/evm.testing.json

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,7 +10,7 @@ Contributors guide: https://github.com/electron/electron/blob/main/CONTRIBUTING.
 #### Checklist
 <!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->
 
-- [ ] PR description included and stakeholders cc'd
+- [ ] PR description included
 - [ ] `npm test` passes
 - [ ] tests are [changed or added](https://github.com/electron/electron/blob/main/docs/development/testing.md)
 - [ ] relevant API documentation, tutorials, and examples are updated and follow the [documentation style guide](https://github.com/electron/electron/blob/main/docs/development/style-guide.md)

.github/actions/fix-sync/action.yml

@@ -37,6 +37,22 @@ runs:
         installation-dir: third_party/esbuild
         target-platform: ${{ inputs.target-platform }}
         package: infra/3pp/tools/esbuild/${platform}
+    - name: Fix rollup
+      if: ${{ inputs.target-platform != 'linux' }}
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        cipd-root-prefix-path: src/third_party/devtools-frontend/src/
+        dependency: rollup_libs
+        deps-file: src/third_party/devtools-frontend/src/DEPS
+        installation-dir: third_party/rollup_libs
+        target-platform: ${{ inputs.target-platform }}
+        package: infra/3pp/tools/rollup_libs/${platform}
+    - name: Sync native rollup libs
+      if: ${{ inputs.target-platform != 'linux' }}
+      shell: bash
+      run : |
+        cd src/third_party/devtools-frontend/src
+        python3 scripts/deps/sync_rollup_libs.py
     - name: Fix rustc
       if: ${{ inputs.target-platform != 'linux' }}
       shell: bash

.github/actions/free-space-macos/action.yml

@@ -80,8 +80,10 @@ runs:
         sudo rm -rf /Users/runner/.rustup
 
         # remove homebrew packages we don't need
-        brew uninstall -f --zap aws-sam-cli session-manager-plugin gcc gcc@13 gcc@14 llvm@18 gradle maven ant azure-cli
-        brew autoremove
+        if command -v brew &> /dev/null; then
+          brew uninstall -f --zap aws-sam-cli session-manager-plugin gcc gcc@13 gcc@14 llvm@18 gradle maven ant azure-cli
+          brew autoremove
+        fi
 
         # lipo off some huge binaries arm64 versions to save space
         strip_universal_deep $(xcode-select -p)/../SharedFrameworks

.github/workflows/apply-patches.yml

@@ -71,3 +71,11 @@ jobs:
       uses: ./src/electron/.github/actions/checkout
       with:
         target-platform: linux
+    - name: Upload Patch Conflict Fix
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: update-patches
+        path: patches/update-patches.patch
+        if-no-files-found: ignore
+        archive: false

.github/workflows/archaeologist-dig.yml

@@ -13,13 +13,13 @@ jobs:
       contents: read
     steps:
       - name: Checkout Electron
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           fetch-depth: 0
       - name: Setup Node.js/npm
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
         with:
-          node-version: 20.19.x
+          node-version: 24.12.x
       - name: Setting Up Dig Site
         run: |
           echo "remote: ${{ github.event.pull_request.head.repo.clone_url }}"
@@ -45,7 +45,7 @@ jobs:
           sha-file: .dig-old
           filename: electron.old.d.ts
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 #v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
         with:
           name: artifacts
           path: electron/artifacts

.github/workflows/audit-branch-ci.yml

@@ -16,15 +16,25 @@ jobs:
       contents: read
     steps:
       - name: Setup Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: 22.17.x
-      - run: npm install @actions/cache@4.0.3 @electron/fiddle-core@2.0.1
+      - name: Sparse checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: |
+            .
+            .github
+            .yarn
+      - run: yarn workspaces focus @electron/gha-workflows
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: audit-errors
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
+            const { chdir } = require('node:process');
+            chdir('${{ github.workspace }}/.github/workflows');
+
             const cache = require('@actions/cache');
             const { ElectronVersions } = require('@electron/fiddle-core');
 
@@ -74,6 +84,7 @@ jobs:
                       !message.startsWith("Process completed with exit code") &&
                       !message.startsWith("Response status code does not indicate success") &&
                       !message.startsWith("The hosted runner lost communication with the server") &&
+                      !message.startsWith("Dependabot encountered an error performing the update") &&
                       !/Unable to make request/.test(message) &&
                       !/The requested URL returned error/.test(message),
                   )

.github/workflows/build-git-cache.yml

@@ -23,7 +23,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -47,7 +47,7 @@ jobs:
       TARGET_OS: 'win'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -72,7 +72,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/build.yml

@@ -57,7 +57,7 @@ jobs:
         build-image-sha: ${{ steps.set-output.outputs.build-image-sha }}
         docs-only: ${{ steps.set-output.outputs.docs-only }}
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -124,7 +124,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -156,7 +156,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -188,7 +188,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/issue-labeled.yml

@@ -75,7 +75,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
       - name: Create comment
         if: ${{ steps.check-for-comment.outputs.SHOULD_COMMENT }}
-        uses: actions-cool/issues-helper@50068f49b7b2b3857270ead65e2d02e4459b022c # v3.6.2
+        uses: actions-cool/issues-helper@e2ff99831a4f13625d35064e2b3dfe65c07a0396 # v3.7.5
         with:
           actions: 'create-comment'
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/issue-opened.yml

@@ -37,7 +37,14 @@ jobs:
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
-      - run: npm install @electron/fiddle-core@1.3.3 mdast-util-from-markdown@2.0.0 unist-util-select@5.1.0 semver@7.6.0
+      - name: Sparse checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: |
+            .
+            .github
+            .yarn
+      - run: yarn workspaces focus @electron/gha-workflows
       - name: Add labels
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: add-labels
@@ -46,9 +53,13 @@ jobs:
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
-            const { fromMarkdown } = await import('${{ github.workspace }}/node_modules/mdast-util-from-markdown/index.js');
-            const { select } = await import('${{ github.workspace }}/node_modules/unist-util-select/index.js');
-            const semver = await import('${{ github.workspace }}/node_modules/semver/index.js');
+            const { chdir } = require('node:process');
+            chdir('${{ github.workspace }}/.github/workflows');
+
+            const { ElectronVersions } = require('@electron/fiddle-core');
+            const { fromMarkdown } = require('mdast-util-from-markdown');
+            const { select } = require('unist-util-select');
+            const semver = require('semver');
 
             const [ owner, repo ] = '${{ github.repository }}'.split('/');
             const issue_number = ${{ github.event.issue.number }};
@@ -79,7 +90,6 @@ jobs:
                     labelExists = true;
                   } catch {}
 
-                  const { ElectronVersions } = await import('${{ github.workspace }}/node_modules/@electron/fiddle-core/dist/index.js');
                   const electronVersions = await ElectronVersions.create(undefined, { ignoreCache: true });
                   const validVersions = [...electronVersions.supportedMajors, ...electronVersions.prereleaseMajors];
 
@@ -136,7 +146,7 @@ jobs:
             }
       - name: Create unsupported major comment
         if: ${{ steps.add-labels.outputs.unsupportedMajor }}
-        uses: actions-cool/issues-helper@50068f49b7b2b3857270ead65e2d02e4459b022c # v3.6.2
+        uses: actions-cool/issues-helper@e2ff99831a4f13625d35064e2b3dfe65c07a0396 # v3.7.5
         with:
           actions: 'create-comment'
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/linux-publish.yml

@@ -35,7 +35,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/macos-disk-cleanup.yml

@@ -0,0 +1,104 @@
+name: macOS Disk Space Cleanup
+
+# Description:
+# This workflow runs the disk space reclaimer on macOS runners every night
+# and logs disk space metrics to Datadog for monitoring.
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  macos-disk-cleanup:
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - macos-15
+          - macos-15-large
+          - macos-15-xlarge
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: |
+            .github/actions/free-space-macos
+          sparse-checkout-cone-mode: false
+
+      - name: Get Disk Space Before Cleanup
+        id: disk-before
+        shell: bash
+        run: |
+          echo "Disk space before cleanup:"
+          df -h /
+          FREE_SPACE_BEFORE=$(df -k / | tail -1 | awk '{print $4}')
+          echo "free_kb=$FREE_SPACE_BEFORE" >> $GITHUB_OUTPUT
+
+      - name: Free Space on macOS
+        uses: ./.github/actions/free-space-macos
+
+      - name: Get Disk Space After Cleanup
+        id: disk-after
+        shell: bash
+        run: |
+          echo "Disk space after cleanup:"
+          df -h /
+          FREE_SPACE_AFTER=$(df -k / | tail -1 | awk '{print $4}')
+          echo "free_kb=$FREE_SPACE_AFTER" >> $GITHUB_OUTPUT
+
+      - name: Log Disk Space to Datadog
+        if: ${{ env.DD_API_KEY != '' }}
+        shell: bash
+        env:
+          DD_API_KEY: ${{ secrets.DD_API_KEY }}
+          FREE_BEFORE: ${{ steps.disk-before.outputs.free_kb }}
+          FREE_AFTER: ${{ steps.disk-after.outputs.free_kb }}
+          MATRIX_RUNNER: ${{ matrix.runner }}
+        run: |
+          TIMESTAMP=$(date +%s)
+          FREE_BEFORE_GB=$(echo "scale=2; $FREE_BEFORE / 1024 / 1024" | bc)
+          FREE_AFTER_GB=$(echo "scale=2; $FREE_AFTER / 1024 / 1024" | bc)
+          SPACE_FREED_GB=$(echo "scale=2; ($FREE_AFTER - $FREE_BEFORE) / 1024 / 1024" | bc)
+
+          echo "Free space before: ${FREE_BEFORE_GB}GB"
+          echo "Free space after: ${FREE_AFTER_GB}GB"
+          echo "Space freed: ${SPACE_FREED_GB}GB"
+
+          curl -s -X POST "https://api.datadoghq.com/api/v2/series" \
+            -H "Content-Type: application/json" \
+            -H "DD-API-KEY: ${DD_API_KEY}" \
+            -d @- << EOF
+          {
+            "series": [
+              {
+                "metric": "electron.macos.disk.free_space_before_cleanup_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${FREE_BEFORE_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              },
+              {
+                "metric": "electron.macos.disk.free_space_after_cleanup_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${FREE_AFTER_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              },
+              {
+                "metric": "electron.macos.disk.space_freed_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${SPACE_FREED_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              }
+            ]
+          }
+          EOF
+
+          echo "Disk space metrics logged to Datadog"

.github/workflows/macos-publish.yml

@@ -36,7 +36,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@electron/gha-workflows",
+  "version": "0.0.0-development",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@actions/cache": "^4.0.3",
+    "@electron/fiddle-core": "^2.0.1",
+    "mdast-util-from-markdown": "^2.0.0",
+    "semver": "^7.7.2",
+    "unist-util-select": "^5.1.0"
+  }
+}

.github/workflows/pipeline-electron-docs-only.yml

@@ -27,7 +27,7 @@ jobs:
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -43,7 +43,7 @@ jobs:
       with:
         target-platform: linux
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-electron-lint.yml

@@ -27,7 +27,7 @@ jobs:
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-build.yml

@@ -95,7 +95,7 @@ jobs:
       run: |
         mkdir src
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -119,9 +119,9 @@ jobs:
       run: df -h
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'macos' }}
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
       with:
-        node-version: 20.19.x
+        node-version: 22.21.x
         cache: yarn
         cache-dependency-path: src/electron/yarn.lock
     - name: Install Dependencies
@@ -163,7 +163,7 @@ jobs:
       if: ${{ inputs.target-platform == 'linux' }}
       uses: ./src/electron/.github/actions/restore-cache-aks
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -48,7 +48,7 @@ jobs:
     container: ${{ fromJSON(inputs.check-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -115,7 +115,7 @@ jobs:
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-publish.yml

@@ -102,7 +102,7 @@ jobs:
         run: |
           mkdir src
       - name: Checkout Electron
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           path: src/electron
           fetch-depth: 0
@@ -127,9 +127,9 @@ jobs:
         run: df -h
       - name: Setup Node.js/npm
         if: ${{ inputs.target-platform == 'macos' }}
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
         with:
-          node-version: 20.19.x
+          node-version: 22.21.x
           cache: yarn
           cache-dependency-path: src/electron/yarn.lock
       - name: Install Dependencies
@@ -172,7 +172,7 @@ jobs:
         if: ${{ inputs.target-platform == 'linux' }}
         uses: ./src/electron/.github/actions/restore-cache-aks
       - name: Checkout Electron
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           path: src/electron
           fetch-depth: 0

.github/workflows/pipeline-segment-electron-test.yml

@@ -72,9 +72,9 @@ jobs:
         cp $(which node) /mnt/runner-externals/node24/bin/
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'win' }}
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
       with:
-        node-version: 20.19.x
+        node-version: 22.21.x
     - name: Add TCC permissions on macOS
       if: ${{ inputs.target-platform == 'macos' }}
       run: |
@@ -119,7 +119,7 @@ jobs:
       if: ${{ inputs.target-platform == 'macos' }}
       run: sudo xcode-select --switch /Applications/Xcode_16.4.app
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -168,12 +168,12 @@ jobs:
         echo "DISABLE_CRASH_REPORTER_TESTS=true" >> $GITHUB_ENV
         echo "IS_ASAN=true" >> $GITHUB_ENV
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
       with:
         name: generated_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./generated_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
       with:
         name: src_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
@@ -289,7 +289,7 @@ jobs:
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always()
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
       with:
         name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
         path: src/electron/spec/artifacts

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -50,7 +50,7 @@ jobs:
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -65,12 +65,12 @@ jobs:
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
@@ -106,7 +106,7 @@ jobs:
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0
@@ -121,12 +121,12 @@ jobs:
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}

.github/workflows/scorecards.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
@@ -42,7 +42,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/stale.yml

@@ -17,7 +17,7 @@ jobs:
         id: generate-token
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # tag: v10.1.0
+      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # tag: v10.1.1
         with:
           repo-token: ${{ steps.generate-token.outputs.token }}
           days-before-stale: 90
@@ -41,7 +41,7 @@ jobs:
         id: generate-token
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # tag: v10.1.0
+      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # tag: v10.1.1
         with:
           repo-token: ${{ steps.generate-token.outputs.token }}
           days-before-stale: -1

.github/workflows/windows-publish.yml

@@ -40,7 +40,7 @@ jobs:
       build-image-sha: ${{ inputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         path: src/electron
         fetch-depth: 0

.yarnrc.yml

@@ -9,8 +9,4 @@ npmMinimalAgeGate: 10080
 npmPreapprovedPackages:
   - "@electron/*"
 
-httpProxy: "${HTTP_PROXY:-}"
-
-httpsProxy: "${HTTPS_PROXY:-}"
-
 yarnPath: .yarn/releases/yarn-4.12.0.cjs

BUILD.gn

@@ -446,6 +446,7 @@ source_set("electron_lib") {
     "shell/services/node/public/mojom",
     "//base:base_static",
     "//base/allocator:buildflags",
+    "//build/util:chromium_git_revision",
     "//chrome:strings",
     "//chrome/app:command_ids",
     "//chrome/app/resources:platform_locale_settings",
@@ -501,6 +502,7 @@ source_set("electron_lib") {
     "//third_party/blink/public/platform/media",
     "//third_party/boringssl",
     "//third_party/electron_node:libnode",
+    "//third_party/highway:libhwy",
     "//third_party/inspector_protocol:crdtp",
     "//third_party/leveldatabase",
     "//third_party/libyuv",

CLAUDE.md

@@ -0,0 +1,246 @@
+# Electron Development Guide
+
+## Project Overview
+
+Electron is a framework for building cross-platform desktop applications using web technologies. It embeds Chromium for rendering and Node.js for backend functionality.
+
+## Directory Structure
+
+```text
+electron/                 # This repo (run `e` commands here)
+├── shell/               # Core C++ application code
+│   ├── browser/         # Main process implementation (107+ API modules)
+│   ├── renderer/        # Renderer process code
+│   ├── common/          # Shared code between processes
+│   ├── app/             # Application entry points
+│   └── services/        # Node.js service integration
+├── lib/                 # TypeScript/JavaScript library code
+│   ├── browser/         # Main process JS (47 API implementations)
+│   ├── renderer/        # Renderer process JS
+│   └── common/          # Shared JS modules
+├── patches/             # Patches for upstream dependencies
+│   ├── chromium/        # ~159 patches to Chromium
+│   ├── node/            # ~48 patches to Node.js
+│   └── ...              # Other targets (v8, boringssl, etc.)
+├── spec/                # Test suite (1189+ TypeScript test files)
+├── docs/                # API documentation and guides
+├── build/               # Build configuration
+├── script/              # Build and automation scripts
+└── chromium_src/        # Chromium source overrides
+../                      # Parent directory is Chromium source
+```
+
+## Build Tools Setup
+
+Electron uses `@electron/build-tools` for development. The `e` command is the primary CLI.
+
+**Installation:**
+
+```bash
+npm i -g @electron/build-tools
+```
+
+**Configuration location:** `~/.electron_build_tools/configs/`
+
+## Essential Commands
+
+### Configuration Management
+
+| Command | Purpose |
+|---------|---------|
+| `e init <name> --root=<path> --bootstrap testing` | Create new build config and sync |
+| `e use <name>` | Switch to a different build configuration |
+| `e show current` | Display active configuration name |
+| `e show configs` | List all available configurations |
+
+### Build & Development Loop
+
+| Command | Purpose |
+|---------|---------|
+| `e sync` | Fetch/update all source code and apply patches |
+| `e sync --3` | Sync with 3-way merge (required for Chromium upgrades) |
+| `e build` | Build Electron (runs GN + Ninja) |
+| `e build -k 999` | Build and continue on errors (up to 999) |
+| `e build -t <target>` | Build specific target (e.g., `electron:node_headers`) |
+| `e start` | Run the built Electron executable |
+| `e start --version` | Verify Electron launches and print version |
+| `e test` | Run the test suite |
+| `e debug` | Run Electron in debugger (lldb on macOS, gdb on Linux) |
+
+### Patch Management
+
+| Command | Purpose |
+|---------|---------|
+| `e patches <target>` | Export patches for a target (chromium, node, v8, etc.) |
+| `e patches all` | Export all patches from all targets |
+| `e patches --list-targets` | List available patch targets |
+
+## Typical Development Workflow
+
+```bash
+# 1. Ensure you're on the right config
+e show current
+
+# 2. Sync to get latest code
+e sync
+
+# 3. Make your changes in shell/ or lib/ or ../
+
+# 4. Build
+e build
+
+# 5. Test your changes (Leave the user to do this, don't run these commands unless asked)
+e start
+e test
+
+# 6. If you modified patched files in Chromium:
+cd ..  # Go to Chromium repo
+git add <files>
+git commit -m "description of change"
+cd electron
+e patches chromium  # Export the patch
+```
+
+## Patches System
+
+Electron patches upstream dependencies (Chromium, Node.js, V8, etc.) to add features or modify behavior.
+
+**How patches work:**
+
+```text
+patches/{target}/*.patch  →  [e sync --3]  →  target repo commits
+                          ←  [e patches]   ←
+```
+
+**Patch configuration:** `patches/config.json` maps patch directories to target repos.
+
+**Key rules:**
+
+- Fix existing patches 99% of the time rather than creating new ones
+- Preserve original authorship in TODO comments
+- Never change TODO assignees (`TODO(name)` must retain original name)
+- Each patch file includes commit message explaining its purpose
+
+**Creating/modifying patches:**
+
+1. Make changes in the target repo (e.g., `../` for Chromium)
+2. Create a git commit
+3. Run `e patches <target>` to export
+
+**Fixing patch conflicts on an existing PR:**
+
+If asked to fix a patch conflict on a branch that already has an open PR, check the PR's failed **Apply Patches** CI run for an `update-patches` artifact before running `e sync` locally. CI has already performed the 3-way merge and exported the resolved patch diff — applying it is much faster than a full local sync.
+
+```bash
+# Find the failed Apply Patches run for the PR and download the artifact
+gh run list --repo electron/electron --branch <pr-branch> --workflow "Apply Patches" --limit 1
+gh run download <run-id> --repo electron/electron --name update-patches
+
+# Apply the CI-generated fix, then push
+git am update-patches.patch
+git push
+```
+
+If no artifact exists (e.g. the 3-way merge itself failed), fall back to `e sync --3` and resolve manually.
+
+## Testing
+
+**Test location:** `spec/` directory
+
+**Running tests:**
+
+```bash
+e test                    # Run full test suite
+```
+
+**Test frameworks:** Mocha, Chai, Sinon
+
+## Build Configuration
+
+**GN build arguments:** Located in `build/args/`:
+
+- `testing.gn` - Debug/testing builds
+- `release.gn` - Release builds
+- `all.gn` - Common arguments for all builds
+
+**Main build file:** `BUILD.gn`
+
+**Feature flags:** `buildflags/buildflags.gni`
+
+## Chromium Upgrade Workflow
+
+When working on the `roller/chromium/main` branch to upgrade Chromium activate the "Electron Chromium Upgrade" skill.
+
+## Pull Requests
+
+PR bodies must always include a `Notes:` section as the **last line** of the body. This is a consumer-facing release note for Electron app developers — describe the user-visible fix or change, not internal implementation details. Use `Notes: none` if there is no user-facing change.
+
+## Code Style
+
+**C++:** Follows Chromium style, enforced by clang-format
+**TypeScript/JavaScript:** ESLint configuration in `.eslintrc.json`
+
+**Linting:**
+
+```bash
+npm run lint              # Run all linters
+npm run lint:clang-format # C++ formatting
+```
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `BUILD.gn` | Main GN build configuration |
+| `DEPS` | Dependency versions and checkout paths |
+| `patches/config.json` | Patch target configuration |
+| `filenames.gni` | Source file lists by platform |
+| `package.json` | Node.js dependencies and scripts |
+
+## Environment Variables
+
+| Variable | Purpose |
+|----------|---------|
+| `GN_EXTRA_ARGS` | Additional GN arguments (useful in CI) |
+| `ELECTRON_RUN_AS_NODE=1` | Run Electron as Node.js |
+
+## Useful Git Commands for Chromium
+
+```bash
+# Find CL that changed a file
+cd ..
+git log --oneline -10 -- {file}
+git blame -L {start},{end} -- {file}
+
+# Look for Chromium CL reference in commit
+git log -1 {commit_sha}  # Find "Reviewed-on:" line
+
+# Find which patch affects a file
+grep -l "filename.cc" patches/chromium/*.patch
+```
+
+## CI/CD
+
+GitHub Actions workflows in `.github/workflows/`:
+
+- `build.yml` - Main build workflow
+- `pipeline-electron-lint.yml` - Linting
+- `pipeline-segment-electron-test.yml` - Testing
+
+## Common Issues
+
+**Patch conflict during sync:**
+
+- Use `e sync --3` for 3-way merge
+- Check if file was renamed/moved upstream
+- Verify patch is still needed
+
+**Build error in patched file:**
+
+- Find the patch: `grep -l "filename" patches/chromium/*.patch`
+- Match existing patch style (#if 0 guards, BUILDFLAG conditionals, etc.)
+
+**Remote build issues:**
+
+- Try `e build --no-remote` to build locally
+- Check reclient/siso configuration in your build config

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '144.0.7559.236',
+    '146.0.7680.80',
   'node_version':
     'v24.14.0',
   'nan_version':

build/args/all.gn

@@ -2,7 +2,7 @@ is_electron_build = true
 root_extra_deps = [ "//electron" ]
 
 # Registry of NMVs --> https://github.com/nodejs/node/blob/main/doc/abi_version_registry.json
-node_module_version = 143
+node_module_version = 145
 
 v8_promise_internal_field_count = 1
 v8_embedder_string = "-electron.0"

build/fuses/fuses.json5

@@ -9,5 +9,6 @@
   "embedded_asar_integrity_validation": "0",
   "only_load_app_from_asar": "0",
   "load_browser_process_specific_v8_snapshot": "0",
-  "grant_file_protocol_extra_privileges": "1"
+  "grant_file_protocol_extra_privileges": "1",
+  "wasm_trap_handlers": "1"
 }

default_app/main.ts

@@ -110,11 +110,12 @@ async function loadApplicationPackage (packagePath: string) {
       } else if (packageJson.name) {
         app.name = packageJson.name;
       }
-      if (packageJson.desktopName) {
-        app.setDesktopName(packageJson.desktopName);
-      } else {
-        app.setDesktopName(`${app.name}.desktop`);
-      }
+
+      // Set application's desktop name (Linux). These usually match the executable name,
+      // so use it as the default to ensure the app gets the correct icon in the taskbar and application switcher.
+      const desktopName = packageJson.desktopName || `${path.basename(process.execPath)}.desktop`;
+      app.setDesktopName(desktopName);
+
       // Set v8 flags, deliberately lazy load so that apps that do not use this
       // feature do not pay the price
       if (packageJson.v8Flags) {

default_app/styles.css

@@ -41,7 +41,7 @@ h4 {
   transform-origin: 50% 50%;
 }
 
-hero-icon.loop-3 {
+.hero-icon.loop-3 {
   transform: translate(79px, 21px);
   opacity: 1;
 }

docs/api/app.md

@@ -567,8 +567,9 @@ and subscribing to the `ready` event if the app is not ready yet.
   * `steal` boolean _macOS_ - Make the receiver the active app even if another app is
   currently active.
 
-On Linux, focuses on the first visible window. On macOS, makes the application
-the active app. On Windows, focuses on the application's first window.
+On macOS, makes the application the active app. On Windows, focuses on the application's
+first window. On Linux, either focuses on the first visible window (X11) or requests
+focus but may instead show a notification or flash the app icon (Wayland).
 
 You should seek to use the `steal` option as sparingly as possible.
 

docs/api/browser-window.md

@@ -140,6 +140,10 @@ state is `hidden` in order to minimize power consumption.
   move.
 * On Linux the type of modal windows will be changed to `dialog`.
 * On Linux many desktop environments do not support hiding a modal window.
+* On Wayland (Linux) it is generally not possible to programmatically resize windows
+  after creation, or to position, move, focus, or blur windows without user input.
+  If your app needs these capabilities, run it in Xwayland by appending the flag
+  `--ozone-platform=x11`.
 
 ## Class: BrowserWindow extends `BaseWindow`
 
@@ -660,10 +664,15 @@ the [close event](#event-close).
 
 Focuses on the window.
 
+On Wayland (Linux), the desktop environment may show a notification or flash
+the app icon if the window or app is not already focused.
+
 #### `win.blur()`
 
 Removes focus from the window.
 
+Not supported on Wayland (Linux).
+
 #### `win.isFocused()`
 
 Returns `boolean` - Whether the window is focused.
@@ -680,6 +689,8 @@ Shows and gives focus to the window.
 
 Shows the window but doesn't focus on it.
 
+Not supported on Wayland (Linux).
+
 #### `win.hide()`
 
 Hides the window.
@@ -828,6 +839,8 @@ Closes the currently open [Quick Look][quick-look] panel.
 
 Resizes and moves the window to the supplied bounds. Any properties that are not supplied will default to their current values.
 
+On Wayland (Linux), has the same limitations as `setSize` and `setPosition`.
+
 ```js
 const { BrowserWindow } = require('electron')
 
@@ -873,6 +886,8 @@ See [Setting `backgroundColor`](#setting-the-backgroundcolor-property).
 Resizes and moves the window's client area (e.g. the web page) to
 the supplied bounds.
 
+On Wayland (Linux), has the same limitations as `setContentSize` and `setPosition`.
+
 #### `win.getContentBounds()`
 
 Returns [`Rectangle`](structures/rectangle.md) - The `bounds` of the window's client area as `Object`.
@@ -902,6 +917,8 @@ Returns `boolean` - whether the window is enabled.
 
 Resizes the window to `width` and `height`. If `width` or `height` are below any set minimum size constraints the window will snap to its minimum size.
 
+On Wayland (Linux), may not work as some window managers restrict programmatic window resizing.
+
 #### `win.getSize()`
 
 Returns `Integer[]` - Contains the window's width and height.
@@ -914,6 +931,8 @@ Returns `Integer[]` - Contains the window's width and height.
 
 Resizes the window's client area (e.g. the web page) to `width` and `height`.
 
+On Wayland (Linux), may not work as some window managers restrict programmatic window resizing.
+
 #### `win.getContentSize()`
 
 Returns `Integer[]` - Contains the window's client area's width and height.
@@ -1051,12 +1070,16 @@ this method throws an error.
 
 #### `win.moveTop()`
 
-Moves window to top(z-order) regardless of focus
+Moves window to top(z-order) regardless of focus.
+
+Not supported on Wayland (Linux).
 
 #### `win.center()`
 
 Moves window to the center of the screen.
 
+Not supported on Wayland (Linux).
+
 #### `win.setPosition(x, y[, animate])`
 
 * `x` Integer
@@ -1065,6 +1088,8 @@ Moves window to the center of the screen.
 
 Moves window to `x` and `y`.
 
+Not supported on Wayland (Linux).
+
 #### `win.getPosition()`
 
 Returns `Integer[]` - Contains the window's current position.

docs/api/clipboard.md

@@ -1,5 +1,14 @@
 # clipboard
 
+<!--
+```YAML history
+deprecated:
+  - pr-url: https://github.com/electron/electron/pull/48877
+    description: "Using the `clipboard` API directly in the renderer process is deprecated."
+    breaking-changes-header: deprecated-clipboard-api-access-from-renderer-processes
+```
+-->
+
 > Perform copy and paste operations on the system clipboard.
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process) _Deprecated_ (non-sandboxed only)

docs/api/command-line-switches.md

@@ -49,6 +49,10 @@ Disables the disk cache for HTTP requests.
 
 Disable HTTP/2 and SPDY/3.1 protocols.
 
+### --disable-geolocation _macOS_
+
+Disables the Geolocation API. Permission requests for geolocation will be denied internally regardless of the decision made by a handler set via `session.setPermissionRequestHandler`. This functionality is currently implemented only for macOS. Has no effect on other platforms.
+
 ### --disable-renderer-backgrounding
 
 Prevents Chromium from lowering the priority of invisible pages' renderer

docs/api/content-tracing.md

@@ -33,6 +33,15 @@ The `contentTracing` module has the following methods:
 
 ### `contentTracing.getCategories()`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/16583
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+```
+-->
+
 Returns `Promise<string[]>` - resolves with an array of category groups once all child processes have acknowledged the `getCategories` request
 
 Get a set of category groups. The category groups can change as new code paths
@@ -44,6 +53,17 @@ are reached. See also the
 
 ### `contentTracing.startRecording(options)`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/13914
+    description: "The `options` parameter now accepts `TraceConfig` in addition to `TraceCategoriesAndOptions`."
+  - pr-url: https://github.com/electron/electron/pull/16584
+    description: "This function now returns a callback`Promise<void>`."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+```
+-->
+
 * `options` ([TraceConfig](structures/trace-config.md) | [TraceCategoriesAndOptions](structures/trace-categories-and-options.md))
 
 Returns `Promise<void>` - resolved once all child processes have acknowledged the `startRecording` request.
@@ -58,6 +78,17 @@ only one trace operation can be in progress at a time.
 
 ### `contentTracing.stopRecording([resultFilePath])`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/16584
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+  - pr-url: https://github.com/electron/electron/pull/18411
+    description: "The `resultFilePath` parameter is now optional."
+```
+-->
+
 * `resultFilePath` string (optional)
 
 Returns `Promise<string>` - resolves with a path to a file that contains the traced data once all child processes have acknowledged the `stopRecording` request
@@ -76,6 +107,15 @@ will be returned in the promise.
 
 ### `contentTracing.getTraceBufferUsage()`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/16600
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+```
+-->
+
 Returns `Promise<Object>` - Resolves with an object containing the `value` and `percentage` of trace buffer maximum usage
 
 * `value` number

docs/api/cookies.md

@@ -51,7 +51,12 @@ Returns:
 * `event` Event
 * `cookie` [Cookie](structures/cookie.md) - The cookie that was changed.
 * `cause` string - The cause of the change with one of the following values:
-  * `explicit` - The cookie was changed directly by a consumer's action.
+  * `inserted` -  The cookie was inserted.
+  * `inserted-no-change-overwrite` - The newly inserted cookie overwrote a cookie but
+    did not result in any change. For example, inserting an identical cookie will produce this cause.
+  * `inserted-no-value-change-overwrite` - The newly inserted cookie overwrote a cookie but
+    did not result in any value change, but it's web observable (e.g. updates the expiry).
+  * `explicit` - The cookie was deleted directly by a consumer's action.
   * `overwrite` - The cookie was automatically removed due to an insert
     operation that overwrote it.
   * `expired` - The cookie was automatically removed as it expired.

docs/api/crash-reporter.md

@@ -50,6 +50,22 @@ The `crashReporter` module has the following methods:
 
 ### `crashReporter.start(options)`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/23062
+    description: "Added `rateLimit` and `compress` options."
+  - pr-url: https://github.com/electron/electron/pull/23265
+    description: "Deprecated calling this method in the renderer process."
+    breaking-changes-header: deprecated-crashreporter-methods-in-the-renderer-process
+  - pr-url: https://github.com/electron/electron/pull/25288
+    description: "Default value of `compress` option changed from `false` to `true`."
+    breaking-changes-header: default-changed-crashreporterstart-compress-true-
+  - pr-url: https://github.com/electron/electron/pull/28105
+    description: "The `submitURL` parameter is now optional when `uploadToServer` is `false`."
+```
+-->
+
 * `options` Object
   * `submitURL` string (optional) - URL that crash reports will be sent to as
     POST. Required unless `uploadToServer` is `false`.
@@ -111,6 +127,15 @@ by the crash reporter.
 
 ### `crashReporter.getLastCrashReport()`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/23265
+    description: "Deprecated calling this method in the renderer process."
+    breaking-changes-header: deprecated-crashreporter-methods-in-the-renderer-process
+```
+-->
+
 Returns [`CrashReport | null`](structures/crash-report.md) - The date and ID of the
 last crash report. Only crash reports that have been uploaded will be returned;
 even if a crash report is present on disk it will not be returned until it is
@@ -121,6 +146,15 @@ uploaded. In the case that there are no uploaded reports, `null` is returned.
 
 ### `crashReporter.getUploadedReports()`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/23265
+    description: "Deprecated calling this method in the renderer process."
+    breaking-changes-header: deprecated-crashreporter-methods-in-the-renderer-process
+```
+-->
+
 Returns [`CrashReport[]`](structures/crash-report.md):
 
 Returns all uploaded crash reports. Each report contains the date and uploaded
@@ -131,6 +165,15 @@ ID.
 
 ### `crashReporter.getUploadToServer()`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/23265
+    description: "Deprecated calling this method in the renderer process."
+    breaking-changes-header: deprecated-crashreporter-methods-in-the-renderer-process
+```
+-->
+
 Returns `boolean` - Whether reports should be submitted to the server. Set through
 the `start` method or `setUploadToServer`.
 
@@ -139,6 +182,15 @@ the `start` method or `setUploadToServer`.
 
 ### `crashReporter.setUploadToServer(uploadToServer)`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/23265
+    description: "Deprecated calling this method in the renderer process."
+    breaking-changes-header: deprecated-crashreporter-methods-in-the-renderer-process
+```
+-->
+
 * `uploadToServer` boolean - Whether reports should be submitted to the server.
 
 This would normally be controlled by user preferences. This has no effect if

docs/api/desktop-capturer.md

@@ -80,6 +80,17 @@ The `desktopCapturer` module has the following methods:
 
 ### `desktopCapturer.getSources(options)`
 
+<!--
+```YAML history
+added:
+  - pr-url: https://github.com/electron/electron/pull/2963
+changes:
+  - pr-url: https://github.com/electron/electron/pull/16427
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+```
+-->
+
 * `options` Object
   * `types` string[] - An array of strings that lists the types of desktop sources
     to be captured, available types can be `screen` and `window`.

docs/api/dialog.md

@@ -18,6 +18,13 @@ The `dialog` module has the following methods:
 
 ### `dialog.showOpenDialogSync([window, ]options)`
 
+<!--
+```YAML history
+added:
+  - pr-url: https://github.com/electron/electron/pull/16973
+```
+-->
+
 * `window` [BaseWindow](base-window.md) (optional)
 * `options` Object
   * `title` string (optional)
@@ -30,7 +37,7 @@ The `dialog` module has the following methods:
     * `openFile` - Allow files to be selected.
     * `openDirectory` - Allow directories to be selected.
     * `multiSelections` - Allow multiple paths to be selected.
-    * `showHiddenFiles` - Show hidden files in dialog.
+    * `showHiddenFiles` _macOS_ _Windows_ _Deprecated_ - Show hidden files in dialog. Deprecated on Linux.
     * `createDirectory` _macOS_ - Allow creating new directories from dialog.
     * `promptToCreate` _Windows_ - Prompt for creation if the file path entered
       in the dialog does not exist. This does not actually create the file at
@@ -90,6 +97,15 @@ dialog.showOpenDialogSync(mainWindow, {
 
 ### `dialog.showOpenDialog([window, ]options)`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/16973
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+```
+-->
+
 * `window` [BaseWindow](base-window.md) (optional)
 * `options` Object
   * `title` string (optional)
@@ -102,7 +118,7 @@ dialog.showOpenDialogSync(mainWindow, {
     * `openFile` - Allow files to be selected.
     * `openDirectory` - Allow directories to be selected.
     * `multiSelections` - Allow multiple paths to be selected.
-    * `showHiddenFiles` - Show hidden files in dialog.
+    * `showHiddenFiles` _macOS_ _Windows_ _Deprecated_ - Show hidden files in dialog. Deprecated on Linux.
     * `createDirectory` _macOS_ - Allow creating new directories from dialog.
     * `promptToCreate` _Windows_ - Prompt for creation if the file path entered
       in the dialog does not exist. This does not actually create the file at
@@ -171,6 +187,13 @@ dialog.showOpenDialog(mainWindow, {
 
 ### `dialog.showSaveDialogSync([window, ]options)`
 
+<!--
+```YAML history
+added:
+  - pr-url: https://github.com/electron/electron/pull/17054
+```
+-->
+
 * `window` [BaseWindow](base-window.md) (optional)
 * `options` Object
   * `title` string (optional) - The dialog title. Cannot be displayed on some _Linux_ desktop environments.
@@ -185,7 +208,7 @@ dialog.showOpenDialog(mainWindow, {
   * `showsTagField` boolean (optional) _macOS_ - Show the tags input box,
     defaults to `true`.
   * `properties` string[]&#32;(optional)
-    * `showHiddenFiles` - Show hidden files in dialog.
+    * `showHiddenFiles` _macOS_ _Windows_ _Deprecated_ - Show hidden files in dialog. Deprecated on Linux.
     * `createDirectory` _macOS_ - Allow creating new directories from dialog.
     * `treatPackageAsDirectory` _macOS_ - Treat packages, such as `.app` folders,
       as a directory instead of a file.
@@ -202,6 +225,15 @@ The `filters` specifies an array of file types that can be displayed, see
 
 ### `dialog.showSaveDialog([window, ]options)`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/17054
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+```
+-->
+
 * `window` [BaseWindow](base-window.md) (optional)
 * `options` Object
   * `title` string (optional) - The dialog title. Cannot be displayed on some _Linux_ desktop environments.
@@ -215,7 +247,7 @@ The `filters` specifies an array of file types that can be displayed, see
     displayed in front of the filename text field.
   * `showsTagField` boolean (optional) _macOS_ - Show the tags input box, defaults to `true`.
   * `properties` string[]&#32;(optional)
-    * `showHiddenFiles` - Show hidden files in dialog.
+    * `showHiddenFiles` _macOS_ _Windows_ _Deprecated_ - Show hidden files in dialog. Deprecated on Linux.
     * `createDirectory` _macOS_ - Allow creating new directories from dialog.
     * `treatPackageAsDirectory` _macOS_ - Treat packages, such as `.app` folders,
       as a directory instead of a file.
@@ -240,6 +272,13 @@ The `filters` specifies an array of file types that can be displayed, see
 
 ### `dialog.showMessageBoxSync([window, ]options)`
 
+<!--
+```YAML history
+added:
+  - pr-url: https://github.com/electron/electron/pull/17298
+```
+-->
+
 * `window` [BaseWindow](base-window.md) (optional)
 * `options` Object
   * `message` string - Content of the message box.
@@ -283,6 +322,19 @@ If `window` is not shown dialog will not be attached to it. In such case it will
 
 ### `dialog.showMessageBox([window, ]options)`
 
+<!--
+```YAML history
+changes:
+  - pr-url: https://github.com/electron/electron/pull/17298
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+  - pr-url: https://github.com/electron/electron/pull/26102
+    description: "Added the `signal` option."
+  - pr-url: https://github.com/electron/electron/pull/30474
+    description: "Added the `textWidth` option."
+```
+-->
+
 * `window` [BaseWindow](base-window.md) (optional)
 * `options` Object
   * `message` string - Content of the message box.
@@ -349,6 +401,17 @@ and no GUI dialog will appear.
 
 ### `dialog.showCertificateTrustDialog([window, ]options)` _macOS_ _Windows_
 
+<!--
+```YAML history
+added:
+  - pr-url: https://github.com/electron/electron/pull/9099
+changes:
+  - pr-url: https://github.com/electron/electron/pull/17181
+    description: "This method now returns a Promise instead of using a callback function."
+    breaking-changes-header: api-changed-callback-based-versions-of-promisified-apis
+```
+-->
+
 * `window` [BaseWindow](base-window.md) (optional)
 * `options` Object
   * `certificate` [Certificate](structures/certificate.md) - The certificate to trust/import.

docs/api/menu.md

@@ -2,10 +2,15 @@
 
 ## Class: Menu
 
-> Create native application menus and context menus.
+> Create application menus and context menus.
 
 Process: [Main](../glossary.md#main-process)
 
+The presentation of menus varies depending on the operating system:
+
+- Under Windows and Linux, menus are visually similar to Chromium.
+- Under macOS, these will be native menus.
+
 > [!TIP]
 > See also: [A detailed guide about how to implement menus in your application](../tutorial/menus.md).
 

docs/api/structures/shared-texture-handle.md

@@ -1,6 +1,6 @@
 # SharedTextureHandle Object
 
-* `ntHandle` Buffer (optional) _Windows_ - NT HANDLE holds the shared texture. Note that this NT HANDLE is local to current process.
+* `ntHandle` Buffer (optional) _Windows_ - NT HANDLE holds the shared texture. Note that this NT HANDLE is local to current process.  Output textures of `rgba`, `bgra`, `rgbaf16` formats don't have a keyed mutex on the texture handle, but `nv12` format texture handles do have a keyed mutex.
 * `ioSurface` Buffer (optional) _macOS_ - IOSurfaceRef holds the shared texture. Note that this IOSurface is local to current process (not global).
 * `nativePixmap` Object (optional) _Linux_ - Structure contains planes of shared texture.
   * `planes` Object[] _Linux_ - Each plane's info of the shared texture.

docs/api/structures/web-preferences.md

@@ -94,7 +94,6 @@
     The actual output pixel format and color space of the texture should refer to [`OffscreenSharedTexture`](../structures/offscreen-shared-texture.md) object in the `paint` event.
     * `argb` - The requested output texture format is 8-bit unorm RGBA, with SRGB SDR color space.
     * `rgbaf16` - The requested output texture format is 16-bit float RGBA, with scRGB HDR color space.
-  * `deviceScaleFactor` number (optional) _Experimental_ - The device scale factor of the offscreen rendering output. If not set, will use primary display's scale factor as default.
 * `contextIsolation` boolean (optional) - Whether to run Electron APIs and
   the specified `preload` script in a separate JavaScript context. Defaults
   to `true`. The context that the `preload` script runs in will only have

docs/api/web-contents.md

@@ -1485,6 +1485,11 @@ mainWindow.webContents.setWindowOpenHandler((details) => {
       const browserView = new BrowserView(options)
       mainWindow.addBrowserView(browserView)
       browserView.setBounds({ x: 0, y: 0, width: 640, height: 480 })
+      // For `background-tab` disposition (e.g., when middle-clicking or ctrl/cmd-clicking a link),
+      // `options.webContents` is undefined because its creation can be deferred. So load the URL manually.
+      if (details.disposition === 'background-tab') {
+        browserView.webContents.loadURL(details.url)
+      }
       return browserView.webContents
     }
   }
@@ -1748,11 +1753,12 @@ Returns `Promise<PrinterInfo[]>` - Resolves with a [`PrinterInfo[]`](structures/
   * `footer` string (optional) - string to be printed as page footer.
   * `pageSize` string | Size (optional) - Specify page size of the printed document. Can be `A0`, `A1`, `A2`, `A3`,
   `A4`, `A5`, `A6`, `Legal`, `Letter`, `Tabloid` or an Object containing `height` and `width`.
+  * `usePrinterDefaultPageSize` boolean (optional) - Whether to use a given printer's default page size. Default is `false`. Cannot be combined with `pageSize`. When `deviceName` is provided, uses the default page size of that specific printer. When `deviceName` is not provided, uses the default page size of the system's default printer. If the printer's default page size cannot be retrieved, falls back to A4 (210mm x 297mm).
 * `callback` Function (optional)
   * `success` boolean - Indicates success of the print call.
   * `failureReason` string - Error description called back if the print fails.
 
-When a custom `pageSize` is passed, Chromium attempts to validate platform specific minimum values for `width_microns` and `height_microns`. Width and height must both be minimum 353 microns but may be higher on some operating systems.
+When a custom `pageSize` is passed, Chromium attempts to validate platform specific minimum values for `width_microns` and `height_microns`. Width and height must both be minimum 353 microns but may be higher on some operating systems. If a valid `pageSize` is not passed and `usePrinterDefaultPageSize` is `false`, an error will be thrown.
 
 Prints window's web page. When `silent` is set to `true`, Electron will pick
 the system's default printer if `deviceName` is empty and the default settings for printing.
@@ -2234,6 +2240,16 @@ Returns `string` - The identifier of a WebContents stream. This identifier can b
 with `navigator.mediaDevices.getUserMedia` using a `chromeMediaSource` of `tab`.
 The identifier is restricted to the web contents that it is registered to and is only valid for 10 seconds.
 
+#### `contents.getOrCreateDevToolsTargetId()`
+
+Returns `string` - The Chrome DevTools Protocol
+[TargetID](https://chromedevtools.github.io/devtools-protocol/tot/Target/#type-TargetID)
+associated with this WebContents. This is the reverse of
+[`webContents.fromDevToolsTargetId()`](#webcontentsfromdevtoolstargetidtargetid).
+
+> [!NOTE]
+> This method creates a new DevTools agent for this WebContents if one does not already exist.
+
 #### `contents.getOSProcessId()`
 
 Returns `Integer` - The operating system `pid` of the associated renderer

docs/api/webview-tag.md

@@ -588,6 +588,7 @@ Stops any `findInPage` request for the `webview` with the provided `action`.
   * `footer` string (optional) - string to be printed as page footer.
   * `pageSize` string | Size (optional) - Specify page size of the printed document. Can be `A3`,
   `A4`, `A5`, `Legal`, `Letter`, `Tabloid` or an Object containing `height` in microns.
+  * `usePrinterDefaultPageSize` boolean (optional) - Whether to use the system's default page size. Default is `false`. Cannot be combined with `pageSize`. When `deviceName` is provided, uses the default page size of that specific printer. When `deviceName` is not provided, uses the default page size of the system's default printer. If the printer's default page size cannot be retrieved, falls back to A4 (210mm x 297mm).
 
 Returns `Promise<void>`
 

docs/breaking-changes.md

@@ -12,6 +12,22 @@ This document uses the following convention to categorize breaking changes:
 * **Deprecated:** An API was marked as deprecated. The API will continue to function, but will emit a deprecation warning, and will be removed in a future release.
 * **Removed:** An API or feature was removed, and is no longer supported by Electron.
 
+## Planned Breaking API Changes (41.0)
+
+### Behavior Changed: PDFs no longer create a separate WebContents
+
+Previously, PDF resources created a separate guest [WebContents](https://www.electronjs.org/docs/latest/api/web-contents) for rendering. Now, PDFs are rendered within the same WebContents instead. If you have code to detect PDF resources, use the [frame tree](https://www.electronjs.org/docs/latest/api/web-frame-main) instead of WebContents.
+
+Under the hood, Chromium [enabled](https://chromium-review.googlesource.com/c/chromium/src/+/7239572) a feature that changes PDFs to use out-of-process iframes (OOPIFs) instead of the `MimeHandlerViewGuest` extension.
+
+### Behavior Changed: Updated Cookie Change Cause in the Cookie 'changed' Event
+
+We have updated the [cookie](https://www.electronjs.org/docs/latest/api/cookies#event-changed) change cause in the cookie 'changed' event.
+When a new cookie is set, the change cause is `inserted`.
+When a cookie is deleted, the change cause remains `explicit`.
+When the cookie being set is identical to an existing one (same name, domain, path, and value, with no actual changes), the change cause is `inserted-no-change-overwrite`.
+When the value of the cookie being set remains unchanged but some of its attributes are updated, such as the expiration attribute, the change cause will be `inserted-no-value-change-overwrite`.
+
 ## Planned Breaking API Changes (40.0)
 
 ### Deprecated: `clipboard` API access from renderer processes
@@ -25,6 +41,12 @@ your preload script and expose it using the [contextBridge](https://www.electron
 Debug symbols for MacOS (dSYM) now use xz compression in order to handle larger file sizes. `dsym.zip` files are now
 `dsym.tar.xz` files. End users using debug symbols may need to update their zip utilities.
 
+### Deprecated: `showHiddenFiles` in Dialogs on Linux
+
+This property will still be honored on macOS and Windows, but support on Linux
+will be removed in Electron 42. GTK intends for this to be a user choice rather
+than an app choice and has removed the API to do this programmatically.
+
 ## Planned Breaking API Changes (39.0)
 
 ### Deprecated: `--host-rules` command line switch

docs/development/pull-requests.md

@@ -21,24 +21,33 @@
 
 ### Step 1: Fork
 
-Fork the project [on GitHub](https://github.com/electron/electron) and clone your fork
-locally.
-
-```sh
-$ git clone git@github.com:username/electron.git
-$ cd electron
-$ git remote add upstream https://github.com/electron/electron.git
-$ git fetch upstream
-```
+Fork Electron's [GitHub repository](https://github.com/electron/electron).
 
 ### Step 2: Build
 
-Build steps and dependencies differ slightly depending on your operating system.
-See these detailed guides on building Electron locally:
+We recommend using [`@electron/build-tools`](https://github.com/electron/build-tools) to build
+Electron itself.
 
-* [Building on macOS](build-instructions-macos.md)
-* [Building on Linux](build-instructions-linux.md)
-* [Building on Windows](build-instructions-windows.md)
+```sh
+# Install build-tools package globally:
+npm install -g @electron/build-tools
+# Run the init script where you want to clone the project and point it to your fork:
+e init --fork my-org/electron --bootstrap testing
+```
+
+This will create a new `electron` folder in your working directory and initialize the project.
+Once the build completes, navigate to `electron/src/electron`, where your fork is actually cloned.
+
+> [!IMPORTANT]
+> Your Electron project has a complex folder structure with nested repositories.
+> See the [Build Instructions](./build-instructions-gn.md) docs for detailed Build Tools
+> usage instructions (e.g. how to sync dependencies or how to recompile the binary)
+> and platform-specific notices.
+
+There, you should have two `remote` URLs in git:
+
+* `origin` will point to `electron/electron`
+* `fork` will point to your fork (`my-org/electron`)
 
 Once you've built the project locally, you're ready to start making changes!
 
@@ -48,7 +57,7 @@ To keep your development environment organized, create local branches to
 hold your work. These should be branched directly off of the `main` branch.
 
 ```sh
-$ git checkout -b my-branch -t upstream/main
+git checkout -b my-branch
 ```
 
 ## Making Changes
@@ -60,7 +69,7 @@ changes to either the C/C++ code in the `shell/` folder,
 the JavaScript code in the `lib/` folder, the documentation in `docs/api/`
 or tests in the `spec/` folder.
 
-Please be sure to run `npm run lint` from time to time on any code changes
+Please be sure to run `yarn lint` from time to time on any code changes
 to ensure that they follow the project's code style.
 
 See [coding style](coding-style.md) for
@@ -75,8 +84,8 @@ across multiple commits. There is no limit to the number of commits in a
 pull request.
 
 ```sh
-$ git add my/changed/files
-$ git commit
+git add my/changed/files
+git commit
 ```
 
 Note that multiple commits get squashed when they are landed.
@@ -138,8 +147,8 @@ Once you have committed your changes, it is a good idea to use `git rebase`
 (not `git merge`) to synchronize your work with the main repository.
 
 ```sh
-$ git fetch upstream
-$ git rebase upstream/main
+git fetch origin
+git rebase origin/main
 ```
 
 This ensures that your working branch has the latest changes from `electron/electron`
@@ -156,7 +165,7 @@ Before submitting your changes in a pull request, always run the full
 test suite. To run the tests:
 
 ```sh
-$ npm run test
+yarn test
 ```
 
 Make sure the linter does not report any issues and that all tests pass.
@@ -165,7 +174,7 @@ Please do not submit patches that fail either check.
 If you are updating tests and want to run a single spec to check it:
 
 ```sh
-$ npm run test -match=menu
+yarn test -match=menu
 ```
 
 The above would only run spec modules matching `menu`, which is useful for
@@ -179,7 +188,7 @@ begin the process of opening a pull request by pushing your working branch
 to your fork on GitHub.
 
 ```sh
-$ git push origin my-branch
+git push fork my-branch
 ```
 
 ### Step 9: Opening the Pull Request
@@ -203,9 +212,9 @@ branch, add a new commit with those changes, and push those to your fork.
 GitHub will automatically update the pull request.
 
 ```sh
-$ git add my/changed/files
-$ git commit
-$ git push origin my-branch
+git add my/changed/files
+git commit
+git push fork my-branch
 ```
 
 There are a number of more advanced mechanisms for managing commits using
@@ -213,8 +222,8 @@ There are a number of more advanced mechanisms for managing commits using
 
 Feel free to post a comment in the pull request to ping reviewers if you are
 awaiting an answer on something. If you encounter words or acronyms that
-seem unfamiliar, refer to this
-[glossary](https://sites.google.com/a/chromium.org/dev/glossary).
+seem unfamiliar, refer to the
+[Chromium glossary](https://sites.google.com/a/chromium.org/dev/glossary).
 
 #### Approval and Request Changes Workflow
 

docs/tutorial/custom-window-styles.md

@@ -12,6 +12,10 @@ To create a frameless window, set the [`BaseWindowContructorOptions`][] `frame`
 
 ```
 
+On Wayland (Linux), frameless windows have GTK drop shadows and extended
+resize boundaries by default. To create a fully frameless window with no
+decorations, set `hasShadow: false` in the window constructor options.
+
 ## Transparent windows
 
 ![Transparent Window](../images/transparent-window.png)

docs/tutorial/fuses.md

@@ -137,6 +137,33 @@ The extra privileges granted to the `file://` protocol by this fuse are incomple
 * `file://` protocol pages have universal access granted to child frames also running on `file://`
   protocols regardless of sandbox settings
 
+### `wasmTrapHandlers`
+
+**Default:** Enabled
+
+**@electron/fuses:** `FuseV1Options.WasmTrapHandlers`
+
+The `wasmTrapHandlers` fuse controls whether V8 will use signal handlers to trap Out of Bounds memory
+access from WebAssembly. The feature works by surrounding the WebAssembly memory with large guard regions
+and then installing a signal handler that traps attempt to access memory in the guard region. The feature
+is only supported on the following 64-bit systems.
+
+Linux. MacOS, Windows - x86_64
+Linux, MacOS - aarch64
+
+| Guard Pages | WASM heap | Guard Pages |
+|-----8GB-----|           |-----8GB-----|
+
+When the fuse is disabled V8 will use explicit bound checks in the generated WebAssembly code to ensure
+memory safety. However, this method has some downsides
+
+* The compiler generates extra nodes for each memory reference, leading to longer compile times due to the
+additional processing time needed for these nodes.
+* In turn, these extra nodes lead to lots of extra code being generated, making WebAssembly modules bigger
+than they ideally should be.
+* This extra code, particularly the compare and branch before every memory reference,
+incurs a significant runtime cost.
+
 ## How do I flip fuses?
 
 ### The easy way

docs/tutorial/ipc.md

@@ -50,7 +50,7 @@ sections.
 
 In the main process, set an IPC listener on the `set-title` channel with the `ipcMain.on` API:
 
-```js {6-10,22} title='main.js (Main Process)'
+```js {7-11,23} title='main.js (Main Process)'
 const { app, BrowserWindow, ipcMain } = require('electron')
 
 const path = require('node:path')

docs/tutorial/native-file-drag-drop.md

@@ -110,4 +110,10 @@ the item is a Markdown file located in the root of the project:
 
 ![Drag and drop](../images/drag-and-drop.gif)
 
+## Dragging files into your app
+
+You can use the standard
+[Drag and Drop web API](https://developer.mozilla.org/en-US/docs/Web/API/HTML_Drag_and_Drop_API)
+for dragging and dropping files into your app.
+
 [`contextBridge`]: ../api/context-bridge.md

filenames.gni

@@ -50,6 +50,8 @@ filenames = {
     "shell/browser/ui/views/caption_button_placeholder_container.h",
     "shell/browser/ui/views/client_frame_view_linux.cc",
     "shell/browser/ui/views/client_frame_view_linux.h",
+    "shell/browser/ui/views/linux_frame_layout.cc",
+    "shell/browser/ui/views/linux_frame_layout.h",
     "shell/common/application_info_linux.cc",
     "shell/common/language_util_linux.cc",
     "shell/common/node_bindings_linux.cc",
@@ -198,6 +200,8 @@ filenames = {
     "shell/common/api/electron_api_clipboard_mac.mm",
     "shell/common/api/electron_api_native_image_mac.mm",
     "shell/common/asar/archive_mac.mm",
+    "shell/common/asar/integrity_digest.h",
+    "shell/common/asar/integrity_digest.mm",
     "shell/common/application_info_mac.mm",
     "shell/common/language_util_mac.mm",
     "shell/common/mac/main_application_bundle.h",
@@ -462,7 +466,6 @@ filenames = {
     "shell/browser/net/system_network_context_manager.h",
     "shell/browser/net/url_loader_network_observer.cc",
     "shell/browser/net/url_loader_network_observer.h",
-    "shell/browser/net/web_request_api_interface.h",
     "shell/browser/network_hints_handler_impl.cc",
     "shell/browser/network_hints_handler_impl.h",
     "shell/browser/notifications/notification.cc",

filenames.libcxx.gni

@@ -309,6 +309,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__concepts/class_or_enum.h",
   "//third_party/libc++/src/include/__concepts/common_reference_with.h",
   "//third_party/libc++/src/include/__concepts/common_with.h",
+  "//third_party/libc++/src/include/__concepts/comparison_common_type.h",
   "//third_party/libc++/src/include/__concepts/constructible.h",
   "//third_party/libc++/src/include/__concepts/convertible_to.h",
   "//third_party/libc++/src/include/__concepts/copyable.h",
@@ -1103,12 +1104,14 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__locale_dir/num.h",
   "//third_party/libc++/src/include/__locale_dir/pad_and_output.h",
   "//third_party/libc++/src/include/__locale_dir/scan_keyword.h",
+  "//third_party/libc++/src/include/__locale_dir/support/aix.h",
   "//third_party/libc++/src/include/__locale_dir/support/apple.h",
   "//third_party/libc++/src/include/__locale_dir/support/bsd_like.h",
   "//third_party/libc++/src/include/__locale_dir/support/freebsd.h",
   "//third_party/libc++/src/include/__locale_dir/support/fuchsia.h",
   "//third_party/libc++/src/include/__locale_dir/support/linux.h",
   "//third_party/libc++/src/include/__locale_dir/support/netbsd.h",
+  "//third_party/libc++/src/include/__locale_dir/support/newlib.h",
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/characters.h",
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/strtonum.h",
   "//third_party/libc++/src/include/__locale_dir/support/windows.h",
@@ -1275,6 +1278,8 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__random/uniform_real_distribution.h",
   "//third_party/libc++/src/include/__random/weibull_distribution.h",
   "//third_party/libc++/src/include/__ranges/access.h",
+  "//third_party/libc++/src/include/__ranges/adjacent_transform_view.h",
+  "//third_party/libc++/src/include/__ranges/adjacent_view.h",
   "//third_party/libc++/src/include/__ranges/all.h",
   "//third_party/libc++/src/include/__ranges/as_rvalue_view.h",
   "//third_party/libc++/src/include/__ranges/chunk_by_view.h",
@@ -1286,6 +1291,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__ranges/data.h",
   "//third_party/libc++/src/include/__ranges/drop_view.h",
   "//third_party/libc++/src/include/__ranges/drop_while_view.h",
+  "//third_party/libc++/src/include/__ranges/elements_of.h",
   "//third_party/libc++/src/include/__ranges/elements_view.h",
   "//third_party/libc++/src/include/__ranges/empty.h",
   "//third_party/libc++/src/include/__ranges/empty_view.h",
@@ -1363,6 +1369,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__tuple/tuple_like.h",
   "//third_party/libc++/src/include/__tuple/tuple_like_no_subrange.h",
   "//third_party/libc++/src/include/__tuple/tuple_size.h",
+  "//third_party/libc++/src/include/__tuple/tuple_transform.h",
   "//third_party/libc++/src/include/__type_traits/add_cv_quals.h",
   "//third_party/libc++/src/include/__type_traits/add_pointer.h",
   "//third_party/libc++/src/include/__type_traits/add_reference.h",

lib/browser/api/web-contents.ts

@@ -263,7 +263,12 @@ WebContents.prototype.print = function (options: ElectronInternal.WebContentsPri
     throw new TypeError('webContents.print(): Invalid print settings specified.');
   }
 
-  const { pageSize } = options;
+  const { pageSize, usePrinterDefaultPageSize } = options;
+
+  if (usePrinterDefaultPageSize !== undefined && pageSize !== undefined) {
+    throw new Error('usePrinterDefaultPageSize cannot be combined with pageSize');
+  }
+
   if (typeof pageSize === 'string' && PDFPageSizes[pageSize]) {
     const mediaSize = PDFPageSizes[pageSize];
     options.mediaSize = {
@@ -777,7 +782,8 @@ WebContents.prototype._init = function () {
   const originCounts = new Map<string, number>();
   const openDialogs = new Set<AbortController>();
   this.on('-run-dialog', async (info, callback) => {
-    const origin = info.frame.origin === 'file://' ? info.frame.url : info.frame.origin;
+    const originUrl = new URL(info.frame.url);
+    const origin = originUrl.protocol === 'file:' ? originUrl.href : originUrl.origin;
     if ((originCounts.get(origin) ?? 0) < 0) return callback(false, '');
 
     const prefs = this.getLastWebPreferences();

lib/browser/guest-window-manager.ts

@@ -17,6 +17,11 @@ export type WindowOpenArgs = {
   features: string,
 }
 
+const frameNamesToWindow = new Map<string, WebContents>();
+const registerFrameNameToGuestWindow = (name: string, webContents: WebContents) => frameNamesToWindow.set(name, webContents);
+const unregisterFrameName = (name: string) => frameNamesToWindow.delete(name);
+const getGuestWebContentsByFrameName = (name: string) => frameNamesToWindow.get(name);
+
 /**
  * `openGuestWindow` is called to create and setup event handling for the new
  * window.
@@ -42,6 +47,20 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
     ...overrideBrowserWindowOptions
   };
 
+  // To spec, subsequent window.open calls with the same frame name (`target` in
+  // spec parlance) will reuse the previous window.
+  // https://html.spec.whatwg.org/multipage/window-object.html#apis-for-creating-and-navigating-browsing-contexts-by-name
+  const existingWebContents = getGuestWebContentsByFrameName(frameName);
+  if (existingWebContents) {
+    if (existingWebContents.isDestroyed()) {
+      // FIXME(t57ser): The webContents is destroyed for some reason, unregister the frame name
+      unregisterFrameName(frameName);
+    } else {
+      existingWebContents.loadURL(url);
+      return;
+    }
+  }
+
   if (createWindow) {
     const webContents = createWindow({
       webContents: guest,
@@ -53,7 +72,7 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
         throw new Error('Invalid webContents. Created window should be connected to webContents passed with options object.');
       }
 
-      handleWindowLifecycleEvents({ embedder, guest, outlivesOpener });
+      handleWindowLifecycleEvents({ embedder, frameName, guest, outlivesOpener });
     }
 
     return;
@@ -77,7 +96,7 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
     });
   }
 
-  handleWindowLifecycleEvents({ embedder, guest: window.webContents, outlivesOpener });
+  handleWindowLifecycleEvents({ embedder, frameName, guest: window.webContents, outlivesOpener });
 
   embedder.emit('did-create-window', window, { url, frameName, options: browserWindowOptions, disposition, referrer, postData });
 }
@@ -88,9 +107,10 @@ export function openGuestWindow ({ embedder, guest, referrer, disposition, postD
  * too is the guest destroyed; this is Electron convention and isn't based in
  * browser behavior.
  */
-const handleWindowLifecycleEvents = function ({ embedder, guest, outlivesOpener }: {
+const handleWindowLifecycleEvents = function ({ embedder, guest, frameName, outlivesOpener }: {
   embedder: WebContents,
   guest: WebContents,
+  frameName: string,
   outlivesOpener: boolean
 }) {
   const closedByEmbedder = function () {
@@ -108,6 +128,13 @@ const handleWindowLifecycleEvents = function ({ embedder, guest, outlivesOpener
     embedder.once('current-render-view-deleted' as any, closedByEmbedder);
   }
   guest.once('destroyed', closedByUser);
+
+  if (frameName) {
+    registerFrameNameToGuestWindow(frameName, guest);
+    guest.once('destroyed', function () {
+      unregisterFrameName(frameName);
+    });
+  }
 };
 
 // Security options that child windows will always inherit from parent windows

lib/browser/init.ts

@@ -125,12 +125,10 @@ if (packageJson.productName != null) {
   app.name = `${packageJson.name}`.trim();
 }
 
-// Set application's desktop name.
-if (packageJson.desktopName != null) {
-  app.setDesktopName(packageJson.desktopName);
-} else {
-  app.setDesktopName(`${app.name}.desktop`);
-}
+// Set application's desktop name (Linux). These usually match the executable name,
+// so use it as the default to ensure the app gets the correct icon in the taskbar and application switcher.
+const desktopName = packageJson.desktopName || `${path.basename(process.execPath)}.desktop`;
+app.setDesktopName(desktopName);
 
 // Set v8 flags, deliberately lazy load so that apps that do not use this
 // feature do not pay the price

lib/common/api/net-client-request.ts

@@ -427,9 +427,8 @@ export class ClientRequest extends Writable implements Electron.ClientRequest {
     this._started = true;
     const stringifyValues = (obj: Record<string, { name: string, value: string | string[] }>) => {
       const ret: Record<string, string> = {};
-      for (const k of Object.keys(obj)) {
-        const kv = obj[k];
-        ret[kv.name] = kv.value.toString();
+      for (const { name, value } of Object.values(obj)) {
+        ret[name] = value.toString();
       }
       return ret;
     };

package.json

@@ -6,7 +6,7 @@
   "devDependencies": {
     "@azure/storage-blob": "^12.28.0",
     "@datadog/datadog-ci": "^4.1.2",
-    "@electron/asar": "^3.2.13",
+    "@electron/asar": "^4.0.1",
     "@electron/docs-parser": "^2.0.0",
     "@electron/fiddle-core": "^1.3.4",
     "@electron/github-app-auth": "^3.2.0",
@@ -64,7 +64,7 @@
   "scripts": {
     "asar": "asar",
     "generate-version-json": "node script/generate-version-json.js",
-    "lint": "node ./script/lint.js && npm run lint:docs",
+    "lint": "node ./script/lint.js && npm run lint:docs && npm run lint:chromium-roller",
     "lint:js": "node ./script/lint.js --js",
     "lint:clang-format": "python3 script/run-clang-format.py -r -c shell/ || (echo \"\\nCode not formatted correctly.\" && exit 1)",
     "lint:clang-tidy": "ts-node ./script/run-clang-tidy.ts",
@@ -79,6 +79,7 @@
     "lint:ts-check-js-in-markdown": "lint-roller-markdown-ts-check --root docs \"**/*.md\" --ignore \"breaking-changes.md\"",
     "lint:js-in-markdown": "lint-roller-markdown-standard --root docs \"**/*.md\"",
     "lint:api-history": "lint-roller-markdown-api-history --root \"./docs/api/\" --schema \"./docs/api-history.schema.json\" --breaking-changes-file \"./docs/breaking-changes.md\" --check-placement --check-strings \"*.md\"",
+    "lint:chromium-roller": "node ./script/lint-roller-chromium-changes.mjs",
     "create-api-json": "node script/create-api-json.mjs",
     "create-typescript-definitions": "npm run create-api-json && electron-typescript-definitions --api=electron-api.json && node spec/ts-smoke/runner.js",
     "gn-typescript-definitions": "npm run create-typescript-definitions && node script/cp.mjs electron.d.ts",
@@ -102,6 +103,9 @@
     "electron"
   ],
   "lint-staged": {
+    "*": [
+      "npm run lint:chromium-roller"
+    ],
     "*.{js,ts}": [
       "node script/lint.js --js --fix --only --"
     ],
@@ -146,6 +150,7 @@
   },
   "packageManager": "yarn@4.12.0",
   "workspaces": [
+    ".github/workflows",
     "spec",
     "spec/fixtures/native-addon/*"
   ],

patches/angle/.patches

@@ -1 +0,0 @@
-optionally_validate_gl_max_uniform_blocks_at_compile_time.patch

patches/angle/optionally_validate_gl_max_uniform_blocks_at_compile_time.patch

@@ -1,376 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Geoff Lang <geofflang@chromium.org>
-Date: Wed, 11 Feb 2026 15:51:46 -0500
-Subject: Optionally validate GL_MAX_*_UNIFORM_BLOCKS at compile time.
-
-These were validated at link time but some drivers have compiler crashes
-when compiling shaders with too many uniform blocks.
-
-Bug: chromium:475877320
-Change-Id: I4413ce06307b4fe9e27105d85f66f610c235a301
-Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7568089
-Commit-Queue: Geoff Lang <geofflang@chromium.org>
-Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
-
-diff --git a/include/GLSLANG/ShaderLang.h b/include/GLSLANG/ShaderLang.h
-index 90b1239689c98a8c94f8c6f57d572268a4450923..81445ade5f2285d52a6b83bfc574c0fa56d4a0da 100644
---- a/include/GLSLANG/ShaderLang.h
-+++ b/include/GLSLANG/ShaderLang.h
-@@ -26,7 +26,7 @@
- 
- // Version number for shader translation API.
- // It is incremented every time the API changes.
--#define ANGLE_SH_VERSION 386
-+#define ANGLE_SH_VERSION 387
- 
- enum ShShaderSpec
- {
-@@ -383,6 +383,10 @@ struct ShCompileOptions
- 
-     uint64_t forceShaderPrecisionHighpToMediump : 1;
- 
-+    // Validate that the count of uniform blocks is within the GL_MAX_*_UNIFORM_BLOCKS limits. These
-+    // limits must be supplied in the BuiltinResources.
-+    uint64_t validatePerStageMaxUniformBlocks : 1;
-+
-     // Ask compiler to generate Vulkan transform feedback emulation support code.
-     uint64_t addVulkanXfbEmulationSupportCode : 1;
- 
-@@ -584,6 +588,12 @@ struct ShBuiltInResources
-     int MinProgramTexelOffset;
-     int MaxProgramTexelOffset;
- 
-+    // GL_MAX_FRAGMENT_UNIFORM_BLOCKS
-+    int MaxFragmentUniformBlocks;
-+
-+    // GL_MAX_VERTEX_UNIFORM_BLOCKS
-+    int MaxVertexUniformBlocks;
-+
-     // Extension constants.
- 
-     // Value of GL_MAX_DUAL_SOURCE_DRAW_BUFFERS_EXT for OpenGL ES output context.
-@@ -701,6 +711,9 @@ struct ShBuiltInResources
-     // maximum point size (higher limit from ALIASED_POINT_SIZE_RANGE)
-     float MaxPointSize;
- 
-+    // GL_MAX_COMPUTE_UNIFORM_BLOCKS
-+    int MaxComputeUniformBlocks;
-+
-     // EXT_geometry_shader constants
-     int MaxGeometryUniformComponents;
-     int MaxGeometryUniformBlocks;
-@@ -724,6 +737,7 @@ struct ShBuiltInResources
-     int MaxTessControlImageUniforms;
-     int MaxTessControlAtomicCounters;
-     int MaxTessControlAtomicCounterBuffers;
-+    int MaxTessControlUniformBlocks;
- 
-     int MaxTessPatchComponents;
-     int MaxPatchVertices;
-@@ -736,6 +750,7 @@ struct ShBuiltInResources
-     int MaxTessEvaluationImageUniforms;
-     int MaxTessEvaluationAtomicCounters;
-     int MaxTessEvaluationAtomicCounterBuffers;
-+    int MaxTessEvaluationUniformBlocks;
- 
-     // Subpixel bits used in rasterization.
-     int SubPixelBits;
-diff --git a/include/platform/autogen/FeaturesGL_autogen.h b/include/platform/autogen/FeaturesGL_autogen.h
-index a732a77d66ec2fad9677d500d8f0ae3d0d92c454..f0b391dfbc4d238df458b334951371429fd496a4 100644
---- a/include/platform/autogen/FeaturesGL_autogen.h
-+++ b/include/platform/autogen/FeaturesGL_autogen.h
-@@ -638,6 +638,12 @@ struct FeaturesGL : FeatureSetBase
-         &members,
-     };
- 
-+    FeatureInfo validateMaxPerStageUniformBlocksAtCompileTime = {
-+        "validateMaxPerStageUniformBlocksAtCompileTime",
-+        FeatureCategory::OpenGLWorkarounds,
-+        &members,
-+    };
-+
- };
- 
- inline FeaturesGL::FeaturesGL()  = default;
-diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
-index e993768974e63d19bf4b71702fe9725aa97ea2fb..03454778c2acfd10c2a3762ef6ad1e9eb0fc7bb2 100644
---- a/include/platform/gl_features.json
-+++ b/include/platform/gl_features.json
-@@ -828,6 +828,14 @@
-                 "Some ES2 Mali drivers are unable to query enough information from a linked program to use passthrough shaders."
-             ],
-             "issue": "https://crbug.com/451796659"
-+        },
-+        {
-+            "name": "validate_max_per_stage_uniform_blocks_at_compile_time",
-+            "category": "Workarounds",
-+            "description": [
-+                "Validate GL_MAX_*_UNIFORM_BLOCKS at compile time instead of link time to work around compiler bugs."
-+            ],
-+            "issue": "http://crbug.com/475877320"
-         }
-     ]
- }
-diff --git a/src/compiler/translator/Compiler.cpp b/src/compiler/translator/Compiler.cpp
-index 7e36dc2cd24a5d0a3a1a009a1171684e4dfe62e5..aae0f1008d573a55e822c10cf02149b8ccef6055 100644
---- a/src/compiler/translator/Compiler.cpp
-+++ b/src/compiler/translator/Compiler.cpp
-@@ -1563,6 +1563,8 @@ void TCompiler::setResourceString()
-         << ":MaxFragmentInputVectors:" << mResources.MaxFragmentInputVectors
-         << ":MinProgramTexelOffset:" << mResources.MinProgramTexelOffset
-         << ":MaxProgramTexelOffset:" << mResources.MaxProgramTexelOffset
-+        << ":MaxFragmentUniformBlocks:" << mResources.MaxFragmentUniformBlocks
-+        << ":MaxVertexUniformBlocks:" << mResources.MaxVertexUniformBlocks
-         << ":MaxDualSourceDrawBuffers:" << mResources.MaxDualSourceDrawBuffers
-         << ":MaxViewsOVR:" << mResources.MaxViewsOVR
-         << ":NV_draw_buffers:" << mResources.NV_draw_buffers
-@@ -1612,6 +1614,7 @@ void TCompiler::setResourceString()
-         << ":MaxFragmentAtomicCounterBuffers:" << mResources.MaxFragmentAtomicCounterBuffers
-         << ":MaxCombinedAtomicCounterBuffers:" << mResources.MaxCombinedAtomicCounterBuffers
-         << ":MaxAtomicCounterBufferSize:" << mResources.MaxAtomicCounterBufferSize
-+        << ":MaxComputeUnformBlocks:" << mResources.MaxComputeUniformBlocks
-         << ":MaxGeometryUniformComponents:" << mResources.MaxGeometryUniformComponents
-         << ":MaxGeometryUniformBlocks:" << mResources.MaxGeometryUniformBlocks
-         << ":MaxGeometryInputComponents:" << mResources.MaxGeometryInputComponents
-@@ -1635,6 +1638,7 @@ void TCompiler::setResourceString()
-         << ":MaxTessControlImageUniforms:" << mResources.MaxTessControlImageUniforms
-         << ":MaxTessControlAtomicCounters:" << mResources.MaxTessControlAtomicCounters
-         << ":MaxTessControlAtomicCounterBuffers:" << mResources.MaxTessControlAtomicCounterBuffers
-+        << ":MaxTessControlUniformBlocks:" << mResources.MaxTessControlUniformBlocks
-         << ":MaxTessPatchComponents:" << mResources.MaxTessPatchComponents
-         << ":MaxPatchVertices:" << mResources.MaxPatchVertices
-         << ":MaxTessGenLevel:" << mResources.MaxTessGenLevel
-@@ -1644,7 +1648,9 @@ void TCompiler::setResourceString()
-         << ":MaxTessEvaluationUniformComponents:" << mResources.MaxTessEvaluationUniformComponents
-         << ":MaxTessEvaluationImageUniforms:" << mResources.MaxTessEvaluationImageUniforms
-         << ":MaxTessEvaluationAtomicCounters:" << mResources.MaxTessEvaluationAtomicCounters
--        << ":MaxTessEvaluationAtomicCounterBuffers:" << mResources.MaxTessEvaluationAtomicCounterBuffers;
-+        << ":MaxTessEvaluationAtomicCounterBuffers:" << mResources.MaxTessEvaluationAtomicCounterBuffers
-+        << ":MaxTessControlUniformBlocks:" << mResources.MaxTessControlUniformBlocks
-+    ;
-     // clang-format on
- 
-     mBuiltInResourcesString = strstream.str();
-diff --git a/src/compiler/translator/ParseContext.cpp b/src/compiler/translator/ParseContext.cpp
-index a8a5e562b2006402e1473c8c6710d75d7c83c42f..e04d27fe695caba55bb29f94c7425d4ecc3d2344 100644
---- a/src/compiler/translator/ParseContext.cpp
-+++ b/src/compiler/translator/ParseContext.cpp
-@@ -367,6 +367,37 @@ bool IsESSL100ConstantExpression(TIntermNode *node)
- {
-     return node->getAsConstantUnion() != nullptr && node->getAsTyped()->getQualifier() == EvqConst;
- }
-+
-+unsigned int GetMaxUniformBlocksForShaderType(sh::GLenum shaderType,
-+                                              const ShCompileOptions &options,
-+                                              const ShBuiltInResources &resources)
-+{
-+    // If the validatePerStageMaxUniformBlocks workaround is disabled. Set a limit that will not be
-+    // hit.
-+    if (!options.validatePerStageMaxUniformBlocks)
-+    {
-+        return std::numeric_limits<unsigned int>::max();
-+    }
-+
-+    switch (shaderType)
-+    {
-+        case GL_FRAGMENT_SHADER:
-+            return resources.MaxFragmentUniformBlocks;
-+        case GL_VERTEX_SHADER:
-+            return resources.MaxVertexUniformBlocks;
-+        case GL_COMPUTE_SHADER:
-+            return resources.MaxComputeUniformBlocks;
-+        case GL_GEOMETRY_SHADER:
-+            return resources.MaxGeometryUniformBlocks;
-+        case GL_TESS_CONTROL_SHADER:
-+            return resources.MaxTessControlUniformBlocks;
-+        case GL_TESS_EVALUATION_SHADER:
-+            return resources.MaxTessEvaluationUniformBlocks;
-+        default:
-+            UNREACHABLE();
-+            return 0;
-+    }
-+}
- }  // namespace
- 
- // This tracks each binding point's current default offset for inheritance of subsequent
-@@ -459,6 +490,8 @@ TParseContext::TParseContext(TSymbolTable &symt,
-       mMaxPixelLocalStoragePlanes(resources.MaxPixelLocalStoragePlanes),
-       mMaxFunctionParameters(resources.MaxFunctionParameters),
-       mMaxCallStackDepth(resources.MaxCallStackDepth),
-+      mMaxUniformBlocks(GetMaxUniformBlocksForShaderType(mShaderType, options, resources)),
-+      mNumUniformBlocks(0),
-       mDeclaringFunction(false),
-       mDeclaringMain(false),
-       mMainFunction(nullptr),
-@@ -6082,6 +6115,22 @@ TIntermDeclaration *TParseContext::addInterfaceBlock(
-         error(arraySizesLine, "geometry shader input blocks must be an array", "");
-     }
- 
-+    // Validate max uniform block limits
-+    if (typeQualifier.qualifier == EvqUniform)
-+    {
-+        unsigned int blockCount =
-+            arraySizes == nullptr || arraySizes->empty() ? 1 : (*arraySizes)[0];
-+        if (mNumUniformBlocks + blockCount > mMaxUniformBlocks)
-+        {
-+            error(arraySizesLine,
-+                  "uniform block count greater than per stage maximum uniform blocks", "");
-+        }
-+        else
-+        {
-+            mNumUniformBlocks += blockCount;
-+        }
-+    }
-+
-     checkIndexIsNotSpecified(typeQualifier.line, typeQualifier.layoutQualifier.index);
- 
-     if (mShaderVersion < 310)
-diff --git a/src/compiler/translator/ParseContext.h b/src/compiler/translator/ParseContext.h
-index f3d0417dd91cda2226203b9b39c2dc8acc1ac880..baf074bd86fe587a72cd3a431fbf0231d6ebd68c 100644
---- a/src/compiler/translator/ParseContext.h
-+++ b/src/compiler/translator/ParseContext.h
-@@ -910,6 +910,12 @@ class TParseContext : angle::NonCopyable
-     // and there are no known users.
-     TUnorderedMap<TQualifier, bool> mBuiltInQualified;
- 
-+    // Maximum number of uniform blocks allowed to be declared in this shader. Taken from the
-+    // built-in resources and resolved to this shader type.
-+    unsigned int mMaxUniformBlocks;
-+    // Current count of declared uniform blocks.
-+    unsigned int mNumUniformBlocks;
-+
-     // keeps track whether we are declaring / defining a function
-     bool mDeclaringFunction;
- 
-diff --git a/src/compiler/translator/ShaderLang.cpp b/src/compiler/translator/ShaderLang.cpp
-index 6044849e6a6392fed77909b45fea475fa4978325..e292cf0403a77f2f70ca9176785fcdad9aac7302 100644
---- a/src/compiler/translator/ShaderLang.cpp
-+++ b/src/compiler/translator/ShaderLang.cpp
-@@ -263,6 +263,8 @@ void InitBuiltInResources(ShBuiltInResources *resources)
-     resources->MaxFragmentInputVectors = 15;
-     resources->MinProgramTexelOffset   = -8;
-     resources->MaxProgramTexelOffset   = 7;
-+    resources->MaxFragmentUniformBlocks = 12;
-+    resources->MaxVertexUniformBlocks   = 12;
- 
-     // Extensions constants.
-     resources->MaxDualSourceDrawBuffers = 0;
-@@ -323,6 +325,8 @@ void InitBuiltInResources(ShBuiltInResources *resources)
-     resources->MaxUniformBufferBindings       = 32;
-     resources->MaxShaderStorageBufferBindings = 4;
- 
-+    resources->MaxComputeUniformBlocks = 12;
-+
-     resources->MaxGeometryUniformComponents     = 1024;
-     resources->MaxGeometryUniformBlocks         = 12;
-     resources->MaxGeometryInputComponents       = 64;
-@@ -344,6 +348,7 @@ void InitBuiltInResources(ShBuiltInResources *resources)
-     resources->MaxTessControlImageUniforms         = 0;
-     resources->MaxTessControlAtomicCounters        = 0;
-     resources->MaxTessControlAtomicCounterBuffers  = 0;
-+    resources->MaxTessControlUniformBlocks         = 12;
- 
-     resources->MaxTessPatchComponents = 120;
-     resources->MaxPatchVertices       = 32;
-@@ -356,6 +361,7 @@ void InitBuiltInResources(ShBuiltInResources *resources)
-     resources->MaxTessEvaluationImageUniforms        = 0;
-     resources->MaxTessEvaluationAtomicCounters       = 0;
-     resources->MaxTessEvaluationAtomicCounterBuffers = 0;
-+    resources->MaxTessEvaluationUniformBlocks        = 12;
- 
-     resources->SubPixelBits = 8;
- 
-diff --git a/src/libANGLE/Compiler.cpp b/src/libANGLE/Compiler.cpp
-index 00684c8ed08609a3a4d6ef6f36107756207ed72b..1893b6bddb33fde567162e2e9dbb12785dad538d 100644
---- a/src/libANGLE/Compiler.cpp
-+++ b/src/libANGLE/Compiler.cpp
-@@ -169,6 +169,8 @@ Compiler::Compiler(rx::GLImplFactory *implFactory, const State &state, egl::Disp
-     mResources.MaxFragmentInputVectors = caps.maxFragmentInputComponents / 4;
-     mResources.MinProgramTexelOffset   = caps.minProgramTexelOffset;
-     mResources.MaxProgramTexelOffset   = caps.maxProgramTexelOffset;
-+    mResources.MaxFragmentUniformBlocks = caps.maxShaderUniformBlocks[gl::ShaderType::Fragment];
-+    mResources.MaxVertexUniformBlocks   = caps.maxShaderUniformBlocks[gl::ShaderType::Vertex];
- 
-     // EXT_blend_func_extended
-     mResources.EXT_blend_func_extended  = extensions.blendFuncExtendedEXT;
-@@ -211,6 +213,7 @@ Compiler::Compiler(rx::GLImplFactory *implFactory, const State &state, egl::Disp
-     mResources.MaxCombinedImageUniforms         = caps.maxCombinedImageUniforms;
-     mResources.MaxCombinedShaderOutputResources = caps.maxCombinedShaderOutputResources;
-     mResources.MaxUniformLocations              = caps.maxUniformLocations;
-+    mResources.MaxComputeUniformBlocks = caps.maxShaderUniformBlocks[gl::ShaderType::Compute];
- 
-     for (size_t index = 0u; index < 3u; ++index)
-     {
-@@ -280,6 +283,8 @@ Compiler::Compiler(rx::GLImplFactory *implFactory, const State &state, egl::Disp
-     mResources.MaxTessControlAtomicCounters = caps.maxShaderAtomicCounters[ShaderType::TessControl];
-     mResources.MaxTessControlAtomicCounterBuffers =
-         caps.maxShaderAtomicCounterBuffers[ShaderType::TessControl];
-+    mResources.MaxTessControlUniformBlocks =
-+        caps.maxShaderUniformBlocks[gl::ShaderType::TessControl];
- 
-     mResources.MaxTessPatchComponents = caps.maxTessPatchComponents;
-     mResources.MaxPatchVertices       = caps.maxPatchVertices;
-@@ -297,6 +302,8 @@ Compiler::Compiler(rx::GLImplFactory *implFactory, const State &state, egl::Disp
-         caps.maxShaderAtomicCounters[ShaderType::TessEvaluation];
-     mResources.MaxTessEvaluationAtomicCounterBuffers =
-         caps.maxShaderAtomicCounterBuffers[ShaderType::TessEvaluation];
-+    mResources.MaxTessEvaluationUniformBlocks =
-+        caps.maxShaderUniformBlocks[gl::ShaderType::TessEvaluation];
- 
-     // Subpixel bits.
-     mResources.SubPixelBits = static_cast<int>(caps.subPixelBits);
-diff --git a/src/libANGLE/renderer/gl/ShaderGL.cpp b/src/libANGLE/renderer/gl/ShaderGL.cpp
-index a10d5545f409faa259a464437401980e40b80e33..d8db2a1f92494fd0dbf0cb6011ab9cea989c5b45 100644
---- a/src/libANGLE/renderer/gl/ShaderGL.cpp
-+++ b/src/libANGLE/renderer/gl/ShaderGL.cpp
-@@ -272,6 +272,11 @@ std::shared_ptr<ShaderTranslateTask> ShaderGL::compile(const gl::Context *contex
-         options->pls = contextGL->getNativePixelLocalStorageOptions();
-     }
- 
-+    if (features.validateMaxPerStageUniformBlocksAtCompileTime.enabled)
-+    {
-+        options->validatePerStageMaxUniformBlocks = true;
-+    }
-+
-     return std::shared_ptr<ShaderTranslateTask>(
-         new ShaderTranslateTaskGL(functions, mShaderID, contextGL->hasNativeParallelCompile()));
- }
-diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp
-index d9694c09146dcb34948646df5ca95a4d8b993d9e..e82a10262dc128e55d2357bf9efc67903c30206b 100644
---- a/src/libANGLE/renderer/gl/renderergl_utils.cpp
-+++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp
-@@ -2718,6 +2718,10 @@ void InitializeFeatures(const FunctionsGL *functions, angle::FeaturesGL *feature
-     // Mali 400 series drivers fail linking shaders when passthrough shaders are enabled. Likely due
-     // to not querying correct information from varyings and uniforms.
-     ANGLE_FEATURE_CONDITION(features, disablePassthroughShaders, IsAdreno4xx(functions));
-+
-+    // IMG GL drivers crash while compiling shaders with more than the limit of uniform blocks.
-+    ANGLE_FEATURE_CONDITION(features, validateMaxPerStageUniformBlocksAtCompileTime,
-+                            IsPowerVR(vendor));
- }
- 
- void InitializeFrontendFeatures(const FunctionsGL *functions, angle::FrontendFeatures *features)
-diff --git a/util/autogen/angle_features_autogen.cpp b/util/autogen/angle_features_autogen.cpp
-index f38ad24bdce73c1ec5facd1130bdf09f896298ee..c07c7e5fa2d28c50101c77bd856f18158777e276 100644
---- a/util/autogen/angle_features_autogen.cpp
-+++ b/util/autogen/angle_features_autogen.cpp
-@@ -484,6 +484,7 @@ constexpr PackedEnumMap<Feature, const char *> kFeatureNames = {{
-     {Feature::UseVkEventForBufferBarrier, "useVkEventForBufferBarrier"},
-     {Feature::UseVkEventForImageBarrier, "useVkEventForImageBarrier"},
-     {Feature::UseVmaForImageSuballocation, "useVmaForImageSuballocation"},
-+    {Feature::ValidateMaxPerStageUniformBlocksAtCompileTime, "validateMaxPerStageUniformBlocksAtCompileTime"},
-     {Feature::VaryingsRequireMatchingPrecisionInSpirv, "varyingsRequireMatchingPrecisionInSpirv"},
-     {Feature::VerifyPipelineCacheInBlobCache, "verifyPipelineCacheInBlobCache"},
-     {Feature::VertexIDDoesNotIncludeBaseVertex, "vertexIDDoesNotIncludeBaseVertex"},
-diff --git a/util/autogen/angle_features_autogen.h b/util/autogen/angle_features_autogen.h
-index 0eef4d53d814db20bb943fcda9e5b1837c371951..e33fd47ac493a3946d87c03a2d6f29b08e2b63aa 100644
---- a/util/autogen/angle_features_autogen.h
-+++ b/util/autogen/angle_features_autogen.h
-@@ -484,6 +484,7 @@ enum class Feature
-     UseVkEventForBufferBarrier,
-     UseVkEventForImageBarrier,
-     UseVmaForImageSuballocation,
-+    ValidateMaxPerStageUniformBlocksAtCompileTime,
-     VaryingsRequireMatchingPrecisionInSpirv,
-     VerifyPipelineCacheInBlobCache,
-     VertexIDDoesNotIncludeBaseVertex,

patches/boringssl/expose_ripemd160.patch

@@ -10,7 +10,7 @@ this patch is required to provide ripemd160 support in the nodejs crypto
 module.
 
 diff --git a/crypto/digest/digest_extra.cc b/crypto/digest/digest_extra.cc
-index ea1709ae6b50faedc786c0eaeb5f9002fd0db7d8..5b0ed4dc6aaf3fafad034e9ecc62cd47b9e3034f 100644
+index 17961ba6bd9de78b5b1b1008eb1f73babd49d0e7..6a870dce37df8f49106c24b183308a2c7a03fd7d 100644
 --- a/crypto/digest/digest_extra.cc
 +++ b/crypto/digest/digest_extra.cc
 @@ -47,6 +47,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
@@ -22,7 +22,7 @@ index ea1709ae6b50faedc786c0eaeb5f9002fd0db7d8..5b0ed4dc6aaf3fafad034e9ecc62cd47
      // hash function when given a signature OID. To avoid unintended lax parsing
      // of hash OIDs, this is no longer supported for lookup by OID or NID.
 diff --git a/crypto/fipsmodule/digest/digests.cc.inc b/crypto/fipsmodule/digest/digests.cc.inc
-index 3a3bfd3f0560fcd7b5fdbdf4cc29a56e0346b90a..a7335ca03b5b3b918c4321d890b45649679d772b 100644
+index a246a51103701e0ac8a0722324350a462f95bcc9..ddf0a90337d4e40de09bc345cf959dffdb161ecb 100644
 --- a/crypto/fipsmodule/digest/digests.cc.inc
 +++ b/crypto/fipsmodule/digest/digests.cc.inc
 @@ -18,6 +18,7 @@
@@ -33,7 +33,7 @@ index 3a3bfd3f0560fcd7b5fdbdf4cc29a56e0346b90a..a7335ca03b5b3b918c4321d890b45649
  
  #include "../../internal.h"
  #include "../bcm_interface.h"
-@@ -179,4 +180,27 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512_256) {
+@@ -181,4 +182,27 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512_256) {
    out->ctx_size = sizeof(SHA512_CTX);
  }
  

patches/boringssl/feat_expose_several_extra_cipher_functions.patch

@@ -28,11 +28,11 @@ RC2 Ciphers: rc2-40-cbc
 It's unclear whether this would be accepted upstream. We should try regardless.
 
 diff --git a/crypto/cipher/get_cipher.cc b/crypto/cipher/get_cipher.cc
-index 6513df01c4b3e4d33fc6b521d9aae78ec5499e73..52eb7fea420e3d81d274fd5c1e21e4da0229687f 100644
+index dabc54aa13745600a62e57ecbb427e48a4565282..ce213e00573102ce9405a794d3c140d9ef499ec1 100644
 --- a/crypto/cipher/get_cipher.cc
 +++ b/crypto/cipher/get_cipher.cc
 @@ -31,6 +31,7 @@ static const struct {
-   const EVP_CIPHER *(*func)(void);
+   const EVP_CIPHER *(*func)();
  } kCiphers[] = {
      {NID_aes_128_cbc, "aes-128-cbc", EVP_aes_128_cbc},
 +    {NID_aes_128_cfb128, "aes-128-cfb", EVP_aes_128_cfb128},

patches/chromium/.patches

@@ -65,7 +65,6 @@ feat_expose_raw_response_headers_from_urlloader.patch
 process_singleton.patch
 add_ui_scopedcliboardwriter_writeunsaferawdata.patch
 feat_add_data_parameter_to_processsingleton.patch
-load_v8_snapshot_in_browser_process.patch
 fix_adapt_exclusive_access_for_electron_needs.patch
 fix_aspect_ratio_with_max_size.patch
 port_autofill_colors_to_the_color_pipeline.patch
@@ -141,21 +140,10 @@ allow_electron_to_depend_on_components_os_crypt_sync.patch
 expose_referrerscriptinfo_hostdefinedoptionsindex.patch
 chore_disable_protocol_handler_dcheck.patch
 fix_check_for_file_existence_before_setting_mtime.patch
-viz_create_isbufferqueuesupportedandenabled.patch
-viz_fix_visual_artifacts_while_resizing_window_with_dcomp.patch
+fix_linux_tray_id.patch
+expose_gtk_ui_platform_field.patch
 fix_os_crypt_async_cookie_encryption.patch
-graphite_handle_out_of_order_recording_errors.patch
-move_wayland_pointer_lock_overrides_to_common_code.patch
-loaf_add_feature_to_enable_sourceurl_for_all_protocols.patch
 fix_update_dbus_signal_signature_for_xdg_globalshortcuts_portal.patch
-patch_osr_control_screen_info.patch
-cherry-pick-12f932985275.patch
-fix_mac_high_res_icons.patch
-cherry-pick-074d472db745.patch
-cherry-pick-50b057660b4d.patch
-cherry-pick-45c5a70d984d.patch
-cherry-pick-05e4b544803c.patch
-cherry-pick-5efc7a0127a6.patch
+fix_set_correct_app_id_on_linux.patch
+fix_pass_trigger_for_global_shortcuts_on_wayland.patch
 feat_plumb_node_integration_in_worker_through_workersettings.patch
-cherry-pick-fbfb27470bf6.patch
-fix_fire_menu_popup_start_for_dynamically_created_aria_menus.patch

patches/chromium/accelerator.patch

@@ -9,17 +9,17 @@ This patch makes three changes to Accelerator::GetShortcutText to improve shortc
 2. Ctrl-Shift-= and Ctrl-Plus show up as such
 
 diff --git a/ui/base/accelerators/accelerator.cc b/ui/base/accelerators/accelerator.cc
-index 5ad9332dd27ceda7d67cd3f571b12218a4415a40..ffe083836c39fb60b4bff1f9fbdd6cebb7fa9d1d 100644
+index 46b49a484fc7d42facf494733ca21e451fc54e25..eb4c80a0b788ac046bcfdb54ae85eaaef90cd76b 100644
 --- a/ui/base/accelerators/accelerator.cc
 +++ b/ui/base/accelerators/accelerator.cc
-@@ -12,6 +12,7 @@
+@@ -13,6 +13,7 @@
  #include "base/i18n/rtl.h"
  #include "base/notreached.h"
  #include "base/strings/string_util.h"
 +#include "base/strings/stringprintf.h"
  #include "base/strings/utf_string_conversions.h"
- #include "base/types/cxx23_to_underlying.h"
  #include "build/build_config.h"
+ #include "ui/base/l10n/l10n_util.h"
 @@ -164,6 +165,11 @@ std::u16string Accelerator::GetKeyCodeStringForShortcut() const {
  #endif
  

patches/chromium/add_contentgpuclient_precreatemessageloop_callback.patch

@@ -10,7 +10,7 @@ Allows Electron to restore WER when ELECTRON_DEFAULT_ERROR_MODE is set.
 This should be upstreamed.
 
 diff --git a/content/gpu/gpu_main.cc b/content/gpu/gpu_main.cc
-index 30cc1d4a179f9da59824cb98415baed8493fc843..2272eaa7e0e3306201e5e32226a0115f6f6636e5 100644
+index 7265019647734154f64108efd7e6376b7a9fc1ba..398aaff3af5bff791f114e4023d0e07be86dd79a 100644
 --- a/content/gpu/gpu_main.cc
 +++ b/content/gpu/gpu_main.cc
 @@ -272,6 +272,10 @@ int GpuMain(MainFunctionParams parameters) {
@@ -24,7 +24,7 @@ index 30cc1d4a179f9da59824cb98415baed8493fc843..2272eaa7e0e3306201e5e32226a0115f
    // We are experiencing what appear to be memory-stomp issues in the GPU
    // process. These issues seem to be impacting the task executor and listeners
    // registered to it. Create the task executor on the heap to guard against
-@@ -381,7 +385,6 @@ int GpuMain(MainFunctionParams parameters) {
+@@ -380,7 +384,6 @@ int GpuMain(MainFunctionParams parameters) {
  #endif
    const bool dead_on_arrival = !init_success;
  

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -10,7 +10,7 @@ DidCreateScriptContext is called, not all JS APIs are available in the
 context, which can cause some preload scripts to trip.
 
 diff --git a/content/public/renderer/render_frame_observer.h b/content/public/renderer/render_frame_observer.h
-index 5196f155cdc641b66c4faa77d8b00097145a1290..bbfac47a74f989482343c222b78f187b70297e4e 100644
+index 8077ed85e45e56d6cccb691223216c1f6a94b5ee..dd4cee346f16df703d414bf206bbe6c9f4b1f796 100644
 --- a/content/public/renderer/render_frame_observer.h
 +++ b/content/public/renderer/render_frame_observer.h
 @@ -141,6 +141,8 @@ class CONTENT_EXPORT RenderFrameObserver {
@@ -23,10 +23,10 @@ index 5196f155cdc641b66c4faa77d8b00097145a1290..bbfac47a74f989482343c222b78f187b
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 1e2534f47a85564244603d228351c84d7bf2ad06..87c6e3d2f6445d6bd54b3fdf8f878b0f9dd7e8a3 100644
+index fd285a51c2982494e345f38eeaba940025ec9276..a6001159b42c7092177c9c7d7608abe0bbd4936e 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4723,6 +4723,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4753,6 +4753,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  
@@ -40,10 +40,10 @@ index 1e2534f47a85564244603d228351c84d7bf2ad06..87c6e3d2f6445d6bd54b3fdf8f878b0f
                                                 int world_id) {
    for (auto& observer : observers_)
 diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
-index 81702780dbd911036f18c93ccef0ce088a52fc03..680d9bb33c4d53b4429bc72b4dd630e8b81f1f39 100644
+index 521b137f242c3feaa9e8ad29a0904597de70bd93..d2f9204e144f90290336e75d21119ef0f99a1d24 100644
 --- a/content/renderer/render_frame_impl.h
 +++ b/content/renderer/render_frame_impl.h
-@@ -604,6 +604,8 @@ class CONTENT_EXPORT RenderFrameImpl
+@@ -606,6 +606,8 @@ class CONTENT_EXPORT RenderFrameImpl
    void DidObserveLayoutShift(double score, bool after_input_or_scroll) override;
    void DidCreateScriptContext(v8::Local<v8::Context> context,
                                int world_id) override;
@@ -53,10 +53,10 @@ index 81702780dbd911036f18c93ccef0ce088a52fc03..680d9bb33c4d53b4429bc72b4dd630e8
                                  int world_id) override;
    void DidChangeScrollOffset() override;
 diff --git a/third_party/blink/public/web/web_local_frame_client.h b/third_party/blink/public/web/web_local_frame_client.h
-index 2ed54a31be77700c2bed2bd28db1d6b70effc0aa..91e234e7fa29e50545fdaed64adcf68498f14c2d 100644
+index 675791f9db1320ee9b3c915f4595eef2183802d5..1ce4e9a1e7b5d5cfbb6201c000eada80b3b3d174 100644
 --- a/third_party/blink/public/web/web_local_frame_client.h
 +++ b/third_party/blink/public/web/web_local_frame_client.h
-@@ -668,6 +668,9 @@ class BLINK_EXPORT WebLocalFrameClient {
+@@ -673,6 +673,9 @@ class BLINK_EXPORT WebLocalFrameClient {
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) {}
  
@@ -79,10 +79,10 @@ index 851e792c6c6f26b6074ffe8b0ba39a5813fabacc..8bd06f4c155cc0ed8afaf89347f9fc97
    if (World().IsMainWorld()) {
      probe::DidCreateMainWorldContext(GetFrame());
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client.h b/third_party/blink/renderer/core/frame/local_frame_client.h
-index 1ed3806f12ad4f70cb8e31d76be023d508e1e388..cdf5e974a2b155a3988f94e599e65ccaa5763db6 100644
+index 47dd48bd495f89f2dd3528053d9b6446df264c7c..ee43008b2bec7ea013cbbe7a782aa0a38e1acd02 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client.h
-@@ -303,6 +303,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
+@@ -311,6 +311,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
  
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) = 0;
@@ -92,10 +92,10 @@ index 1ed3806f12ad4f70cb8e31d76be023d508e1e388..cdf5e974a2b155a3988f94e599e65cca
                                          int32_t world_id) = 0;
    virtual bool AllowScriptExtensions() = 0;
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-index 23d6c6a864ad7e27477c34d2497a3eec1a9e707c..359b11ea39db7bb5fe2f9dad26b0a3a8bc8d6c28 100644
+index 294c9ec4bfb788235be8047eb3174d7dcc97bdfb..6ab8ec1924a76f51d6e390d9457c596f9b0d8453 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-@@ -300,6 +300,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
+@@ -301,6 +301,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
    }
  }
  
@@ -110,7 +110,7 @@ index 23d6c6a864ad7e27477c34d2497a3eec1a9e707c..359b11ea39db7bb5fe2f9dad26b0a3a8
      v8::Local<v8::Context> context,
      int32_t world_id) {
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.h b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
-index 7f2bff4cc2c35c0ed34a0c436df4f1a2aacbfe0a..cbc59f17897d3c6c98886a7ef7d6db81b0e1117b 100644
+index e7b822d45d608a78009576c2a299201014dd93ec..54be144d5b24b369e12d551e6c15d2d85fa8b8c3 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
 @@ -80,6 +80,8 @@ class CORE_EXPORT LocalFrameClientImpl final : public LocalFrameClient {
@@ -123,7 +123,7 @@ index 7f2bff4cc2c35c0ed34a0c436df4f1a2aacbfe0a..cbc59f17897d3c6c98886a7ef7d6db81
                                  int32_t world_id) override;
  
 diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
-index b8ddd6b9f5d250865c7a32999279b808c4ceec91..e3d80c533d3c0703af7a1a9d60270641288b8a3e 100644
+index 1122107b258e34e389eb5db2204c3c9d5782a688..3293587e03aab9104fd2baffd215782cc8266a6d 100644
 --- a/third_party/blink/renderer/core/loader/empty_clients.h
 +++ b/third_party/blink/renderer/core/loader/empty_clients.h
 @@ -426,6 +426,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {

patches/chromium/add_electron_deps_to_license_credits_file.patch

@@ -7,7 +7,7 @@ Ensure that licenses for the dependencies introduced by Electron
 are included in `LICENSES.chromium.html`
 
 diff --git a/tools/licenses/licenses.py b/tools/licenses/licenses.py
-index 7f22f02d2bc80abdb3be5191d55a1a6d00d1d0a7..8989fde2a7416100f238b0350fb7daf6e3944a70 100755
+index f87d1ffc90ba5bd6da87a90c6dd904c01ae42e23..9987b33124cfec689502f991b92c0b05d0433106 100755
 --- a/tools/licenses/licenses.py
 +++ b/tools/licenses/licenses.py
 @@ -355,6 +355,31 @@ SPECIAL_CASES = {

patches/chromium/add_ui_scopedcliboardwriter_writeunsaferawdata.patch

@@ -8,7 +8,7 @@ was removed as part of the Raw Clipboard API scrubbing.
 https://bugs.chromium.org/p/chromium/issues/detail?id=1217643
 
 diff --git a/ui/base/clipboard/scoped_clipboard_writer.cc b/ui/base/clipboard/scoped_clipboard_writer.cc
-index e104f4d7814b6f6a0e1f5cf49ae24d5571e30fb1..cc7e9064b21f8f2c45690454805901c0c56e2aa1 100644
+index bafc8421e14071a926a48bee1958a44d266a9a0b..4463080e08f7a0635ef240794deae1ea8d90e148 100644
 --- a/ui/base/clipboard/scoped_clipboard_writer.cc
 +++ b/ui/base/clipboard/scoped_clipboard_writer.cc
 @@ -244,6 +244,16 @@ void ScopedClipboardWriter::WriteData(std::u16string_view format,

patches/chromium/adjust_accessibility_ui_for_electron.patch

@@ -10,7 +10,7 @@ usage of BrowserList and Browser as we subclass related methods and use our
 WindowList.
 
 diff --git a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
-index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3b33c3777 100644
+index 9b22efa07e43b60a8bd8bb6288792846709fae87..cf60a541720ffbcdaa5163d727a7761dcb30f131 100644
 --- a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
 +++ b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
 @@ -48,6 +48,7 @@
@@ -21,19 +21,19 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
  #include "ui/accessibility/accessibility_features.h"
  #include "ui/accessibility/ax_mode.h"
  #include "ui/accessibility/ax_updates_and_events.h"
-@@ -179,7 +180,7 @@ base::Value::Dict BuildTargetDescriptor(content::RenderViewHost* rvh) {
+@@ -179,7 +180,7 @@ base::DictValue BuildTargetDescriptor(content::RenderViewHost* rvh) {
                                 rvh->GetRoutingID(), accessibility_mode);
  }
  
 -#if !BUILDFLAG(IS_ANDROID)
 +#if 0
- base::Value::Dict BuildTargetDescriptor(BrowserWindowInterface* browser) {
-   base::Value::Dict target_data;
+ base::DictValue BuildTargetDescriptor(BrowserWindowInterface* browser) {
+   base::DictValue target_data;
    target_data.Set(kSessionIdField, browser->GetSessionID().id());
 @@ -226,7 +227,7 @@ void HandleAccessibilityRequestCallback(
    auto& browser_accessibility_state =
        *content::BrowserAccessibilityState::GetInstance();
-   base::Value::Dict data;
+   base::DictValue data;
 -  PrefService* pref = Profile::FromBrowserContext(current_context)->GetPrefs();
 +  PrefService* pref = static_cast<electron::ElectronBrowserContext*>(current_context)->prefs();
    ui::AXMode mode = browser_accessibility_state.GetAccessibilityMode();
@@ -51,7 +51,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
 @@ -355,13 +356,13 @@ void HandleAccessibilityRequestCallback(
    data.Set(kPagesField, std::move(page_list));
  
-   base::Value::List browser_list;
+   base::ListValue browser_list;
 -#if !BUILDFLAG(IS_ANDROID)
 +#if 0
    ForEachCurrentBrowserWindowInterfaceOrderedByActivation(
@@ -64,7 +64,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    data.Set(kBrowsersField, std::move(browser_list));
  
  #if BUILDFLAG(IS_WIN)
-@@ -848,7 +849,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
+@@ -847,7 +848,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
    const std::string value = CheckJSValue(data.FindString(kValueField));
  
    if (string_name == kApiTypeField) {
@@ -74,7 +74,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
      pref->SetString(prefs::kShownAccessibilityApiType, value);
    }
  }
-@@ -902,7 +904,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
+@@ -901,7 +903,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
                       AXPropertyFilter::ALLOW_EMPTY);
    AddPropertyFilters(property_filters, deny, AXPropertyFilter::DENY);
  
@@ -84,7 +84,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    ui::AXApiType::Type api_type =
        ui::AXApiType::From(pref->GetString(prefs::kShownAccessibilityApiType));
    std::string accessibility_contents =
-@@ -922,7 +925,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+@@ -921,7 +924,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
  
    AllowJavascript();
  
@@ -93,16 +93,16 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    std::vector<AXPropertyFilter> property_filters;
    AddPropertyFilters(property_filters, allow, AXPropertyFilter::ALLOW);
    AddPropertyFilters(property_filters, allow_empty,
-@@ -949,7 +952,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+@@ -948,7 +951,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
    if (found) {
      return;
    }
 -#endif  // !BUILDFLAG(IS_ANDROID)
 +#endif
    // No browser with the specified |session_id| was found.
-   base::Value::Dict result;
+   base::DictValue result;
    result.Set(kSessionIdField, session_id);
-@@ -992,11 +995,13 @@ void AccessibilityUIMessageHandler::StopRecording(
+@@ -991,11 +994,13 @@ void AccessibilityUIMessageHandler::StopRecording(
  }
  
  ui::AXApiType::Type AccessibilityUIMessageHandler::GetRecordingApiType() {
@@ -119,7 +119,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    // Check to see if it is in the supported types list.
    if (std::find(supported_types.begin(), supported_types.end(), api_type) ==
        supported_types.end()) {
-@@ -1066,10 +1071,13 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
+@@ -1065,10 +1070,13 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
  // static
  void AccessibilityUIMessageHandler::RegisterProfilePrefs(
      user_prefs::PrefRegistrySyncable* registry) {
@@ -127,14 +127,14 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    const std::string_view default_api_type =
        std::string_view(ui::AXApiType::Type(ui::AXApiType::kBlink));
    registry->RegisterStringPref(prefs::kShownAccessibilityApiType,
-                                std::string(default_api_type));
+                                default_api_type);
 +  registry->RegisterBooleanPref(prefs::kShowInternalAccessibilityTree, false);
 +#endif
  }
  
  void AccessibilityUIMessageHandler::OnVisibilityChanged(
 diff --git a/chrome/browser/ui/webui/accessibility/accessibility_ui.h b/chrome/browser/ui/webui/accessibility/accessibility_ui.h
-index 4b9d7df73c901c57c14693e9f24a51694ecd375f..93e1c9a79d88c8b4c57b244c9eec1e83c1d1fa0a 100644
+index 67f7e34271994ff66da2a3c3b90c2f02797c2d14..8f786bc00dc4a7cc775ca3ff3fca4da680272682 100644
 --- a/chrome/browser/ui/webui/accessibility/accessibility_ui.h
 +++ b/chrome/browser/ui/webui/accessibility/accessibility_ui.h
 @@ -28,6 +28,8 @@ namespace content {
@@ -152,6 +152,6 @@ index 4b9d7df73c901c57c14693e9f24a51694ecd375f..93e1c9a79d88c8b4c57b244c9eec1e83
   private:
 +  friend class ElectronAccessibilityUIMessageHandler;
 +
-   void ToggleAccessibilityForWebContents(const base::Value::List& args);
-   void SetGlobalFlag(const base::Value::List& args);
-   void SetGlobalString(const base::Value::List& args);
+   void ToggleAccessibilityForWebContents(const base::ListValue& args);
+   void SetGlobalFlag(const base::ListValue& args);
+   void SetGlobalString(const base::ListValue& args);

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -6,7 +6,7 @@ Subject: allow disabling blink scheduler throttling per RenderView
 This allows us to disable throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/navigation_controller_impl_unittest.cc b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
-index 1390ff8785644a5e2c9d057124bf364972db53cc..8fcb52f033e175703f6695197ae61cd97bc15002 100644
+index e74b8674d5cec49a510948b97f6e8b790c57e864..8f4f3787fc590fe6e4378546a656a8d51ae965a0 100644
 --- a/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 +++ b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 @@ -168,6 +168,12 @@ class MockPageBroadcast : public blink::mojom::PageBroadcast {
@@ -23,10 +23,10 @@ index 1390ff8785644a5e2c9d057124bf364972db53cc..8fcb52f033e175703f6695197ae61cd9
      return receiver_.BindNewEndpointAndPassDedicatedRemote();
    }
 diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
-index 44fc40e608097797e4c2f5675bf10e5cdeb54d27..aa1d092cfc389fe81052160dc435981069a8a600 100644
+index b8193571d0a3b7609e89b284f57a9cbf36d593e0..0d42b04031006b844d5a2a2b73241d2b7e2fb93d 100644
 --- a/content/browser/renderer_host/render_view_host_impl.cc
 +++ b/content/browser/renderer_host/render_view_host_impl.cc
-@@ -756,6 +756,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
+@@ -759,6 +759,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
    GetWidget()->GetAssociatedFrameWidget()->SetBackgroundOpaque(opaque);
  }
  
@@ -39,10 +39,10 @@ index 44fc40e608097797e4c2f5675bf10e5cdeb54d27..aa1d092cfc389fe81052160dc4359810
    return is_active();
  }
 diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
-index 834dd10992a7ab6235cdf8e6ec1a019376a4056e..3b9ac2bc6954ab3a1a1f456ff64723da7db80fb0 100644
+index 2dddaff6c16c55288b6ea72cb8df0f8737971d71..dce9dae250ff2ac070752830df41cc45ed72823e 100644
 --- a/content/browser/renderer_host/render_view_host_impl.h
 +++ b/content/browser/renderer_host/render_view_host_impl.h
-@@ -135,6 +135,7 @@ class CONTENT_EXPORT RenderViewHostImpl
+@@ -134,6 +134,7 @@ class CONTENT_EXPORT RenderViewHostImpl
    void EnablePreferredSizeMode() override;
    void WriteIntoTrace(perfetto::TracedProto<TraceProto> context) const override;
  
@@ -51,10 +51,10 @@ index 834dd10992a7ab6235cdf8e6ec1a019376a4056e..3b9ac2bc6954ab3a1a1f456ff64723da
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index b4f1a82dc4294313c4439cb132ae05ea8cd19a99..6a6ede73a913615fdefd5d21c2c7dd46f296010a 100644
+index 722eff1cf2e51fe628b873c67694764c99dae496..b16c96b5682846d897c2f0f4dd3881d386928b68 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -633,8 +633,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
+@@ -646,8 +646,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
    // OnShowWithPageVisibility will not call NotifyHostAndDelegateOnWasShown,
    // which updates `visibility_`, unless the host is hidden. Make sure no update
    // is needed.
@@ -116,10 +116,10 @@ index 932658273154ef2e022358e493a8e7c00c86e732..57bbfb5cde62c9496c351c861880a189
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 05de505006f17c1638710c1b109134eabd488b10..6bb88a68c14297f3c506220c9714a826248ea925 100644
+index 0b91bcd4961918e4c601c99fcddf5f0afa57bba3..89a578d1246a54b01597937d0441452ab1169ebf 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -2507,6 +2507,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
+@@ -2509,6 +2509,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
    TRACE_EVENT2("navigation", "WebViewImpl::SetPageLifecycleStateInternal",
                 "old_state", old_state, "new_state", new_state);
  
@@ -130,7 +130,7 @@ index 05de505006f17c1638710c1b109134eabd488b10..6bb88a68c14297f3c506220c9714a826
    bool storing_in_bfcache = new_state->is_in_back_forward_cache &&
                              !old_state->is_in_back_forward_cache;
    bool restoring_from_bfcache = !new_state->is_in_back_forward_cache &&
-@@ -4020,10 +4024,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -4149,10 +4153,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  
@@ -155,7 +155,7 @@ index 05de505006f17c1638710c1b109134eabd488b10..6bb88a68c14297f3c506220c9714a826
    // Do not throttle if the page should be painting.
    bool is_visible =
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index aecdcea36ed0a502a9da68e871e0ee86040b4350..b2788642a20511f3725d045bc97bc108fba88752 100644
+index db7b6217c87a02023635ab2ed078ddc5f7688c7d..a5b16d5b16568aead6ff6cd244148db14f27b5e1 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
 @@ -445,6 +445,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
@@ -166,7 +166,7 @@ index aecdcea36ed0a502a9da68e871e0ee86040b4350..b2788642a20511f3725d045bc97bc108
    void SetVisibilityState(mojom::blink::PageVisibilityState visibility_state,
                            bool is_initial_state) override;
    mojom::blink::PageVisibilityState GetVisibilityState() override;
-@@ -938,6 +939,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -952,6 +953,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    // If true, we send IPC messages when |preferred_size_| changes.
    bool send_preferred_size_changes_ = false;
  

patches/chromium/allow_electron_to_depend_on_components_os_crypt_sync.patch

@@ -10,7 +10,7 @@ so we can remove this patch once we migrate our code to use
 os_crypt async.
 
 diff --git a/components/os_crypt/sync/BUILD.gn b/components/os_crypt/sync/BUILD.gn
-index 23aa391aaf380f87310fb295277809f8b105d6e8..bb308187837371ecfa2482affaf35ac7ed98c1f3 100644
+index 2535b697f48fb5a28ee65d3cc651db5e5bc17b24..64345078af6ebb76f5ca695ff7b87f8df1956e5f 100644
 --- a/components/os_crypt/sync/BUILD.gn
 +++ b/components/os_crypt/sync/BUILD.gn
 @@ -10,6 +10,7 @@ import("//components/os_crypt/sync/features.gni")

patches/chromium/allow_in-process_windows_to_have_different_web_prefs.patch

@@ -8,10 +8,10 @@ WebPreferences of in-process child windows, rather than relying on
 process-level command line switches, as before.
 
 diff --git a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
-index ebd35a078ad640f1102f270cead9c48ca7fc829c..7e5d2ca71b66a520099c26be2d4f4cee39876191 100644
+index ca771db96607de17323123ed74d7e7852da754c1..67969140ffaa75c819b1809c384ef1c28b8d6a2e 100644
 --- a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
 +++ b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
-@@ -151,6 +151,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -149,6 +149,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
    out->v8_cache_options = data.v8_cache_options();
    out->record_whole_document = data.record_whole_document();
    out->stylus_handwriting_enabled = data.stylus_handwriting_enabled();
@@ -32,7 +32,7 @@ index ebd35a078ad640f1102f270cead9c48ca7fc829c..7e5d2ca71b66a520099c26be2d4f4cee
    out->accelerated_video_decode_enabled =
        data.accelerated_video_decode_enabled();
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences.h b/third_party/blink/public/common/web_preferences/web_preferences.h
-index 9cff5c9f6bd7d24eb7b2884b3d4fd3224a48de7b..10a01ec3da9ba8c88db51e4e6a2c904fe3f7e839 100644
+index 1c9f1a57ee1f9e295a7f4bb1b445ebf8d8a9e9f1..6d04d8ff71d36e1df99c9d69cc4e1bd439890667 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences.h
 @@ -9,6 +9,7 @@
@@ -43,7 +43,7 @@ index 9cff5c9f6bd7d24eb7b2884b3d4fd3224a48de7b..10a01ec3da9ba8c88db51e4e6a2c904f
  #include "build/build_config.h"
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
-@@ -464,6 +465,19 @@ struct BLINK_COMMON_EXPORT WebPreferences {
+@@ -462,6 +463,19 @@ struct BLINK_COMMON_EXPORT WebPreferences {
    bool should_screenshot_on_mainframe_same_doc_navigation = true;
  #endif  // BUILDFLAG(IS_ANDROID)
  
@@ -64,7 +64,7 @@ index 9cff5c9f6bd7d24eb7b2884b3d4fd3224a48de7b..10a01ec3da9ba8c88db51e4e6a2c904f
    // chrome, except for the cases where it would require lots of extra work for
    // the embedder to use the same default value.
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
-index d900db0706d383ec8f2069243e7d1c5c361e4088..3d035dbe5bdab7d02c7514c7d9cafa25d11eae38 100644
+index db2ff72cf836d6e10ff30d00df2fe14896b214fe..50ac38be6ab78eb15fb5621c9e9065d88b6649e7 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 @@ -8,6 +8,7 @@
@@ -75,7 +75,7 @@ index d900db0706d383ec8f2069243e7d1c5c361e4088..3d035dbe5bdab7d02c7514c7d9cafa25
  #include "mojo/public/cpp/bindings/struct_traits.h"
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
-@@ -445,6 +446,52 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -440,6 +441,52 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
      return r.stylus_handwriting_enabled;
    }
  
@@ -129,7 +129,7 @@ index d900db0706d383ec8f2069243e7d1c5c361e4088..3d035dbe5bdab7d02c7514c7d9cafa25
      return r.cookie_enabled;
    }
 diff --git a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
-index 7f44cff8d6493d2ce0d70631440eeb85ae1118f7..2eb4e977cb0fa6d57f2f2edac02b80dc06176808 100644
+index 230fbc9018462e5f1f3f7a600ac3a0eef64ba459..34be07248d1738bf1b820ba179a9c8e427efca4c 100644
 --- a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
 +++ b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
 @@ -4,6 +4,7 @@
@@ -140,7 +140,7 @@ index 7f44cff8d6493d2ce0d70631440eeb85ae1118f7..2eb4e977cb0fa6d57f2f2edac02b80dc
  import "mojo/public/mojom/base/string16.mojom";
  import "skia/public/mojom/skcolor.mojom";
  import "third_party/blink/public/mojom/css/preferred_color_scheme.mojom";
-@@ -225,6 +226,19 @@ struct WebPreferences {
+@@ -221,6 +222,19 @@ struct WebPreferences {
    // If true, stylus handwriting recognition to text input will be available in
    // editable input fields which are non-password type.
    bool stylus_handwriting_enabled;

patches/chromium/allow_new_privileges_in_unsandboxed_child_processes.patch

@@ -6,10 +6,10 @@ Subject: allow new privileges in unsandboxed child processes
 This allows unsandboxed child process to launch setuid processes on Linux.
 
 diff --git a/content/browser/child_process_launcher_helper_linux.cc b/content/browser/child_process_launcher_helper_linux.cc
-index 75cafbe0dbd7d4b3dca4c8fe56e17cd836123588..8f551374e1ffc729081f7d50e73671313c641bb6 100644
+index b6f5667c86c3e74807728aa2dbb61fee87e6156a..492a0822181aebbede38f7783a457b820ce4f8d1 100644
 --- a/content/browser/child_process_launcher_helper_linux.cc
 +++ b/content/browser/child_process_launcher_helper_linux.cc
-@@ -64,6 +64,15 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
+@@ -65,6 +65,15 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
        options->fds_to_remap.emplace_back(sandbox_fd, GetSandboxFD());
      }
  

patches/chromium/allow_setting_secondary_label_via_simplemenumodel.patch

@@ -6,10 +6,10 @@ Subject: Allow setting secondary label via SimpleMenuModel
 Builds on https://chromium-review.googlesource.com/c/chromium/src/+/2208976
 
 diff --git a/ui/menus/simple_menu_model.cc b/ui/menus/simple_menu_model.cc
-index 1e43ac04035446ea68a6aa3b1b252f8bc9e22099..cdf45574fde7459019ecd57ad14b8fec5e04c8af 100644
+index 156e5068000ceb89a096f51d358ae69a3f0cf5d8..4609ad44d0f75789070e28fa8e485a98cc60c11a 100644
 --- a/ui/menus/simple_menu_model.cc
 +++ b/ui/menus/simple_menu_model.cc
-@@ -55,6 +55,11 @@ std::u16string SimpleMenuModel::Delegate::GetLabelForCommandId(
+@@ -57,6 +57,11 @@ std::u16string SimpleMenuModel::Delegate::GetLabelForCommandId(
    return std::u16string();
  }
  
@@ -21,7 +21,7 @@ index 1e43ac04035446ea68a6aa3b1b252f8bc9e22099..cdf45574fde7459019ecd57ad14b8fec
  ImageModel SimpleMenuModel::Delegate::GetIconForCommandId(
      int command_id) const {
    return ImageModel();
-@@ -348,6 +353,11 @@ void SimpleMenuModel::SetAcceleratorAt(size_t index,
+@@ -350,6 +355,11 @@ void SimpleMenuModel::SetAcceleratorAt(size_t index,
    MenuItemsChanged();
  }
  
@@ -33,7 +33,7 @@ index 1e43ac04035446ea68a6aa3b1b252f8bc9e22099..cdf45574fde7459019ecd57ad14b8fec
  void SimpleMenuModel::SetMinorText(size_t index,
                                     const std::u16string& minor_text) {
    items_[ValidateItemIndex(index)].minor_text = minor_text;
-@@ -454,6 +464,12 @@ std::u16string SimpleMenuModel::GetLabelAt(size_t index) const {
+@@ -458,6 +468,12 @@ std::u16string SimpleMenuModel::GetLabelAt(size_t index) const {
    return items_[ValidateItemIndex(index)].label;
  }
  
@@ -47,7 +47,7 @@ index 1e43ac04035446ea68a6aa3b1b252f8bc9e22099..cdf45574fde7459019ecd57ad14b8fec
    return items_[ValidateItemIndex(index)].minor_text;
  }
 diff --git a/ui/menus/simple_menu_model.h b/ui/menus/simple_menu_model.h
-index 596663d62632e4331f8aad421298d1fcdc9ab05e..469778f0c13e6d3fd30023af9b19c4a4cb7969be 100644
+index 8ddab95a135c34c8153dfe208104f0233e511093..59dc68ce7d69c10fe6f3b286c790da155e2d16f2 100644
 --- a/ui/menus/simple_menu_model.h
 +++ b/ui/menus/simple_menu_model.h
 @@ -99,6 +99,7 @@ class COMPONENT_EXPORT(UI_MENUS) SimpleMenuModel : public MenuModel {
@@ -68,7 +68,7 @@ index 596663d62632e4331f8aad421298d1fcdc9ab05e..469778f0c13e6d3fd30023af9b19c4a4
    // Sets the minor text for the item at |index|.
    void SetMinorText(size_t index, const std::u16string& minor_text);
  
-@@ -274,6 +278,7 @@ class COMPONENT_EXPORT(UI_MENUS) SimpleMenuModel : public MenuModel {
+@@ -276,6 +280,7 @@ class COMPONENT_EXPORT(UI_MENUS) SimpleMenuModel : public MenuModel {
    ui::MenuSeparatorType GetSeparatorTypeAt(size_t index) const override;
    int GetCommandIdAt(size_t index) const override;
    std::u16string GetLabelAt(size_t index) const override;
@@ -76,7 +76,7 @@ index 596663d62632e4331f8aad421298d1fcdc9ab05e..469778f0c13e6d3fd30023af9b19c4a4
    std::u16string GetMinorTextAt(size_t index) const override;
    ImageModel GetMinorIconAt(size_t index) const override;
    bool IsItemDynamicAt(size_t index) const override;
-@@ -321,6 +326,7 @@ class COMPONENT_EXPORT(UI_MENUS) SimpleMenuModel : public MenuModel {
+@@ -324,6 +329,7 @@ class COMPONENT_EXPORT(UI_MENUS) SimpleMenuModel : public MenuModel {
      ItemType type = TYPE_COMMAND;
      std::u16string label;
      ui::Accelerator accelerator;

patches/chromium/blink_local_frame.patch

@@ -15,10 +15,10 @@ Refs changes in:
 This patch reverts the changes to fix associated crashes in Electron.
 
 diff --git a/third_party/blink/renderer/core/frame/frame.cc b/third_party/blink/renderer/core/frame/frame.cc
-index 2670ea1361ccd8a9e3bac507e94dd25b7205ecf9..c12f78d925e4ccb4ac2fd3851a9c61e87058dc75 100644
+index ac5d88520a785e12b66ebd96c92c46319a08311c..5c582e4f249c28a5739da2da4e600ee2ed7e19ea 100644
 --- a/third_party/blink/renderer/core/frame/frame.cc
 +++ b/third_party/blink/renderer/core/frame/frame.cc
-@@ -134,14 +134,6 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -135,14 +135,6 @@ bool Frame::Detach(FrameDetachType type) {
  
    DCHECK(!IsDetached());
  
@@ -33,7 +33,7 @@ index 2670ea1361ccd8a9e3bac507e94dd25b7205ecf9..c12f78d925e4ccb4ac2fd3851a9c61e8
    if (type == FrameDetachType::kRemove) {
      if (provisional_frame_) {
        provisional_frame_->Detach(FrameDetachType::kRemove);
-@@ -166,6 +158,14 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -167,6 +159,14 @@ bool Frame::Detach(FrameDetachType type) {
      GetWindowProxyManager()->ClearForSwap();
    }
  
@@ -49,10 +49,10 @@ index 2670ea1361ccd8a9e3bac507e94dd25b7205ecf9..c12f78d925e4ccb4ac2fd3851a9c61e8
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 06c9674d90964e00b291f6f88210f885c28018c2..808943d761385ec225ba7f99f35090705b529289 100644
+index 0be460ef929e13fc07e8114764dc5600edcce016..b9370cc9d15601cfccde02b28cdd92bfaf3208f9 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -753,10 +753,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -778,10 +778,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    }
    DCHECK(!view_ || !view_->IsAttached());
  
@@ -63,7 +63,7 @@ index 06c9674d90964e00b291f6f88210f885c28018c2..808943d761385ec225ba7f99f3509070
    if (!Client())
      return false;
  
-@@ -810,6 +806,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -838,6 +834,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    DCHECK(!view_->IsAttached());
    Client()->WillBeDetached();
  

patches/chromium/build_add_electron_tracing_category.patch

@@ -8,10 +8,10 @@ categories in use are known / declared.  This patch is required for us
 to introduce a new Electron category for Electron-specific tracing.
 
 diff --git a/base/trace_event/builtin_categories.h b/base/trace_event/builtin_categories.h
-index 404faaae45884e2347fb3a7a2d77c7b95c7f6b43..e63bfce2d65a2015993de91630928029288738f4 100644
+index 56408734b26428933a1fb8c04cee317c659feea7..0fa09a8d86241456293119edecf209f8d0790c0e 100644
 --- a/base/trace_event/builtin_categories.h
 +++ b/base/trace_event/builtin_categories.h
-@@ -131,6 +131,7 @@ PERFETTO_DEFINE_CATEGORIES_IN_NAMESPACE_WITH_ATTRS(
+@@ -133,6 +133,7 @@ PERFETTO_DEFINE_CATEGORIES_IN_NAMESPACE_WITH_ATTRS(
      perfetto::Category("drm"),
      perfetto::Category("drmcursor"),
      perfetto::Category("dwrite"),

patches/chromium/build_add_public_config_simdutf_config.patch

@@ -11,7 +11,7 @@ To accomplish this, we need to make simdutf's config public here
 for use by third_party/electron_node.
 
 diff --git a/third_party/simdutf/BUILD.gn b/third_party/simdutf/BUILD.gn
-index 68f1ed4e012cff5e0abd64a153a329518860689d..eeb846525e58f038733318915a770bafa22cafc5 100644
+index 05215d2610d5c4bed1381b6d3af39441bc1eb8c5..bbb3495511da95d56728eb092979bb1e5dd650c2 100644
 --- a/third_party/simdutf/BUILD.gn
 +++ b/third_party/simdutf/BUILD.gn
 @@ -8,9 +8,14 @@ source_set("header") {

patches/chromium/build_allow_electron_mojom_interfaces_to_depend_on_blink.patch

@@ -10,10 +10,10 @@ Needed for:
 2) //electron/shell/common:web_contents_utility
 
 diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
-index 49f3360c3d5ff66ebbc7d6164de3f7ff7244b1fe..ec9018d38520dfca461e9dbb041566b0b3400133 100644
+index afa85a15f8064b6a1b3f3ddd34797f0008af94d1..51946114bfd1564e4e5352ecae934a5d89b4ce03 100644
 --- a/content/public/common/BUILD.gn
 +++ b/content/public/common/BUILD.gn
-@@ -362,6 +362,8 @@ mojom("interfaces") {
+@@ -358,6 +358,8 @@ mojom("interfaces") {
      "//content/common/*",
      "//extensions/common:mojom",
      "//extensions/common:mojom_blink",

patches/chromium/build_disable_thin_lto_mac.patch

@@ -11,10 +11,10 @@ This patch can (and should) be removed when we can prevent those symbols
 from being stripped in the release build.
 
 diff --git a/build/config/compiler/compiler.gni b/build/config/compiler/compiler.gni
-index b70dadec11c97f8d2b93260777be5aefbf6c7bea..054e53d0e52420494d887670510616ad51116421 100644
+index 2b6c46c29b2589d5de861e5b24f8a1c02011b9e4..0611e4033fa321a0f20e2b16d4a5e2ded6683ad8 100644
 --- a/build/config/compiler/compiler.gni
 +++ b/build/config/compiler/compiler.gni
-@@ -93,7 +93,7 @@ declare_args() {
+@@ -90,7 +90,7 @@ declare_args() {
    # Chrome's clang. crbug.com/1033839
    use_thin_lto =
        is_cfi || (is_clang && is_official_build && chrome_pgo_phase != 1 &&

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -11,7 +11,7 @@ if we ever align our .pak file generation with Chrome we can remove this
 patch.
 
 diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
-index 606b3bd43179a5b4179a6ec9f58e531d55c1acb5..4d503a53290b4deaea016bb6867f3c07920f4055 100644
+index 4a742db71f62f9ac891ceeb0604ca0b99d1d89c1..2c5af6482e2b6905552a05b16d3df0a400e96582 100644
 --- a/chrome/BUILD.gn
 +++ b/chrome/BUILD.gn
 @@ -196,11 +196,16 @@ if (!is_android && !is_mac) {
@@ -33,10 +33,10 @@ index 606b3bd43179a5b4179a6ec9f58e531d55c1acb5..4d503a53290b4deaea016bb6867f3c07
          "//base",
          "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 61ea8e60d7d26433a847c208aff58632e04d61df..00812dde31ba718e4731d4bed7cfae1ad54da4d9 100644
+index 2fc3a991d89093ff9139eb09d74123197155caff..0862aa96c2a7b496338ac0593f84fcfa21f25572 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4852,7 +4852,7 @@ static_library("browser") {
+@@ -4749,7 +4749,7 @@ static_library("browser") {
        ]
      }
  
@@ -46,10 +46,10 @@ index 61ea8e60d7d26433a847c208aff58632e04d61df..00812dde31ba718e4731d4bed7cfae1a
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 546735291c35d0ce160694aadf9a5e3ef319dd9a..cc4f1a3c154c9ee83bafdf2c386286b55c308ad6 100644
+index 7d5a246787bc3cc3bcb883aa78121d3d3f124780..b5de35620bc636d5e1d0d5770d898f564843bcef 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -7601,9 +7601,12 @@ test("unit_tests") {
+@@ -7728,9 +7728,12 @@ test("unit_tests") {
        "//chrome/notification_helper",
      ]
  
@@ -63,7 +63,7 @@ index 546735291c35d0ce160694aadf9a5e3ef319dd9a..cc4f1a3c154c9ee83bafdf2c386286b5
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -8560,6 +8563,10 @@ test("unit_tests") {
+@@ -8698,6 +8701,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -74,7 +74,7 @@ index 546735291c35d0ce160694aadf9a5e3ef319dd9a..cc4f1a3c154c9ee83bafdf2c386286b5
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -8616,7 +8623,6 @@ test("unit_tests") {
+@@ -8755,7 +8762,6 @@ test("unit_tests") {
      # TODO(crbug.com/417513088): Maybe merge with the non-android `deps` declaration above?
      deps += [
        "../browser/screen_ai:screen_ai_install_state",

patches/chromium/build_gn.patch

@@ -7,7 +7,7 @@ These are variables we add to the root BUILDCONFIG so that they're available
 everywhere, without having to import("//electron/.../flags.gni").
 
 diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
-index 38719796a381e2dcf22782693f458b6750d2670f..0879a86dbfad7ce3e1333ec2daf5ab98b7cc6470 100644
+index 4174baa9c0e39b517ade66aab07123eaf9b58e47..9601a32e3b763bb6b84727be509f51326fa08233 100644
 --- a/build/config/BUILDCONFIG.gn
 +++ b/build/config/BUILDCONFIG.gn
 @@ -123,6 +123,9 @@ if (current_os == "") {

patches/chromium/build_libc_as_static_library.patch

@@ -7,10 +7,10 @@ Build libc++ as static library to compile and pass
 nan tests
 
 diff --git a/buildtools/third_party/libc++/BUILD.gn b/buildtools/third_party/libc++/BUILD.gn
-index f1ac049db7df5637c94893009287b53c6127158f..ebf028bdb2934ca2f9f2ab7b7c3e6d3daa544d37 100644
+index 49bd8af6f4e5762c6059c2f8d2663683f350e386..f386b473b73ba83b383adbb90acb98709f5a3bf1 100644
 --- a/buildtools/third_party/libc++/BUILD.gn
 +++ b/buildtools/third_party/libc++/BUILD.gn
-@@ -481,6 +481,7 @@ target(libcxx_target_type, "libc++") {
+@@ -480,6 +480,7 @@ target(libcxx_target_type, "libc++") {
    # need to explicitly depend on libc++.
    visibility = [
      "//build/config:common_deps",

patches/chromium/build_make_libcxx_abi_unstable_false_for_electron.patch

@@ -3,15 +3,22 @@ From: Charles Kerr <charles@charleskerr.com>
 Date: Tue, 22 Mar 2022 16:24:44 -0500
 Subject: build: make libcxx_abi_unstable false for electron
 
-https://nornagon.medium.com/a-libc-odyssey-973e51649063
+The libc++ C++ standard library uses ABI versioning to control binary
+compatibility. ABI version 2 (Chromium's default) enables various
+optimizations that break compatibility with system libc++, while ABI
+version 1 maintains compatibility needed for native Node.js modules.
 
-See also https://github.com/electron/electron/issues/45810#issuecomment-2691417213.
+References:
+* https://nornagon.medium.com/a-libc-odyssey-973e51649063
+* https://github.com/electron/electron/issues/45810#issuecomment-2691417213.
+* https://libcxx.llvm.org/ABIGuarantees.html
+* third_party/libc++/src/include/__configuration/abi.h
 
 diff --git a/buildtools/third_party/libc++/__config_site b/buildtools/third_party/libc++/__config_site
-index 3cd0af88fd13613216464d31d04e26dbb8f61343..6335536338e1eba8b56055eee31910ecba6a65c4 100644
+index 3cd0af88fd13613216464d31d04e26dbb8f61343..218cfaf258ebc55e4d332c67abd02b5b1ad2ba19 100644
 --- a/buildtools/third_party/libc++/__config_site
 +++ b/buildtools/third_party/libc++/__config_site
-@@ -18,7 +18,9 @@
+@@ -18,7 +18,11 @@
  //    _LIBCPP_ABI_NAMESPACE to a shorter value.
  #define _LIBCPP_ABI_NAMESPACE __Cr
  
@@ -19,6 +26,8 @@ index 3cd0af88fd13613216464d31d04e26dbb8f61343..6335536338e1eba8b56055eee31910ec
 +#define _LIBCPP_ABI_VERSION 1
 +#define _LIBCPP_ABI_USE_WRAP_ITER_IN_STD_ARRAY
 +#define _LIBCPP_ABI_USE_WRAP_ITER_IN_STD_STRING_VIEW
++#define _LIBCPP_ABI_TRIVIALLY_COPYABLE_BIT_ITERATOR
++#define _LIBCPP_ABI_BITSET_VECTOR_BOOL_CONST_SUBSCRIPT_RETURN_BOOL
  
  #define _LIBCPP_ABI_FORCE_ITANIUM 0
  #define _LIBCPP_ABI_FORCE_MICROSOFT 0

patches/chromium/build_partial_revert_mac_fullscreen_top_chrome_mouse_events.patch

@@ -11,7 +11,7 @@ solution is put in place.
 This reverts commit 8c004781dde7d42d9a3fed8cafcaa4929943dd69.
 
 diff --git a/components/remote_cocoa/app_shim/bridged_content_view.mm b/components/remote_cocoa/app_shim/bridged_content_view.mm
-index 8f572c0822f95176bb35c25c7c8971bf4fe6139b..4b657e55f3782e951706b5edbe0dcf6974d236ab 100644
+index 8f4ba0a9644bff955b91e373a9b81778ee079e5a..eac83e955aeb82dc10312363ac54bc9d1677cc90 100644
 --- a/components/remote_cocoa/app_shim/bridged_content_view.mm
 +++ b/components/remote_cocoa/app_shim/bridged_content_view.mm
 @@ -305,14 +305,6 @@ - (NSView*)hitTest:(NSPoint)point {

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index ce64151028cc30c81292326ee73126cb8415aec5..3feca12a6185afef139a0cb4a8148b5a3ca9e32f 100644
+index 46368e70af175d8d0ab0fb5a36d258e48270371e..8d7be769a6c76650ae999338578215dcd324c199 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -9868,6 +9868,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -9990,6 +9990,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index ce64151028cc30c81292326ee73126cb8415aec5..3feca12a6185afef139a0cb4a8148b5a
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index dc9e636c1a64efc1fbcea34caf793f649e0c0182..ec8c9c382d1689d8ac698482df4909cb03cde6c2 100644
+index 345951d78dab34836dbb6d541f245cecaa2f1a67..628b6a5e66ed71ae5e470d841a88119349bc3667 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5326,6 +5326,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5360,6 +5360,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    create_params.initially_hidden = renderer_started_hidden;
    create_params.initial_popup_url = params.target_url;
  
@@ -35,7 +35,7 @@ index dc9e636c1a64efc1fbcea34caf793f649e0c0182..ec8c9c382d1689d8ac698482df4909cb
    // Even though all codepaths leading here are in response to a renderer
    // trying to open a new window, if the new window ends up in a different
    // browsing instance, then the RenderViewHost, RenderWidgetHost,
-@@ -5378,6 +5382,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5412,6 +5416,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    // Sets the newly created WebContents WindowOpenDisposition.
    new_contents_impl->original_window_open_disposition_ = params.disposition;
  
@@ -48,7 +48,7 @@ index dc9e636c1a64efc1fbcea34caf793f649e0c0182..ec8c9c382d1689d8ac698482df4909cb
    // If the new frame has a name, make sure any SiteInstances that can find
    // this named frame have proxies for it.  Must be called after
    // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
-@@ -5419,12 +5429,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5453,12 +5463,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -62,10 +62,10 @@ index dc9e636c1a64efc1fbcea34caf793f649e0c0182..ec8c9c382d1689d8ac698482df4909cb
                               new_contents_impl, opener, params.target_url,
                               params.referrer.To<Referrer>(), params.disposition,
 diff --git a/content/common/frame.mojom b/content/common/frame.mojom
-index 4c55f0abf8df5a3408f3f90d444ceff3c23ee1bc..72bdb5b5a4c2c21a7192b34bb293bd23bafaf50c 100644
+index ecfe129905639e9b7a5ed973017539cfaec9c2af..39308fa42e57b2dfba91aaa6f33d1a0bea3273ae 100644
 --- a/content/common/frame.mojom
 +++ b/content/common/frame.mojom
-@@ -648,6 +648,10 @@ struct CreateNewWindowParams {
+@@ -651,6 +651,10 @@ struct CreateNewWindowParams {
    pending_associated_remote<blink.mojom.Widget> widget;
    pending_associated_receiver<blink.mojom.FrameWidgetHost> frame_widget_host;
    pending_associated_remote<blink.mojom.FrameWidget> frame_widget;
@@ -77,10 +77,10 @@ index 4c55f0abf8df5a3408f3f90d444ceff3c23ee1bc..72bdb5b5a4c2c21a7192b34bb293bd23
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index a8ea6bddeba52ae56e988123479f641371e43267..70d457e79bd07d691e4a827f333120737de76f14 100644
+index d6b69893dd3cc9767b71ed226218ef78d2b63acf..f31f64a9ddf1cfbd0f945f93f1dfc1e7a22b4955 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -885,6 +885,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -868,6 +868,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -90,10 +90,10 @@ index a8ea6bddeba52ae56e988123479f641371e43267..70d457e79bd07d691e4a827f33312073
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 298cf367684135e2a86c3fc1fe580f009905ccfe..30ffe14569312d0a0ae570a444724db7a7805103 100644
+index fe026fe112aefcc7a3e6ea6f9647b486ea59e289..d644dceaee373b1f4f7d9b2386fdf1b2438d8050 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
-@@ -203,6 +203,7 @@ class NetworkService;
+@@ -205,6 +205,7 @@ class NetworkService;
  class TrustedURLLoaderHeaderClient;
  }  // namespace mojom
  struct ResourceRequest;
@@ -101,7 +101,7 @@ index 298cf367684135e2a86c3fc1fe580f009905ccfe..30ffe14569312d0a0ae570a444724db7
  }  // namespace network
  
  namespace sandbox {
-@@ -1462,6 +1463,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1450,6 +1451,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -111,10 +111,10 @@ index 298cf367684135e2a86c3fc1fe580f009905ccfe..30ffe14569312d0a0ae570a444724db7
        bool opener_suppressed,
        bool* no_javascript_access);
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index 7544c393932b0dea1f14b722d559cc78f294f20b..badec4ea2cc0ecf1920839cf6cf731a6c81d6940 100644
+index 509256e4c327806f9a24eab69c1d4e84581767ce..f8f3996cbd00c06bec2962a54488b2d8f1666530 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
-@@ -35,6 +35,17 @@ namespace content {
+@@ -34,6 +34,17 @@ namespace content {
  
  WebContentsDelegate::WebContentsDelegate() = default;
  
@@ -133,7 +133,7 @@ index 7544c393932b0dea1f14b722d559cc78f294f20b..badec4ea2cc0ecf1920839cf6cf731a6
      WebContents* source,
      const OpenURLParams& params,
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 0e2ce90fd9c4a4c4aba0caacf026aa7a42c82f3a..d1f16f9c48bb2c60094f4644a9c41526a73a45a0 100644
+index ea862108a0f83a4aa966046ba15a8ca6757261ee..8fd2a5d359dd883754316095f66a83e8e255926c 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
 @@ -18,6 +18,7 @@
@@ -170,15 +170,15 @@ index 0e2ce90fd9c4a4c4aba0caacf026aa7a42c82f3a..d1f16f9c48bb2c60094f4644a9c41526
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index e22a59db4480be49b0bc3bdc1339cf7577eb6b59..1e2534f47a85564244603d228351c84d7bf2ad06 100644
+index cd9a5bb5b14a00b555f86bee503fc3f8d51db80b..fd285a51c2982494e345f38eeaba940025ec9276 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -6788,6 +6788,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
-           request.HasUserGesture(), GetWebFrame()->IsAdFrame(),
-           GetWebFrame()->IsAdScriptInStack());
+@@ -6845,6 +6845,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
+   params->started_by_ad =
+       GetWebFrame()->IsAdFrame() || GetWebFrame()->IsAdScriptInStack();
  
 +  params->raw_features = features.raw_features.Utf8(
-+      blink::Utf8ConversionMode::kStrictReplacingErrors);
++      WebString::UTF8ConversionMode::kStrictReplacingErrorsWithFFFD);
 +  params->body = GetRequestBodyForWebURLRequest(request);
 +
    // We preserve this information before sending the message since |params| is
@@ -211,31 +211,23 @@ index 790f004d2a3a9ae5a3588fda097732a5daac0c75..83fcc9418b89b669863e730f2049a1d8
                         bool opener_suppressed,
                         bool* no_javascript_access) override;
 diff --git a/third_party/blink/public/web/web_window_features.h b/third_party/blink/public/web/web_window_features.h
-index d92bab531c12c62a5321a23f4a0cb89691668127..c354a79c7c8dd047264df35b873e90c15fa364a2 100644
+index d92bab531c12c62a5321a23f4a0cb89691668127..2060e04795ba8e7a923fd0fe3485b8c553ca4421 100644
 --- a/third_party/blink/public/web/web_window_features.h
 +++ b/third_party/blink/public/web/web_window_features.h
-@@ -35,6 +35,7 @@
- #include <vector>
- 
- #include "third_party/blink/public/platform/web_string.h"
-+#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
- 
- namespace blink {
- 
-@@ -70,6 +71,8 @@ struct WebWindowFeatures {
+@@ -70,6 +70,8 @@ struct WebWindowFeatures {
    // TODO(apaseltiner): Investigate moving this field to a non-public struct
    // since it is only needed within //third_party/blink.
    std::optional<std::vector<WebString>> attribution_srcs;
 +
-+  String raw_features;
++  WebString raw_features;
  };
  
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
-index 95137bfcdc4ce0432fa9460e945fd022cacd4d73..c2c5909c11eb46e374c190f8d4fc43285f9ed150 100644
+index c425735d53a8a79c9ce20c049506659c17b51be3..0c652f899781138cc177460a949280606ebd059f 100644
 --- a/third_party/blink/renderer/core/frame/local_dom_window.cc
 +++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
-@@ -2348,6 +2348,8 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
+@@ -2335,6 +2335,8 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
    WebWindowFeatures window_features =
        GetWindowFeaturesFromString(features, entered_window);
  

patches/chromium/cherry-pick-05e4b544803c.patch

@@ -1,204 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Anders Hartvoll Ruud <andruud@chromium.org>
-Date: Wed, 25 Feb 2026 03:24:31 -0800
-Subject: Stringify CSSUnparsedValues via toString, as normal
-
-CSSUnparsedValue exposes a special stringification function
-ToUnparsedString() in addition to the regular toString().
-The documentation says it returns "tokens without substituting
-variables", but it's not clear what this means; we don't substitute
-any variables in CSSStyleValue::toString() either.
-
-This CL makes ToUnparsedString() private (and renames it).
-Clients needing to serialize a CSSUnparsedValue can do so via
-the normal toString() function. (If ToUnparsedString() existed
-for performance reasons, that should have been documented.)
-
-Also, the /**/-"fixup" pass over the value has been folded into
-ToStringInternal(). This is to make it easy to find the canonical string
-representation of this value within CSSUnparsedValue (without going
-through a CSSValue).
-
-The main point of this CL is to prepare for validating
-the "argument grammar" of the value during the StyleValue-to-CSSValue
-conversion in StylePropertyMap (which requires item (2) above).
-
-We now jump through additional hoops to ultimately get a string
-from the outside of CSSUnparsedValue, but there should otherwise
-be no behavior change.
-
-Bug: 484751092
-Change-Id: I5db45ad85f780c67a2ea3ba8482c390ebab10068
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7600415
-Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
-Reviewed-by: Steinar H Gunderson <sesse@chromium.org>
-Cr-Commit-Position: refs/heads/main@{#1590041}
-
-diff --git a/third_party/blink/renderer/core/css/cssom/cross_thread_style_value_test.cc b/third_party/blink/renderer/core/css/cssom/cross_thread_style_value_test.cc
-index dcc2eccbc84e6cd5710ab51cee2dab49661467c1..86d42c87a6bd10838a3e059c9227868e5bfc0798 100644
---- a/third_party/blink/renderer/core/css/cssom/cross_thread_style_value_test.cc
-+++ b/third_party/blink/renderer/core/css/cssom/cross_thread_style_value_test.cc
-@@ -19,12 +19,12 @@
- #include "third_party/blink/renderer/core/css/cssom/css_keyword_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_style_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_unit_value.h"
--#include "third_party/blink/renderer/core/css/cssom/css_unparsed_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_unsupported_color.h"
- #include "third_party/blink/renderer/platform/scheduler/public/non_main_thread.h"
- #include "third_party/blink/renderer/platform/scheduler/public/post_cross_thread_task.h"
- #include "third_party/blink/renderer/platform/wtf/cross_thread_copier_std.h"
- #include "third_party/blink/renderer/platform/wtf/cross_thread_functional.h"
-+#include "third_party/blink/renderer/platform/wtf/wtf.h"
- 
- namespace blink {
- 
-@@ -152,8 +152,7 @@ TEST_F(CrossThreadStyleValueTest, CrossThreadUnparsedValueToCSSStyleValue) {
-   CSSStyleValue* style_value = value->ToCSSStyleValue();
-   EXPECT_EQ(style_value->GetType(),
-             CSSStyleValue::StyleValueType::kUnparsedType);
--  EXPECT_EQ(static_cast<CSSUnparsedValue*>(style_value)->ToUnparsedString(),
--            "Unparsed");
-+  EXPECT_EQ(style_value->toString(), "Unparsed");
- }
- 
- TEST_F(CrossThreadStyleValueTest, PassKeywordValueCrossThread) {
-diff --git a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-index 567d4fad7436c24d4c42bc36ebfd7ee3641e3b90..12d70ed096cb1c509a2acf14b7f421273d833d0e 100644
---- a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-+++ b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-@@ -137,16 +137,26 @@ IndexedPropertySetterResult CSSUnparsedValue::AnonymousIndexedSetter(
- }
- 
- const CSSValue* CSSUnparsedValue::ToCSSValue() const {
--  String unparsed_string = ToUnparsedString();
--  CSSParserTokenStream stream(unparsed_string);
-+  String unparsed_string = ToStringInternal();
- 
--  if (stream.AtEnd()) {
-+  if (unparsed_string.IsNull()) {
-     return MakeGarbageCollected<CSSUnparsedDeclarationValue>(
-         MakeGarbageCollected<CSSVariableData>());
-   }
- 
--  // The string we just parsed has /**/ inserted between every token
--  // to make sure we get back the correct sequence of tokens.
-+  // TODO(crbug.com/985028): We should probably propagate the CSSParserContext
-+  // to here.
-+  return MakeGarbageCollected<CSSUnparsedDeclarationValue>(
-+      CSSVariableData::Create(unparsed_string, false /* is_animation_tainted */,
-+                              false /* is_attr_tainted */,
-+                              false /* needs_variable_resolution */));
-+}
-+
-+String CSSUnparsedValue::ToStringInternal() const {
-+  String serialized = SerializeSegments();
-+
-+  // The serialization above defensively inserted /**/ between segments
-+  // to make sure that e.g. ['foo', 'bar'] does not collapse into 'foobar'.
-   // The spec mentions nothing of the sort:
-   // https://drafts.css-houdini.org/css-typed-om-1/#unparsedvalue-serialization
-   //
-@@ -160,6 +170,10 @@ const CSSValue* CSSUnparsedValue::ToCSSValue() const {
-   // the original contents of any comments will be lost, but Typed OM does
-   // not have anywhere to store that kind of data, so it is expected.
-   StringBuilder builder;
-+  CSSParserTokenStream stream(serialized);
-+  if (stream.AtEnd()) {
-+    return g_null_atom;
-+  }
-   CSSParserToken token = stream.ConsumeRaw();
-   token.Serialize(builder);
-   while (!stream.Peek().IsEOF()) {
-@@ -169,17 +183,10 @@ const CSSValue* CSSUnparsedValue::ToCSSValue() const {
-     token = stream.ConsumeRaw();
-     token.Serialize(builder);
-   }
--  String original_text = builder.ReleaseString();
--
--  // TODO(crbug.com/985028): We should probably propagate the CSSParserContext
--  // to here.
--  return MakeGarbageCollected<CSSUnparsedDeclarationValue>(
--      CSSVariableData::Create(original_text, false /* is_animation_tainted */,
--                              false /* is_attr_tainted */,
--                              false /* needs_variable_resolution */));
-+  return builder.ReleaseString();
- }
- 
--String CSSUnparsedValue::ToUnparsedString() const {
-+String CSSUnparsedValue::SerializeSegments() const {
-   StringBuilder builder;
-   HeapHashSet<Member<const CSSUnparsedValue>> values_on_stack;
-   if (AppendUnparsedString(builder, values_on_stack)) {
-diff --git a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-index 5d1961b170f14ae21ca8f69b3c3cd8af28f4478a..ec7e3ed708f406d7a61fdb370b2eed8a8297cffb 100644
---- a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-+++ b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-@@ -67,15 +67,9 @@ class CORE_EXPORT CSSUnparsedValue final : public CSSStyleValue {
-     CSSStyleValue::Trace(visitor);
-   }
- 
--  // Unlike CSSStyleValue::toString(), this returns tokens without
--  // substituting variables. There are extra /**/ inserted between
--  // every token to ensure there are no ambiguities, which is fine
--  // because this value is never presented directly to the user
--  // (ToCSSValue() will parse to a token range and then re-serialize
--  // using extra /**/ only where needed).
--  String ToUnparsedString() const;
--
-  private:
-+  String ToStringInternal() const;
-+  String SerializeSegments() const;
-   // Return 'false' if there is a cycle in the serialization.
-   bool AppendUnparsedString(
-       StringBuilder&,
-diff --git a/third_party/blink/renderer/core/css/cssom/paint_worklet_style_property_map_test.cc b/third_party/blink/renderer/core/css/cssom/paint_worklet_style_property_map_test.cc
-index f81fa39423a9235bc58e1600ca7a250affd3d9bb..2ee4dd7e591095b8460ca559b29b78e37ab71729 100644
---- a/third_party/blink/renderer/core/css/cssom/paint_worklet_style_property_map_test.cc
-+++ b/third_party/blink/renderer/core/css/cssom/paint_worklet_style_property_map_test.cc
-@@ -5,6 +5,7 @@
- #include "third_party/blink/renderer/core/css/cssom/paint_worklet_style_property_map.h"
- 
- #include <memory>
-+
- #include "base/synchronization/waitable_event.h"
- #include "base/task/single_thread_task_runner.h"
- #include "testing/gtest/include/gtest/gtest.h"
-@@ -13,7 +14,6 @@
- #include "third_party/blink/renderer/core/css/cssom/css_keyword_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_paint_worklet_input.h"
- #include "third_party/blink/renderer/core/css/cssom/css_unit_value.h"
--#include "third_party/blink/renderer/core/css/cssom/css_unparsed_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_unsupported_color.h"
- #include "third_party/blink/renderer/core/css/properties/longhands/custom_property.h"
- #include "third_party/blink/renderer/core/dom/element.h"
-@@ -23,6 +23,7 @@
- #include "third_party/blink/renderer/platform/scheduler/public/post_cross_thread_task.h"
- #include "third_party/blink/renderer/platform/wtf/cross_thread_copier_base.h"
- #include "third_party/blink/renderer/platform/wtf/cross_thread_functional.h"
-+#include "third_party/blink/renderer/platform/wtf/wtf.h"
- 
- namespace blink {
- 
-@@ -66,8 +67,7 @@ class PaintWorkletStylePropertyMapTest : public PageTestBase {
-     CSSStyleValue* style_value = data.at("--x")->ToCSSStyleValue();
-     EXPECT_EQ(style_value->GetType(),
-               CSSStyleValue::StyleValueType::kUnparsedType);
--    EXPECT_EQ(static_cast<CSSUnparsedValue*>(style_value)->ToUnparsedString(),
--              "50");
-+    EXPECT_EQ(style_value->toString(), "50");
-     waitable_event->Signal();
-   }
- 
-diff --git a/third_party/blink/renderer/core/css/properties/computed_style_utils.cc b/third_party/blink/renderer/core/css/properties/computed_style_utils.cc
-index 79b292f72efe32e6b56971ea577481710b0c750c..8b0c9f73656d664b04b640016391965009b667d6 100644
---- a/third_party/blink/renderer/core/css/properties/computed_style_utils.cc
-+++ b/third_party/blink/renderer/core/css/properties/computed_style_utils.cc
-@@ -5059,7 +5059,7 @@ ComputedStyleUtils::CrossThreadStyleValueFromCSSStyleValue(
-           To<CSSUnsupportedColor>(style_value)->Value());
-     case CSSStyleValue::StyleValueType::kUnparsedType:
-       return std::make_unique<CrossThreadUnparsedValue>(
--          To<CSSUnparsedValue>(style_value)->ToUnparsedString());
-+          To<CSSUnparsedValue>(style_value)->toString());
-     default:
-       return std::make_unique<CrossThreadUnsupportedValue>(
-           style_value->toString());

patches/chromium/cherry-pick-074d472db745.patch

@@ -1,296 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Mikel Astiz <mastiz@chromium.org>
-Date: Tue, 10 Mar 2026 13:22:17 -0700
-Subject: [M146][base] Fix UAF in base::OnceCallbackList on re-entrant Notify()
-
-Before this patch, `base::OnceCallbackList` was susceptible to a
-heap-use-after-free when `Notify()` was called re-entrantly.
-
-The UAF occurred because `OnceCallbackList::RunCallback()` immediately
-spliced executed nodes out of `callbacks_` and into `null_callbacks_`.
-If a nested `Notify()` executed a node that an outer `Notify()` loop was
-already holding an iterator to, and that node's subscription was
-subsequently destroyed during the re-entrant cycle, the node would be
-physically erased from `null_callbacks_`. When control returned to the
-outer loop, it would attempt to evaluate the now-dangling iterator.
-
-This CL fixes the bug by deferring list mutations until the outermost
-iteration completes:
-1. `RunCallback()` no longer splices nodes during iteration.
-2. Cancellation logic is pushed down to the subclasses via a new
-   `CancelCallback()` hook, which is an extension to the pre-existing
-   `CancelNullCallback()` with increased responsibilities and clearer
-   semantics.
-3. If a subscription is destroyed while `is_iterating` is true,
-   `OnceCallbackList` resets the node and stashes its iterator in
-   `pending_erasures_`.
-4. A new `CleanUpNullCallbacksPostIteration()` phase runs at the end
-   of the outermost `Notify()`, which safely splices executed nodes
-   into `null_callbacks_` and physically erases the pending dead nodes.
-
-As a side effect, the type-trait hack in `Notify()` based on
-`is_instantiation<CallbackType, OnceCallback>` can be removed, because
-this information is exposed directly by
-`OnceCallbackList::CleanUpNullCallbacksPostIteration()`.
-
-The newly-added unit-test
-CallbackListTest.OnceCallbackListCancelDuringReentrantNotify reproduces
-the scenario and crashed before this patch.
-
-(cherry picked from commit 36acd49636845be2419269acbe9a5137da3d5d96)
-
-Change-Id: I6b1e2bcb97be1bc8d6a15e5ca7511992e00e1772
-Fixed: 489381399
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7627506
-Commit-Queue: Mikel Astiz <mastiz@chromium.org>
-Reviewed-by: Gabriel Charette <gab@chromium.org>
-Cr-Original-Commit-Position: refs/heads/main@{#1594520}
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7653916
-Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
-Cr-Commit-Position: refs/branch-heads/7680@{#2287}
-Cr-Branched-From: 76b7d80e5cda23fe6537eed26d68c92e995c7f39-refs/heads/main@{#1582197}
-
-diff --git a/base/callback_list.h b/base/callback_list.h
-index 82cb11dc0ee02906b009cc383c41a056861199d0..d5f99cf685486f1ea74718b4e6b228a5d83f0c29 100644
---- a/base/callback_list.h
-+++ b/base/callback_list.h
-@@ -9,6 +9,7 @@
- #include <list>
- #include <memory>
- #include <utility>
-+#include <vector>
- 
- #include "base/auto_reset.h"
- #include "base/base_export.h"
-@@ -16,7 +17,6 @@
- #include "base/functional/bind.h"
- #include "base/functional/callback.h"
- #include "base/memory/weak_ptr.h"
--#include "base/types/is_instantiation.h"
- 
- // OVERVIEW:
- //
-@@ -240,17 +240,14 @@ class CallbackListBase {
- 
-     // Any null callbacks remaining in the list were canceled due to
-     // Subscription destruction during iteration, and can safely be erased now.
--    const size_t erased_callbacks =
--        std::erase_if(callbacks_, [](const auto& cb) { return cb.is_null(); });
--
--    // Run |removal_callback_| if any callbacks were canceled. Note that we
--    // cannot simply compare list sizes before and after iterating, since
--    // notification may result in Add()ing new callbacks as well as canceling
--    // them. Also note that if this is a OnceCallbackList, the OnceCallbacks
--    // that were executed above have all been removed regardless of whether
--    // they're counted in |erased_callbacks_|.
--    if (removal_callback_ &&
--        (erased_callbacks || is_instantiation<CallbackType, OnceCallback>)) {
-+    const bool any_callbacks_erased = static_cast<CallbackListImpl*>(this)
-+                                          ->CleanUpNullCallbacksPostIteration();
-+
-+    // Run |removal_callback_| if any callbacks were canceled or executed. Note
-+    // that simply comparing list sizes before and after iterating cannot be
-+    // done, since notification may result in Add()ing new callbacks as well as
-+    // canceling them.
-+    if (removal_callback_ && any_callbacks_erased) {
-       removal_callback_.Run();  // May delete |this|!
-     }
-   }
-@@ -264,21 +261,9 @@ class CallbackListBase {
-  private:
-   // Cancels the callback pointed to by |it|, which is guaranteed to be valid.
-   void CancelCallback(const typename Callbacks::iterator& it) {
--    if (static_cast<CallbackListImpl*>(this)->CancelNullCallback(it)) {
--      return;
--    }
--
--    if (iterating_) {
--      // Calling erase() here is unsafe, since the loop in Notify() may be
--      // referencing this same iterator, e.g. if adjacent callbacks'
--      // Subscriptions are both destroyed when the first one is Run().  Just
--      // reset the callback and let Notify() clean it up at the end.
--      it->Reset();
--    } else {
--      callbacks_.erase(it);
--      if (removal_callback_) {
--        removal_callback_.Run();  // May delete |this|!
--      }
-+    if (static_cast<CallbackListImpl*>(this)->CancelCallback(it, iterating_) &&
-+        removal_callback_) {
-+      removal_callback_.Run();  // May delete |this|!
-     }
-   }
- 
-@@ -304,23 +289,71 @@ class OnceCallbackList
-   // Runs the current callback, which may cancel it or any other callbacks.
-   template <typename... RunArgs>
-   void RunCallback(typename Traits::Callbacks::iterator it, RunArgs&&... args) {
--    // OnceCallbacks still have Subscriptions with outstanding iterators;
--    // splice() removes them from |callbacks_| without invalidating those.
--    null_callbacks_.splice(null_callbacks_.end(), this->callbacks_, it);
-+    // Do not splice here. Splicing during iteration breaks re-entrant Notify()
-+    // by invalidating the outer loop's iterator. Splicing is deferred to
-+    // CleanUpNullCallbacksPostIteration(), which is called when the outermost
-+    // Notify() finishes.
- 
-     // NOTE: Intentionally does not call std::forward<RunArgs>(args)...; see
-     // comments in Notify().
-     std::move(*it).Run(args...);
-   }
- 
--  // If |it| refers to an already-canceled callback, does any necessary cleanup
--  // and returns true.  Otherwise returns false.
--  bool CancelNullCallback(const typename Traits::Callbacks::iterator& it) {
-+  // Called during subscription destruction to cancel the callback. Returns true
-+  // if the callback was removed from the active list and the generic removal
-+  // callback should be executed. Returns false if the callback was already
-+  // executed, or if the erasure is deferred due to active iteration.
-+  bool CancelCallback(const typename Traits::Callbacks::iterator& it,
-+                      bool is_iterating) {
-+    if (is_iterating) {
-+      // During iteration, nodes cannot be safely erased from |callbacks_|
-+      // without invalidating iterators. They also cannot be spliced into
-+      // |null_callbacks_| right now. Thus, the node is reset and tracked for
-+      // erasure in CleanUpNullCallbacksPostIteration().
-+      it->Reset();
-+      pending_erasures_.push_back(it);
-+      return false;
-+    }
-+
-     if (it->is_null()) {
-+      // The callback already ran, so it's safely sitting in |null_callbacks_|.
-       null_callbacks_.erase(it);
--      return true;
-+      return false;
-     }
--    return false;
-+
-+    // The callback hasn't run yet, so it's still in |callbacks_|.
-+    this->callbacks_.erase(it);
-+    return true;
-+  }
-+
-+  // Performs post-iteration cleanup. Successfully executed callbacks (which
-+  // become null) are spliced into |null_callbacks_| to keep their
-+  // Subscriptions' iterators valid. Callbacks explicitly canceled during
-+  // iteration (tracked in |pending_erasures_|) are erased. Returns true if any
-+  // callbacks were erased or spliced out.
-+  bool CleanUpNullCallbacksPostIteration() {
-+    bool any_spliced = false;
-+    for (auto it = this->callbacks_.begin(); it != this->callbacks_.end();) {
-+      if (it->is_null()) {
-+        any_spliced = true;
-+        auto next = std::next(it);
-+        null_callbacks_.splice(null_callbacks_.end(), this->callbacks_, it);
-+        it = next;
-+      } else {
-+        ++it;
-+      }
-+    }
-+
-+    bool any_erased = !pending_erasures_.empty();
-+    for (auto pending_it : pending_erasures_) {
-+      // Note: `pending_it` was originally an iterator into `callbacks_`, but
-+      // the node it points to has just been spliced into `null_callbacks_`. The
-+      // iterator itself remains valid and can now be used for erasure from
-+      // `null_callbacks_`.
-+      null_callbacks_.erase(pending_it);
-+    }
-+    pending_erasures_.clear();
-+    return any_spliced || any_erased;
-   }
- 
-   // Holds null callbacks whose Subscriptions are still alive, so the
-@@ -328,6 +361,11 @@ class OnceCallbackList
-   // OnceCallbacks, since RepeatingCallbacks are not canceled except by
-   // Subscription destruction.
-   typename Traits::Callbacks null_callbacks_;
-+
-+  // Holds iterators for callbacks canceled during iteration.
-+  // Erasure is deferred to CleanUpNullCallbacksPostIteration() when iteration
-+  // completes to prevent invalidating iterators that an outer loop might hold.
-+  std::vector<typename Traits::Callbacks::iterator> pending_erasures_;
- };
- 
- template <typename Signature>
-@@ -344,14 +382,29 @@ class RepeatingCallbackList
-     it->Run(args...);
-   }
- 
--  // If |it| refers to an already-canceled callback, does any necessary cleanup
--  // and returns true.  Otherwise returns false.
--  bool CancelNullCallback(const typename Traits::Callbacks::iterator& it) {
--    // Because at most one Subscription can point to a given callback, and
--    // RepeatingCallbacks are only reset by CancelCallback(), no one should be
--    // able to request cancellation of a canceled RepeatingCallback.
--    DCHECK(!it->is_null());
--    return false;
-+  // Called during subscription destruction to cancel the callback. Returns true
-+  // if the callback was removed from the active list and the generic removal
-+  // callback should be executed. Returns false if the callback was already
-+  // executed, or if the erasure is deferred due to active iteration.
-+  bool CancelCallback(const typename Traits::Callbacks::iterator& it,
-+                      bool is_iterating) {
-+    if (is_iterating) {
-+      // During iteration, nodes cannot be safely erased from |callbacks_|
-+      // without invalidating iterators. The node is reset and will be swept up
-+      // by CleanUpNullCallbacksPostIteration().
-+      it->Reset();
-+      return false;
-+    }
-+
-+    this->callbacks_.erase(it);
-+    return true;
-+  }
-+
-+  // Performs post-iteration cleanup by erasing all canceled callbacks. Returns
-+  // true if any callbacks were erased.
-+  bool CleanUpNullCallbacksPostIteration() {
-+    return std::erase_if(this->callbacks_,
-+                         [](const auto& cb) { return cb.is_null(); }) > 0;
-   }
- };
- 
-diff --git a/base/callback_list_unittest.cc b/base/callback_list_unittest.cc
-index 7474278525e5efecc0de903809a54d366896d524..a855443fbae862befbc3a2a484ea335632136e94 100644
---- a/base/callback_list_unittest.cc
-+++ b/base/callback_list_unittest.cc
-@@ -10,6 +10,7 @@
- #include "base/functional/bind.h"
- #include "base/functional/callback_helpers.h"
- #include "base/memory/raw_ptr.h"
-+#include "base/test/bind.h"
- #include "base/test/test_future.h"
- #include "testing/gtest/include/gtest/gtest.h"
- 
-@@ -577,6 +578,30 @@ TEST(CallbackListTest, ReentrantNotify) {
-   EXPECT_EQ(1, d.total());
- }
- 
-+// Regression test for crbug.com/489381399: Verifies Notify() can be called
-+// reentrantly for OnceCallbackList even if a callback is canceled during the
-+// reentrant notification.
-+TEST(CallbackListTest, OnceCallbackListCancelDuringReentrantNotify) {
-+  OnceClosureList cb_reg;
-+  CallbackListSubscription sub_a, sub_b;
-+
-+  auto cb_a = base::BindLambdaForTesting([&]() {
-+    // Re-entrant notification.
-+    cb_reg.Notify();
-+    // After re-entrant notification returns, sub_b has been run. Destroying it
-+    // now should be a no-op.
-+    sub_b = {};
-+  });
-+
-+  auto cb_b = base::DoNothing();
-+
-+  sub_a = cb_reg.Add(std::move(cb_a));
-+  sub_b = cb_reg.Add(std::move(cb_b));
-+
-+  // This should not crash.
-+  cb_reg.Notify();
-+}
-+
- TEST(CallbackListTest, ClearPreventsInvocation) {
-   Listener listener;
-   RepeatingClosureList cb_reg;

patches/chromium/cherry-pick-12f932985275.patch

@@ -1,762 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Geoff Lang <geofflang@chromium.org>
-Date: Wed, 11 Feb 2026 08:05:52 -0800
-Subject: Ensure the previous complete fbo is not deleted on IMG.
-
-Change-Id: I7d84833312749fc58ecb511b276ff6bd783af1ba
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7533383
-Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
-Commit-Queue: Geoff Lang <geofflang@chromium.org>
-Cr-Commit-Position: refs/heads/main@{#1583241}
-
-diff --git a/gpu/command_buffer/service/context_group.cc b/gpu/command_buffer/service/context_group.cc
-index 9a913cdefd0681d9972a83d8f940a3c48af0f46d..4a3a68b4415b6cc05eab01f98b1a0afffe73afc9 100644
---- a/gpu/command_buffer/service/context_group.cc
-+++ b/gpu/command_buffer/service/context_group.cc
-@@ -120,9 +120,17 @@ ContextGroup::ContextGroup(
- 
-   use_passthrough_cmd_decoder_ = gpu_preferences_.use_passthrough_cmd_decoder;
- }
--
- gpu::ContextResult ContextGroup::Initialize(DecoderContext* decoder,
-                                             ContextType context_type) {
-+  return InitializeWithCompleteFramebufferForWorkarounds(decoder, context_type,
-+                                                         0);
-+}
-+
-+gpu::ContextResult
-+ContextGroup::InitializeWithCompleteFramebufferForWorkarounds(
-+    DecoderContext* decoder,
-+    ContextType context_type,
-+    uint32_t complete_fbo_for_workarounds) {
-   switch (context_type) {
-     case CONTEXT_TYPE_WEBGL1:
-       if (kGpuFeatureStatusBlocklisted ==
-@@ -156,8 +164,9 @@ gpu::ContextResult ContextGroup::Initialize(DecoderContext* decoder,
-   DisallowedFeatures adjusted_disallowed_features =
-       GetDisallowedFeatures(context_type);
- 
--  feature_info_->Initialize(context_type, use_passthrough_cmd_decoder_,
--                            adjusted_disallowed_features);
-+  feature_info_->InitializeWithCompleteFramebufferForWorkarounds(
-+      context_type, use_passthrough_cmd_decoder_, adjusted_disallowed_features,
-+      complete_fbo_for_workarounds);
- 
-   // Fail early if ES3 is requested and driver does not support it.
-   if ((context_type == CONTEXT_TYPE_WEBGL2 ||
-diff --git a/gpu/command_buffer/service/context_group.h b/gpu/command_buffer/service/context_group.h
-index 78ea1ccd987cfc6f8ec0e378f906fb19fdccbc19..051d8126c128c47af71d0862cc0ec9476414825e 100644
---- a/gpu/command_buffer/service/context_group.h
-+++ b/gpu/command_buffer/service/context_group.h
-@@ -72,7 +72,10 @@ class GPU_GLES2_EXPORT ContextGroup : public base::RefCounted<ContextGroup> {
-   // call to destroy if it succeeds.
-   gpu::ContextResult Initialize(DecoderContext* decoder,
-                                 ContextType context_type);
--
-+  gpu::ContextResult InitializeWithCompleteFramebufferForWorkarounds(
-+      DecoderContext* decoder,
-+      ContextType context_type,
-+      uint32_t complete_fbo_for_workarounds);
-   // Destroys all the resources when called for the last context in the group.
-   // It should only be called by DecoderContext.
-   void Destroy(DecoderContext* decoder, bool have_context);
-diff --git a/gpu/command_buffer/service/decoder_context.h b/gpu/command_buffer/service/decoder_context.h
-index f00ad2459ff2b4993af37ac6fe0a5aa661fee692..96edc25e2d1ce364470b75ec1a3658ed0e217e54 100644
---- a/gpu/command_buffer/service/decoder_context.h
-+++ b/gpu/command_buffer/service/decoder_context.h
-@@ -139,6 +139,12 @@ class GPU_GLES2_EXPORT DecoderContext : public AsyncAPIInterface,
-   virtual gles2::ContextGroup* GetContextGroup() = 0;
-   virtual gles2::ErrorState* GetErrorState() = 0;
- 
-+  //
-+  // Methods required by GLES2 Decoder helpers
-+  //
-+  // Bind the framebuffer `service_id` and perform any workarounds needed.
-+  virtual void BindFramebuffer(unsigned target, uint32_t service_id) const = 0;
-+
-   //
-   // Methods required by Texture.
-   //
-diff --git a/gpu/command_buffer/service/feature_info.cc b/gpu/command_buffer/service/feature_info.cc
-index 14bf6c1a220f7b37fa81ddbc7ac1f2a16fb08e4c..6f1cb7f75f8bc4b80d1bd95be721285bd0bab1a8 100644
---- a/gpu/command_buffer/service/feature_info.cc
-+++ b/gpu/command_buffer/service/feature_info.cc
-@@ -64,7 +64,8 @@ class ScopedPixelUnpackBufferOverride {
- 
- bool IsWebGLDrawBuffersSupported(bool webglCompatibilityContext,
-                                  GLenum depth_texture_internal_format,
--                                 GLenum depth_stencil_texture_internal_format) {
-+                                 GLenum depth_stencil_texture_internal_format,
-+                                 GLuint complete_fbo_for_workarounds) {
-   // This is called after we make sure GL_EXT_draw_buffers is supported.
-   GLint max_draw_buffers = 0;
-   GLint max_color_attachments = 0;
-@@ -81,6 +82,9 @@ bool IsWebGLDrawBuffersSupported(bool webglCompatibilityContext,
- 
-   GLuint fbo;
-   glGenFramebuffersEXT(1, &fbo);
-+  if (complete_fbo_for_workarounds) {
-+    glBindFramebufferEXT(GL_FRAMEBUFFER, complete_fbo_for_workarounds);
-+  }
-   glBindFramebufferEXT(GL_FRAMEBUFFER, fbo);
- 
-   GLuint depth_stencil_texture = 0;
-@@ -157,6 +161,9 @@ bool IsWebGLDrawBuffersSupported(bool webglCompatibilityContext,
-     }
-   }
- 
-+  if (complete_fbo_for_workarounds) {
-+    glBindFramebufferEXT(GL_FRAMEBUFFER, complete_fbo_for_workarounds);
-+  }
-   glBindFramebufferEXT(GL_FRAMEBUFFER, static_cast<GLuint>(fb_binding));
-   glDeleteFramebuffersEXT(1, &fbo);
- 
-@@ -238,6 +245,15 @@ void FeatureInfo::InitializeBasicState(const base::CommandLine* command_line) {
- void FeatureInfo::Initialize(ContextType context_type,
-                              bool is_passthrough_cmd_decoder,
-                              const DisallowedFeatures& disallowed_features) {
-+  InitializeWithCompleteFramebufferForWorkarounds(
-+      context_type, is_passthrough_cmd_decoder, disallowed_features, 0);
-+}
-+
-+void FeatureInfo::InitializeWithCompleteFramebufferForWorkarounds(
-+    ContextType context_type,
-+    bool is_passthrough_cmd_decoder,
-+    const DisallowedFeatures& disallowed_features,
-+    unsigned complete_fbo_for_workarounds) {
-   if (initialized_) {
-     DCHECK_EQ(context_type, context_type_);
-     DCHECK_EQ(is_passthrough_cmd_decoder, is_passthrough_cmd_decoder_);
-@@ -248,14 +264,14 @@ void FeatureInfo::Initialize(ContextType context_type,
-   disallowed_features_ = disallowed_features;
-   context_type_ = context_type;
-   is_passthrough_cmd_decoder_ = is_passthrough_cmd_decoder;
--  InitializeFeatures();
-+  InitializeFeatures(complete_fbo_for_workarounds);
-   initialized_ = true;
- }
- 
- void FeatureInfo::ForceReinitialize() {
-   CHECK(initialized_);
-   CHECK(is_passthrough_cmd_decoder_);
--  InitializeFeatures();
-+  InitializeFeatures(0);
- }
- 
- void FeatureInfo::InitializeForTesting(
-@@ -277,7 +293,7 @@ void FeatureInfo::InitializeForTesting(ContextType context_type) {
-              DisallowedFeatures());
- }
- 
--bool IsGL_REDSupportedOnFBOs() {
-+bool IsGL_REDSupportedOnFBOs(uint32_t complete_fbo_for_workarounds) {
- #if BUILDFLAG(IS_MAC)
-   // The glTexImage2D call below can hang on Mac so skip this since it's only
-   // really needed to workaround a Mesa issue. See https://crbug.com/1158744.
-@@ -311,6 +327,9 @@ bool IsGL_REDSupportedOnFBOs() {
-                GL_UNSIGNED_BYTE, nullptr);
-   GLuint textureFBOID = 0;
-   glGenFramebuffersEXT(1, &textureFBOID);
-+  if (complete_fbo_for_workarounds) {
-+    glBindFramebufferEXT(GL_FRAMEBUFFER, complete_fbo_for_workarounds);
-+  }
-   glBindFramebufferEXT(GL_FRAMEBUFFER, textureFBOID);
-   glFramebufferTexture2DEXT(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D,
-                             textureId, 0);
-@@ -319,6 +338,9 @@ bool IsGL_REDSupportedOnFBOs() {
-   glDeleteFramebuffersEXT(1, &textureFBOID);
-   glDeleteTextures(1, &textureId);
- 
-+  if (complete_fbo_for_workarounds) {
-+    glBindFramebufferEXT(GL_FRAMEBUFFER, complete_fbo_for_workarounds);
-+  }
-   glBindFramebufferEXT(GL_FRAMEBUFFER, static_cast<GLuint>(fb_binding));
-   glBindTexture(GL_TEXTURE_2D, static_cast<GLuint>(tex_binding));
- 
-@@ -476,7 +498,7 @@ void FeatureInfo::EnableWEBGLMultiDrawIfPossible(
-   }
- }
- 
--void FeatureInfo::InitializeFeatures() {
-+void FeatureInfo::InitializeFeatures(uint32_t complete_fbo_for_workarounds) {
-   // Figure out what extensions to turn on.
-   std::string extensions_string(gl::GetGLExtensionsFromCurrentContext());
-   gfx::ExtensionSet extensions(gfx::MakeExtensionSet(extensions_string));
-@@ -1264,9 +1286,9 @@ void FeatureInfo::InitializeFeatures() {
-        can_emulate_es2_draw_buffers_on_es3_nv) &&
-       (context_type_ == CONTEXT_TYPE_OPENGLES2 ||
-        (context_type_ == CONTEXT_TYPE_WEBGL1 &&
--        IsWebGLDrawBuffersSupported(is_webgl_compatibility_context,
--                                    depth_texture_format,
--                                    depth_stencil_texture_format)));
-+        IsWebGLDrawBuffersSupported(
-+            is_webgl_compatibility_context, depth_texture_format,
-+            depth_stencil_texture_format, complete_fbo_for_workarounds)));
-   if (have_es2_draw_buffers) {
-     AddExtensionString("GL_EXT_draw_buffers");
-     feature_flags_.ext_draw_buffers = true;
-@@ -1387,7 +1409,7 @@ void FeatureInfo::InitializeFeatures() {
- 
-   if ((gl_version_info_->is_es3 ||
-        gfx::HasExtension(extensions, "GL_EXT_texture_rg")) &&
--      IsGL_REDSupportedOnFBOs()) {
-+      IsGL_REDSupportedOnFBOs(complete_fbo_for_workarounds)) {
-     feature_flags_.ext_texture_rg = true;
-     AddExtensionString("GL_EXT_texture_rg");
- 
-diff --git a/gpu/command_buffer/service/feature_info.h b/gpu/command_buffer/service/feature_info.h
-index 2db3588ca3ed729799b113350ea8a7c449712587..83c683e900a3267061ced97ba971bf9dc0b88f4f 100644
---- a/gpu/command_buffer/service/feature_info.h
-+++ b/gpu/command_buffer/service/feature_info.h
-@@ -163,6 +163,14 @@ class GPU_GLES2_EXPORT FeatureInfo : public base::RefCounted<FeatureInfo> {
-                   bool is_passthrough_cmd_decoder,
-                   const DisallowedFeatures& disallowed_features);
- 
-+  // Same as initialize but with a provided `complete_fbo_for_workarounds` to
-+  // use with the ensure_previous_framebuffer_not_deleted driver bug workaround.
-+  void InitializeWithCompleteFramebufferForWorkarounds(
-+      ContextType context_type,
-+      bool is_passthrough_cmd_decoder,
-+      const DisallowedFeatures& disallowed_features,
-+      uint32_t complete_fbo_for_workarounds);
-+
-   // Same as above, but allows reinitialization.
-   void ForceReinitialize();
- 
-@@ -250,7 +258,7 @@ class GPU_GLES2_EXPORT FeatureInfo : public base::RefCounted<FeatureInfo> {
- 
-   void AddExtensionString(std::string_view s);
-   void InitializeBasicState(const base::CommandLine* command_line);
--  void InitializeFeatures();
-+  void InitializeFeatures(uint32_t complete_fbo_for_workarounds);
-   void InitializeFloatAndHalfFloatFeatures(const gfx::ExtensionSet& extensions);
- 
-   void EnableANGLEInstancedArrayIfPossible(const gfx::ExtensionSet& extensions);
-diff --git a/gpu/command_buffer/service/gles2_cmd_copy_tex_image.cc b/gpu/command_buffer/service/gles2_cmd_copy_tex_image.cc
-index b500acb4fe7cbff0e84a4e52e66459d5b85fdf75..a08bb3ac4ab625f220865803352e206713763d77 100644
---- a/gpu/command_buffer/service/gles2_cmd_copy_tex_image.cc
-+++ b/gpu/command_buffer/service/gles2_cmd_copy_tex_image.cc
-@@ -185,7 +185,7 @@ void CopyTexImageResourceManager::DoCopyTexSubImageToLUMACompatibilityTexture(
-   // framebuffer is copying from a texture and sample directly from that texture
-   // instead of doing an extra copy
- 
--  glBindFramebufferEXT(GL_FRAMEBUFFER, source_framebuffer);
-+  decoder->BindFramebuffer(GL_FRAMEBUFFER, source_framebuffer);
-   glActiveTexture(GL_TEXTURE0);
-   glBindTexture(GL_TEXTURE_2D, scratch_textures_[0]);
-   glCopyTexImage2D(GL_TEXTURE_2D, 0, source_framebuffer_internal_format, x, y,
-@@ -217,7 +217,7 @@ void CopyTexImageResourceManager::DoCopyTexSubImageToLUMACompatibilityTexture(
-   glTexImage2D(GL_TEXTURE_2D, 0, compatability_format, width, height, 0,
-                compatability_format, luma_type, nullptr);
- 
--  glBindFramebufferEXT(GL_FRAMEBUFFER, scratch_fbo_);
-+  decoder->BindFramebuffer(GL_FRAMEBUFFER, scratch_fbo_);
-   glFramebufferTexture2DEXT(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D,
-                             scratch_textures_[1], 0);
- 
-diff --git a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
-index 469642028b839d490199379254a5a44c2fcd7f02..98f476de9e4d423b6ec86f2a69638e43bd0fb423 100644
---- a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
-+++ b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
-@@ -491,7 +491,8 @@ void DeleteShader(GLuint shader) {
-     glDeleteShader(shader);
- }
- 
--bool BindFramebufferTexture2D(GLenum target,
-+bool BindFramebufferTexture2D(DecoderContext* decoder,
-+                              GLenum target,
-                               GLuint texture_id,
-                               GLint level,
-                               GLuint framebuffer) {
-@@ -511,7 +512,7 @@ bool BindFramebufferTexture2D(GLenum target,
-   glTexParameterf(binding_target, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
-   glTexParameteri(binding_target, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
-   glTexParameteri(binding_target, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
--  glBindFramebufferEXT(GL_FRAMEBUFFER, framebuffer);
-+  decoder->BindFramebuffer(GL_FRAMEBUFFER, framebuffer);
-   glFramebufferTexture2DEXT(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, target,
-                             texture_id, level);
- 
-@@ -545,7 +546,7 @@ void DoCopyTexImage2D(
-   DCHECK(dest_binding_target == GL_TEXTURE_2D ||
-          dest_binding_target == GL_TEXTURE_CUBE_MAP);
-   DCHECK(source_level == 0 || decoder->GetFeatureInfo()->IsES3Capable());
--  if (BindFramebufferTexture2D(source_target, source_id, source_level,
-+  if (BindFramebufferTexture2D(decoder, source_target, source_id, source_level,
-                                framebuffer)) {
-     glBindTexture(dest_binding_target, dest_id);
-     glTexParameterf(dest_binding_target, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
-@@ -603,7 +604,7 @@ void DoCopyTexSubImage2D(
-   DCHECK(dest_binding_target == GL_TEXTURE_2D ||
-          dest_binding_target == GL_TEXTURE_CUBE_MAP);
-   DCHECK(source_level == 0 || decoder->GetFeatureInfo()->IsES3Capable());
--  if (BindFramebufferTexture2D(source_target, source_id, source_level,
-+  if (BindFramebufferTexture2D(decoder, source_target, source_id, source_level,
-                                framebuffer)) {
-     glBindTexture(dest_binding_target, dest_id);
-     glTexParameterf(dest_binding_target, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
-@@ -767,7 +768,7 @@ void DoReadbackAndTexImage(TexImageCommandType command_type,
-   DCHECK(dest_binding_target == GL_TEXTURE_2D ||
-          dest_binding_target == GL_TEXTURE_CUBE_MAP);
-   DCHECK(source_level == 0 || decoder->GetFeatureInfo()->IsES3Capable());
--  if (BindFramebufferTexture2D(source_target, source_id, source_level,
-+  if (BindFramebufferTexture2D(decoder, source_target, source_id, source_level,
-                                framebuffer)) {
-     glBindTexture(dest_binding_target, dest_id);
-     glTexParameterf(dest_binding_target, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
-@@ -1341,7 +1342,7 @@ void CopyTextureResourceManagerImpl::DoCopyTextureInternal(
-               (y + height / 2.f) * m_y / source_height);
- 
-   DCHECK(dest_level == 0 || decoder->GetFeatureInfo()->IsES3Capable());
--  if (BindFramebufferTexture2D(dest_target, dest_id, dest_level,
-+  if (BindFramebufferTexture2D(decoder, dest_target, dest_id, dest_level,
-                                framebuffer_)) {
- #ifndef NDEBUG
-     // glValidateProgram of MACOSX validates FBO unlike other platforms, so
-diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
-index 0bb2581fa602217ab77aa429ed51ce0ce5a06f00..895266f5988e2446eadf3d3e1d5c4919416cba76 100644
---- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
-+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
-@@ -675,6 +675,9 @@ class GLES2DecoderImpl : public GLES2Decoder,
-   // Implements GpuSwitchingObserver.
-   void OnGpuSwitched() override;
- 
-+  // Bind the framebuffer `fbo` and perform any workarounds needed.
-+  void BindFramebuffer(unsigned target, uint32_t service_id) const override;
-+
-   // Restores the current state to the user's settings.
-   void RestoreCurrentFramebufferBindings();
- 
-@@ -2418,6 +2421,10 @@ class GLES2DecoderImpl : public GLES2Decoder,
-   // Backbuffer attachments that are currently undefined.
-   uint32_t backbuffer_needs_clear_bits_;
- 
-+  // An always-complete FBO to use for workarounds
-+  GLuint complete_fbo_ = 0;
-+  GLuint complete_fbo_color_texture_ = 0;
-+
-   // The current decoder error communicates the decoder error through command
-   // processing functions that do not return the error value. Should be set only
-   // if not returning an error.
-@@ -2594,7 +2601,7 @@ ScopedFramebufferBinder::ScopedFramebufferBinder(GLES2DecoderImpl* decoder,
-     : decoder_(decoder) {
-   ScopedGLErrorSuppressor suppressor("ScopedFramebufferBinder::ctor",
-                                      decoder_->error_state_.get());
--  decoder->api()->glBindFramebufferEXTFn(GL_FRAMEBUFFER, id);
-+  decoder->BindFramebuffer(GL_FRAMEBUFFER, id);
-   decoder->OnFboChanged();
- }
- 
-@@ -2980,7 +2987,27 @@ gpu::ContextResult GLES2DecoderImpl::Initialize(
-     return gpu::ContextResult::kFatalFailure;
-   }
- 
--  auto result = group_->Initialize(this, context_type);
-+  if (workarounds().ensure_previous_framebuffer_not_deleted) {
-+    // Use a 1x1 RGBA8 framebuffer as the "always complete" framebuffer to bind
-+    // before binding other framebuffers
-+    api()->glGenTexturesFn(1, &complete_fbo_color_texture_);
-+    api()->glBindTextureFn(GL_TEXTURE_2D, complete_fbo_color_texture_);
-+    api()->glTexImage2DFn(GL_TEXTURE_2D, 0, GL_RGBA, 1, 1, 0, GL_RGBA,
-+                          GL_UNSIGNED_BYTE, nullptr);
-+
-+    api()->glGenFramebuffersEXTFn(1, &complete_fbo_);
-+    api()->glBindFramebufferEXTFn(GL_FRAMEBUFFER, complete_fbo_);
-+    api()->glFramebufferTexture2DEXTFn(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
-+                                       GL_TEXTURE_2D,
-+                                       complete_fbo_color_texture_, 0);
-+    CHECK_EQ(api()->glCheckFramebufferStatusEXTFn(GL_FRAMEBUFFER),
-+             static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
-+  }
-+  CHECK_GL_ERROR();
-+
-+  auto result = group_->InitializeWithCompleteFramebufferForWorkarounds(
-+      this, context_type, complete_fbo_);
-+
-   if (result != gpu::ContextResult::kSuccess) {
-     // Must not destroy ContextGroup if it is not initialized.
-     group_ = nullptr;
-@@ -3116,7 +3143,7 @@ gpu::ContextResult GLES2DecoderImpl::Initialize(
-     state_.viewport_width = initial_size.width();
-     state_.viewport_height = initial_size.height();
-   } else {
--    api()->glBindFramebufferEXTFn(GL_FRAMEBUFFER, GetBackbufferServiceId());
-+    BindFramebuffer(GL_FRAMEBUFFER, GetBackbufferServiceId());
-     // These are NOT if the back buffer has these proprorties. They are
-     // if we want the command buffer to enforce them regardless of what
-     // the real backbuffer is assuming the real back buffer gives us more than
-@@ -3809,7 +3836,7 @@ void GLES2DecoderImpl::DeleteFramebuffersHelper(
-         if (workarounds().unbind_attachments_on_bound_render_fbo_delete)
-           framebuffer->DoUnbindGLAttachmentsForWorkaround(target);
- 
--        api()->glBindFramebufferEXTFn(target, GetBackbufferServiceId());
-+        BindFramebuffer(target, GetBackbufferServiceId());
-         state_.UpdateWindowRectanglesForBoundDrawFramebufferClientID(0);
-         framebuffer_state_.bound_draw_framebuffer = nullptr;
-         framebuffer_state_.clear_state_dirty = true;
-@@ -3817,7 +3844,7 @@ void GLES2DecoderImpl::DeleteFramebuffersHelper(
-       if (framebuffer == framebuffer_state_.bound_read_framebuffer.get()) {
-         framebuffer_state_.bound_read_framebuffer = nullptr;
-         GLenum target = GetReadFramebufferTarget();
--        api()->glBindFramebufferEXTFn(target, GetBackbufferServiceId());
-+        BindFramebuffer(target, GetBackbufferServiceId());
-       }
-       OnFboChanged();
-       RemoveFramebuffer(client_id);
-@@ -3965,33 +3992,32 @@ void GLES2DecoderImpl::ProcessFinishedAsyncTransfers() {
-   ProcessPendingReadPixels(false);
- }
- 
--static void RebindCurrentFramebuffer(gl::GLApi* api,
--                                     GLenum target,
--                                     Framebuffer* framebuffer,
--                                     GLuint back_buffer_service_id) {
--  GLuint framebuffer_id = framebuffer ? framebuffer->service_id() : 0;
-+void GLES2DecoderImpl::RestoreCurrentFramebufferBindings() {
-+  framebuffer_state_.clear_state_dirty = true;
- 
--  if (framebuffer_id == 0) {
--    framebuffer_id = back_buffer_service_id;
--  }
-+  auto rebind_current_framebuffer = [this](GLenum target,
-+                                           Framebuffer* framebuffer,
-+                                           GLuint back_buffer_service_id) {
-+    GLuint framebuffer_id = framebuffer ? framebuffer->service_id() : 0;
- 
--  api->glBindFramebufferEXTFn(target, framebuffer_id);
--}
-+    if (framebuffer_id == 0) {
-+      framebuffer_id = back_buffer_service_id;
-+    }
- 
--void GLES2DecoderImpl::RestoreCurrentFramebufferBindings() {
--  framebuffer_state_.clear_state_dirty = true;
-+    BindFramebuffer(target, framebuffer_id);
-+  };
- 
-   if (!SupportsSeparateFramebufferBinds()) {
--    RebindCurrentFramebuffer(api(), GL_FRAMEBUFFER,
--                             framebuffer_state_.bound_draw_framebuffer.get(),
--                             GetBackbufferServiceId());
-+    rebind_current_framebuffer(GL_FRAMEBUFFER,
-+                               framebuffer_state_.bound_draw_framebuffer.get(),
-+                               GetBackbufferServiceId());
-   } else {
--    RebindCurrentFramebuffer(api(), GL_READ_FRAMEBUFFER,
--                             framebuffer_state_.bound_read_framebuffer.get(),
--                             GetBackbufferServiceId());
--    RebindCurrentFramebuffer(api(), GL_DRAW_FRAMEBUFFER,
--                             framebuffer_state_.bound_draw_framebuffer.get(),
--                             GetBackbufferServiceId());
-+    rebind_current_framebuffer(GL_READ_FRAMEBUFFER,
-+                               framebuffer_state_.bound_read_framebuffer.get(),
-+                               GetBackbufferServiceId());
-+    rebind_current_framebuffer(GL_DRAW_FRAMEBUFFER,
-+                               framebuffer_state_.bound_draw_framebuffer.get(),
-+                               GetBackbufferServiceId());
-   }
-   OnFboChanged();
- }
-@@ -4380,6 +4406,16 @@ void GLES2DecoderImpl::OnGpuSwitched() {
-   client()->OnGpuSwitched();
- }
- 
-+void GLES2DecoderImpl::BindFramebuffer(unsigned target,
-+                                       uint32_t service_id) const {
-+  if (workarounds().ensure_previous_framebuffer_not_deleted) {
-+    DCHECK(complete_fbo_);
-+    api()->glBindFramebufferEXTFn(target, complete_fbo_);
-+  }
-+
-+  api()->glBindFramebufferEXTFn(target, service_id);
-+}
-+
- void GLES2DecoderImpl::Destroy(bool have_context) {
-   if (!initialized())
-     return;
-@@ -4429,6 +4465,13 @@ void GLES2DecoderImpl::Destroy(bool have_context) {
-       offscreen_target_frame_buffer_->Destroy();
-     if (offscreen_target_color_texture_.get())
-       offscreen_target_color_texture_->Destroy();
-+
-+    if (complete_fbo_color_texture_) {
-+      api()->glDeleteTexturesFn(1, &complete_fbo_color_texture_);
-+    }
-+    if (complete_fbo_) {
-+      api()->glDeleteFramebuffersEXTFn(1, &complete_fbo_);
-+    }
-   } else {
-     if (offscreen_target_frame_buffer_.get())
-       offscreen_target_frame_buffer_->Invalidate();
-@@ -5058,13 +5101,13 @@ void GLES2DecoderImpl::RestoreFramebufferBindings() const {
-           ? framebuffer_state_.bound_draw_framebuffer->service_id()
-           : GetBackbufferServiceId();
-   if (!SupportsSeparateFramebufferBinds()) {
--    api()->glBindFramebufferEXTFn(GL_FRAMEBUFFER, service_id);
-+    BindFramebuffer(GL_FRAMEBUFFER, service_id);
-   } else {
--    api()->glBindFramebufferEXTFn(GL_DRAW_FRAMEBUFFER, service_id);
-+    BindFramebuffer(GL_DRAW_FRAMEBUFFER, service_id);
-     service_id = framebuffer_state_.bound_read_framebuffer.get()
-                      ? framebuffer_state_.bound_read_framebuffer->service_id()
-                      : GetBackbufferServiceId();
--    api()->glBindFramebufferEXTFn(GL_READ_FRAMEBUFFER, service_id);
-+    BindFramebuffer(GL_READ_FRAMEBUFFER, service_id);
-   }
-   OnFboChanged();
- }
-@@ -5205,7 +5248,7 @@ void GLES2DecoderImpl::DoBindFramebuffer(GLenum target, GLuint client_id) {
-     service_id = GetBackbufferServiceId();
-   }
- 
--  api()->glBindFramebufferEXTFn(target, service_id);
-+  BindFramebuffer(target, service_id);
-   OnFboChanged();
- }
- 
-@@ -6976,8 +7019,7 @@ void GLES2DecoderImpl::ClearUnclearedAttachments(
-     if (target == GL_READ_FRAMEBUFFER && draw_framebuffer != framebuffer) {
-       // TODO(zmo): There is no guarantee that an FBO that is complete on the
-       // READ attachment will be complete as a DRAW attachment.
--      api()->glBindFramebufferEXTFn(GL_DRAW_FRAMEBUFFER,
--                                    framebuffer->service_id());
-+      BindFramebuffer(GL_DRAW_FRAMEBUFFER, framebuffer->service_id());
-     }
-     state_.SetDeviceColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
-     state_.SetDeviceCapabilityState(GL_SCISSOR_TEST, false);
-@@ -7024,8 +7066,7 @@ void GLES2DecoderImpl::ClearUnclearedAttachments(
-         target == GL_READ_FRAMEBUFFER && draw_framebuffer != framebuffer) {
-       // TODO(zmo): There is no guarantee that an FBO that is complete on the
-       // READ attachment will be complete as a DRAW attachment.
--      api()->glBindFramebufferEXTFn(GL_DRAW_FRAMEBUFFER,
--                                    framebuffer->service_id());
-+      BindFramebuffer(GL_DRAW_FRAMEBUFFER, framebuffer->service_id());
-     }
-     state_.SetDeviceCapabilityState(GL_SCISSOR_TEST, false);
-     ClearDeviceWindowRectangles();
-@@ -7043,7 +7084,7 @@ void GLES2DecoderImpl::ClearUnclearedAttachments(
-     if (target == GL_READ_FRAMEBUFFER && draw_framebuffer != framebuffer) {
-       GLuint service_id = draw_framebuffer ? draw_framebuffer->service_id() :
-                                              GetBackbufferServiceId();
--      api()->glBindFramebufferEXTFn(GL_DRAW_FRAMEBUFFER, service_id);
-+      BindFramebuffer(GL_DRAW_FRAMEBUFFER, service_id);
-     }
-   }
- 
-@@ -7900,7 +7941,8 @@ void GLES2DecoderImpl::RenderbufferStorageMultisampleHelperAMD(
- 
- bool GLES2DecoderImpl::RegenerateRenderbufferIfNeeded(
-     Renderbuffer* renderbuffer) {
--  if (!renderbuffer->RegenerateAndBindBackingObjectIfNeeded(workarounds())) {
-+  if (!renderbuffer->RegenerateAndBindBackingObjectIfNeeded(this,
-+                                                            workarounds())) {
-     return false;
-   }
- 
-@@ -12059,7 +12101,7 @@ bool GLES2DecoderImpl::ClearLevelUsingGL(Texture* texture,
-   GLenum fb_target = GetDrawFramebufferTarget();
-   GLuint fb = 0;
-   api()->glGenFramebuffersEXTFn(1, &fb);
--  api()->glBindFramebufferEXTFn(fb_target, fb);
-+  BindFramebuffer(fb_target, fb);
- 
-   bool have_color = (channels & GLES2Util::kRGBA) != 0;
-   if (have_color) {
-@@ -12102,7 +12144,7 @@ bool GLES2DecoderImpl::ClearLevelUsingGL(Texture* texture,
-   Framebuffer* framebuffer = GetFramebufferInfoForTarget(fb_target);
-   GLuint fb_service_id =
-       framebuffer ? framebuffer->service_id() : GetBackbufferServiceId();
--  api()->glBindFramebufferEXTFn(fb_target, fb_service_id);
-+  BindFramebuffer(fb_target, fb_service_id);
-   return result;
- }
- 
-@@ -14581,8 +14623,9 @@ error::Error GLES2DecoderImpl::HandleGetRequestableExtensionsCHROMIUM(
-       new FeatureInfo(workarounds(), group_->gpu_feature_info()));
-   DisallowedFeatures disallowed_features = feature_info_->disallowed_features();
-   disallowed_features.AllowExtensions();
--  info->Initialize(feature_info_->context_type(),
--                   false /* is_passthrough_cmd_decoder */, disallowed_features);
-+  info->InitializeWithCompleteFramebufferForWorkarounds(
-+      feature_info_->context_type(), false /* is_passthrough_cmd_decoder */,
-+      disallowed_features, complete_fbo_);
-   bucket->SetFromString(gfx::MakeExtensionString(info->extensions()).c_str());
-   return error::kNoError;
- }
-diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_mock.h b/gpu/command_buffer/service/gles2_cmd_decoder_mock.h
-index bd3158e174f0881f99c45a0c8b8d5640e3be2b8f..cc160b5771954b485652f4b0cdc6695bfdea9954 100644
---- a/gpu/command_buffer/service/gles2_cmd_decoder_mock.h
-+++ b/gpu/command_buffer/service/gles2_cmd_decoder_mock.h
-@@ -147,6 +147,8 @@ class MockGLES2Decoder : public GLES2Decoder {
-                     int height,
-                     int depth));
-   MOCK_METHOD0(GetErrorState, ErrorState *());
-+  MOCK_CONST_METHOD2(BindFramebuffer,
-+                     void(unsigned target, uint32_t service_id));
- 
-   MOCK_METHOD0(GetLogger, Logger*());
- 
-diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc
-index e8808f50df6d179879bc44fcacfb4154a4ac0454..de9f2f5cfb247a914606d3ba8b24f0924ac728e0 100644
---- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc
-+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc
-@@ -1541,6 +1541,11 @@ gpu::gles2::ErrorState* GLES2DecoderPassthroughImpl::GetErrorState() {
-   return nullptr;
- }
- 
-+void GLES2DecoderPassthroughImpl::BindFramebuffer(unsigned target,
-+                                                  uint32_t service_id) const {
-+  NOTREACHED();
-+}
-+
- void GLES2DecoderPassthroughImpl::WaitForReadPixels(
-     base::OnceClosure callback) {}
- 
-diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
-index 30dc611c8f0a84ec3493e3f865b6640cab157e2a..50938ca4a0086d14493ec7e0d85b99615c0c7fb7 100644
---- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
-+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
-@@ -315,6 +315,8 @@ class GPU_GLES2_EXPORT GLES2DecoderPassthroughImpl
- 
-   ErrorState* GetErrorState() override;
- 
-+  void BindFramebuffer(unsigned target, uint32_t service_id) const override;
-+
-   void WaitForReadPixels(base::OnceClosure callback) override;
- 
-   // Returns true if the context was lost either by GL_ARB_robustness, forced
-diff --git a/gpu/command_buffer/service/raster_decoder.cc b/gpu/command_buffer/service/raster_decoder.cc
-index 5f61aac4fc217a97ccfcdbd6634056e5f305a425..767fee8cace6dec4cfaf1ccdd46f1764a7ae5318 100644
---- a/gpu/command_buffer/service/raster_decoder.cc
-+++ b/gpu/command_buffer/service/raster_decoder.cc
-@@ -560,6 +560,7 @@ class RasterDecoderImpl final : public RasterDecoder,
- 
-   gles2::ContextGroup* GetContextGroup() override;
-   gles2::ErrorState* GetErrorState() override;
-+  void BindFramebuffer(unsigned target, uint32_t service_id) const override;
- 
-   bool IsCompressedTextureFormat(unsigned format) override;
-   bool ClearLevel(gles2::Texture* texture,
-@@ -1598,6 +1599,11 @@ gles2::ErrorState* RasterDecoderImpl::GetErrorState() {
-   return error_state_.get();
- }
- 
-+void RasterDecoderImpl::BindFramebuffer(unsigned target,
-+                                        uint32_t service_id) const {
-+  NOTREACHED();
-+}
-+
- bool RasterDecoderImpl::IsCompressedTextureFormat(unsigned format) {
-   return feature_info()->validators()->compressed_texture_format.IsValid(
-       format);
-diff --git a/gpu/command_buffer/service/renderbuffer_manager.cc b/gpu/command_buffer/service/renderbuffer_manager.cc
-index 8075cb3acf7204a661a6c094edc1c1a783d46dfb..6cdb9186c4e3bfe40dd437db6b92343f60830171 100644
---- a/gpu/command_buffer/service/renderbuffer_manager.cc
-+++ b/gpu/command_buffer/service/renderbuffer_manager.cc
-@@ -15,6 +15,7 @@
- #include "base/trace_event/memory_dump_manager.h"
- #include "base/trace_event/trace_event.h"
- #include "gpu/command_buffer/common/gles2_cmd_utils.h"
-+#include "gpu/command_buffer/service/decoder_context.h"
- #include "gpu/command_buffer/service/feature_info.h"
- #include "gpu/command_buffer/service/framebuffer_manager.h"
- #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
-@@ -141,6 +142,7 @@ Renderbuffer::Renderbuffer(RenderbufferManager* manager,
- }
- 
- bool Renderbuffer::RegenerateAndBindBackingObjectIfNeeded(
-+    const DecoderContext* decoder,
-     const GpuDriverBugWorkarounds& workarounds) {
-   bool multisample_workaround =
-       workarounds.multisample_renderbuffer_resize_emulation;
-@@ -167,7 +169,7 @@ bool Renderbuffer::RegenerateAndBindBackingObjectIfNeeded(
- 
-   // Attach new renderbuffer to all framebuffers
-   for (auto& point : framebuffer_attachment_points_) {
--    glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER, point.first->service_id());
-+    decoder->BindFramebuffer(GL_DRAW_FRAMEBUFFER, point.first->service_id());
-     glFramebufferRenderbufferEXT(GL_DRAW_FRAMEBUFFER, point.second,
-                                  GL_RENDERBUFFER, service_id_);
-   }
-diff --git a/gpu/command_buffer/service/renderbuffer_manager.h b/gpu/command_buffer/service/renderbuffer_manager.h
-index 7d575387ca8f6a7cb1b4bb020c52f7b53bed5d10..5eabeb9dd160122366507b7dfba53fd1c3285115 100644
---- a/gpu/command_buffer/service/renderbuffer_manager.h
-+++ b/gpu/command_buffer/service/renderbuffer_manager.h
-@@ -22,6 +22,7 @@
- 
- namespace gpu {
- class GpuDriverBugWorkarounds;
-+class DecoderContext;
- 
- namespace gles2 {
- 
-@@ -79,6 +80,7 @@ class GPU_GLES2_EXPORT Renderbuffer : public base::RefCounted<Renderbuffer> {
-   // Regenerates the object backing this client_id, creating a new service_id.
-   // Also reattaches any framebuffers using this renderbuffer.
-   bool RegenerateAndBindBackingObjectIfNeeded(
-+      const DecoderContext* decoder,
-       const GpuDriverBugWorkarounds& workarounds);
- 
-   void AddFramebufferAttachmentPoint(Framebuffer* framebuffer,
-diff --git a/gpu/command_buffer/service/webgpu_decoder_impl.cc b/gpu/command_buffer/service/webgpu_decoder_impl.cc
-index 172834911e75edb3ed1c4dceb3ec23755bf3b5f6..fb873fee0e4b1d33edd4210fad8ad74c6d563355 100644
---- a/gpu/command_buffer/service/webgpu_decoder_impl.cc
-+++ b/gpu/command_buffer/service/webgpu_decoder_impl.cc
-@@ -305,6 +305,9 @@ class WebGPUDecoderImpl final : public WebGPUDecoder {
-   std::string_view GetLogPrefix() override { return "WebGPUDecoderImpl"; }
-   gles2::ContextGroup* GetContextGroup() override { return nullptr; }
-   gles2::ErrorState* GetErrorState() override { NOTREACHED(); }
-+  void BindFramebuffer(unsigned target, uint32_t service_id) const override {
-+    NOTREACHED();
-+  }
-   bool IsCompressedTextureFormat(unsigned format) override { NOTREACHED(); }
-   bool ClearLevel(gles2::Texture* texture,
-                   unsigned target,
-diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
-index ebea892a523322b38a22ba6b0442262edcd6166b..2af5b0460beed7b78c00c9f2a70e14e5f7696ac0 100644
---- a/gpu/config/gpu_driver_bug_list.json
-+++ b/gpu/config/gpu_driver_bug_list.json
-@@ -3818,6 +3818,31 @@
-       "features": [
-         "disable_d3d12_video_encoder"
-       ]
-+    },
-+    {
-+      "id": 470,
-+      "description": "Disable D3D12 video encoder on Windows versions older 11 24H2",
-+      "os": {
-+        "type": "win",
-+        "version": {
-+          "op": "<",
-+          "value": "10.0.26100.2033"
-+        }
-+      },
-+      "features": [
-+        "disable_d3d12_video_encoder"
-+      ]
-+    },
-+    {
-+      "id": 471,
-+      "description": "IMG drivers can sometimes reference previously bound complete framebuffers.",
-+      "os": {
-+        "type": "android"
-+      },
-+      "gl_vendor": "Imagination.*",
-+      "features": [
-+        "ensure_previous_framebuffer_not_deleted"
-+      ]
-     }
-   ]
- }
-diff --git a/gpu/config/gpu_workaround_list.txt b/gpu/config/gpu_workaround_list.txt
-index 7f8b6e019f9b1986411b17c4ef1a2e863eb689f0..30ee7799cdd0a344e433e95cd74e4630a7c87aff 100644
---- a/gpu/config/gpu_workaround_list.txt
-+++ b/gpu/config/gpu_workaround_list.txt
-@@ -78,6 +78,7 @@ dont_delete_source_texture_for_egl_image
- dont_use_loops_to_initialize_variables
- enable_bgra8_overlays_with_yuv_overlay_support
- enable_webgl_timer_query_extensions
-+ensure_previous_framebuffer_not_deleted
- etc1_power_of_two_only
- exit_on_context_lost
- flush_before_create_fence

patches/chromium/cherry-pick-45c5a70d984d.patch

@@ -1,199 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Anders Hartvoll Ruud <andruud@chromium.org>
-Date: Wed, 25 Feb 2026 03:24:19 -0800
-Subject: Describe a vector of segments as "segments", not "tokens"
-
-The specification uses the term "tokens" to refer to a sequence
-of V8CSSUnparsedSegment objects, and CSSUnparsedValue has adopted
-this terminology. While it is usually a good idea for Blink
-to mirror the language used in specifications, "tokens" is very
-confusing here, since it always means CSSParserTokens in every other
-place in the style code.
-
-Bug: 487117772
-Change-Id: I2dc132c4e618e398e1f8bdabc03a8d2ab6c118e7
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7606599
-Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
-Reviewed-by: Steinar H Gunderson <sesse@chromium.org>
-Cr-Commit-Position: refs/heads/main@{#1590040}
-
-diff --git a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-index 486e9d10c1e0a682ec239f4df696f4133300eebb..567d4fad7436c24d4c42bc36ebfd7ee3641e3b90 100644
---- a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-+++ b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-@@ -28,12 +28,12 @@ String FindVariableName(CSSParserTokenStream& stream) {
- 
- V8CSSUnparsedSegment* VariableReferenceValue(
-     const StringView& variable_name,
--    const HeapVector<Member<V8CSSUnparsedSegment>>& tokens) {
-+    const HeapVector<Member<V8CSSUnparsedSegment>>& segments) {
-   CSSUnparsedValue* unparsed_value;
--  if (tokens.size() == 0) {
-+  if (segments.size() == 0) {
-     unparsed_value = nullptr;
-   } else {
--    unparsed_value = CSSUnparsedValue::Create(tokens);
-+    unparsed_value = CSSUnparsedValue::Create(segments);
-   }
- 
-   CSSStyleVariableReferenceValue* variable_reference =
-@@ -50,13 +50,13 @@ V8CSSUnparsedSegment* VariableReferenceValue(
- HeapVector<Member<V8CSSUnparsedSegment>> ParserTokenStreamToTokens(
-     CSSParserTokenStream& stream) {
-   int nesting_level = 0;
--  HeapVector<Member<V8CSSUnparsedSegment>> tokens;
-+  HeapVector<Member<V8CSSUnparsedSegment>> segments;
-   StringBuilder builder;
-   while (stream.Peek().GetType() != kEOFToken) {
-     if (stream.Peek().FunctionId() == CSSValueID::kVar ||
-         stream.Peek().FunctionId() == CSSValueID::kEnv) {
-       if (!builder.empty()) {
--        tokens.push_back(MakeGarbageCollected<V8CSSUnparsedSegment>(
-+        segments.push_back(MakeGarbageCollected<V8CSSUnparsedSegment>(
-             builder.ReleaseString()));
-       }
- 
-@@ -71,7 +71,7 @@ HeapVector<Member<V8CSSUnparsedSegment>> ParserTokenStreamToTokens(
-       if (!ref) {
-         break;
-       }
--      tokens.push_back(ref);
-+      segments.push_back(ref);
-     } else {
-       if (stream.Peek().GetBlockType() == CSSParserToken::kBlockStart) {
-         ++nesting_level;
-@@ -86,10 +86,10 @@ HeapVector<Member<V8CSSUnparsedSegment>> ParserTokenStreamToTokens(
-     }
-   }
-   if (!builder.empty()) {
--    tokens.push_back(
-+    segments.push_back(
-         MakeGarbageCollected<V8CSSUnparsedSegment>(builder.ReleaseString()));
-   }
--  return tokens;
-+  return segments;
- }
- 
- }  // namespace
-@@ -109,8 +109,8 @@ CSSUnparsedValue* CSSUnparsedValue::FromCSSVariableData(
- V8CSSUnparsedSegment* CSSUnparsedValue::AnonymousIndexedGetter(
-     uint32_t index,
-     ExceptionState& exception_state) const {
--  if (index < tokens_.size()) {
--    return tokens_[index].Get();
-+  if (index < segments_.size()) {
-+    return segments_[index].Get();
-   }
-   return nullptr;
- }
-@@ -119,20 +119,20 @@ IndexedPropertySetterResult CSSUnparsedValue::AnonymousIndexedSetter(
-     uint32_t index,
-     V8CSSUnparsedSegment* segment,
-     ExceptionState& exception_state) {
--  if (index < tokens_.size()) {
--    tokens_[index] = segment;
-+  if (index < segments_.size()) {
-+    segments_[index] = segment;
-     return IndexedPropertySetterResult::kIntercepted;
-   }
- 
--  if (index == tokens_.size()) {
--    tokens_.push_back(segment);
-+  if (index == segments_.size()) {
-+    segments_.push_back(segment);
-     return IndexedPropertySetterResult::kIntercepted;
-   }
- 
-   exception_state.ThrowRangeError(
-       ExceptionMessages::IndexOutsideRange<unsigned>(
--          "index", index, 0, ExceptionMessages::kInclusiveBound, tokens_.size(),
--          ExceptionMessages::kInclusiveBound));
-+          "index", index, 0, ExceptionMessages::kInclusiveBound,
-+          segments_.size(), ExceptionMessages::kInclusiveBound));
-   return IndexedPropertySetterResult::kIntercepted;
- }
- 
-@@ -195,14 +195,14 @@ bool CSSUnparsedValue::AppendUnparsedString(
-     return false;  // Cycle.
-   }
-   values_on_stack.insert(this);
--  for (unsigned i = 0; i < tokens_.size(); i++) {
-+  for (unsigned i = 0; i < segments_.size(); i++) {
-     if (i) {
-       builder.Append("/**/");
-     }
--    switch (tokens_[i]->GetContentType()) {
-+    switch (segments_[i]->GetContentType()) {
-       case V8CSSUnparsedSegment::ContentType::kCSSVariableReferenceValue: {
-         const auto* reference_value =
--            tokens_[i]->GetAsCSSVariableReferenceValue();
-+            segments_[i]->GetAsCSSVariableReferenceValue();
-         builder.Append("var(");
-         builder.Append(reference_value->variable());
-         if (reference_value->fallback()) {
-@@ -216,7 +216,7 @@ bool CSSUnparsedValue::AppendUnparsedString(
-         break;
-       }
-       case V8CSSUnparsedSegment::ContentType::kString:
--        builder.Append(tokens_[i]->GetAsString());
-+        builder.Append(segments_[i]->GetAsString());
-         break;
-     }
-   }
-diff --git a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-index c9dab7a0b3ffeaeb6b5d2ab50d876d40c38a760e..5d1961b170f14ae21ca8f69b3c3cd8af28f4478a 100644
---- a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-+++ b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-@@ -26,8 +26,8 @@ class CORE_EXPORT CSSUnparsedValue final : public CSSStyleValue {
- 
-  public:
-   static CSSUnparsedValue* Create(
--      const HeapVector<Member<V8CSSUnparsedSegment>>& tokens) {
--    return MakeGarbageCollected<CSSUnparsedValue>(tokens);
-+      const HeapVector<Member<V8CSSUnparsedSegment>>& segments) {
-+    return MakeGarbageCollected<CSSUnparsedValue>(segments);
-   }
- 
-   // Blink-internal constructor
-@@ -37,14 +37,14 @@ class CORE_EXPORT CSSUnparsedValue final : public CSSStyleValue {
-   static CSSUnparsedValue* FromCSSValue(const CSSUnparsedDeclarationValue&);
-   static CSSUnparsedValue* FromCSSVariableData(const CSSVariableData&);
-   static CSSUnparsedValue* FromString(const String& string) {
--    HeapVector<Member<V8CSSUnparsedSegment>> tokens;
--    tokens.push_back(MakeGarbageCollected<V8CSSUnparsedSegment>(string));
--    return Create(tokens);
-+    HeapVector<Member<V8CSSUnparsedSegment>> segments;
-+    segments.push_back(MakeGarbageCollected<V8CSSUnparsedSegment>(string));
-+    return Create(segments);
-   }
- 
-   explicit CSSUnparsedValue(
--      const HeapVector<Member<V8CSSUnparsedSegment>>& tokens)
--      : tokens_(tokens) {}
-+      const HeapVector<Member<V8CSSUnparsedSegment>>& segments)
-+      : segments_(segments) {}
-   CSSUnparsedValue(const CSSUnparsedValue&) = delete;
-   CSSUnparsedValue& operator=(const CSSUnparsedValue&) = delete;
- 
-@@ -60,10 +60,10 @@ class CORE_EXPORT CSSUnparsedValue final : public CSSStyleValue {
-       V8CSSUnparsedSegment* segment,
-       ExceptionState& exception_state);
- 
--  wtf_size_t length() const { return tokens_.size(); }
-+  wtf_size_t length() const { return segments_.size(); }
- 
-   void Trace(Visitor* visitor) const override {
--    visitor->Trace(tokens_);
-+    visitor->Trace(segments_);
-     CSSStyleValue::Trace(visitor);
-   }
- 
-@@ -81,7 +81,7 @@ class CORE_EXPORT CSSUnparsedValue final : public CSSStyleValue {
-       StringBuilder&,
-       HeapHashSet<Member<const CSSUnparsedValue>>& values_on_stack) const;
- 
--  HeapVector<Member<V8CSSUnparsedSegment>> tokens_;
-+  HeapVector<Member<V8CSSUnparsedSegment>> segments_;
- 
-   FRIEND_TEST_ALL_PREFIXES(CSSUnparsedDeclarationValueTest, MixedList);
- };

patches/chromium/cherry-pick-50b057660b4d.patch

@@ -1,149 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Kai Ninomiya <kainino@chromium.org>
-Date: Wed, 11 Mar 2026 14:52:44 -0700
-Subject: [M146] Increment WebGL context generation number on context restore
-
-Objects created while the context is lost should not be valid to use
-after the context is restored.
-- Replace number_of_context_losses_ with a "context generation number"
-  which increments on both context loss and context restore.
-  - Technically, it would make sense to increment it only on context
-    restore, but just in case any logic is relying on the current
-    behavior, increment it in both places.
-  - It's uint64_t just in case someone figures out how to increment it 4
-    billion times.
-- Remove unused WebGLRenderingContextBase::number_of_context_losses_,
-  left over from before it was moved into WebGLContextObjectSupport.
-
-(cherry picked from commit c1433740f3ea902fd6b15d63c4865ad60a3761f9)
-
-Bug: 485935305
-Change-Id: I1007217c8e69cfb8de4f117e0b7845ca574579c4
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7630664
-Reviewed-by: Kenneth Russell <kbr@chromium.org>
-Commit-Queue: Kai Ninomiya <kainino@chromium.org>
-Cr-Original-Commit-Position: refs/heads/main@{#1593726}
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7658823
-Auto-Submit: Kai Ninomiya <kainino@chromium.org>
-Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
-Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
-Cr-Commit-Position: refs/branch-heads/7680@{#2370}
-Cr-Branched-From: 76b7d80e5cda23fe6537eed26d68c92e995c7f39-refs/heads/main@{#1582197}
-
-diff --git a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc
-index 6a3b1416354e7993e7a9ebd25c4ca08593105d9a..83941f8163a5e9425f2df8fd3bb98e1fd37537ad 100644
---- a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc
-+++ b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc
-@@ -22,7 +22,10 @@ WebGLContextObjectSupport::WebGLContextObjectSupport(
- 
- void WebGLContextObjectSupport::OnContextLost() {
-   DCHECK(!is_lost_);
--  number_of_context_losses_++;
-+  // Invalidate all past objects.
-+  // (It may not be strictly necessary to do this here, since it's also done in
-+  // OnContextRestored, but we did it historically, and there's no harm in it.)
-+  context_generation_++;
-   is_lost_ = true;
-   gles2_interface_ = nullptr;
-   extensions_enabled_.reset();
-@@ -31,6 +34,8 @@ void WebGLContextObjectSupport::OnContextLost() {
- void WebGLContextObjectSupport::OnContextRestored(
-     gpu::gles2::GLES2Interface* gl) {
-   DCHECK(is_lost_);
-+  // Invalidate all past objects.
-+  context_generation_++;
-   is_lost_ = false;
-   gles2_interface_ = gl;
- }
-diff --git a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h
-index 907866bb21acf9647d1c0ecd791e642e96b734fc..ba8b79f8bb9db12058614982a625baaff5546af7 100644
---- a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h
-+++ b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h
-@@ -33,10 +33,10 @@ class MODULES_EXPORT WebGLContextObjectSupport : public ScriptWrappable {
-   bool IsWebGL2() const { return is_webgl2_; }
-   bool IsLost() const { return is_lost_; }
- 
--  // How many context losses there were, to check whether a WebGLObject was
--  // created since the last context resoration or before that (and hence invalid
--  // to use).
--  uint32_t NumberOfContextLosses() const { return number_of_context_losses_; }
-+  // Which "generation" the context is on (essentially, how many times it has
-+  // been restored), to check whether a WebGLObject was created since the last
-+  // context restoration, or before that (and hence invalid to use).
-+  uint64_t GetContextGeneration() const { return context_generation_; }
- 
-   bool ExtensionEnabled(WebGLExtensionName name) const {
-     return extensions_enabled_.test(name);
-@@ -65,7 +65,7 @@ class MODULES_EXPORT WebGLContextObjectSupport : public ScriptWrappable {
-   std::bitset<kWebGLExtensionNameCount> extensions_enabled_ = {};
-   raw_ptr<gpu::gles2::GLES2Interface> gles2_interface_ = nullptr;
- 
--  uint32_t number_of_context_losses_ = 0;
-+  uint64_t context_generation_ = 0;
-   bool is_lost_ = true;
-   bool is_webgl2_;
- };
-diff --git a/third_party/blink/renderer/modules/webgl/webgl_object.cc b/third_party/blink/renderer/modules/webgl/webgl_object.cc
-index 9d984de0073796f23a5038bfc0a51ec676179765..07e0a9a4aa3406a1298a677a3159edadc5f2cbb5 100644
---- a/third_party/blink/renderer/modules/webgl/webgl_object.cc
-+++ b/third_party/blink/renderer/modules/webgl/webgl_object.cc
-@@ -33,9 +33,9 @@ namespace blink {
- 
- WebGLObject::WebGLObject(WebGLContextObjectSupport* context)
-     : context_(context),
--      cached_number_of_context_losses_(std::numeric_limits<uint32_t>::max()) {
-+      context_generation_at_creation_(std::numeric_limits<uint64_t>::max()) {
-   if (context_) {
--    cached_number_of_context_losses_ = context->NumberOfContextLosses();
-+    context_generation_at_creation_ = context->GetContextGeneration();
-   }
- }
- 
-@@ -46,7 +46,7 @@ bool WebGLObject::Validate(const WebGLContextObjectSupport* context) const {
-   // the objects they ever created, so there's no way to invalidate them
-   // eagerly during context loss. The invalidation is discovered lazily.
-   return (context == context_ && context_ != nullptr &&
--          cached_number_of_context_losses_ == context->NumberOfContextLosses());
-+          context_generation_at_creation_ == context->GetContextGeneration());
- }
- 
- void WebGLObject::SetObject(GLuint object) {
-@@ -71,7 +71,7 @@ void WebGLObject::DeleteObject(gpu::gles2::GLES2Interface* gl) {
-     return;
-   }
- 
--  if (context_->NumberOfContextLosses() != cached_number_of_context_losses_) {
-+  if (context_->GetContextGeneration() != context_generation_at_creation_) {
-     // This object has been invalidated.
-     return;
-   }
-diff --git a/third_party/blink/renderer/modules/webgl/webgl_object.h b/third_party/blink/renderer/modules/webgl/webgl_object.h
-index bb56df0f99e8e8432e03442feb9302b8dde27d01..97caa90e34288911b1a827e60c2569544d2b8f69 100644
---- a/third_party/blink/renderer/modules/webgl/webgl_object.h
-+++ b/third_party/blink/renderer/modules/webgl/webgl_object.h
-@@ -123,9 +123,9 @@ class WebGLObject : public ScriptWrappable {
- 
-   GLuint object_ = 0;
- 
--  // This was the number of context losses of the object's associated
--  // WebGLContext at the time this object was created.
--  uint32_t cached_number_of_context_losses_;
-+  // The context generation number of the associated WebGLContext when the
-+  // object was created, to prevent reuse in later generations.
-+  uint64_t context_generation_at_creation_;
- 
-   unsigned attachment_count_ = 0;
- 
-diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
-index 060563a9955a8564d176177fc389c4f98aa64e9f..f24221cb2f47cfde515179ff945c13756487ebfc 100644
---- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
-+++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
-@@ -2073,8 +2073,6 @@ class MODULES_EXPORT WebGLRenderingContextBase
- 
-   bool has_been_drawn_to_ = false;
- 
--  uint32_t number_of_context_losses_ = 0;
--
-   // Tracks if the context has ever called glBeginPixelLocalStorageANGLE. If it
-   // has, we need to start using the pixel local storage interrupt mechanism
-   // when we take over the client's context.

patches/chromium/cherry-pick-5efc7a0127a6.patch

@@ -1,219 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Anders Hartvoll Ruud <andruud@chromium.org>
-Date: Wed, 25 Feb 2026 06:21:21 -0800
-Subject: Validate CSSUnparsedValues upon assignment
-
-CSS Typed OM has a concept of a value "matching a grammar" (or not)
-upon assignment to a property [1]. For CSSUnparsedValues, we currently
-don't perform any significant validation, and as a consequence
-we allow "invalid" CSSUnparsedDeclarationValues to be created
-(causing DCHECKs later in the pipeline).
-
-This CL makes sure values can be parsed using CSSVariableParser::
-ConsumeUnparsedDeclaration before assignment.
-
-We're still not handling the value in the context of the destination
-property, which we probably should. This is also a problem with
-current state of things, however, so for now the goal is primarily
-to avoid the DCHECKs in Issue 484751092.
-
-Finally, I opened an issue against the specification [2], which
-currently doesn't define any of this.
-
-[1] https://drafts.css-houdini.org/css-typed-om-1/#create-an-internal-representation
-[2] https://github.com/w3c/csswg-drafts/issues/13547
-
-Fixed: 484751092
-Change-Id: Id7f888a6df8c02ade24910900f5d01909cb2dfad
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7595347
-Reviewed-by: Steinar H Gunderson <sesse@chromium.org>
-Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
-Cr-Commit-Position: refs/heads/main@{#1590110}
-
-diff --git a/third_party/blink/renderer/build/scripts/core/css/templates/cssom_types.cc.tmpl b/third_party/blink/renderer/build/scripts/core/css/templates/cssom_types.cc.tmpl
-index edfa73a57d30ebd4f9a7147702df42b836f7d82b..4442ba0872ca4c739596b546e6d3b600c5a31598 100644
---- a/third_party/blink/renderer/build/scripts/core/css/templates/cssom_types.cc.tmpl
-+++ b/third_party/blink/renderer/build/scripts/core/css/templates/cssom_types.cc.tmpl
-@@ -11,6 +11,7 @@
- #include "third_party/blink/renderer/core/css/cssom/css_keyword_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_numeric_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_style_value.h"
-+#include "third_party/blink/renderer/core/css/cssom/css_unparsed_value.h"
- #include "third_party/blink/renderer/core/css/cssom/css_unsupported_style_value.h"
- #include "third_party/blink/renderer/core/css/cssom/cssom_keywords.h"
- #include "third_party/blink/renderer/core/css/properties/css_property.h"
-@@ -105,8 +106,8 @@ bool CSSOMTypes::PropertyCanTake(CSSPropertyID id,
-                     : CSSPropertyName(id);
-     return unsupported_style_value->IsValidFor(name);
-   }
--  if (value.GetType() == CSSStyleValue::kUnparsedType) {
--    return true;
-+  if (auto* unparsed_value = DynamicTo<CSSUnparsedValue>(value)) {
-+    return unparsed_value->IsValidDeclarationValue();
-   }
- 
-   switch (id) {
-diff --git a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-index 12d70ed096cb1c509a2acf14b7f421273d833d0e..5f9d6a39effe207e44dd84cececebdb6c666f011 100644
---- a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-+++ b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
-@@ -4,11 +4,13 @@
- 
- #include "third_party/blink/renderer/core/css/cssom/css_unparsed_value.h"
- 
-+#include "css_style_value.h"
- #include "third_party/blink/renderer/core/css/css_unparsed_declaration_value.h"
- #include "third_party/blink/renderer/core/css/css_variable_data.h"
- #include "third_party/blink/renderer/core/css/cssom/css_style_variable_reference_value.h"
- #include "third_party/blink/renderer/core/css/parser/css_parser_token_stream.h"
- #include "third_party/blink/renderer/core/css/parser/css_tokenizer.h"
-+#include "third_party/blink/renderer/core/css/parser/css_variable_parser.h"
- #include "third_party/blink/renderer/core/css_value_keywords.h"
- #include "third_party/blink/renderer/platform/bindings/exception_messages.h"
- #include "third_party/blink/renderer/platform/bindings/exception_state.h"
-@@ -136,6 +138,10 @@ IndexedPropertySetterResult CSSUnparsedValue::AnonymousIndexedSetter(
-   return IndexedPropertySetterResult::kIntercepted;
- }
- 
-+bool CSSUnparsedValue::IsValidDeclarationValue() const {
-+  return IsValidDeclarationValue(ToStringInternal());
-+}
-+
- const CSSValue* CSSUnparsedValue::ToCSSValue() const {
-   String unparsed_string = ToStringInternal();
- 
-@@ -144,12 +150,40 @@ const CSSValue* CSSUnparsedValue::ToCSSValue() const {
-         MakeGarbageCollected<CSSVariableData>());
-   }
- 
-+  CHECK(IsValidDeclarationValue(unparsed_string));
-+  // The call to IsValidDeclarationValue() above also creates a CSSVariableData
-+  // to carry out its check. It would be nice to use that here, but WPTs
-+  // expect leading whitespace to be preserved, even though it's not possible
-+  // to create such declaration values normally.
-+  CSSVariableData* variable_data =
-+      CSSVariableData::Create(unparsed_string,
-+                              /*is_animation_tainted=*/false,
-+                              /*is_attr_tainted=*/false,
-+                              /*needs_variable_resolution=*/false);
-+
-   // TODO(crbug.com/985028): We should probably propagate the CSSParserContext
-   // to here.
--  return MakeGarbageCollected<CSSUnparsedDeclarationValue>(
--      CSSVariableData::Create(unparsed_string, false /* is_animation_tainted */,
--                              false /* is_attr_tainted */,
--                              false /* needs_variable_resolution */));
-+  return MakeGarbageCollected<CSSUnparsedDeclarationValue>(variable_data);
-+}
-+
-+bool CSSUnparsedValue::IsValidDeclarationValue(const String& string) {
-+  CSSParserTokenStream stream(string);
-+  bool important_unused;
-+  // This checks that the value does not violate the "argument grammar" [1]
-+  // of any substitution functions, and that it is a valid <declaration-value>
-+  // otherwise.
-+  //
-+  // [1] https://drafts.csswg.org/css-values-5/#argument-grammar
-+  //
-+  // TODO(andruud): 'restricted_value' depends on the destination property.
-+  return CSSVariableParser::ConsumeUnparsedDeclaration(
-+      stream,
-+      /*allow_important_annotation=*/false,
-+      /*is_animation_tainted=*/false,
-+      /*must_contain_variable_reference=*/false,
-+      /*restricted_value=*/false,
-+      /*comma_ends_declaration=*/false, important_unused,
-+      *StrictCSSParserContext(SecureContextMode::kInsecureContext));
- }
- 
- String CSSUnparsedValue::ToStringInternal() const {
-diff --git a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-index ec7e3ed708f406d7a61fdb370b2eed8a8297cffb..7fd66aed677e31046a1bd206854b2cbeac07c25b 100644
---- a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-+++ b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.h
-@@ -48,6 +48,14 @@ class CORE_EXPORT CSSUnparsedValue final : public CSSStyleValue {
-   CSSUnparsedValue(const CSSUnparsedValue&) = delete;
-   CSSUnparsedValue& operator=(const CSSUnparsedValue&) = delete;
- 
-+  // True if this CSSUnparsedValue can be converted into
-+  // a CSSUnparsedDeclarationValue.
-+  //
-+  // We may want to ban some invalid values earlier, see:
-+  // https://github.com/w3c/csswg-drafts/issues/13547
-+  bool IsValidDeclarationValue() const;
-+
-+  // Requires IsValidDeclarationValue()==true.
-   const CSSValue* ToCSSValue() const override;
- 
-   StyleValueType GetType() const override { return kUnparsedType; }
-@@ -68,6 +76,7 @@ class CORE_EXPORT CSSUnparsedValue final : public CSSStyleValue {
-   }
- 
-  private:
-+  static bool IsValidDeclarationValue(const String&);
-   String ToStringInternal() const;
-   String SerializeSegments() const;
-   // Return 'false' if there is a cycle in the serialization.
-diff --git a/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html b/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html
-deleted file mode 100644
-index b92bd62deb71f2623b0265bed099d739cd1fce3a..0000000000000000000000000000000000000000
---- a/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html
-+++ /dev/null
-@@ -1,12 +0,0 @@
--<!DOCTYPE html>
--<title>Crash Test: Missing variable name in CSSUnparsedValue</title>
--<link rel="help" href="https://issues.chromium.org/issues/484811719">
--<div id="div"></div>
--<script>
--  for (let i = 0; i < 5000; ++i) {
--    const bad = new CSSUnparsedValue(['var(,)']);
--    div.attributeStyleMap.set('--x', bad);
--    div.attributeStyleMap.get('--x');
--  }
--</script>
--<p>PASS if no crash</p>
-diff --git a/third_party/blink/web_tests/external/wpt/css/css-typed-om/set-invalid-untyped-value-crash.html b/third_party/blink/web_tests/external/wpt/css/css-typed-om/set-invalid-untyped-value-crash.html
-new file mode 100644
-index 0000000000000000000000000000000000000000..ce618bf38fe651297b969ffdc16e212dee6a3688
---- /dev/null
-+++ b/third_party/blink/web_tests/external/wpt/css/css-typed-om/set-invalid-untyped-value-crash.html
-@@ -0,0 +1,39 @@
-+<!DOCTYPE html>
-+<title>Crash when setting invalid CSSUnparsedValue</title>
-+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/13547">
-+<div id=target></div>
-+<script>
-+  let examples = [
-+    'var()',
-+    'var(,)',
-+    'var(0)',
-+    'env()',
-+    'env(,)',
-+    'env(0)',
-+    'attr()',
-+    'attr(,)',
-+    'attr(0)',
-+    'if()',
-+    'if(,)',
-+    'if(0)',
-+    '--f()',
-+    '--f(,)',
-+    '--f(0)',
-+    'thing!!!',
-+    'var(--x) !important',
-+  ];
-+  // Some of the above cases may be valid. That's fine; just don't crash.
-+
-+  for (let e of examples) {
-+    try {
-+      let value = new CSSUnparsedValue([e]);
-+      target.attributeStyleMap.set('width', value);
-+      // One of the two above statements should likely throw an exception.
-+      // If they don't, then we should at least not crash on get():
-+      target.attributeStyleMap.get('width');
-+    } catch (e) {
-+      // Intentionally empty.
-+    }
-+    target.offsetTop;
-+  }
-+</script>

patches/chromium/cherry-pick-fbfb27470bf6.patch

@@ -1,65 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Geoff Lang <geofflang@chromium.org>
-Date: Wed, 18 Feb 2026 13:54:37 -0800
-Subject: Validate uniform block count limits at compile time on IMG.
-
-Normally these limits are validated at link time but the IMG compiler
-has issues when these limits are exceeded. Validate at compile time
-instead.
-
-Bug: chromium:475877320
-Change-Id: Ieeed6914b8cdd2b5e50242d06facae62badddefd
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7568129
-Auto-Submit: Geoff Lang <geofflang@chromium.org>
-Reviewed-by: Kyle Charbonneau <kylechar@chromium.org>
-Commit-Queue: Kyle Charbonneau <kylechar@chromium.org>
-Cr-Commit-Position: refs/heads/main@{#1586673}
-
-diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
-index 895266f5988e2446eadf3d3e1d5c4919416cba76..aeafafece78faa6ece837386fe170592589d1b10 100644
---- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
-+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
-@@ -3678,6 +3678,9 @@ bool GLES2DecoderImpl::InitializeShaderTranslator() {
-     driver_bug_workarounds.dontUseLoopsToInitializeVariables = true;
-   if (workarounds().remove_dynamic_indexing_of_swizzled_vector)
-     driver_bug_workarounds.removeDynamicIndexingOfSwizzledVector = true;
-+  if (workarounds().validate_max_per_stage_uniform_blocks_at_compile_time) {
-+    driver_bug_workarounds.validatePerStageMaxUniformBlocks = true;
-+  }
- 
-   // Initialize uninitialized locals by default
-   driver_bug_workarounds.initializeUninitializedLocals = true;
-diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
-index 2af5b0460beed7b78c00c9f2a70e14e5f7696ac0..3cc48e4a79576f93bfa22b8f8d1b74e5ba5baae7 100644
---- a/gpu/config/gpu_driver_bug_list.json
-+++ b/gpu/config/gpu_driver_bug_list.json
-@@ -3843,6 +3843,17 @@
-       "features": [
-         "ensure_previous_framebuffer_not_deleted"
-       ]
-+    },
-+    {
-+      "id": 472,
-+      "description": "Validate GL_MAX_*_UNIFORM_BLOCKS at compile time instead of link time to work around compiler bugs.",
-+      "os": {
-+        "type": "android"
-+      },
-+      "gl_vendor": "Imagination.*",
-+      "features": [
-+        "validate_max_per_stage_uniform_blocks_at_compile_time"
-+      ]
-     }
-   ]
- }
-diff --git a/gpu/config/gpu_workaround_list.txt b/gpu/config/gpu_workaround_list.txt
-index 30ee7799cdd0a344e433e95cd74e4630a7c87aff..6d43d0b1937cd1eeaa044fb9949a52ba2e07d446 100644
---- a/gpu/config/gpu_workaround_list.txt
-+++ b/gpu/config/gpu_workaround_list.txt
-@@ -126,6 +126,7 @@ use_first_valid_ref_for_av1_invalid_ref
- use_gpu_driver_workaround_for_testing
- use_non_zero_size_for_client_side_stream_buffers
- use_virtualized_gl_contexts
-+validate_max_per_stage_uniform_blocks_at_compile_time
- wake_up_gpu_before_drawing
- webgl_or_caps_max_texture_size_limit_4096
- webgl_or_caps_max_texture_size_limit_8192