Bump v6.1.12

Co-authored-by: Andrey Belenko <anbelen@microsoft.com>

.circleci/config.yml

@@ -543,8 +543,10 @@ step-mksnapshot-build: &step-mksnapshot-build
       if [ "`uname`" != "Darwin" ]; then
         if [ "$TARGET_ARCH" == "arm" ]; then
           electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/mksnapshot
+          electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/v8_context_snapshot_generator
         elif [ "$TARGET_ARCH" == "arm64" ]; then
           electron/script/strip-binaries.py --file $PWD/out/Default/clang_x64_v8_arm64/mksnapshot
+          electron/script/strip-binaries.py --file $PWD/out/Default/clang_x64_v8_arm64/v8_context_snapshot_generator
         else
           electron/script/strip-binaries.py --file $PWD/out/Default/mksnapshot
           electron/script/strip-binaries.py --file $PWD/out/Default/v8_context_snapshot_generator

BUILD.gn

@@ -1350,7 +1350,7 @@ dist_zip("electron_chromedriver_zip") {
 
 mksnapshot_deps = [
   ":licenses",
-  "//tools/v8_context_snapshot:v8_context_snapshot_generator",
+  "//tools/v8_context_snapshot:v8_context_snapshot_generator($v8_snapshot_toolchain)",
   "//v8:mksnapshot($v8_snapshot_toolchain)",
 ]
 

ELECTRON_VERSION

@@ -1 +1 @@
-6.1.10
+6.1.12

atom/app/atom_content_client.cc

@@ -21,7 +21,7 @@
 #include "ui/base/resource/resource_bundle.h"
 #include "url/url_constants.h"
 // In SHARED_INTERMEDIATE_DIR.
-#include "widevine_cdm_version.h"  // NOLINT(build/include)
+#include "widevine_cdm_version.h"  // NOLINT(build/include_directory)
 
 #if defined(WIDEVINE_CDM_AVAILABLE)
 #include "base/native_library.h"

atom/app/uv_task_runner.h

@@ -10,7 +10,7 @@
 #include "base/callback.h"
 #include "base/location.h"
 #include "base/single_thread_task_runner.h"
-#include "uv.h"  // NOLINT(build/include)
+#include "uv.h"  // NOLINT(build/include_directory)
 
 namespace atom {
 

atom/browser/javascript_environment.h

@@ -9,7 +9,7 @@
 
 #include "base/macros.h"
 #include "gin/public/isolate_holder.h"
-#include "uv.h"  // NOLINT(build/include)
+#include "uv.h"  // NOLINT(build/include_directory)
 
 namespace node {
 class Environment;

atom/browser/resources/mac/Info.plist

@@ -17,9 +17,9 @@
     <key>CFBundleIconFile</key>
     <string>electron.icns</string>
     <key>CFBundleVersion</key>
-    <string>6.1.10</string>
+    <string>6.1.12</string>
     <key>CFBundleShortVersionString</key>
-    <string>6.1.10</string>
+    <string>6.1.12</string>
     <key>LSApplicationCategoryType</key>
     <string>public.app-category.developer-tools</string>
     <key>LSMinimumSystemVersion</key>

atom/browser/resources/win/atom.rc

@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 6,1,10,0
- PRODUCTVERSION 6,1,10,0
+ FILEVERSION 6,1,12,0
+ PRODUCTVERSION 6,1,12,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "6.1.10"
+            VALUE "FileVersion", "6.1.12"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "6.1.10"
+            VALUE "ProductVersion", "6.1.12"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

atom/common/api/electron_bindings.h

@@ -15,7 +15,7 @@
 #include "base/process/process_metrics.h"
 #include "base/strings/string16.h"
 #include "native_mate/arguments.h"
-#include "uv.h"  // NOLINT(build/include)
+#include "uv.h"  // NOLINT(build/include_directory)
 #include "v8/include/v8.h"
 
 namespace mate {

atom/common/atom_command_line.cc

@@ -5,7 +5,7 @@
 #include "atom/common/atom_command_line.h"
 
 #include "base/command_line.h"
-#include "uv.h"  // NOLINT(build/include)
+#include "uv.h"  // NOLINT(build/include_directory)
 
 namespace atom {
 

atom/common/atom_version.h

@@ -7,7 +7,7 @@
 
 #define ATOM_MAJOR_VERSION 6
 #define ATOM_MINOR_VERSION 1
-#define ATOM_PATCH_VERSION 10
+#define ATOM_PATCH_VERSION 12
 // clang-format off
 // #define ATOM_PRE_RELEASE_VERSION
 // clang-format on

atom/common/node_bindings.h

@@ -9,7 +9,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
-#include "uv.h"  // NOLINT(build/include)
+#include "uv.h"  // NOLINT(build/include_directory)
 #include "v8/include/v8.h"
 
 namespace base {

atom/renderer/renderer_client_base.h

@@ -12,7 +12,7 @@
 #include "content/public/renderer/content_renderer_client.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 // In SHARED_INTERMEDIATE_DIR.
-#include "widevine_cdm_version.h"  // NOLINT(build/include)
+#include "widevine_cdm_version.h"  // NOLINT(build/include_directory)
 
 #if defined(WIDEVINE_CDM_AVAILABLE)
 #include "chrome/renderer/media/chrome_key_systems_provider.h"  // nogncheck

azure-pipelines-woa.yml

@@ -80,5 +80,6 @@ steps:
 - powershell: |
     Get-Process | Where Name –Like "electron*" | Stop-Process
     Get-Process | Where Name –Like "MicrosoftEdge*" | Stop-Process
+    Get-Process | Where Name –Like "msedge*" | Stop-Process
   displayName: 'Kill processes left running from last test run'
   condition: always()

lib/browser/guest-window-manager.js

@@ -191,7 +191,7 @@ ipcMainInternal.on('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_OPEN', (event, url, fra
   const options = {}
 
   const ints = ['x', 'y', 'width', 'height', 'minWidth', 'maxWidth', 'minHeight', 'maxHeight', 'zoomFactor']
-  const webPreferences = ['zoomFactor', 'nodeIntegration', 'enableRemoteModule', 'preload', 'javascript', 'contextIsolation', 'webviewTag']
+  const webPreferences = ['zoomFactor', 'nodeIntegration', 'enableRemoteModule', 'javascript', 'contextIsolation', 'webviewTag']
   const disposition = 'new-window'
 
   // Used to store additional features

lib/renderer/api/ipc-renderer.js

@@ -7,24 +7,26 @@ const v8Util = process.electronBinding('v8_util')
 const ipcRenderer = v8Util.getHiddenValue(global, 'ipc')
 const internal = false
 
-ipcRenderer.send = function (channel, ...args) {
-  return ipc.send(internal, channel, args)
-}
+if (!ipcRenderer.send) {
+  ipcRenderer.send = function (channel, ...args) {
+    return ipc.send(internal, channel, args)
+  }
 
-ipcRenderer.sendSync = function (channel, ...args) {
-  return ipc.sendSync(internal, channel, args)[0]
-}
+  ipcRenderer.sendSync = function (channel, ...args) {
+    return ipc.sendSync(internal, channel, args)[0]
+  }
 
-ipcRenderer.sendToHost = function (channel, ...args) {
-  return ipc.sendToHost(channel, args)
-}
+  ipcRenderer.sendToHost = function (channel, ...args) {
+    return ipc.sendToHost(channel, args)
+  }
 
-ipcRenderer.sendTo = function (webContentsId, channel, ...args) {
-  return ipc.sendTo(internal, false, webContentsId, channel, args)
-}
+  ipcRenderer.sendTo = function (webContentsId, channel, ...args) {
+    return ipc.sendTo(internal, false, webContentsId, channel, args)
+  }
 
-ipcRenderer.sendToAll = function (webContentsId, channel, ...args) {
-  return ipc.sendTo(internal, true, webContentsId, channel, args)
+  ipcRenderer.sendToAll = function (webContentsId, channel, ...args) {
+    return ipc.sendTo(internal, true, webContentsId, channel, args)
+  }
 }
 
 module.exports = ipcRenderer

lib/renderer/ipc-renderer-internal.ts

@@ -5,18 +5,20 @@ const v8Util = process.electronBinding('v8_util')
 export const ipcRendererInternal: Electron.IpcRendererInternal = v8Util.getHiddenValue(global, 'ipc-internal')
 const internal = true
 
-ipcRendererInternal.send = function (channel, ...args) {
-  return binding.ipc.send(internal, channel, args)
-}
+if (!ipcRendererInternal.send) {
+  ipcRendererInternal.send = function (channel, ...args) {
+    return binding.ipc.send(internal, channel, args)
+  }
 
-ipcRendererInternal.sendSync = function (channel, ...args) {
-  return binding.ipc.sendSync(internal, channel, args)[0]
-}
+  ipcRendererInternal.sendSync = function (channel, ...args) {
+    return binding.ipc.sendSync(internal, channel, args)[0]
+  }
 
-ipcRendererInternal.sendTo = function (webContentsId, channel, ...args) {
-  return binding.ipc.sendTo(internal, false, webContentsId, channel, args)
-}
+  ipcRendererInternal.sendTo = function (webContentsId, channel, ...args) {
+    return binding.ipc.sendTo(internal, false, webContentsId, channel, args)
+  }
 
-ipcRendererInternal.sendToAll = function (webContentsId, channel, ...args) {
-  return binding.ipc.sendTo(internal, true, webContentsId, channel, args)
+  ipcRendererInternal.sendToAll = function (webContentsId, channel, ...args) {
+    return binding.ipc.sendTo(internal, true, webContentsId, channel, args)
+  }
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "6.1.10",
+  "version": "6.1.12",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {

patches/common/angle/.patches

@@ -0,0 +1 @@
+update_the_active_texture_cache_before_changing_the_texture_binding.patch

patches/common/angle/update_the_active_texture_cache_before_changing_the_texture_binding.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Geoff Lang <geofflang@chromium.org>
+Date: Fri, 27 Mar 2020 12:24:52 -0400
+Subject: Update the active texture cache before changing the texture binding.
+
+When a new texture is bound, the texture binding state is updated before
+updating the active texture cache. With this ordering, it is possible to delete
+the currently bound texture when the binding changes and then use-after-free it
+when updating the active texture cache.
+
+BUG=angleproject:1065186
+
+Change-Id: Id6d56b6c6db423755b195cda1e5cf1bcb1ee7aee
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2124588
+Commit-Queue: Geoff Lang <geofflang@chromium.org>
+Reviewed-by: Jamie Madill <jmadill@chromium.org>
+
+diff --git a/src/libANGLE/State.cpp b/src/libANGLE/State.cpp
+index 9b2b36e9346753d90f84c2af9b3added7d984aba..e028ebde202c375b6df888fdc5a6933683794380 100644
+--- a/src/libANGLE/State.cpp
++++ b/src/libANGLE/State.cpp
+@@ -1096,14 +1096,14 @@ void State::setActiveSampler(unsigned int active)
+ 
+ void State::setSamplerTexture(const Context *context, TextureType type, Texture *texture)
+ {
+-    mSamplerTextures[type][mActiveSampler].set(context, texture);
+-
+     if (mProgram && mProgram->getActiveSamplersMask()[mActiveSampler] &&
+         mProgram->getActiveSamplerTypes()[mActiveSampler] == type)
+     {
+         updateActiveTexture(context, mActiveSampler, texture);
+     }
+ 
++    mSamplerTextures[type][mActiveSampler].set(context, texture);
++
+     mDirtyBits.set(DIRTY_BIT_TEXTURE_BINDINGS);
+ }
+ 

patches/common/chromium/.patches

@@ -110,3 +110,10 @@ speculative_fix_for_crashes_in_filechooserimpl.patch
 reland_sequentialise_access_to_callbacks_in.patch
 handle_err_cache_race_in_dodoneheadersaddtoentrycomplete.patch
 mojovideoencodeacceleratorservice_handle_potential_later.patch
+cherry-pick-826a4af58b3d.patch
+cherry-pick-686d1bfbcb8f.patch
+cherry-pick-b69991a9b701.patch
+cherry-pick-38990b7d56e6.patch
+cherry-pick-67864c214770.patch
+cherry-pick-7101418f85a0.patch
+cherry-pick-86c02c5dcd37.patch

patches/common/chromium/cherry-pick-38990b7d56e6.patch

@@ -0,0 +1,77 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marijn Kruisselbrink <mek@chromium.org>
+Date: Tue, 21 Apr 2020 23:51:25 +0000
+Subject: Fix bug when BytesProvider replies with invalid data.
+
+Bug: 1072983
+Change-Id: Ideaa0a67680375e770995880a4b8d2014b51d642
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2159583
+Reviewed-by: enne <enne@chromium.org>
+Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#761203}
+
+diff --git a/storage/browser/blob/blob_registry_impl.cc b/storage/browser/blob/blob_registry_impl.cc
+index aa81ace360a4b85e4eca8a3e72d2674036159f76..166fc9cb65b81a3836f410c34f0cdd8ed6726b9d 100644
+--- a/storage/browser/blob/blob_registry_impl.cc
++++ b/storage/browser/blob/blob_registry_impl.cc
+@@ -433,6 +433,10 @@ void BlobRegistryImpl::BlobUnderConstruction::TransportComplete(
+   // try to delete |this| again afterwards.
+   auto weak_this = weak_ptr_factory_.GetWeakPtr();
+ 
++  // Store the bad_message_callback_, so we can invoke it if needed, after
++  // notifying about the blob being finished.
++  auto bad_message_callback = std::move(bad_message_callback_);
++
+   // The blob might no longer have any references, in which case it may no
+   // longer exist. If that happens just skip calling Complete.
+   // TODO(mek): Stop building sooner if a blob is no longer referenced.
+@@ -446,7 +450,7 @@ void BlobRegistryImpl::BlobUnderConstruction::TransportComplete(
+     // BlobTransportStrategy might have already reported a BadMessage on the
+     // BytesProvider binding, but just to be safe, also report one on the
+     // BlobRegistry binding itself.
+-    std::move(bad_message_callback_)
++    std::move(bad_message_callback)
+         .Run("Received invalid data while transporting blob");
+   }
+   if (weak_this)
+diff --git a/storage/browser/blob/blob_registry_impl_unittest.cc b/storage/browser/blob/blob_registry_impl_unittest.cc
+index 31be8a2658c7e29f06ec319671d086f407a1192d..7b57ec7fef8077962fe2f50ea7a2a4f2420e49a2 100644
+--- a/storage/browser/blob/blob_registry_impl_unittest.cc
++++ b/storage/browser/blob/blob_registry_impl_unittest.cc
+@@ -755,6 +755,36 @@ TEST_F(BlobRegistryImplTest, Register_ValidBytesAsReply) {
+   EXPECT_EQ(0u, BlobsUnderConstruction());
+ }
+ 
++TEST_F(BlobRegistryImplTest, Register_InvalidBytesAsReply) {
++  const std::string kId = "id";
++  const std::string kData = "hello";
++
++  std::vector<blink::mojom::DataElementPtr> elements;
++  elements.push_back(
++      blink::mojom::DataElement::NewBytes(blink::mojom::DataElementBytes::New(
++          kData.size(), base::nullopt, CreateBytesProvider(""))));
++
++  mojo::PendingRemote<blink::mojom::Blob> blob;
++  EXPECT_TRUE(registry_->Register(blob.InitWithNewPipeAndPassReceiver(), kId,
++                                  "", "", std::move(elements)));
++
++  std::unique_ptr<BlobDataHandle> handle = context_->GetBlobDataFromUUID(kId);
++  WaitForBlobCompletion(handle.get());
++
++  EXPECT_TRUE(handle->IsBroken());
++  ASSERT_EQ(BlobStatus::ERR_INVALID_CONSTRUCTION_ARGUMENTS,
++            handle->GetBlobStatus());
++
++  EXPECT_EQ(1u, reply_request_count_);
++  EXPECT_EQ(0u, stream_request_count_);
++  EXPECT_EQ(0u, file_request_count_);
++  EXPECT_EQ(0u, BlobsUnderConstruction());
++
++  // Expect 2 bad messages, one for the bad reply by the bytes provider, and one
++  // for the original register call.
++  EXPECT_EQ(2u, bad_messages_.size());
++}
++
+ TEST_F(BlobRegistryImplTest, Register_ValidBytesAsStream) {
+   const std::string kId = "id";
+   const std::string kData =

patches/common/chromium/cherry-pick-67864c214770.patch

@@ -0,0 +1,82 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Cheng <dcheng@chromium.org>
+Date: Fri, 10 Apr 2020 00:43:45 +0000
+Subject: Use std::deque to store the stack of currently executing tasks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The stack of currently executing stacks includes a PendingTask field. A
+pointer to this field is stored in TLS. However, std::vector does not
+guarantee pointer stability on resize.
+
+(cherry picked from commit c34431a597aba8f4374975217d97a73eaf7d1f18)
+
+Bug: 1064891
+Change-Id: I04eb06c9521722f08fd72826f552cedaffe61b53
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2146349
+Commit-Queue: Daniel Cheng <dcheng@chromium.org>
+Reviewed-by: Sami Kyöstilä <skyostil@chromium.org>
+Reviewed-by: François Doray <fdoray@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#759017}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2158048
+Cr-Commit-Position: refs/branch-heads/4044@{#970}
+Cr-Branched-From: a6d9daf149a473ceea37f629c41d4527bf2055bd-refs/heads/master@{#737173}
+
+diff --git a/base/task/sequence_manager/sequence_manager_impl.cc b/base/task/sequence_manager/sequence_manager_impl.cc
+index 55d82917a4eb17e5da7b88221cc623ae2b1b8c05..252500a534822dcc305b10690d4636c4c3e0dd05 100644
+--- a/base/task/sequence_manager/sequence_manager_impl.cc
++++ b/base/task/sequence_manager/sequence_manager_impl.cc
+@@ -44,13 +44,6 @@ GetTLSSequenceManagerImpl() {
+ 
+ }  // namespace
+ 
+-// This controls how big the the initial for
+-// |MainThreadOnly::task_execution_stack| should be. We don't expect to see
+-// depths of more than 2 unless cooperative scheduling is used on Blink, where
+-// we might get up to 6. Anyway 10 was chosen because it's a round number
+-// greater than current anticipated usage.
+-static constexpr const size_t kInitialTaskExecutionStackReserveCount = 10;
+-
+ std::unique_ptr<SequenceManager> CreateSequenceManagerOnCurrentThread(
+     SequenceManager::Settings settings) {
+   return internal::SequenceManagerImpl::CreateOnCurrentThread(
+@@ -221,7 +214,6 @@ SequenceManagerImpl::MainThreadOnly::MainThreadOnly(
+     random_generator = std::mt19937_64(RandUint64());
+     uniform_distribution = std::uniform_real_distribution<double>(0.0, 1.0);
+   }
+-  task_execution_stack.reserve(kInitialTaskExecutionStackReserveCount);
+ }
+ 
+ SequenceManagerImpl::MainThreadOnly::~MainThreadOnly() = default;
+diff --git a/base/task/sequence_manager/sequence_manager_impl.h b/base/task/sequence_manager/sequence_manager_impl.h
+index eb80e6a0792cca841af742f1ae560472a69ca38a..7395fd8af8ccadc084c2e19b4e53234c58e6423e 100644
+--- a/base/task/sequence_manager/sequence_manager_impl.h
++++ b/base/task/sequence_manager/sequence_manager_impl.h
+@@ -5,6 +5,7 @@
+ #ifndef BASE_TASK_SEQUENCE_MANAGER_SEQUENCE_MANAGER_IMPL_H_
+ #define BASE_TASK_SEQUENCE_MANAGER_SEQUENCE_MANAGER_IMPL_H_
+ 
++#include <deque>
+ #include <list>
+ #include <map>
+ #include <memory>
+@@ -12,7 +13,6 @@
+ #include <set>
+ #include <unordered_map>
+ #include <utility>
+-#include <vector>
+ 
+ #include "base/atomic_sequence_num.h"
+ #include "base/cancelable_callback.h"
+@@ -298,7 +298,9 @@ class BASE_EXPORT SequenceManagerImpl
+     bool nesting_observer_registered_ = false;
+ 
+     // Due to nested runloops more than one task can be executing concurrently.
+-    std::vector<ExecutingTask> task_execution_stack;
++    // Note that this uses std::deque for pointer stability, since pointers to
++    // objects in this container are stored in TLS.
++    std::deque<ExecutingTask> task_execution_stack;
+ 
+     Observer* observer = nullptr;  // NOT OWNED
+ 

patches/common/chromium/cherry-pick-686d1bfbcb8f.patch

@@ -0,0 +1,144 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Rouslan Solomakhin <rouslan@chromium.org>
+Date: Wed, 15 Apr 2020 23:03:07 +0000
+Subject: Browser context owned callback.
+
+Before this patch, an unowned function pointer would be invoked
+asynchronously with a reference to the possibly freed reference to the
+browser context, which could cause use after free in certain
+circumstances.
+
+This patch makes the browser context own the callback and binds the
+function with a weak pointer, so freeing the browser context invalidates
+the weak pointer, which cancels the callback execution.
+
+After this patch, freeing the browser context aborts the asynchronous
+callback that dereferences the browser context, so the use after free
+is prevented.
+
+TBR=rouslan@chromium.org
+
+(cherry picked from commit 2d0aad1e7602a7076d86772cc159b891cf2cf03b)
+
+Bug: 1065298
+Change-Id: Id6de3099a55c4505e94a8a6d21fb25d6d2b34c6c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2144311
+Reviewed-by: Danyao Wang <danyao@chromium.org>
+Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#758404}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2151474
+Reviewed-by: Rouslan Solomakhin <rouslan@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4044@{#942}
+Cr-Branched-From: a6d9daf149a473ceea37f629c41d4527bf2055bd-refs/heads/master@{#737173}
+
+diff --git a/content/browser/payments/payment_app_provider_impl.cc b/content/browser/payments/payment_app_provider_impl.cc
+index 88643bbaa7f37b3005d8a247f87543b9cf5f01e6..0c3f4b4966a6b2017a143f306f4f6269b35f7f02 100644
+--- a/content/browser/payments/payment_app_provider_impl.cc
++++ b/content/browser/payments/payment_app_provider_impl.cc
+@@ -8,6 +8,7 @@
+ #include "base/bind.h"
+ #include "base/bind_helpers.h"
+ #include "base/strings/string_util.h"
++#include "base/supports_user_data.h"
+ #include "base/task/post_task.h"
+ #include "content/browser/payments/payment_app_context_impl.h"
+ #include "content/browser/payments/payment_app_installer.h"
+@@ -393,28 +394,65 @@ void OnInstallPaymentApp(payments::mojom::PaymentRequestEventDataPtr event_data,
+   }
+ }
+ 
+-void CheckPermissionForPaymentApps(
+-    BrowserContext* browser_context,
+-    PaymentAppProvider::GetAllPaymentAppsCallback callback,
+-    PaymentAppProvider::PaymentApps apps) {
+-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
++// Callbacks for checking permissions asynchronously. Owned by the browser
++// context to avoid using the browser context after it has been freed. Deleted
++// after the callback is invoked.
++// Sample usage:
++//   PostTask(&PermissionChecker::CheckPermissionForPaymentApps,
++//       PermissionChecker::Create(browser_context), std::move(callback));
++class PermissionChecker : public base::SupportsUserData::Data {
++ public:
++  static base::WeakPtr<PermissionChecker> Create(
++      BrowserContext* browser_context) {
++    auto owned = std::make_unique<PermissionChecker>(browser_context);
++    auto weak_pointer_result = owned->weak_ptr_factory_.GetWeakPtr();
++    void* key = owned.get();
++    browser_context->SetUserData(key, std::move(owned));
++    return weak_pointer_result;
++  }
++
++  // Do not use this method directly! Use the static PermissionChecker::Create()
++  // method instead. (The constructor must be public for std::make_unique<> in
++  // the Create() method.)
++  explicit PermissionChecker(BrowserContext* browser_context)
++      : browser_context_(browser_context) {}
++  ~PermissionChecker() override = default;
+ 
+-  PermissionController* permission_controller =
+-      BrowserContext::GetPermissionController(browser_context);
+-  DCHECK(permission_controller);
+-
+-  PaymentAppProvider::PaymentApps permitted_apps;
+-  for (auto& app : apps) {
+-    GURL origin = app.second->scope.GetOrigin();
+-    if (permission_controller->GetPermissionStatus(
+-            PermissionType::PAYMENT_HANDLER, origin, origin) ==
+-        blink::mojom::PermissionStatus::GRANTED) {
+-      permitted_apps[app.first] = std::move(app.second);
++  // Disallow copy and assign.
++  PermissionChecker(const PermissionChecker& other) = delete;
++  PermissionChecker& operator=(const PermissionChecker& other) = delete;
++
++  void CheckPermissionForPaymentApps(
++      PaymentAppProvider::GetAllPaymentAppsCallback callback,
++      PaymentAppProvider::PaymentApps apps) {
++    DCHECK_CURRENTLY_ON(BrowserThread::UI);
++
++    PermissionController* permission_controller =
++        BrowserContext::GetPermissionController(browser_context_);
++    DCHECK(permission_controller);
++
++    PaymentAppProvider::PaymentApps permitted_apps;
++    for (auto& app : apps) {
++      GURL origin = app.second->scope.GetOrigin();
++      if (permission_controller->GetPermissionStatus(
++              PermissionType::PAYMENT_HANDLER, origin, origin) ==
++          blink::mojom::PermissionStatus::GRANTED) {
++        permitted_apps[app.first] = std::move(app.second);
++      }
+     }
++
++    std::move(callback).Run(std::move(permitted_apps));
++
++    // Deletes this PermissionChecker object.
++    browser_context_->RemoveUserData(/*key=*/this);
+   }
+ 
+-  std::move(callback).Run(std::move(permitted_apps));
+-}
++ private:
++  // Owns this PermissionChecker object, so it's always valid.
++  BrowserContext* browser_context_;
++
++  base::WeakPtrFactory<PermissionChecker> weak_ptr_factory_{this};
++};
+ 
+ void AbortInvokePaymentApp(BrowserContext* browser_context) {
+   DCHECK_CURRENTLY_ON(BrowserThread::IO);
+@@ -451,9 +489,11 @@ void PaymentAppProviderImpl::GetAllPaymentApps(
+ 
+   base::PostTaskWithTraits(
+       FROM_HERE, {BrowserThread::IO},
+-      base::BindOnce(&GetAllPaymentAppsOnIO, payment_app_context,
+-                     base::BindOnce(&CheckPermissionForPaymentApps,
+-                                    browser_context, std::move(callback))));
++      base::BindOnce(
++          &GetAllPaymentAppsOnIO, payment_app_context,
++          base::BindOnce(&PermissionChecker::CheckPermissionForPaymentApps,
++                         PermissionChecker::Create(browser_context),
++                         std::move(callback))));
+ }
+ 
+ void PaymentAppProviderImpl::InvokePaymentApp(

patches/common/chromium/cherry-pick-7101418f85a0.patch

@@ -0,0 +1,191 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mason Freed <masonfreed@chromium.org>
+Date: Mon, 20 Apr 2020 21:57:52 +0000
+Subject: Fix customized built-in element constructor behavior
+
+This CL implements two changes:
+ 1. It fixes the implementation to better match the spec for the
+    "create an element for the token" [1] algorithm. Prior to this CL,
+    step 7 of that algorithm was skipping directly to step 6 of the
+    "create an element" [2] algorithm, skipping over step 5 for
+    customized built-in elements. This is now fixed. This case is
+    illustrated by the issue and example at [3] and [4]. This becomes
+    the first test in customized-built-in-constructor-exceptions.html.
+
+ 2. It updates the comments to match the new behavior discussed in [3]
+    and the [5] spec PR, which changes the return value in the case
+    that a customized built-in element constructor throws an exception.
+    With the change above, that is actually already the behavior. So
+    this is just a comment change. Two new tests are added to
+    customized-built-in-constructor-exceptions.html.
+
+[1] https://html.spec.whatwg.org/multipage/parsing.html#create-an-element-for-the-token
+[2] https://dom.spec.whatwg.org/#concept-create-element
+[3] https://github.com/whatwg/html/issues/5084
+[4] https://crbug.com/1024866
+[5] https://github.com/whatwg/dom/pull/797
+
+Bug: 1071059, 1024866
+Change-Id: I814c81991eb5e83501304bcb3d2da476743aef52
+Cq-Do-Not-Cancel-Tryjobs: true
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2152986
+Commit-Queue: Mason Freed <masonfreed@chromium.org>
+Auto-Submit: Mason Freed <masonfreed@chromium.org>
+Reviewed-by: Kent Tamura <tkent@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#760705}
+
+diff --git a/third_party/blink/renderer/bindings/core/v8/script_custom_element_definition.cc b/third_party/blink/renderer/bindings/core/v8/script_custom_element_definition.cc
+index f6256921c84992a90a9e589cfcf331d8d00df478..9a4c4799ef589ab9049d398a10ebe5dc41b25e36 100644
+--- a/third_party/blink/renderer/bindings/core/v8/script_custom_element_definition.cc
++++ b/third_party/blink/renderer/bindings/core/v8/script_custom_element_definition.cc
+@@ -146,6 +146,7 @@ HTMLElement* ScriptCustomElementDefinition::HandleCreateElementSyncException(
+ HTMLElement* ScriptCustomElementDefinition::CreateAutonomousCustomElementSync(
+     Document& document,
+     const QualifiedName& tag_name) {
++  DCHECK(CustomElement::ShouldCreateCustomElement(tag_name)) << tag_name;
+   if (!script_state_->ContextIsValid())
+     return CustomElement::CreateFailedElement(document, tag_name);
+   ScriptState::Scope scope(script_state_);
+diff --git a/third_party/blink/renderer/core/html/custom/custom_element.cc b/third_party/blink/renderer/core/html/custom/custom_element.cc
+index d21c582052cbf861b792ec6f44e418cc25f3a8cc..1edcd4e60009c9f994c0711a8d373d771b4e8965 100644
+--- a/third_party/blink/renderer/core/html/custom/custom_element.cc
++++ b/third_party/blink/renderer/core/html/custom/custom_element.cc
+@@ -205,7 +205,8 @@ Element* CustomElement::CreateUncustomizedOrUndefinedElement(
+ 
+ HTMLElement* CustomElement::CreateFailedElement(Document& document,
+                                                 const QualifiedName& tag_name) {
+-  DCHECK(ShouldCreateCustomElement(tag_name));
++  CHECK(ShouldCreateCustomElement(tag_name))
++      << "HTMLUnknownElement with built-in tag name: " << tag_name;
+ 
+   // "create an element for a token":
+   // https://html.spec.whatwg.org/C/#create-an-element-for-the-token
+diff --git a/third_party/blink/renderer/core/html/custom/custom_element_definition.cc b/third_party/blink/renderer/core/html/custom/custom_element_definition.cc
+index 6126e0d04c48e8f7cebe8dbf39418599fcfcb84e..3341f49f48de367cbe4f736c4acac09c5d59ddbd 100644
+--- a/third_party/blink/renderer/core/html/custom/custom_element_definition.cc
++++ b/third_party/blink/renderer/core/html/custom/custom_element_definition.cc
+@@ -142,14 +142,19 @@ HTMLElement* CustomElementDefinition::CreateElement(
+     result->SetCustomElementState(CustomElementState::kUndefined);
+     result->SetIsValue(Descriptor().GetName());
+ 
+-    // 5.3. If the synchronous custom elements flag is set, upgrade
+-    // element using definition.
+-    // 5.4. Otherwise, enqueue a custom element upgrade reaction given
+-    // result and definition.
+-    if (!flags.IsAsyncCustomElements())
++    if (!flags.IsAsyncCustomElements()) {
++      // 5.3 If the synchronous custom elements flag is set, then run this step
++      // while catching any exceptions:
++      //   1. Upgrade element using definition.
++      // If this step threw an exception, then:
++      //   1. Report the exception.
++      //   2. Set result's custom element state to "failed".
+       Upgrade(*result);
+-    else
++    } else {
++      // 5.4. Otherwise, enqueue a custom element upgrade reaction given
++      // result and definition.
+       EnqueueUpgradeReaction(*result);
++    }
+     return To<HTMLElement>(result);
+   }
+ 
+diff --git a/third_party/blink/renderer/core/html/parser/html_construction_site.cc b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
+index f0be9372801fb2942cb29070166a303b6a757fa5..1dd2a6076678f0431bbcffc232813c92696dbf8c 100644
+--- a/third_party/blink/renderer/core/html/parser/html_construction_site.cc
++++ b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
+@@ -915,8 +915,11 @@ Element* HTMLConstructionSite::CreateElement(
+     // reactions stack."
+     CEReactionsScope reactions;
+ 
+-    // 7.
+-    element = definition->CreateAutonomousCustomElementSync(document, tag_name);
++    // 7. Let element be the result of creating an element given document,
++    // localName, given namespace, null, and is. If will execute script is true,
++    // set the synchronous custom elements flag; otherwise, leave it unset.
++    element =
++        definition->CreateElement(document, tag_name, GetCreateElementFlags());
+ 
+     // "8. Append each attribute in the given token to element." We don't use
+     // setAttributes here because the custom element constructor may have
+diff --git a/third_party/blink/web_tests/external/wpt/custom-elements/customized-built-in-constructor-exceptions.html b/third_party/blink/web_tests/external/wpt/custom-elements/customized-built-in-constructor-exceptions.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..32729bdb6bb2c82f54c074c7609ff5c79883a37a
+--- /dev/null
++++ b/third_party/blink/web_tests/external/wpt/custom-elements/customized-built-in-constructor-exceptions.html
+@@ -0,0 +1,75 @@
++<!DOCTYPE html>
++<title>Customized built-in element constructor behavior</title>
++<meta name='author' title='Mason Freed' href='mailto:masonfreed@chromium.org'>
++<link rel='help' href='https://dom.spec.whatwg.org/#concept-create-element'>
++<script src='/resources/testharness.js'></script>
++<script src='/resources/testharnessreport.js'></script>
++
++<script>
++setup({allow_uncaught_exception : true});
++
++class MyCustomParagraph extends HTMLParagraphElement {
++  constructor() {
++    super();
++    this.textContent = 'PASS';
++  }
++}
++customElements.define('custom-p', MyCustomParagraph, { extends: 'p' });
++</script>
++<p id=targetp is='custom-p'></p>
++<script>
++test(t => {
++  let target = document.getElementById('targetp');
++  assert_true(!!target);
++  assert_equals(target.localName, 'p');
++  assert_true(target instanceof MyCustomParagraph);
++  assert_true(target instanceof HTMLParagraphElement);
++  assert_equals(target.childNodes.length, 1);
++  assert_equals(target.textContent, 'PASS');
++}, 'Appending children in customized built-in constructor should work');
++</script>
++
++
++<script>
++class MyCustomVideo extends HTMLVideoElement {
++  constructor() {
++  super();
++  throw new Error();
++  }
++}
++customElements.define('custom-video', MyCustomVideo, { extends: 'video' });
++</script>
++<video id=targetvideo is='custom-video'> <source></source> </video>
++<script>
++test(t => {
++  let target = document.getElementById('targetvideo');
++  assert_true(!!target);
++  assert_equals(target.localName, 'video');
++  assert_true(target instanceof MyCustomVideo);
++  assert_true(target instanceof HTMLVideoElement);
++  assert_equals(target.children.length, 1);
++}, 'Throwing exception in customized built-in constructor should not crash and should return correct element type (video)');
++</script>
++
++
++<script>
++class MyCustomForm extends HTMLFormElement {
++  constructor() {
++  super();
++  throw new Error();
++  }
++}
++customElements.define('custom-form', MyCustomForm, { extends: 'form' });
++</script>
++<form id=targetform is='custom-form'> <label></label><input> </form>
++<script>
++test(t => {
++  let target = document.getElementById('targetform');
++  assert_true(!!target);
++  assert_equals(target.localName, 'form');
++  assert_true(target instanceof MyCustomForm);
++  assert_true(target instanceof HTMLFormElement);
++  assert_equals(target.children.length, 2);
++}, 'Throwing exception in customized built-in constructor should not crash and should return correct element type (form)');
++</script>
++

patches/common/chromium/cherry-pick-826a4af58b3d.patch

@@ -0,0 +1,50 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mustafa Emre Acer <meacer@chromium.org>
+Date: Fri, 10 Apr 2020 00:43:45 +0000
+Subject: Don't decode invalid punycode in URL formatter
+
+TBR=meacer@chromium.org
+
+(cherry picked from commit 50c6e900fc4170a14154cbfea57ade2aa50990b5)
+
+Bug: 1063566
+Change-Id: I631ba68718cf69c5972555d7826b089e27fa5150
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2137872
+Reviewed-by: Peter Kasting <pkasting@chromium.org>
+Commit-Queue: Peter Kasting <pkasting@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#756819}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2144830
+Reviewed-by: Mustafa Emre Acer <meacer@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4103@{#62}
+Cr-Branched-From: 8ad47e8d21f6866e4a37f47d83a860d41debf514-refs/heads/master@{#756066}
+
+diff --git a/components/url_formatter/url_formatter.cc b/components/url_formatter/url_formatter.cc
+index edf29bddccdbdab43e87a7ff9e2ce49b13befeb3..e2a73aa3ae00236cd4ac0cf676a95ca9488ac6dc 100644
+--- a/components/url_formatter/url_formatter.cc
++++ b/components/url_formatter/url_formatter.cc
+@@ -374,9 +374,11 @@ bool IDNToUnicodeOneComponent(const base::char16* comp,
+     return false;
+ 
+   // Early return if the input cannot be an IDN component.
++  // Valid punycode must not end with a dash.
+   static const base::char16 kIdnPrefix[] = {'x', 'n', '-', '-'};
+   if (comp_len <= base::size(kIdnPrefix) ||
+-      memcmp(comp, kIdnPrefix, sizeof(kIdnPrefix)) != 0) {
++      memcmp(comp, kIdnPrefix, sizeof(kIdnPrefix)) != 0 ||
++      comp[comp_len - 1] == '-') {
+     out->append(comp, comp_len);
+     return false;
+   }
+diff --git a/components/url_formatter/url_formatter_unittest.cc b/components/url_formatter/url_formatter_unittest.cc
+index 383d2ec2d4256bb376cedad2b63e1f697a73ef87..c3efe47c5a599d37ef88014efa83c988f0f1ff2e 100644
+--- a/components/url_formatter/url_formatter_unittest.cc
++++ b/components/url_formatter/url_formatter_unittest.cc
+@@ -61,6 +61,8 @@ const IDNTestCase kIdnCases[] = {
+     {"www.google.com.", L"www.google.com.", true},
+     {".", L".", true},
+     {"", L"", true},
++    // Invalid IDN
++    {"xn--example-.com", L"xn--example-.com", false},
+     // IDN
+     // Hanzi (Traditional Chinese)
+     {"xn--1lq90ic7f1rc.cn", L"\x5317\x4eac\x5927\x5b78.cn", true},

patches/common/chromium/cherry-pick-86c02c5dcd37.patch

@@ -0,0 +1,237 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Matthias=20K=C3=B6rber?= <koerber@google.com>
+Date: Tue, 14 Apr 2020 16:55:14 +0000
+Subject: Fixed requesting invalid country codes from CountryData.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: Id0ce647400bdce2eb4cdd358432b7c647f880570
+Bug: 1062861
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2122057
+Reviewed-by: Matthias Körber <koerber@google.com>
+Reviewed-by: Dominic Battré <battre@chromium.org>
+Reviewed-by: Vadym Doroshenko  <dvadym@chromium.org>
+Commit-Queue: Matthias Körber <koerber@google.com>
+Cr-Commit-Position: refs/heads/master@{#758887}
+
+diff --git a/components/autofill/core/browser/geo/autofill_country.cc b/components/autofill/core/browser/geo/autofill_country.cc
+index 260fd019831675afb955ab1b5e279e47379adc29..091bab650b2cb35462e0dbeb1454c9027b0ea31c 100644
+--- a/components/autofill/core/browser/geo/autofill_country.cc
++++ b/components/autofill/core/browser/geo/autofill_country.cc
+@@ -25,13 +25,28 @@ const size_t kLocaleCapacity =
+ 
+ AutofillCountry::AutofillCountry(const std::string& country_code,
+                                  const std::string& locale) {
+-  auto result =
+-      CountryDataMap::GetInstance()->country_data().find(country_code);
+-  DCHECK(result != CountryDataMap::GetInstance()->country_data().end());
+-  const CountryData& data = result->second;
++  CountryDataMap* country_data_map = CountryDataMap::GetInstance();
+ 
+-  country_code_ = country_code;
+-  name_ = l10n_util::GetDisplayNameForCountry(country_code, locale);
++  // If the country code is an alias (e.g. "GB" for "UK") expand the country
++  // code.
++  country_code_ = country_data_map->HasCountryCodeAlias(country_code)
++                      ? country_data_map->GetCountryCodeForAlias(country_code)
++                      : country_code;
++
++  // If there is no entry in the |CountryDataMap| for the
++  // |country_code_for_country_data| use the country code  derived from the
++  // locale. This reverts to US.
++  country_data_map->HasCountryData(country_code_)
++      ? country_code_
++      : CountryCodeForLocale(locale);
++
++  // Acquire the country address data.
++  const CountryData& data = country_data_map->GetCountryData(country_code_);
++
++  // Translate the country name by the supplied local.
++  name_ = l10n_util::GetDisplayNameForCountry(country_code_, locale);
++
++  // Get the localized strings associate with the address fields.
+   postal_code_label_ = l10n_util::GetStringUTF16(data.postal_code_label_id);
+   state_label_ = l10n_util::GetStringUTF16(data.state_label_id);
+   address_required_fields_ = data.address_required_fields;
+diff --git a/components/autofill/core/browser/geo/autofill_country_unittest.cc b/components/autofill/core/browser/geo/autofill_country_unittest.cc
+index e9726a8da766b5463475f086637fe225dc60c13e..586564b4fecd5fa0c46bd8fba3beca7c521f1b59 100644
+--- a/components/autofill/core/browser/geo/autofill_country_unittest.cc
++++ b/components/autofill/core/browser/geo/autofill_country_unittest.cc
+@@ -14,6 +14,7 @@
+ #include "base/android/build_info.h"
+ #endif
+ 
++using autofill::CountryDataMap;
+ using base::ASCIIToUTF16;
+ 
+ namespace autofill {
+@@ -30,6 +31,11 @@ TEST(AutofillCountryTest, AutofillCountry) {
+   EXPECT_EQ("US", united_states_es.country_code());
+   EXPECT_EQ(ASCIIToUTF16("Estados Unidos"), united_states_es.name());
+ 
++  AutofillCountry great_britain_uk_alias("UK", "en_GB");
++  EXPECT_EQ("GB", great_britain_uk_alias.country_code());
++  EXPECT_EQ("GB", great_britain_uk_alias.country_code());
++  EXPECT_EQ(ASCIIToUTF16("United Kingdom"), great_britain_uk_alias.name());
++
+   AutofillCountry canada_en("CA", "en_US");
+   EXPECT_EQ("CA", canada_en.country_code());
+   EXPECT_EQ(ASCIIToUTF16("Canada"), canada_en.name());
+@@ -74,4 +80,27 @@ TEST(AutofillCountryTest, AllCountryCodesHaveCountryName) {
+   }
+ }
+ 
++// Test alias mappings for falsely existing country codes.
++TEST(AutofillCountryTest, AliasMappingsForCountryData) {
++  CountryDataMap* country_data_map = CountryDataMap::GetInstance();
++
++  // There should be country data for the "GB".
++  EXPECT_TRUE(country_data_map->HasCountryData("GB"));
++
++  // Check the correctness of the alias definitions.
++  EXPECT_TRUE(country_data_map->HasCountryCodeAlias("UK"));
++  EXPECT_FALSE(country_data_map->HasCountryCodeAlias("does_not_exist"));
++
++  // Query not existing mapping.
++  auto expected_country_code = std::string();
++  auto actual_country_code =
++      country_data_map->GetCountryCodeForAlias("does_not_exist");
++  EXPECT_EQ(expected_country_code, actual_country_code);
++
++  // GB should map the UK.
++  expected_country_code = "GB";
++  actual_country_code = country_data_map->GetCountryCodeForAlias("UK");
++  EXPECT_EQ(expected_country_code, actual_country_code);
++}
++
+ }  // namespace autofill
+diff --git a/components/autofill/core/browser/geo/country_data.cc b/components/autofill/core/browser/geo/country_data.cc
+index 1fe65ecf65323ce1917cb786b63d10ea4a7ac0b7..ec78e723ca71972d32ba00c2b46de9673fe91f46 100644
+--- a/components/autofill/core/browser/geo/country_data.cc
++++ b/components/autofill/core/browser/geo/country_data.cc
+@@ -19,6 +19,17 @@ struct StaticCountryData {
+   CountryData country_data;
+ };
+ 
++// Alias definitions record for CountryData requests.  A request for
++// |country_code_alias| is served with the |CountryData| for
++// |country_code_target|.
++struct StaticCountryCodeAliasData {
++  char country_code_alias[3];
++  char country_code_target[3];
++};
++
++// Alias definitions.
++const StaticCountryCodeAliasData kCountryCodeAliases[] = {{"UK", "GB"}};
++
+ // Maps country codes to localized label string identifiers. Keep this sorted
+ // by country code.
+ // This list is comprized of countries appearing in both
+@@ -790,7 +801,7 @@ std::vector<std::string> GetCountryCodes() {
+   return country_codes;
+ }
+ 
+-std::map<std::string, CountryData> GetCountryData() {
++std::map<std::string, CountryData> GetCountryDataMap() {
+   std::map<std::string, CountryData> country_data;
+   // Add all the countries we have explicit data for.
+   for (const auto& static_data : kCountryData) {
+@@ -813,6 +824,18 @@ std::map<std::string, CountryData> GetCountryData() {
+   return country_data;
+ }
+ 
++std::map<std::string, std::string> GetCountryCodeAliasMap() {
++  std::map<std::string, std::string> country_code_aliases;
++  // Create mappings for the aliases defined in |kCountryCodeAliases|.
++  for (const auto& static_alias_data : kCountryCodeAliases) {
++    // Insert the alias.
++    country_code_aliases.insert(
++        std::make_pair(std::string(static_alias_data.country_code_alias),
++                       std::string(static_alias_data.country_code_target)));
++  }
++  return country_code_aliases;
++}
++
+ }  // namespace
+ 
+ // static
+@@ -821,8 +844,38 @@ CountryDataMap* CountryDataMap::GetInstance() {
+ }
+ 
+ CountryDataMap::CountryDataMap()
+-    : country_data_(GetCountryData()), country_codes_(GetCountryCodes()) {}
++    : country_data_(GetCountryDataMap()),
++      country_code_aliases_(GetCountryCodeAliasMap()),
++      country_codes_(GetCountryCodes()) {}
+ 
+ CountryDataMap::~CountryDataMap() = default;
+ 
++bool CountryDataMap::HasCountryData(const std::string& country_code) const {
++  return country_data_.count(country_code) > 0;
++}
++
++const CountryData& CountryDataMap::GetCountryData(
++    const std::string& country_code) const {
++  auto lookup = country_data_.find(country_code);
++  if (lookup != country_data_.end())
++    return lookup->second;
++  // If there is no entry for country_code return the entry for the US.
++  return country_data_.find("US")->second;
++}
++
++bool CountryDataMap::HasCountryCodeAlias(
++    const std::string& country_code_alias) const {
++  return country_code_aliases_.count(country_code_alias) > 0;
++}
++
++const std::string CountryDataMap::GetCountryCodeForAlias(
++    const std::string& country_code_alias) const {
++  auto lookup = country_code_aliases_.find(country_code_alias);
++  if (lookup != country_code_aliases_.end()) {
++    DCHECK(HasCountryData(lookup->second));
++    return lookup->second;
++  }
++  return std::string();
++}
++
+ }  // namespace autofill
+diff --git a/components/autofill/core/browser/geo/country_data.h b/components/autofill/core/browser/geo/country_data.h
+index b6a9497594b1c22a5521a9c40fab2decae449c3f..8266102deadd40e5f2b9b24703123f59034a9781 100644
+--- a/components/autofill/core/browser/geo/country_data.h
++++ b/components/autofill/core/browser/geo/country_data.h
+@@ -58,10 +58,23 @@ class CountryDataMap {
+  public:
+   static CountryDataMap* GetInstance();
+ 
+-  const std::map<std::string, CountryData>& country_data() {
+-    return country_data_;
+-  }
++  // Returns true if a |CountryData| entry for the supplied |country_code|
++  // exists.
++  bool HasCountryData(const std::string& country_code) const;
+ 
++  // Returns true if there is a country code alias for |country_code|.
++  bool HasCountryCodeAlias(const std::string& country_code_alias) const;
++
++  // Returns the country code for a country code alias. If no alias definition
++  // is present return an empty string.
++  const std::string GetCountryCodeForAlias(
++      const std::string& country_code_alias) const;
++
++  // Lookup the |CountryData| for the supplied |country_code|. If no entry
++  // exists, return the data for the US as a best guess.
++  const CountryData& GetCountryData(const std::string& country_code) const;
++
++  // Return a constant reference to a vector of all country codes.
+   const std::vector<std::string>& country_codes() { return country_codes_; }
+ 
+  private:
+@@ -70,6 +83,7 @@ class CountryDataMap {
+   friend struct base::DefaultSingletonTraits<CountryDataMap>;
+ 
+   const std::map<std::string, CountryData> country_data_;
++  const std::map<std::string, std::string> country_code_aliases_;
+   const std::vector<std::string> country_codes_;
+ 
+   DISALLOW_COPY_AND_ASSIGN(CountryDataMap);

patches/common/chromium/cherry-pick-b69991a9b701.patch

@@ -0,0 +1,105 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hans Wennborg <hans@chromium.org>
+Date: Thu, 30 Apr 2020 00:20:16 +0000
+Subject: SpeechRecognizerImpl: use a WeakPtr to itself for all tasks
+
+It seems that during shutdown, SpeechRecognizerImpl can go away before the
+posted task runs. This is similar to crrev.com/729694.
+
+(cherry picked from commit 0b2aaaa8a4948d88b892c3e6cabc87848f248e52)
+
+(cherry picked from commit 9a8f835f66472f044da1d0a88c574c6b7f6d776f)
+
+Bug: 1067851
+Change-Id: I1c43d3bfaf978891f4abaef8e452a088d0f18c5c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2139701
+Reviewed-by: Primiano Tucci <primiano@chromium.org>
+Reviewed-by: Tommi <tommi@chromium.org>
+Reviewed-by: Olga Sharonova <olka@chromium.org>
+Commit-Queue: Hans Wennborg <hans@chromium.org>
+Cr-Original-Original-Commit-Position: refs/heads/master@{#757385}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2148952
+Reviewed-by: Ben Mason <benmason@chromium.org>
+Reviewed-by: Hans Wennborg <hans@chromium.org>
+Commit-Queue: Ben Mason <benmason@chromium.org>
+Cr-Original-Commit-Position: refs/branch-heads/4044@{#926}
+Cr-Original-Branched-From: a6d9daf149a473ceea37f629c41d4527bf2055bd-refs/heads/master@{#737173}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2173741
+Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
+Commit-Queue: Jorge Lucangeli Obes <jorgelo@chromium.org>
+Cr-Commit-Position: refs/branch-heads/3987@{#1040}
+Cr-Branched-From: c4e8da9871cc266be74481e212f3a5252972509d-refs/heads/master@{#722274}
+
+diff --git a/content/browser/speech/speech_recognizer_impl.cc b/content/browser/speech/speech_recognizer_impl.cc
+index 35ed5f799396d636006148db8e4e02af7c599886..6dfc4392e0fdb096a994f321abd7ac5d6e7a8059 100644
+--- a/content/browser/speech/speech_recognizer_impl.cc
++++ b/content/browser/speech/speech_recognizer_impl.cc
+@@ -227,7 +227,8 @@ void SpeechRecognizerImpl::StartRecognition(const std::string& device_id) {
+ 
+   base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
+                            base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
+-                                          this, FSMEventArgs(EVENT_PREPARE)));
++                                          weak_ptr_factory_.GetWeakPtr(),
++                                          FSMEventArgs(EVENT_PREPARE)));
+ }
+ 
+ void SpeechRecognizerImpl::AbortRecognition() {
+@@ -239,7 +240,8 @@ void SpeechRecognizerImpl::AbortRecognition() {
+ void SpeechRecognizerImpl::StopAudioCapture() {
+   base::PostTaskWithTraits(
+       FROM_HERE, {BrowserThread::IO},
+-      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this,
++      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
++                     weak_ptr_factory_.GetWeakPtr(),
+                      FSMEventArgs(EVENT_STOP_CAPTURE)));
+ }
+ 
+@@ -280,14 +282,16 @@ void SpeechRecognizerImpl::Capture(const AudioBus* data,
+   event_args.audio_data = audio_converter_->Convert(data);
+   base::PostTaskWithTraits(
+       FROM_HERE, {BrowserThread::IO},
+-      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
++      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
++                     weak_ptr_factory_.GetWeakPtr(), event_args));
+   // See http://crbug.com/506051 regarding why one extra convert call can
+   // sometimes be required. It should be a rare case.
+   if (!audio_converter_->data_was_converted()) {
+     event_args.audio_data = audio_converter_->Convert(data);
+     base::PostTaskWithTraits(
+         FROM_HERE, {BrowserThread::IO},
+-        base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
++        base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
++                       weak_ptr_factory_.GetWeakPtr(), event_args));
+   }
+   // Something is seriously wrong here and we are most likely missing some
+   // audio segments.
+@@ -298,7 +302,8 @@ void SpeechRecognizerImpl::OnCaptureError(const std::string& message) {
+   FSMEventArgs event_args(EVENT_AUDIO_ERROR);
+   base::PostTaskWithTraits(
+       FROM_HERE, {BrowserThread::IO},
+-      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
++      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
++                     weak_ptr_factory_.GetWeakPtr(), event_args));
+ }
+ 
+ void SpeechRecognizerImpl::OnSpeechRecognitionEngineResults(
+@@ -307,7 +312,8 @@ void SpeechRecognizerImpl::OnSpeechRecognitionEngineResults(
+   event_args.engine_results = mojo::Clone(results);
+   base::PostTaskWithTraits(
+       FROM_HERE, {BrowserThread::IO},
+-      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
++      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
++                     weak_ptr_factory_.GetWeakPtr(), event_args));
+ }
+ 
+ void SpeechRecognizerImpl::OnSpeechRecognitionEngineEndOfUtterance() {
+@@ -321,7 +327,8 @@ void SpeechRecognizerImpl::OnSpeechRecognitionEngineError(
+   event_args.engine_error = error;
+   base::PostTaskWithTraits(
+       FROM_HERE, {BrowserThread::IO},
+-      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
++      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
++                     weak_ptr_factory_.GetWeakPtr(), event_args));
+ }
+ 
+ // -----------------------  Core FSM implementation ---------------------------

patches/common/config.json

@@ -1,6 +1,8 @@
 {
   "src/electron/patches/common/chromium": "src",
 
+  "src/electron/patches/common/angle": "src/third_party/angle",
+
   "src/electron/patches/common/boringssl": "src/third_party/boringssl/src",
 
   "src/electron/patches/common/ffmpeg": "src/third_party/ffmpeg",
@@ -11,5 +13,7 @@
 
   "src/electron/patches/common/webrtc": "src/third_party/webrtc",
 
+  "src/electron/patches/common/usrsctp": "src/third_party/usrsctp/usrsctplib",
+
   "src/electron/patches/node": "src/third_party/electron_node"
 }

patches/common/usrsctp/.patches

@@ -0,0 +1 @@
+cherry-pick-e89fe66d0473.patch

patches/common/usrsctp/cherry-pick-e89fe66d0473.patch

@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Tuexen <tuexen@fh-muenster.de>
+Date: Fri, 10 Apr 2020 00:43:45 +0000
+Subject: Improve input validation when processing AUTH chunks
+
+Cherry picked from:
+https://chromium.googlesource.com/external/github.com/sctplab/usrsctp/+/b218e8957d7af0b07ee3ca74caded05ada8d1df9
+https://chromium.googlesource.com/external/github.com/sctplab/usrsctp/+/e89fe66d04735dcfc6bfda1648fbe68008da6277
+
+Bug: 1073602
+
+diff --git a/usrsctplib/netinet/sctp_input.c b/usrsctplib/netinet/sctp_input.c
+index c62bb8506dc0fb86112f35e0b66d08c198e8f9bd..4e53dfb27ec597a8f6ac99c329bc80b9d7306836 100755
+--- a/usrsctplib/netinet/sctp_input.c
++++ b/usrsctplib/netinet/sctp_input.c
+@@ -2178,7 +2178,7 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
+ 	int init_offset, initack_offset, initack_limit;
+ 	int retval;
+ 	int error = 0;
+-	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
++	uint8_t auth_chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
+ #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
+ 	struct socket *so;
+ 
+@@ -2373,8 +2373,11 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
+ 	if (auth_skipped) {
+ 		struct sctp_auth_chunk *auth;
+ 
+-		auth = (struct sctp_auth_chunk *)
+-		    sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
++		if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
++			auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
++		} else {
++			auth = NULL;
++		}
+ 		if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
+ 			/* auth HMAC failed, dump the assoc and packet */
+ 			SCTPDBG(SCTP_DEBUG_AUTH1,
+@@ -4846,11 +4849,13 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
+ 			if (auth_skipped && (stcb != NULL)) {
+ 				struct sctp_auth_chunk *auth;
+ 
+-				auth = (struct sctp_auth_chunk *)
+-					sctp_m_getptr(m, auth_offset,
+-						      auth_len, chunk_buf);
+-				got_auth = 1;
+-				auth_skipped = 0;
++				if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
++					auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, chunk_buf);
++					got_auth = 1;
++					auth_skipped = 0;
++				} else {
++					auth = NULL;
++				}
+ 				if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
+ 								       auth_offset)) {
+ 					/* auth HMAC failed so dump it */

patches/common/v8/.patches

@@ -12,3 +12,4 @@ fix_bug_in_receiver_maps_inference.patch
 make_createdynamicfunction_throw_if_disallowed.patch
 merged_make_createdynamicfunction_switch_context_before_throwing.patch
 intl_fix_intl_numberformat_constructor.patch
+use_context_of_then_function_for_promiseresolvethenablejob.patch

patches/common/v8/use_context_of_then_function_for_promiseresolvethenablejob.patch

@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Samuel Attard <samuel.r.attard@gmail.com>
+Date: Mon, 20 Apr 2020 12:11:40 -0700
+Subject: Use context of then function for PromiseResolveThenableJob
+
+When a microtask is executed, we need to use an appropriate,
+non-detached Context for its execution. Currently with
+PromiseResolveThenableJobs [1], the Context used is always drawn from
+the realm of the Promise constructor being used. This may cause
+non-intuitive behavior, such as in the following case:
+
+  const DeadPromise = iframe.contentWindow.Promise;
+  const p = DeadPromise.resolve({
+    then() {
+      return { success: true };
+    }
+  });
+  p.then(result => { console.log(result); });
+
+  // Some time later, but synchronously...
+  iframe.src = "http://example.com"; // navigate away.
+  // DeadPromise's Context is detached state now.
+  // p never gets resolved, and its reaction handler never gets called.
+
+To fix this behavior, when PromiseResolveThenableJob is being queued up,
+the `then` method of the thenable should be used to determine the
+context of the resultant microtask. Doing so aligns with Firefox, and
+also with the latest HTML spec [2][3].
+
+diff --git a/src/builtins/builtins-promise-gen.cc b/src/builtins/builtins-promise-gen.cc
+index ad70fb1dd1a49e8b879bc3296994292bdcb9db67..6e447fdf8a6e4b5e71a0edcc3cfae939de1ec999 100644
+--- a/src/builtins/builtins-promise-gen.cc
++++ b/src/builtins/builtins-promise-gen.cc
+@@ -2002,9 +2002,16 @@ TF_BUILTIN(ResolvePromise, PromiseBuiltinsAssembler) {
+   {
+     // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
+     //                        «promise, resolution, thenAction»).
++    // According to HTML, we use the context of the then function
++    // (|thenAction|) as the context of the microtask. See step 3 of HTML's
++    // EnqueueJob:
++    // https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
++    VARIABLE(var_then_context, MachineRepresentation::kTagged, native_context);
++    ExtractHandlerContext(var_then.value(), &var_then_context);
++    const TNode<NativeContext> native_then_context = Cast(LoadNativeContext(var_then_context.value()));
+     Node* const task = AllocatePromiseResolveThenableJobTask(
+-        promise, var_then.value(), resolution, native_context);
+-    TailCallBuiltin(Builtins::kEnqueueMicrotask, native_context, task);
++        promise, var_then.value(), resolution, native_then_context);
++    TailCallBuiltin(Builtins::kEnqueueMicrotask, native_then_context, task);
+   }
+ 
+   BIND(&if_fulfill);
+diff --git a/src/objects/objects.cc b/src/objects/objects.cc
+index 3e685d901b4b52b8f45bbb12c6dfd71c3675746a..676a5799966d37ed71396614eb826515906c6143 100644
+--- a/src/objects/objects.cc
++++ b/src/objects/objects.cc
+@@ -6027,10 +6027,20 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
+ 
+   // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
+   //                        «promise, resolution, thenAction»).
++
++  // According to HTML, we use the context of the then function (|thenAction|)
++  // as the context of the microtask. See step 3 of HTML's EnqueueJob:
++  // https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
++  Handle<NativeContext> then_context;
++  if (!JSReceiver::GetContextForMicrotask(Handle<JSReceiver>::cast(then_action))
++           .ToHandle(&then_context)) {
++    then_context = isolate->native_context();
++  }
++
+   Handle<PromiseResolveThenableJobTask> task =
+       isolate->factory()->NewPromiseResolveThenableJobTask(
+           promise, Handle<JSReceiver>::cast(then_action),
+-          Handle<JSReceiver>::cast(resolution), isolate->native_context());
++          Handle<JSReceiver>::cast(resolution), then_context);
+   if (isolate->debug()->is_active() && resolution->IsJSPromise()) {
+     // Mark the dependency of the new {promise} on the {resolution}.
+     Object::SetProperty(isolate, resolution,
+@@ -6038,8 +6048,7 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
+                         promise)
+         .Check();
+   }
+-  MicrotaskQueue* microtask_queue =
+-      isolate->native_context()->microtask_queue();
++  MicrotaskQueue* microtask_queue = then_context->microtask_queue();
+   if (microtask_queue) microtask_queue->EnqueueMicrotask(*task);
+ 
+   // 13. Return undefined.
+@@ -6075,6 +6084,9 @@ Handle<Object> JSPromise::TriggerPromiseReactions(Isolate* isolate,
+     Handle<PromiseReaction> reaction = Handle<PromiseReaction>::cast(task);
+     reactions = handle(reaction->next(), isolate);
+ 
++    // According to HTML, we use the context of the appropriate handler as the
++    // context of the microtask. See step 3 of HTML's EnqueueJob:
++    // https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
+     Handle<NativeContext> handler_context;
+ 
+     Handle<HeapObject> primary_handler;

script/lib/patches.py

@@ -7,10 +7,12 @@ def read_patch(patch_dir, patch_filename):
   """Read a patch from |patch_dir/filename| and amend the commit message with
   metadata about the patch file it came from."""
   ret = []
+  added_filename_line = False
   with open(os.path.join(patch_dir, patch_filename)) as f:
     for l in f.readlines():
-      if l.startswith('diff -'):
+      if not added_filename_line and (l.startswith('diff -') or l.startswith('---')):
         ret.append('Patch-Filename: {}\n'.format(patch_filename))
+        added_filename_line = True
       ret.append(l)
   return ''.join(ret)