cef/patch/patches/browser_child_frame_2507.patch

diff --git content/browser/renderer_host/render_widget_host_view_child_frame.cc content/browser/renderer_host/render_widget_host_view_child_frame.cc
index fbb86a38a7ac..bd1c70e53371 100644
--- content/browser/renderer_host/render_widget_host_view_child_frame.cc
+++ content/browser/renderer_host/render_widget_host_view_child_frame.cc
@@ -613,6 +613,7 @@ void RenderWidgetHostViewChildFrame::SubmitCompositorFrame(
                "RenderWidgetHostViewChildFrame::OnSwapCompositorFrame");
   support_->SubmitCompositorFrame(local_surface_id, std::move(frame),
                                   std::move(hit_test_region_list));
+  ProcessFrameSwappedCallbacks();
 }
 
 void RenderWidgetHostViewChildFrame::OnDidNotProduceFrame(
@@ -621,6 +622,15 @@ void RenderWidgetHostViewChildFrame::OnDidNotProduceFrame(
   support_->DidNotProduceFrame(ack);
 }
 
+void RenderWidgetHostViewChildFrame::ProcessFrameSwappedCallbacks() {
+  std::vector<base::OnceClosure> process_callbacks;
+  // Swap the vectors to avoid re-entrancy issues due to calls to
+  // RegisterFrameSwappedCallback() while running the OnceClosures.
+  process_callbacks.swap(frame_swapped_callbacks_);
+  for (base::OnceClosure& callback : process_callbacks)
+    std::move(callback).Run();
+}
+
 void RenderWidgetHostViewChildFrame::TransformPointToRootSurface(
     gfx::PointF* point) {
   // This function is called by RenderWidgetHostInputEventRouter only for
@@ -818,6 +828,11 @@ void RenderWidgetHostViewChildFrame::ShowDefinitionForSelection() {
 void RenderWidgetHostViewChildFrame::SpeakSelection() {}
 #endif  // defined(OS_MACOSX)
 
+void RenderWidgetHostViewChildFrame::RegisterFrameSwappedCallback(
+    base::OnceClosure callback) {
+  frame_swapped_callbacks_.emplace_back(std::move(callback));
+}
+
 void RenderWidgetHostViewChildFrame::CopyFromSurface(
     const gfx::Rect& src_subrect,
     const gfx::Size& output_size,