Improve crashpad integration (issue #1995)

- Crash reporting is enabled and configured using a "crash_reporter.cfg"
  file. See comments in include/cef_crash_util.h and tools/crash_server.py
  for usage.

Add product name and version to crash_reporter.cfg (issue #1995)

patch/patches/crashpad_1995.patch

@@ -0,0 +1,596 @@
+diff --git build/secondary/third_party/crashpad/crashpad/handler/BUILD.gn build/secondary/third_party/crashpad/crashpad/handler/BUILD.gn
+index 6cd8b9f..dfbbdc6 100644
+--- build/secondary/third_party/crashpad/crashpad/handler/BUILD.gn
++++ build/secondary/third_party/crashpad/crashpad/handler/BUILD.gn
+@@ -2,6 +2,8 @@
+ # Use of this source code is governed by a BSD-style license that can be
+ # found in the LICENSE file.
+ 
++import("//cef/libcef/features/features.gni")
++
+ static_library("handler_lib") {
+   sources = [
+     "crash_report_upload_thread.cc",
+@@ -26,8 +28,18 @@ static_library("handler_lib") {
+     "../snapshot",
+     "../tools:tool_support",
+     "//base",
++    "//cef/libcef/features",
+   ]
+ 
++  if (enable_cef) {
++    sources += [
++      "//cef/libcef/common/cef_crash_report_upload_thread.cc",
++      "//cef/libcef/common/cef_crash_report_upload_thread.h",
++    ]
++
++    include_dirs += [ "//cef" ]
++  }
++
+   if (is_win) {
+     cflags = [ "/wd4201" ]
+   }
+diff --git chrome/common/crash_keys.cc chrome/common/crash_keys.cc
+index e7f304b..0042ed6 100644
+--- chrome/common/crash_keys.cc
++++ chrome/common/crash_keys.cc
+@@ -4,6 +4,8 @@
+ 
+ #include "chrome/common/crash_keys.h"
+ 
++#include <iterator>
++
+ #include "base/base_switches.h"
+ #include "base/command_line.h"
+ #include "base/format_macros.h"
+@@ -84,7 +86,7 @@ const char kViewCount[] = "view-count";
+ 
+ const char kZeroEncodeDetails[] = "zero-encode-details";
+ 
+-size_t RegisterChromeCrashKeys() {
++void GetChromeCrashKeys(std::vector<base::debug::CrashKey>& keys) {
+   // The following keys may be chunked by the underlying crash logging system,
+   // but ultimately constitute a single key-value pair.
+   //
+@@ -231,10 +233,16 @@ size_t RegisterChromeCrashKeys() {
+ 
+   // This dynamic set of keys is used for sets of key value pairs when gathering
+   // a collection of data, like command line switches or extension IDs.
+-  std::vector<base::debug::CrashKey> keys(
+-      fixed_keys, fixed_keys + arraysize(fixed_keys));
++  keys.reserve(keys.size() + arraysize(fixed_keys));
++  std::copy(fixed_keys, fixed_keys + arraysize(fixed_keys),
++            std::back_inserter(keys));
+ 
+   crash_keys::GetCrashKeysForCommandLineSwitches(&keys);
++}
++
++size_t RegisterChromeCrashKeys() {
++  std::vector<base::debug::CrashKey> keys;
++  GetChromeCrashKeys(keys);
+ 
+   // Register the extension IDs.
+   {
+@@ -268,7 +276,7 @@ size_t RegisterChromeCrashKeys() {
+   return base::debug::InitCrashKeys(&keys.at(0), keys.size(), kChunkMaxLength);
+ }
+ 
+-static bool IsBoringSwitch(const std::string& flag) {
++bool IsBoringChromeSwitch(const std::string& flag) {
+   static const char* const kIgnoreSwitches[] = {
+     switches::kEnableLogging,
+     switches::kFlagSwitchesBegin,
+@@ -324,7 +332,7 @@ static bool IsBoringSwitch(const std::string& flag) {
+ }
+ 
+ void SetCrashKeysFromCommandLine(const base::CommandLine& command_line) {
+-  return SetSwitchesFromCommandLine(command_line, &IsBoringSwitch);
++  return SetSwitchesFromCommandLine(command_line, &IsBoringChromeSwitch);
+ }
+ 
+ void SetActiveExtensions(const std::set<std::string>& extensions) {
+diff --git chrome/common/crash_keys.h chrome/common/crash_keys.h
+index 335b8d3..d56f09b 100644
+--- chrome/common/crash_keys.h
++++ chrome/common/crash_keys.h
+@@ -23,10 +23,18 @@ class CommandLine;
+ 
+ namespace crash_keys {
+ 
++// Returns the list of potential crash keys that can be sent to the crash
++// server.
++void GetChromeCrashKeys(std::vector<base::debug::CrashKey>& keys);
++
+ // Registers all of the potential crash keys that can be sent to the crash
+ // reporting server. Returns the size of the union of all keys.
+ size_t RegisterChromeCrashKeys();
+ 
++// Returns true if the specified command-line flag should be excluded from
++// crash reporting.
++bool IsBoringChromeSwitch(const std::string& flag);
++
+ // Sets the kNumSwitches key and the set of keys named using kSwitchFormat based
+ // on the given |command_line|.
+ void SetCrashKeysFromCommandLine(const base::CommandLine& command_line);
+diff --git chrome/install_static/install_util.cc chrome/install_static/install_util.cc
+index 10e187d..b7c32dc 100644
+--- chrome/install_static/install_util.cc
++++ chrome/install_static/install_util.cc
+@@ -500,7 +500,9 @@ bool IsNonBrowserProcess() {
+   return g_process_type == ProcessType::NON_BROWSER_PROCESS;
+ }
+ 
+-bool GetDefaultUserDataDirectory(std::wstring* result) {
++bool GetDefaultUserDataDirectory(
++    std::wstring* result,
++    const std::wstring& sub_directory) {
+   static const wchar_t kLocalAppData[] = L"%LOCALAPPDATA%";
+ 
+   std::unique_ptr<wchar_t> user_data_dir_path;
+@@ -527,7 +529,8 @@ bool GetDefaultUserDataDirectory(std::wstring* result) {
+       return false;
+   }
+ 
+-  std::wstring install_sub_directory = GetChromeInstallSubDirectory();
++  std::wstring install_sub_directory =
++      sub_directory.empty() ? GetChromeInstallSubDirectory() : sub_directory;
+ 
+   *result = user_data_dir_path.get();
+   if ((*result)[result->length() - 1] != L'\\')
+@@ -538,11 +541,13 @@ bool GetDefaultUserDataDirectory(std::wstring* result) {
+   return true;
+ }
+ 
+-bool GetDefaultCrashDumpLocation(std::wstring* crash_dir) {
++bool GetDefaultCrashDumpLocation(
++    std::wstring* crash_dir,
++    const std::wstring& install_sub_directory) {
+   // In order to be able to start crash handling very early, we do not rely on
+   // chrome's PathService entries (for DIR_CRASH_DUMPS) being available on
+   // Windows. See https://crbug.com/564398.
+-  if (!GetDefaultUserDataDirectory(crash_dir))
++  if (!GetDefaultUserDataDirectory(crash_dir, install_sub_directory))
+     return false;
+ 
+   // We have to make sure the user data dir exists on first run. See
+diff --git chrome/install_static/install_util.h chrome/install_static/install_util.h
+index 4ddcbfd..8888df1 100644
+--- chrome/install_static/install_util.h
++++ chrome/install_static/install_util.h
+@@ -106,14 +106,18 @@ bool IsNonBrowserProcess();
+ // TODO(ananta)
+ // http://crbug.com/604923
+ // Unify this with the Browser Distribution code.
+-bool GetDefaultUserDataDirectory(std::wstring* result);
++bool GetDefaultUserDataDirectory(
++    std::wstring* result,
++    const std::wstring& install_sub_directory = std::wstring());
+ 
+ // Populates |crash_dir| with the default crash dump location regardless of
+ // whether DIR_USER_DATA or DIR_CRASH_DUMPS has been overridden.
+ // TODO(ananta)
+ // http://crbug.com/604923
+ // Unify this with the Browser Distribution code.
+-bool GetDefaultCrashDumpLocation(std::wstring* crash_dir);
++bool GetDefaultCrashDumpLocation(
++    std::wstring* crash_dir,
++    const std::wstring& install_sub_directory = std::wstring());
+ 
+ // Returns the contents of the specified |variable_name| from the environment
+ // block of the calling process. Returns an empty string if the variable does
+diff --git chrome_elf/BUILD.gn chrome_elf/BUILD.gn
+index 14eafbb..171f5d5 100644
+--- chrome_elf/BUILD.gn
++++ chrome_elf/BUILD.gn
+@@ -7,6 +7,7 @@
+ 
+ import("//build/config/compiler/compiler.gni")
+ import("//build/config/win/manifest.gni")
++import("//cef/libcef/features/features.gni")
+ import("//chrome/process_version_rc_template.gni")
+ import("//testing/test.gni")
+ 
+@@ -135,16 +136,40 @@ static_library("blacklist") {
+ 
+ static_library("crash") {
+   sources = [
+-    "../chrome/app/chrome_crash_reporter_client_win.cc",
+-    "../chrome/app/chrome_crash_reporter_client_win.h",
+-    "../chrome/common/chrome_result_codes.h",
+     "crash/crash_helper.cc",
+     "crash/crash_helper.h",
+   ]
++
++  if (enable_cef) {
++    sources += [
++      "//cef/libcef/common/crash_reporter_client.cc",
++      "//cef/libcef/common/crash_reporter_client.h",
++
++      # Required for crash_keys::GetChromeCrashKeys.
++      # Otherwise we need to copy this array into CEF, which would be difficult
++      # to maintain.
++      "//chrome/common/crash_keys.cc",
++      "//chrome/common/chrome_switches.cc",
++      "//components/flags_ui/flags_ui_switches.cc",
++      "//content/public/common/content_switches.cc",
++
++    ]
++    include_dirs = [
++      "//cef",
++    ]
++  } else {
++    sources += [
++      "//chrome/app/chrome_crash_reporter_client_win.cc",
++      "//chrome/app/chrome_crash_reporter_client_win.h",
++      "//chrome/common/chrome_result_codes.h",
++    ]
++  }
++
+   deps = [
+     ":hook_util",
+     "//base:base",  # This needs to go.  DEP of app, crash_keys, client.
+     "//base:base_static",  # pe_image
++    "//cef/libcef/features",
+     "//chrome/install_static:install_static_util",
+     "//components/crash/content/app:app",
+     "//components/crash/core/common",  # crash_keys
+diff --git chrome_elf/crash/crash_helper.cc chrome_elf/crash/crash_helper.cc
+index c658fa9..8c4a145 100644
+--- chrome_elf/crash/crash_helper.cc
++++ chrome_elf/crash/crash_helper.cc
+@@ -11,12 +11,17 @@
+ #include <string>
+ #include <vector>
+ 
++#include "cef/libcef/features/features.h"
+ #include "chrome/app/chrome_crash_reporter_client_win.h"
+ #include "chrome_elf/hook_util/hook_util.h"
+ #include "components/crash/content/app/crashpad.h"
+ #include "components/crash/core/common/crash_keys.h"
+ #include "third_party/crashpad/crashpad/client/crashpad_client.h"
+ 
++#if BUILDFLAG(ENABLE_CEF)
++#include "cef/libcef/common/crash_reporter_client.h"
++#endif
++
+ namespace {
+ 
+ // Crash handling from elf is only enabled for the chrome.exe process.
+@@ -74,7 +79,11 @@ bool InitializeCrashReporting() {
+   g_crash_reports = new std::vector<crash_reporter::Report>;
+   g_set_unhandled_exception_filter = new elf_hook::IATHook();
+ 
++#if BUILDFLAG(ENABLE_CEF)
++  CefCrashReporterClient::InitializeCrashReportingForProcess();
++#else
+   ChromeCrashReporterClient::InitializeCrashReportingForProcess();
++#endif
+ 
+   g_crash_helper_enabled = true;
+   return true;
+diff --git components/crash/content/app/breakpad_linux.cc components/crash/content/app/breakpad_linux.cc
+index 9ebc33f..c013b36 100644
+--- components/crash/content/app/breakpad_linux.cc
++++ components/crash/content/app/breakpad_linux.cc
+@@ -29,6 +29,7 @@
+ #include "base/command_line.h"
+ #include "base/debug/crash_logging.h"
+ #include "base/debug/dump_without_crashing.h"
++#include "base/debug/leak_annotations.h"
+ #include "base/files/file_path.h"
+ #include "base/lazy_instance.h"
+ #include "base/linux_util.h"
+@@ -89,6 +90,7 @@ namespace {
+ 
+ #if !defined(OS_CHROMEOS)
+ const char kUploadURL[] = "https://clients2.google.com/cr/report";
++const char* g_crash_server_url = kUploadURL;
+ #endif
+ 
+ bool g_is_crash_reporter_enabled = false;
+@@ -654,7 +656,7 @@ bool CrashDone(const MinidumpDescriptor& minidump,
+   info.process_type_length = 7;
+   info.distro = base::g_linux_distro;
+   info.distro_length = my_strlen(base::g_linux_distro);
+-  info.upload = upload;
++  info.upload = upload && g_crash_server_url;
+   info.process_start_time = g_process_start_time;
+   info.oom_size = base::g_oom_size;
+   info.pid = g_pid;
+@@ -1275,7 +1277,7 @@ void ExecUploadProcessOrTerminate(const BreakpadInfo& info,
+     header_content_encoding,
+     header_content_type,
+     post_file,
+-    kUploadURL,
++    g_crash_server_url,
+     "--timeout=10",  // Set a timeout so we don't hang forever.
+     "--tries=1",     // Don't retry if the upload fails.
+     "-O",  // output reply to fd 3
+@@ -1880,6 +1882,17 @@ void InitCrashReporter(const std::string& process_type) {
+   PostEnableBreakpadInitialization();
+ }
+ 
++void SetCrashServerURL(const std::string& url) {
++  if (url.empty()) {
++    g_crash_server_url = nullptr;
++  } else {
++    char* new_url = new char[url.size() + 1];
++    ANNOTATE_LEAKING_OBJECT_PTR(new_url);
++    strcpy(new_url, url.c_str());
++    g_crash_server_url = new_url;
++  }
++}
++
+ #if defined(OS_ANDROID)
+ void InitNonBrowserCrashReporterForAndroid(const std::string& process_type) {
+   const base::CommandLine* command_line =
+diff --git components/crash/content/app/breakpad_linux.h components/crash/content/app/breakpad_linux.h
+index 3316fa0..df90dbd 100644
+--- components/crash/content/app/breakpad_linux.h
++++ components/crash/content/app/breakpad_linux.h
+@@ -16,6 +16,9 @@ namespace breakpad {
+ // Turns on the crash reporter in any process.
+ extern void InitCrashReporter(const std::string& process_type);
+ 
++// Set the crash server URL.
++void SetCrashServerURL(const std::string& url);
++
+ #if defined(OS_ANDROID)
+ 
+ const char kWebViewSingleProcessType[] = "webview";
+diff --git components/crash/content/app/crash_reporter_client.cc components/crash/content/app/crash_reporter_client.cc
+index 3dfbd99..80e5b66 100644
+--- components/crash/content/app/crash_reporter_client.cc
++++ components/crash/content/app/crash_reporter_client.cc
+@@ -88,11 +88,12 @@ int CrashReporterClient::GetResultCodeRespawnFailed() {
+ }
+ #endif
+ 
+-#if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_IOS)
++#if defined(OS_POSIX) && !defined(OS_IOS)
+ void CrashReporterClient::GetProductNameAndVersion(const char** product_name,
+                                                    const char** version) {
+ }
+ 
++#if !defined(OS_MACOSX)
+ base::FilePath CrashReporterClient::GetReporterLogFilename() {
+   return base::FilePath();
+ }
+@@ -101,6 +102,7 @@ bool CrashReporterClient::HandleCrashDump(const char* crashdump_filename) {
+   return false;
+ }
+ #endif
++#endif
+ 
+ #if defined(OS_WIN)
+ bool CrashReporterClient::GetCrashDumpLocation(base::string16* crash_dir) {
+@@ -141,6 +143,26 @@ bool CrashReporterClient::ReportingIsEnforcedByPolicy(bool* breakpad_enabled) {
+ }
+ #endif
+ 
++bool CrashReporterClient::EnableBreakpadForProcess(
++    const std::string& process_type) {
++  return false;
++}
++
++std::string CrashReporterClient::GetCrashServerURL() {
++  return std::string();
++}
++
++void CrashReporterClient::GetCrashOptionalArguments(
++    std::vector<std::string>* arguments) {
++}
++
++#if defined(OS_WIN)
++base::string16 CrashReporterClient::GetCrashExternalHandler(
++    const base::string16& exe_dir) {
++  return exe_dir + L"\\crashpad_handler.exe";
++}
++#endif
++
+ #if defined(OS_ANDROID)
+ int CrashReporterClient::GetAndroidMinidumpDescriptor() {
+   return 0;
+@@ -165,9 +187,4 @@ bool CrashReporterClient::ShouldEnableBreakpadMicrodumps() {
+ }
+ #endif
+ 
+-bool CrashReporterClient::EnableBreakpadForProcess(
+-    const std::string& process_type) {
+-  return false;
+-}
+-
+ }  // namespace crash_reporter
+diff --git components/crash/content/app/crash_reporter_client.h components/crash/content/app/crash_reporter_client.h
+index 25ae505..d923b39 100644
+--- components/crash/content/app/crash_reporter_client.h
++++ components/crash/content/app/crash_reporter_client.h
+@@ -8,6 +8,7 @@
+ #include <stddef.h>
+ 
+ #include <string>
++#include <vector>
+ 
+ #include "base/strings/string16.h"
+ #include "build/build_config.h"
+@@ -104,12 +105,13 @@ class CrashReporterClient {
+   virtual int GetResultCodeRespawnFailed();
+ #endif
+ 
+-#if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_IOS)
++#if defined(OS_POSIX) && !defined(OS_IOS)
+   // Returns a textual description of the product type and version to include
+   // in the crash report. Neither out parameter should be set to NULL.
+   virtual void GetProductNameAndVersion(const char** product_name,
+                                         const char** version);
+ 
++#if !defined(OS_MACOSX)
+   virtual base::FilePath GetReporterLogFilename();
+ 
+   // Custom crash minidump handler after the minidump is generated.
+@@ -119,6 +121,7 @@ class CrashReporterClient {
+   // libc nor allocate memory normally.
+   virtual bool HandleCrashDump(const char* crashdump_filename);
+ #endif
++#endif
+ 
+   // The location where minidump files should be written. Returns true if
+   // |crash_dir| was set. Windows has to use base::string16 because this code
+@@ -176,6 +179,17 @@ class CrashReporterClient {
+ 
+   // Returns true if breakpad should run in the given process type.
+   virtual bool EnableBreakpadForProcess(const std::string& process_type);
++
++  // Returns the URL for submitting crash reports.
++  virtual std::string GetCrashServerURL();
++
++  // Populate |arguments| with additional optional arguments.
++  virtual void GetCrashOptionalArguments(std::vector<std::string>* arguments);
++
++#if defined(OS_WIN)
++  // Returns the absolute path to the external crash handler exe.
++  virtual base::string16 GetCrashExternalHandler(const base::string16& exe_dir);
++#endif
+ };
+ 
+ }  // namespace crash_reporter
+diff --git components/crash/content/app/crashpad_mac.mm components/crash/content/app/crashpad_mac.mm
+index 3223ddd..c70a498 100644
+--- components/crash/content/app/crashpad_mac.mm
++++ components/crash/content/app/crashpad_mac.mm
+@@ -16,11 +16,14 @@
+ #include "base/logging.h"
+ #include "base/mac/bundle_locations.h"
+ #include "base/mac/foundation_util.h"
++#include "base/path_service.h"
+ #include "base/strings/string_number_conversions.h"
+ #include "base/strings/string_piece.h"
+ #include "base/strings/stringprintf.h"
+ #include "base/strings/sys_string_conversions.h"
+ #include "components/crash/content/app/crash_reporter_client.h"
++#include "components/crash/content/app/crash_switches.h"
++#include "content/public/common/content_paths.h"
+ #include "third_party/crashpad/crashpad/client/crash_report_database.h"
+ #include "third_party/crashpad/crashpad/client/crashpad_client.h"
+ #include "third_party/crashpad/crashpad/client/crashpad_info.h"
+@@ -40,9 +43,10 @@ base::FilePath PlatformCrashpadInitialization(bool initial_client,
+ 
+   if (initial_client) {
+     @autoreleasepool {
+-      base::FilePath framework_bundle_path = base::mac::FrameworkBundlePath();
+-      base::FilePath handler_path =
+-          framework_bundle_path.Append("Helpers").Append("crashpad_handler");
++      // Use the same subprocess helper exe.
++      base::FilePath handler_path;
++      PathService::Get(content::CHILD_PROCESS_EXE, &handler_path);
++      DCHECK(!handler_path.empty());
+ 
+       // Is there a way to recover if this fails?
+       CrashReporterClient* crash_reporter_client = GetCrashReporterClient();
+@@ -54,16 +58,27 @@ base::FilePath PlatformCrashpadInitialization(bool initial_client,
+       // crash server won't have symbols for any other build types.
+       std::string url = "https://clients2.google.com/cr/report";
+ #else
+-      std::string url;
++      std::string url = crash_reporter_client->GetCrashServerURL();
+ #endif
+ 
+       std::map<std::string, std::string> process_annotations;
+ 
++      const char* product_name = "";
++      const char* product_version = "";
++      crash_reporter_client->GetProductNameAndVersion(&product_name,
++                                                      &product_version);
++ 
+       NSBundle* outer_bundle = base::mac::OuterBundle();
+-      NSString* product = base::mac::ObjCCast<NSString>([outer_bundle
+-          objectForInfoDictionaryKey:base::mac::CFToNSCast(kCFBundleNameKey)]);
+-      process_annotations["prod"] =
+-          base::SysNSStringToUTF8(product).append("_Mac");
++
++      if (strlen(product_name) == 0) {
++        NSString* product = base::mac::ObjCCast<NSString>([outer_bundle
++            objectForInfoDictionaryKey:base::mac::CFToNSCast(
++                kCFBundleNameKey)]);
++        process_annotations["prod"] =
++            base::SysNSStringToUTF8(product).append("_Mac");
++      } else {
++        process_annotations["prod"] = product_name;
++      }
+ 
+ #if defined(GOOGLE_CHROME_BUILD)
+       NSString* channel = base::mac::ObjCCast<NSString>(
+@@ -73,10 +88,14 @@ base::FilePath PlatformCrashpadInitialization(bool initial_client,
+       }
+ #endif
+ 
+-      NSString* version =
+-          base::mac::ObjCCast<NSString>([base::mac::FrameworkBundle()
+-              objectForInfoDictionaryKey:@"CFBundleShortVersionString"]);
+-      process_annotations["ver"] = base::SysNSStringToUTF8(version);
++      if (strlen(product_version) == 0) {
++        NSString* version =
++            base::mac::ObjCCast<NSString>([base::mac::FrameworkBundle()
++                objectForInfoDictionaryKey:@"CFBundleShortVersionString"]);
++        process_annotations["ver"] = base::SysNSStringToUTF8(version);
++      } else {
++        process_annotations["ver"] = product_version;
++      }
+ 
+       process_annotations["plat"] = std::string("OS X");
+ 
+@@ -90,6 +109,12 @@ base::FilePath PlatformCrashpadInitialization(bool initial_client,
+             "--reset-own-crash-exception-port-to-system-default");
+       }
+ 
++      // Since we're using the same subprocess helper exe we must specify the
++      // process type.
++      arguments.push_back(std::string("--type=") + switches::kCrashpadHandler);
++
++      crash_reporter_client->GetCrashOptionalArguments(&arguments);
++
+       crashpad::CrashpadClient crashpad_client;
+       bool result = crashpad_client.StartHandler(handler_path,
+                                                  database_path,
+diff --git components/crash/content/app/crashpad_win.cc components/crash/content/app/crashpad_win.cc
+index d9a4089..6a74e5b 100644
+--- components/crash/content/app/crashpad_win.cc
++++ components/crash/content/app/crashpad_win.cc
+@@ -82,7 +82,7 @@ base::FilePath PlatformCrashpadInitialization(bool initial_client,
+ #if defined(GOOGLE_CHROME_BUILD)
+     std::string url = "https://clients2.google.com/cr/report";
+ #else
+-    std::string url;
++    std::string url = crash_reporter_client->GetCrashServerURL();
+ #endif
+ 
+     // Allow the crash server to be overridden for testing. If the variable
+@@ -116,9 +116,12 @@ base::FilePath PlatformCrashpadInitialization(bool initial_client,
+       arguments.push_back("/prefetch:7");
+     } else {
+       base::FilePath exe_dir = exe_file.DirName();
+-      exe_file = exe_dir.Append(FILE_PATH_LITERAL("crashpad_handler.exe"));
++      exe_file = base::FilePath(
++          crash_reporter_client->GetCrashExternalHandler(exe_dir.value()));
+     }
+ 
++    crash_reporter_client->GetCrashOptionalArguments(&arguments);
++
+     result = g_crashpad_client.Get().StartHandler(
+         exe_file, database_path, metrics_path, url, process_annotations,
+         arguments, false);
+diff --git content/browser/frame_host/debug_urls.cc content/browser/frame_host/debug_urls.cc
+index 1ff19d5..41bbbdc4 100644
+--- content/browser/frame_host/debug_urls.cc
++++ content/browser/frame_host/debug_urls.cc
+@@ -186,7 +186,9 @@ bool HandleDebugURL(const GURL& url, ui::PageTransition transition) {
+           cc::switches::kEnableGpuBenchmarking) &&
+       (PageTransitionCoreTypeIs(transition, ui::PAGE_TRANSITION_TYPED));
+ 
+-  if (!(transition & ui::PAGE_TRANSITION_FROM_ADDRESS_BAR) &&
++  // CEF does not use PAGE_TRANSITION_FROM_ADDRESS_BAR.
++  if (!(transition & (ui::PAGE_TRANSITION_TYPED ||
++                      ui::PAGE_TRANSITION_FROM_ADDRESS_BAR)) &&
+       !is_telemetry_navigation)
+     return false;
+ 

patch/patches/crashpad_tp_1995.patch

@@ -0,0 +1,292 @@
+diff --git crashpad/client/prune_crash_reports.cc crashpad/client/prune_crash_reports.cc
+index 3aaaeee..d99fcb4 100644
+--- crashpad/client/prune_crash_reports.cc
++++ crashpad/client/prune_crash_reports.cc
+@@ -67,13 +67,19 @@ void PruneCrashReportDatabase(CrashReportDatabase* database,
+ }
+ 
+ // static
+-std::unique_ptr<PruneCondition> PruneCondition::GetDefault() {
++std::unique_ptr<PruneCondition> PruneCondition::GetDefault(
++    int max_size_in_mb,
++    int max_age_in_days) {
+   // DatabaseSizePruneCondition must be the LHS so that it is always evaluated,
+   // due to the short-circuting behavior of BinaryPruneCondition.
++  if (max_size_in_mb <= 0)
++    max_size_in_mb = 128;
++  if (max_age_in_days <= 0)
++    max_age_in_days = 365;
+   return base::WrapUnique(
+       new BinaryPruneCondition(BinaryPruneCondition::OR,
+-                               new DatabaseSizePruneCondition(1024 * 128),
+-                               new AgePruneCondition(365)));
++                               new DatabaseSizePruneCondition(max_size_in_mb),
++                               new AgePruneCondition(max_age_in_days)));
+ }
+ 
+ static const time_t kSecondsInDay = 60 * 60 * 24;
+diff --git crashpad/client/prune_crash_reports.h crashpad/client/prune_crash_reports.h
+index b66e9349..86d1f15 100644
+--- crashpad/client/prune_crash_reports.h
++++ crashpad/client/prune_crash_reports.h
+@@ -57,7 +57,8 @@ class PruneCondition {
+   //! of 128 MB.
+   //!
+   //! \return A PruneCondition for use with PruneCrashReportDatabase().
+-  static std::unique_ptr<PruneCondition> GetDefault();
++  static std::unique_ptr<PruneCondition> GetDefault(int max_size_in_mb,
++                                                    int max_age_in_days);
+ 
+   virtual ~PruneCondition() {}
+ 
+diff --git crashpad/client/settings.cc crashpad/client/settings.cc
+index d018e37f..47d8110 100644
+--- crashpad/client/settings.cc
++++ crashpad/client/settings.cc
+@@ -38,7 +38,7 @@ void ScopedLockedFileHandleTraits::Free(FileHandle handle) {
+ 
+ struct Settings::Data {
+   static const uint32_t kSettingsMagic = 'CPds';
+-  static const uint32_t kSettingsVersion = 1;
++  static const uint32_t kSettingsVersion = 2;
+ 
+   enum Options : uint32_t {
+     kUploadsEnabled = 1 << 0,
+@@ -49,6 +49,9 @@ struct Settings::Data {
+            options(0),
+            padding_0(0),
+            last_upload_attempt_time(0),
++           next_upload_attempt_time(0),
++           backoff_step(0),
++           padding_1(0),
+            client_id() {}
+ 
+   uint32_t magic;
+@@ -56,6 +59,9 @@ struct Settings::Data {
+   uint32_t options;
+   uint32_t padding_0;
+   uint64_t last_upload_attempt_time;  // time_t
++  uint64_t next_upload_attempt_time;  // time_t
++  uint32_t backoff_step;
++  uint32_t padding_1;
+   UUID client_id;
+ };
+ 
+@@ -141,6 +147,56 @@ bool Settings::SetLastUploadAttemptTime(time_t time) {
+   return WriteSettings(handle.get(), settings);
+ }
+ 
++bool Settings::GetNextUploadAttemptTime(time_t* time) {
++  DCHECK(initialized_.is_valid());
++
++  Data settings;
++  if (!OpenAndReadSettings(&settings))
++    return false;
++
++  *time = InRangeCast<time_t>(settings.next_upload_attempt_time,
++                              std::numeric_limits<time_t>::max());
++  return true;
++}
++
++bool Settings::SetNextUploadAttemptTime(time_t time) {
++  DCHECK(initialized_.is_valid());
++
++  Data settings;
++  ScopedLockedFileHandle handle = OpenForWritingAndReadSettings(&settings);
++  if (!handle.is_valid())
++    return false;
++
++  settings.next_upload_attempt_time = InRangeCast<uint64_t>(time, 0);
++
++  return WriteSettings(handle.get(), settings);
++}
++
++bool Settings::GetBackoffStep(int* step) {
++  DCHECK(initialized_.is_valid());
++
++  Data settings;
++  if (!OpenAndReadSettings(&settings))
++    return false;
++
++  *step = InRangeCast<int>(settings.backoff_step,
++                           std::numeric_limits<int>::max());
++  return true;
++}
++
++bool Settings::SetBackoffStep(int step) {
++  DCHECK(initialized_.is_valid());
++
++  Data settings;
++  ScopedLockedFileHandle handle = OpenForWritingAndReadSettings(&settings);
++  if (!handle.is_valid())
++    return false;
++
++  settings.backoff_step = InRangeCast<uint32_t>(step, 0);
++
++  return WriteSettings(handle.get(), settings);
++}
++
+ // static
+ Settings::ScopedLockedFileHandle Settings::MakeScopedLockedFileHandle(
+     FileHandle file,
+diff --git crashpad/client/settings.h crashpad/client/settings.h
+index b64f74f..0c3c22e 100644
+--- crashpad/client/settings.h
++++ crashpad/client/settings.h
+@@ -102,6 +102,11 @@ class Settings {
+   //!     error logged.
+   bool SetLastUploadAttemptTime(time_t time);
+ 
++  bool GetNextUploadAttemptTime(time_t* time);
++  bool SetNextUploadAttemptTime(time_t time);
++  bool GetBackoffStep(int* step);
++  bool SetBackoffStep(int step);
++
+  private:
+   struct Data;
+ 
+diff --git crashpad/handler/crash_report_upload_thread.h crashpad/handler/crash_report_upload_thread.h
+index a9601d1..9517730 100644
+--- crashpad/handler/crash_report_upload_thread.h
++++ crashpad/handler/crash_report_upload_thread.h
+@@ -76,7 +76,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate {
+   //! This method may be called from any thread.
+   void ReportPending();
+ 
+- private:
++ protected:
+   //! \brief The result code from UploadReport().
+   enum class UploadResult {
+     //! \brief The crash report was uploaded successfully.
+@@ -99,7 +99,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate {
+ 
+   //! \brief Obtains all pending reports from the database, and calls
+   //!     ProcessPendingReport() to process each one.
+-  void ProcessPendingReports();
++  virtual void ProcessPendingReports();
+ 
+   //! \brief Processes a single pending report from the database.
+   //!
+@@ -113,7 +113,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate {
+   //! remain in the “pending” state. If the upload fails and no more retries are
+   //! desired, or report upload is disabled, it will be marked as “completed” in
+   //! the database without ever having been uploaded.
+-  void ProcessPendingReport(const CrashReportDatabase::Report& report);
++  virtual void ProcessPendingReport(const CrashReportDatabase::Report& report);
+ 
+   //! \brief Attempts to upload a crash report.
+   //!
+diff --git crashpad/handler/handler_main.cc crashpad/handler/handler_main.cc
+index 8749c58..40eaeab 100644
+--- crashpad/handler/handler_main.cc
++++ crashpad/handler/handler_main.cc
+@@ -29,8 +29,10 @@
+ #include "base/logging.h"
+ #include "base/metrics/persistent_histogram_allocator.h"
+ #include "base/scoped_generic.h"
++#include "base/strings/string_number_conversions.h"
+ #include "base/strings/utf_string_conversions.h"
+ #include "build/build_config.h"
++#include "cef/libcef/features/features.h"
+ #include "client/crash_report_database.h"
+ #include "client/crashpad_client.h"
+ #include "client/prune_crash_reports.h"
+@@ -61,6 +63,10 @@
+ #include "util/win/handle.h"
+ #endif  // OS_MACOSX
+ 
++#if BUILDFLAG(ENABLE_CEF)
++#include "cef/libcef/common/cef_crash_report_upload_thread.h"
++#endif
++
+ namespace crashpad {
+ 
+ namespace {
+@@ -157,6 +163,9 @@ int HandlerMain(int argc, char* argv[]) {
+     kOptionPipeName,
+ #endif  // OS_MACOSX
+     kOptionURL,
++    kOptionMaxUploads,
++    kOptionMaxDatabaseSize,
++    kOptionMaxDatabaseAge,
+ 
+     // Standard options.
+     kOptionHelp = -2,
+@@ -177,6 +186,9 @@ int HandlerMain(int argc, char* argv[]) {
+     std::string pipe_name;
+ #endif  // OS_MACOSX
+     bool rate_limit;
++    int max_uploads;
++    int max_database_size;
++    int max_database_age;
+   } options = {};
+ #if defined(OS_MACOSX)
+   options.handshake_fd = -1;
+@@ -184,6 +196,9 @@ int HandlerMain(int argc, char* argv[]) {
+   options.handshake_handle = INVALID_HANDLE_VALUE;
+ #endif
+   options.rate_limit = true;
++  options.max_uploads = 0;
++  options.max_database_size = 0;
++  options.max_database_age = 0;
+ 
+   const option long_options[] = {
+       {"annotation", required_argument, nullptr, kOptionAnnotation},
+@@ -207,6 +222,9 @@ int HandlerMain(int argc, char* argv[]) {
+       {"url", required_argument, nullptr, kOptionURL},
+       {"help", no_argument, nullptr, kOptionHelp},
+       {"version", no_argument, nullptr, kOptionVersion},
++      {"max-uploads", required_argument, nullptr, kOptionMaxUploads},
++      {"max-db-size", required_argument, nullptr, kOptionMaxDatabaseSize},
++      {"max-db-age", required_argument, nullptr, kOptionMaxDatabaseAge},
+       {nullptr, 0, nullptr, 0},
+   };
+ 
+@@ -282,6 +300,27 @@ int HandlerMain(int argc, char* argv[]) {
+         options.url = optarg;
+         break;
+       }
++      case kOptionMaxUploads: {
++        if (base::StringToInt(optarg, &options.max_uploads)) {
++          if (options.max_uploads < 0)
++            options.max_uploads = 0;
++        }
++        break;
++      }
++      case kOptionMaxDatabaseSize: {
++        if (base::StringToInt(optarg, &options.max_database_size)) {
++          if (options.max_database_size < 0)
++            options.max_database_size = 0;
++        }
++        break;
++      }
++      case kOptionMaxDatabaseAge: {
++        if (base::StringToInt(optarg, &options.max_database_age)) {
++          if (options.max_database_age < 0)
++            options.max_database_age = 0;
++        }
++        break;
++      }
+       case kOptionHelp: {
+         Usage(me);
+         return EXIT_SUCCESS;
+@@ -429,12 +468,18 @@ int HandlerMain(int argc, char* argv[]) {
+   // TODO(scottmg): options.rate_limit should be removed when we have a
+   // configurable database setting to control upload limiting.
+   // See https://crashpad.chromium.org/bug/23.
++#if BUILDFLAG(ENABLE_CEF)
++  CefCrashReportUploadThread upload_thread(
++      database.get(), options.url, options.rate_limit, options.max_uploads);
++#else
+   CrashReportUploadThread upload_thread(
+       database.get(), options.url, options.rate_limit);
++#endif
+   upload_thread.Start();
+ 
+   PruneCrashReportThread prune_thread(database.get(),
+-                                      PruneCondition::GetDefault());
++      PruneCondition::GetDefault(options.max_database_size,
++                                 options.max_database_age));
+   prune_thread.Start();
+ 
+   CrashReportExceptionHandler exception_handler(