diff --git a/CHROMIUM_BUILD_COMPATIBILITY.txt b/CHROMIUM_BUILD_COMPATIBILITY.txt
index ac3a34865..4ecde200f 100644
--- a/CHROMIUM_BUILD_COMPATIBILITY.txt
+++ b/CHROMIUM_BUILD_COMPATIBILITY.txt
@@ -7,5 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/60.0.3112.10',
+  'chromium_checkout': 'refs/tags/60.0.3112.40',
 }
diff --git a/patch/patch.cfg b/patch/patch.cfg
index c644ab8b3..9f7ad3aee 100644
--- a/patch/patch.cfg
+++ b/patch/patch.cfg
@@ -303,4 +303,10 @@ patches = [
     # https://bitbucket.org/chromiumembedded/cef/issues/2196
     'name': 'printing_context_2196',
   },
+  {
+    # Windows: Fix GPU process crash.
+    # https://bugs.chromium.org/p/chromium/issues/detail?id=735986
+    'name': 'libangle_735986',
+    'path': 'third_party/angle/',
+  },
 ]
diff --git a/patch/patches/browser_plugin_guest_1565.patch b/patch/patches/browser_plugin_guest_1565.patch
index 64aee1437..dc5d93ec8 100644
--- a/patch/patches/browser_plugin_guest_1565.patch
+++ b/patch/patches/browser_plugin_guest_1565.patch
@@ -36,7 +36,7 @@ index 1f985ec..47bf303 100644
    }
  
 diff --git content/browser/frame_host/interstitial_page_impl.cc content/browser/frame_host/interstitial_page_impl.cc
-index d890e64..1965603 100644
+index 90e4de3..5311193 100644
 --- content/browser/frame_host/interstitial_page_impl.cc
 +++ content/browser/frame_host/interstitial_page_impl.cc
 @@ -605,7 +605,7 @@ WebContentsView* InterstitialPageImpl::CreateWebContentsView() {
diff --git a/patch/patches/chrome_profile.patch b/patch/patches/chrome_profile.patch
index b2c31c98a..bacfc4cf1 100644
--- a/patch/patches/chrome_profile.patch
+++ b/patch/patches/chrome_profile.patch
@@ -63,10 +63,10 @@ index 4b43013..169ca47 100644
  content::BrowserContext* GetBrowserContextRedirectedInIncognito(
      content::BrowserContext* context);
 diff --git chrome/browser/profiles/profile_manager.h chrome/browser/profiles/profile_manager.h
-index 385f9c3..3d126bd 100644
+index 5753fec..cc23f06 100644
 --- chrome/browser/profiles/profile_manager.h
 +++ chrome/browser/profiles/profile_manager.h
-@@ -89,7 +89,7 @@ class ProfileManager : public base::NonThreadSafe,
+@@ -95,7 +95,7 @@ class ProfileManager : public base::NonThreadSafe,
    // acceptable. Returns null if creation of the new profile fails.
    // TODO(bauerb): Migrate calls from other code to GetProfileByPath(), then
    // make this method private.
@@ -75,7 +75,7 @@ index 385f9c3..3d126bd 100644
  
    // Returns total number of profiles available on this machine.
    size_t GetNumberOfProfiles();
-@@ -117,7 +117,7 @@ class ProfileManager : public base::NonThreadSafe,
+@@ -123,7 +123,7 @@ class ProfileManager : public base::NonThreadSafe,
  
    // Returns true if the profile pointer is known to point to an existing
    // profile.
@@ -84,7 +84,7 @@ index 385f9c3..3d126bd 100644
  
    // Returns the directory where the first created profile is stored,
    // relative to the user data directory currently in use.
-@@ -126,7 +126,7 @@ class ProfileManager : public base::NonThreadSafe,
+@@ -132,7 +132,7 @@ class ProfileManager : public base::NonThreadSafe,
    // Get the Profile last used (the Profile to which owns the most recently
    // focused window) with this Chrome build. If no signed profile has been
    // stored in Local State, hand back the Default profile.
diff --git a/patch/patches/content_1129_2015.patch b/patch/patches/content_1129_2015.patch
index 8b4ec3ecc..934b67c3e 100644
--- a/patch/patches/content_1129_2015.patch
+++ b/patch/patches/content_1129_2015.patch
@@ -78,10 +78,10 @@ index ea5764b..ae06854 100644
                mime_type, false, NULL, &plugin, NULL));
  }
 diff --git content/browser/frame_host/navigation_handle_impl.cc content/browser/frame_host/navigation_handle_impl.cc
-index 7563fdf..d4e0a38 100644
+index 578c05b..b2d2687 100644
 --- content/browser/frame_host/navigation_handle_impl.cc
 +++ content/browser/frame_host/navigation_handle_impl.cc
-@@ -294,12 +294,6 @@ net::Error NavigationHandleImpl::GetNetErrorCode() {
+@@ -299,12 +299,6 @@ net::Error NavigationHandleImpl::GetNetErrorCode() {
  }
  
  RenderFrameHostImpl* NavigationHandleImpl::GetRenderFrameHost() {
@@ -95,7 +95,7 @@ index 7563fdf..d4e0a38 100644
  }
  
 diff --git content/browser/frame_host/render_frame_host_impl.cc content/browser/frame_host/render_frame_host_impl.cc
-index 55f8a8b..5020178 100644
+index cee576c..e3a7dd5 100644
 --- content/browser/frame_host/render_frame_host_impl.cc
 +++ content/browser/frame_host/render_frame_host_impl.cc
 @@ -865,10 +865,8 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
@@ -109,7 +109,7 @@ index 55f8a8b..5020178 100644
      IPC_MESSAGE_HANDLER(FrameHostMsg_RequestOverlayRoutingToken,
                          OnRequestOverlayRoutingToken)
      IPC_MESSAGE_HANDLER(FrameHostMsg_ShowCreatedWindow, OnShowCreatedWindow)
-@@ -1323,6 +1321,7 @@ void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
+@@ -1329,6 +1327,7 @@ void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
    if (navigation_handle_) {
      navigation_handle_->set_net_error_code(
          static_cast<net::Error>(params.error_code));
@@ -117,7 +117,7 @@ index 55f8a8b..5020178 100644
    }
  
    frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
-@@ -2578,14 +2577,12 @@ void RenderFrameHostImpl::OnHidePopup() {
+@@ -2584,14 +2583,12 @@ void RenderFrameHostImpl::OnHidePopup() {
  }
  #endif
  
@@ -429,7 +429,7 @@ index ebf4cd4..27a9df4 100644
    virtual void FocusedNodeChanged(const blink::WebNode& node) {}
  
 diff --git content/renderer/render_frame_impl.cc content/renderer/render_frame_impl.cc
-index d1e9d50..ad7c36d7 100644
+index 7e2ea09..799a0d2 100644
 --- content/renderer/render_frame_impl.cc
 +++ content/renderer/render_frame_impl.cc
 @@ -2902,7 +2902,8 @@ blink::WebPlugin* RenderFrameImpl::CreatePlugin(
@@ -451,7 +451,7 @@ index d1e9d50..ad7c36d7 100644
  }
  
  void RenderFrameImpl::WillCommitProvisionalLoad() {
-@@ -5495,9 +5498,8 @@ WebNavigationPolicy RenderFrameImpl::DecidePolicyForNavigation(
+@@ -5502,9 +5505,8 @@ WebNavigationPolicy RenderFrameImpl::DecidePolicyForNavigation(
         (!IsBrowserSideNavigationEnabled() ||
          url != pending_navigation_params_->request_params.redirects[0]));
  
@@ -463,7 +463,7 @@ index d1e9d50..ad7c36d7 100644
    // The handlenavigation API is deprecated and will be removed once
    // crbug.com/325351 is resolved.
    if (GetContentClient()->renderer()->HandleNavigation(
-@@ -5510,7 +5512,6 @@ WebNavigationPolicy RenderFrameImpl::DecidePolicyForNavigation(
+@@ -5517,7 +5519,6 @@ WebNavigationPolicy RenderFrameImpl::DecidePolicyForNavigation(
      }
      return blink::kWebNavigationPolicyIgnore;
    }
@@ -472,7 +472,7 @@ index d1e9d50..ad7c36d7 100644
    Referrer referrer(
        RenderViewImpl::GetReferrerFromRequest(frame_, info.url_request));
 diff --git content/renderer/render_thread_impl.cc content/renderer/render_thread_impl.cc
-index 116d31a8..ef645bb 100644
+index d7a0de4..8d1e96e 100644
 --- content/renderer/render_thread_impl.cc
 +++ content/renderer/render_thread_impl.cc
 @@ -754,6 +754,8 @@ void RenderThreadImpl::Init(
diff --git a/patch/patches/libangle_735986.patch b/patch/patches/libangle_735986.patch
new file mode 100644
index 000000000..9fb29f749
--- /dev/null
+++ b/patch/patches/libangle_735986.patch
@@ -0,0 +1,15 @@
+diff --git src/libANGLE/renderer/d3d/d3d11/Clear11.cpp src/libANGLE/renderer/d3d/d3d11/Clear11.cpp
+index 2b960fe..4755132 100644
+--- src/libANGLE/renderer/d3d/d3d11/Clear11.cpp
++++ src/libANGLE/renderer/d3d/d3d11/Clear11.cpp
+@@ -370,8 +370,8 @@ gl::Error Clear11::clearFramebuffer(const ClearParameters &clearParams,
+     {
+         const gl::FramebufferAttachment &attachment = colorAttachments[colorAttachmentIndex];
+ 
+-        if (clearParams.clearColor[colorAttachmentIndex] && attachment.isAttached() &&
+-            drawBufferStates[colorAttachmentIndex] != GL_NONE)
++        if (!clearParams.clearColor[colorAttachmentIndex] || !attachment.isAttached() ||
++            drawBufferStates[colorAttachmentIndex] == GL_NONE)
+         {
+             continue;
+         }
diff --git a/patch/patches/prefs_content_1161.patch b/patch/patches/prefs_content_1161.patch
index bc5e78e6d..aedce6ce3 100644
--- a/patch/patches/prefs_content_1161.patch
+++ b/patch/patches/prefs_content_1161.patch
@@ -1,8 +1,8 @@
 diff --git content/public/common/common_param_traits_macros.h content/public/common/common_param_traits_macros.h
-index 3220d59..f0fa24c 100644
+index e0f025b..b691251 100644
 --- content/public/common/common_param_traits_macros.h
 +++ content/public/common/common_param_traits_macros.h
-@@ -206,6 +206,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::WebPreferences)
+@@ -207,6 +207,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::WebPreferences)
    IPC_STRUCT_TRAITS_MEMBER(main_frame_resizes_are_orientation_changes)
    IPC_STRUCT_TRAITS_MEMBER(initialize_at_minimum_page_scale)
    IPC_STRUCT_TRAITS_MEMBER(smart_insert_delete_enabled)
@@ -35,7 +35,7 @@ index 41f7a69..d04e476 100644
    bool inert_visual_viewport;
    bool record_whole_document;
 diff --git content/renderer/render_view_impl.cc content/renderer/render_view_impl.cc
-index 48b7bc0..f4d9b48 100644
+index af998d3..56a4cf9 100644
 --- content/renderer/render_view_impl.cc
 +++ content/renderer/render_view_impl.cc
 @@ -1399,6 +1399,8 @@ void RenderViewImpl::ApplyWebPreferencesInternal(
diff --git a/patch/patches/storage_partition_1973.patch b/patch/patches/storage_partition_1973.patch
index 0a0151c0c..a37340ab5 100644
--- a/patch/patches/storage_partition_1973.patch
+++ b/patch/patches/storage_partition_1973.patch
@@ -90,7 +90,7 @@ index 0f23bbe..b21982f 100644
    CHECK(GetUserData(kMojoWasInitialized))
        << "Attempting to destroy a BrowserContext that never called "
 diff --git content/browser/devtools/protocol/service_worker_handler.cc content/browser/devtools/protocol/service_worker_handler.cc
-index 242d33e..4dfb463 100644
+index 31abe59..849745c 100644
 --- content/browser/devtools/protocol/service_worker_handler.cc
 +++ content/browser/devtools/protocol/service_worker_handler.cc
 @@ -321,10 +321,9 @@ Response ServiceWorkerHandler::DispatchSyncEvent(
@@ -152,7 +152,7 @@ index 73f3cba..55d488b 100644
    BrowserThread::PostTask(
        BrowserThread::IO, FROM_HERE,
 diff --git content/browser/renderer_host/render_process_host_impl.cc content/browser/renderer_host/render_process_host_impl.cc
-index cbd667c..c0158c9 100644
+index 8d76dbf..8b3c223 100644
 --- content/browser/renderer_host/render_process_host_impl.cc
 +++ content/browser/renderer_host/render_process_host_impl.cc
 @@ -482,7 +482,7 @@ class DefaultSubframeProcessHostHolder : public base::SupportsUserData::Data,
@@ -346,7 +346,7 @@ index cbd667c..c0158c9 100644
    if (!GetWorkerRefCount())
      return;
    service_worker_ref_count_ = 0;
-@@ -3065,8 +3084,8 @@ RenderProcessHost* RenderProcessHostImpl::GetProcessHostForSiteInstance(
+@@ -3063,8 +3082,8 @@ RenderProcessHost* RenderProcessHostImpl::GetProcessHostForSiteInstance(
            g_render_process_host_factory_->CreateRenderProcessHost(
                browser_context, site_instance);
      } else {
diff --git a/patch/patches/views_widget_180_1481_1565_1677_1749.patch b/patch/patches/views_widget_180_1481_1565_1677_1749.patch
index afc76db88..7b08cae86 100644
--- a/patch/patches/views_widget_180_1481_1565_1677_1749.patch
+++ b/patch/patches/views_widget_180_1481_1565_1677_1749.patch
@@ -18,7 +18,7 @@ index 98460d7..ffbfa04f 100644
    return renderer_frame_number_;
  }
 diff --git content/browser/renderer_host/render_widget_host_view_base.h content/browser/renderer_host/render_widget_host_view_base.h
-index 904897a..38f6e28 100644
+index fd1e999..c4dad6d 100644
 --- content/browser/renderer_host/render_widget_host_view_base.h
 +++ content/browser/renderer_host/render_widget_host_view_base.h
 @@ -72,6 +72,7 @@ class BrowserAccessibilityDelegate;
@@ -38,7 +38,7 @@ index 904897a..38f6e28 100644
  
    // This only needs to be overridden by RenderWidgetHostViewBase subclasses
    // that handle content embedded within other RenderWidgetHostViews.
-@@ -355,6 +358,12 @@ class CONTENT_EXPORT RenderWidgetHostViewBase : public RenderWidgetHostView,
+@@ -359,6 +362,12 @@ class CONTENT_EXPORT RenderWidgetHostViewBase : public RenderWidgetHostView,
    // helps to position the full screen widget on the correct monitor.
    virtual void InitAsFullscreen(RenderWidgetHostView* reference_host_view) = 0;
  
@@ -51,7 +51,7 @@ index 904897a..38f6e28 100644
    // Sets the cursor to the one associated with the specified cursor_type
    virtual void UpdateCursor(const WebCursor& cursor) = 0;
  
-@@ -469,6 +478,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase : public RenderWidgetHostView,
+@@ -473,6 +482,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase : public RenderWidgetHostView,
  
    const bool wheel_scroll_latching_enabled_;
  
diff --git a/patch/patches/web_contents_1257_1565.patch b/patch/patches/web_contents_1257_1565.patch
index 7fee0fc5e..7c29a51c2 100644
--- a/patch/patches/web_contents_1257_1565.patch
+++ b/patch/patches/web_contents_1257_1565.patch
@@ -1,5 +1,5 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index 627a0e5..21c6210 100644
+index 7f4a8b0..f6a2840 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
 @@ -1692,6 +1692,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
@@ -48,7 +48,7 @@ index 627a0e5..21c6210 100644
      }
      // Save the created window associated with the route so we can show it
      // later.
-@@ -5182,7 +5198,7 @@ NavigationEntry*
+@@ -5204,7 +5220,7 @@ NavigationEntry*
  void WebContentsImpl::CreateRenderWidgetHostViewForRenderManager(
      RenderViewHost* render_view_host) {
    RenderWidgetHostViewBase* rwh_view =
diff --git a/patch/patches/webkit_plugin_info_2015.patch b/patch/patches/webkit_plugin_info_2015.patch
index f12d427a8..173c75423 100644
--- a/patch/patches/webkit_plugin_info_2015.patch
+++ b/patch/patches/webkit_plugin_info_2015.patch
@@ -17,7 +17,7 @@ index 372b21d..78107f3 100644
                                                          .Top()
                                                          .GetSecurityContext()
 diff --git third_party/WebKit/Source/core/frame/LocalFrame.cpp third_party/WebKit/Source/core/frame/LocalFrame.cpp
-index 9c6d497..6296f53 100644
+index 97a5393..21da4ee 100644
 --- third_party/WebKit/Source/core/frame/LocalFrame.cpp
 +++ third_party/WebKit/Source/core/frame/LocalFrame.cpp
 @@ -930,7 +930,7 @@ ContentSettingsClient* LocalFrame::GetContentSettingsClient() {
diff --git a/patch/patches/webkit_popups.patch b/patch/patches/webkit_popups.patch
index 7d1fe8674..f1b7e14f5 100644
--- a/patch/patches/webkit_popups.patch
+++ b/patch/patches/webkit_popups.patch
@@ -25,7 +25,7 @@ index 2a35f2c..dded520 100644
  
    DCHECK(RuntimeEnabledFeatures::pagePopupEnabled());
 diff --git third_party/WebKit/Source/web/WebViewImpl.cpp third_party/WebKit/Source/web/WebViewImpl.cpp
-index a8985f8..2cf5913 100644
+index bd1490b..80b61b8 100644
 --- third_party/WebKit/Source/web/WebViewImpl.cpp
 +++ third_party/WebKit/Source/web/WebViewImpl.cpp
 @@ -353,6 +353,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client,
diff --git a/patch/patches/webview_plugin_2020.patch b/patch/patches/webview_plugin_2020.patch
index 3ce646167..47690a171 100644
--- a/patch/patches/webview_plugin_2020.patch
+++ b/patch/patches/webview_plugin_2020.patch
@@ -1,5 +1,5 @@
 diff --git chrome/app/generated_resources.grd chrome/app/generated_resources.grd
-index 3ff9d30..5b53c44 100644
+index c79a92e..e619f31 100644
 --- chrome/app/generated_resources.grd
 +++ chrome/app/generated_resources.grd
 @@ -5158,7 +5158,7 @@ Keep your key file in a safe place. You will need it to create new versions of y