tests: Fix URLRequestTest failure with ReduceAcceptLanguage trial

File dialogs that specify mime type (e.g. "image/*") accept filters will pass
those values unchanged to the OnFileDialog |accept_filters| parameter. The
default dialog implementation will show those filters in addition to a combined
"Custom Files" filter. This is a change from preexisting Google Chrome
behavior where only the combined "Custom Files" filter is displayed, and
restores CEF behavior that existed prior to 2ea7459a89.

Document the fact that OnFileDialog may be called twice, once before MIME type
expansion and once afterwards.

Add new OnFileDialog |accept_extensions| and |accept_descriptions| parameters
for MIME type extensions and descriptions.

Details: This change adds a SelectFileDialog::FileTypeInfo::extension_mimetypes
member and improves the logic in FileSelectHelper::GetFileTypesFromAcceptType
and file_dialog_manager.cc SelectFileToFileChooserParams to support recall of
the source mime type when populating the FileChooserParams structure.

To test:
- Run `ceftests --gtest_filter=DialogTest.*`
- Run `cefclient --url=https://tests/dialogs`

BUILD.gn

@@ -252,8 +252,7 @@ if (is_linux) {
 # Set by GetRequiredArgs() in //cef/tools/gn_args.py.
 #
 
-# Set ENABLE_PRINTING=1 ENABLE_BASIC_PRINTING=1.
-assert(enable_basic_printing)
+# Enable support for Print Preview.
 assert(enable_print_preview)
 
 # Enable support for Widevine CDM.
@@ -1018,7 +1017,6 @@ source_set("libcef_static") {
 
     # Normal build dependencies. Should be sorted alphabetically.
     "//base:base_static",
-    "//base/third_party/dynamic_annotations",
     "//cc",
     "//chrome:dependencies",
     "//chrome:packed_resources",
@@ -1129,12 +1127,6 @@ source_set("libcef_static") {
       deps += [ "//content:sandbox_helper_win" ]
     }
 
-    libs = [
-      "comctl32.lib",
-      # For D3D11_DECODER_PROFILE_H264_VLD_NOFGT.
-      "dxguid.lib",
-    ]
-
     data_deps = [
       "//chrome/elevation_service",
     ]
@@ -1323,7 +1315,11 @@ if (is_win) {
   static_library("cef_sandbox") {
     sources = [ "libcef_dll/sandbox/sandbox_win.cc" ]
     configs += [ ":libcef_includes_config" ]
-    deps = [ "libcef/features", "//sandbox" ]
+    deps = [
+      ":make_config_header",
+      "libcef/features",
+      "//sandbox",
+    ]
   }
 }
 
@@ -1332,8 +1328,9 @@ if (is_mac) {
     sources = [ "libcef_dll/sandbox/sandbox_mac.mm" ]
     configs += [ ":libcef_includes_config" ]
     deps = [
+      ":make_config_header",
       "//build/config:executable_deps",
-      "//sandbox/mac:seatbelt"
+      "//sandbox/mac:seatbelt",
     ]
   }
 }
@@ -1754,6 +1751,12 @@ if (is_mac) {
       # Delay-load as many DLLs as possible for sandbox and startup perf
       # improvements.
       configs += [ "//build/config/win:delayloads" ]
+
+      libs = [
+        "comctl32.lib",
+        # For D3D11_DECODER_PROFILE_H264_VLD_NOFGT.
+        "dxguid.lib",
+      ]
     }
 
     if (is_linux && !is_debug && !use_partition_alloc_as_malloc) {
@@ -2268,8 +2271,13 @@ if (is_mac) {
 
       if (target_cpu != "arm64") {
         libs += [
+          "glu32.lib",
           "opengl32.lib",
-          "glu32.lib"
+        ]
+        ldflags = [
+          "/DELAYLOAD:glu32.dll",
+          "/DELAYLOAD:oleaut32.dll",
+          "/DELAYLOAD:opengl32.dll",
         ]
       }
     }

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/125.0.6422.0'
+  'chromium_checkout': 'refs/tags/126.0.6478.0'
 }

cef_paths2.gypi

@@ -20,7 +20,6 @@
       'include/base/cef_logging.h',
       'include/base/cef_macros.h',
       'include/base/cef_platform_thread.h',
-      'include/base/cef_ptr_util.h',
       'include/base/cef_ref_counted.h',
       'include/base/cef_scoped_refptr.h',
       'include/base/cef_thread_checker.h',

include/base/cef_ptr_util.h

@@ -1,60 +0,0 @@
-// Copyright (c) 2021 Marshall A. Greenblatt. Portions copyright (c) 2015
-// Google Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//    * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//    * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//    * Neither the name of Google Inc. nor the name Chromium Embedded
-// Framework nor the names of its contributors may be used to endorse
-// or promote products derived from this software without specific prior
-// written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-#ifndef INCLUDE_BASE_CEF_PTR_UTIL_H_
-#define INCLUDE_BASE_CEF_PTR_UTIL_H_
-#pragma once
-
-#if defined(USING_CHROMIUM_INCLUDES)
-// When building CEF include the Chromium header directly.
-#include "base/memory/ptr_util.h"
-#else  // !USING_CHROMIUM_INCLUDES
-// The following is substantially similar to the Chromium implementation.
-// If the Chromium implementation diverges the below implementation should be
-// updated to match.
-
-#include <memory>
-#include <utility>
-
-namespace base {
-
-///
-/// Helper to transfer ownership of a raw pointer to a std::unique_ptr<T>.
-/// Note that std::unique_ptr<T> has very different semantics from
-/// std::unique_ptr<T[]>: do not use this helper for array allocations.
-///
-template <typename T>
-std::unique_ptr<T> WrapUnique(T* ptr) {
-  return std::unique_ptr<T>(ptr);
-}
-
-}  // namespace base
-
-#endif  // INCLUDE_BASE_CEF_PTR_UTIL_H_

include/capi/cef_dialog_handler_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=5644fdc2453dd083079bf9e3616b687eeb49f250$
+// $hash=bf7208a86ee17f63fd7163cef8c3a13373a1f1c8$
 //
 
 #ifndef CEF_INCLUDE_CAPI_CEF_DIALOG_HANDLER_CAPI_H_
@@ -86,13 +86,20 @@ typedef struct _cef_dialog_handler_t {
   /// to show the default title ("Open" or "Save" depending on the mode).
   /// |default_file_path| is the path with optional directory and/or file name
   /// component that should be initially selected in the dialog.
-  /// |accept_filters| are used to restrict the selectable file types and may
-  /// any combination of (a) valid lower-cased MIME types (e.g. "text/*" or
-  /// "image/*"), (b) individual file extensions (e.g. ".txt" or ".png"), or (c)
-  /// combined description and file extension delimited using "|" and ";" (e.g.
-  /// "Image Types|.png;.gif;.jpg"). To display a custom dialog return true (1)
-  /// and execute |callback| either inline or at a later time. To display the
-  /// default dialog return false (0).
+  /// |accept_filters| are used to restrict the selectable file types and may be
+  /// any combination of valid lower-cased MIME types (e.g. "text/*" or
+  /// "image/*") and individual file extensions (e.g. ".txt" or ".png").
+  /// |accept_extensions| provides the semicolon-delimited expansion of MIME
+  /// types to file extensions (if known, or NULL string otherwise).
+  /// |accept_descriptions| provides the descriptions for MIME types (if known,
+  /// or NULL string otherwise). For example, the "image/*" mime type might have
+  /// extensions ".png;.jpg;.bmp;..." and description "Image Files".
+  /// |accept_filters|, |accept_extensions| and |accept_descriptions| will all
+  /// be the same size. To display a custom dialog return true (1) and execute
+  /// |callback| either inline or at a later time. To display the default dialog
+  /// return false (0). If this function returns false (0) it may be called an
+  /// additional time for the same dialog (both before and after MIME type
+  /// expansion).
   ///
   int(CEF_CALLBACK* on_file_dialog)(
       struct _cef_dialog_handler_t* self,
@@ -101,6 +108,8 @@ typedef struct _cef_dialog_handler_t {
       const cef_string_t* title,
       const cef_string_t* default_file_path,
       cef_string_list_t accept_filters,
+      cef_string_list_t accept_extensions,
+      cef_string_list_t accept_descriptions,
       struct _cef_file_dialog_callback_t* callback);
 } cef_dialog_handler_t;
 

include/capi/cef_v8_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=3a188f380f8044060ea93fdca0b3d231df88979d$
+// $hash=5dd4948a92af2ad69e2171f2dffb8f2c23e5c147$
 //
 
 #ifndef CEF_INCLUDE_CAPI_CEF_V8_CAPI_H_
@@ -611,7 +611,6 @@ typedef struct _cef_v8value_t {
   ///
   int(CEF_CALLBACK* set_value_byaccessor)(struct _cef_v8value_t* self,
                                           const cef_string_t* key,
-                                          cef_v8_accesscontrol_t settings,
                                           cef_v8_propertyattribute_t attribute);
 
   ///

include/capi/test/cef_test_helpers_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=db81a65aba3c2d1213744ad4251322acf97c608c$
+// $hash=da2edf5e08eb45942b6a82109aa86682c202ccac$
 //
 
 #ifndef CEF_INCLUDE_CAPI_TEST_CEF_TEST_HELPERS_CAPI_H_
@@ -67,6 +67,14 @@ CEF_EXPORT void cef_execute_java_script_with_user_gesture_for_tests(
 ///
 CEF_EXPORT void cef_set_data_directory_for_tests(const cef_string_t* dir);
 
+///
+/// Returns true (1) if |feature_name| is enabled by default, command line or
+/// field trial. This supports a short list of curated values that are queried
+/// by unit tests.
+///
+CEF_EXPORT int cef_is_feature_enabled_for_tests(
+    const cef_string_t* feature_name);
+
 #ifdef __cplusplus
 }
 #endif

include/cef_api_hash.h

@@ -42,13 +42,13 @@
 // way that may cause binary incompatibility with other builds. The universal
 // hash value will change if any platform is affected whereas the platform hash
 // values will change only if that particular platform is affected.
-#define CEF_API_HASH_UNIVERSAL "c9171db05e2e3ad611ea09d9457edaaa336bd4d6"
+#define CEF_API_HASH_UNIVERSAL "3ecad1c27a9f10720824f4c4be478dab28f1258d"
 #if defined(OS_WIN)
-#define CEF_API_HASH_PLATFORM "d65aa12068be307fd8e6642024cb67d82643d412"
+#define CEF_API_HASH_PLATFORM "551fbcb8ec2687c554be82cc10f471201c88727b"
 #elif defined(OS_MAC)
-#define CEF_API_HASH_PLATFORM "41e80b4bf45ce56cea0e87e825f9e6b58977a1da"
+#define CEF_API_HASH_PLATFORM "4ca22671083a799f3c8c09905804882988ebd97b"
 #elif defined(OS_LINUX)
-#define CEF_API_HASH_PLATFORM "1ed8d88d0d7d9d8a3b0296e9f84fea7752fdff2e"
+#define CEF_API_HASH_PLATFORM "fb827bbeab0a16044f5cee11912d7dfc2ad44999"
 #endif
 
 #ifdef __cplusplus

include/cef_dialog_handler.h

@@ -77,21 +77,30 @@ class CefDialogHandler : public virtual CefBaseRefCounted {
   /// empty to show the default title ("Open" or "Save" depending on the mode).
   /// |default_file_path| is the path with optional directory and/or file name
   /// component that should be initially selected in the dialog.
-  /// |accept_filters| are used to restrict the selectable file types and may
-  /// any combination of (a) valid lower-cased MIME types (e.g. "text/*" or
-  /// "image/*"), (b) individual file extensions (e.g. ".txt" or ".png"), or (c)
-  /// combined description and file extension delimited using "|" and ";" (e.g.
-  /// "Image Types|.png;.gif;.jpg"). To display a custom dialog return true and
-  /// execute |callback| either inline or at a later time. To display the
-  /// default dialog return false.
+  /// |accept_filters| are used to restrict the selectable file types and may be
+  /// any combination of valid lower-cased MIME types (e.g. "text/*" or
+  /// "image/*") and individual file extensions (e.g. ".txt" or ".png").
+  /// |accept_extensions| provides the semicolon-delimited expansion of MIME
+  /// types to file extensions (if known, or empty string otherwise).
+  /// |accept_descriptions| provides the descriptions for MIME types (if known,
+  /// or empty string otherwise). For example, the "image/*" mime type might
+  /// have extensions ".png;.jpg;.bmp;..." and description "Image Files".
+  /// |accept_filters|, |accept_extensions| and |accept_descriptions| will all
+  /// be the same size. To display a custom dialog return true and execute
+  /// |callback| either inline or at a later time. To display the default dialog
+  /// return false. If this method returns false it may be called an additional
+  /// time for the same dialog (both before and after MIME type expansion).
   ///
   /*--cef(optional_param=title,optional_param=default_file_path,
-          optional_param=accept_filters)--*/
+          optional_param=accept_filters,optional_param=accept_extensions,
+          optional_param=accept_descriptions)--*/
   virtual bool OnFileDialog(CefRefPtr<CefBrowser> browser,
                             FileDialogMode mode,
                             const CefString& title,
                             const CefString& default_file_path,
                             const std::vector<CefString>& accept_filters,
+                            const std::vector<CefString>& accept_extensions,
+                            const std::vector<CefString>& accept_descriptions,
                             CefRefPtr<CefFileDialogCallback> callback) {
     return false;
   }

include/cef_v8.h

@@ -435,7 +435,6 @@ class CefV8ArrayBufferReleaseCallback : public virtual CefBaseRefCounted {
 /*--cef(source=library,no_debugct_check)--*/
 class CefV8Value : public virtual CefBaseRefCounted {
  public:
-  typedef cef_v8_accesscontrol_t AccessControl;
   typedef cef_v8_propertyattribute_t PropertyAttribute;
 
   ///
@@ -794,9 +793,7 @@ class CefV8Value : public virtual CefBaseRefCounted {
   /// will return true even though assignment failed.
   ///
   /*--cef(capi_name=set_value_byaccessor,optional_param=key)--*/
-  virtual bool SetValue(const CefString& key,
-                        AccessControl settings,
-                        PropertyAttribute attribute) = 0;
+  virtual bool SetValue(const CefString& key, PropertyAttribute attribute) = 0;
 
   ///
   /// Read the keys for the object's values into the specified vector. Integer-

include/internal/cef_types.h

@@ -1239,16 +1239,6 @@ typedef enum {
   CEF_TEXT_INPUT_MODE_MAX = CEF_TEXT_INPUT_MODE_SEARCH,
 } cef_text_input_mode_t;
 
-///
-/// V8 access control values.
-///
-typedef enum {
-  V8_ACCESS_CONTROL_DEFAULT = 0,
-  V8_ACCESS_CONTROL_ALL_CAN_READ = 1,
-  V8_ACCESS_CONTROL_ALL_CAN_WRITE = 1 << 1,
-  V8_ACCESS_CONTROL_PROHIBITS_OVERWRITING = 1 << 2
-} cef_v8_accesscontrol_t;
-
 ///
 /// V8 property attribute values.
 ///
@@ -3480,11 +3470,11 @@ typedef enum {
   CEF_CPAIT_PAYMENTS_OFFER_NOTIFICATION,
   CEF_CPAIT_PRICE_TRACKING,
   CEF_CPAIT_PWA_INSTALL,
-  CEF_CPAIT_QR_CODE_GENERATOR,
-  CEF_CPAIT_READER_MODE,
+  CEF_CPAIT_QR_CODE_GENERATOR_DEPRECATED,
+  CEF_CPAIT_READER_MODE_DEPRECATED,
   CEF_CPAIT_SAVE_AUTOFILL_ADDRESS,
   CEF_CPAIT_SAVE_CARD,
-  CEF_CPAIT_SEND_TAB_TO_SELF,
+  CEF_CPAIT_SEND_TAB_TO_SELF_DEPRECATED,
   CEF_CPAIT_SHARING_HUB,
   CEF_CPAIT_SIDE_SEARCH,
   CEF_CPAIT_SMS_REMOTE_FETCHER,
@@ -3496,7 +3486,8 @@ typedef enum {
   CEF_CPAIT_MANDATORY_REAUTH,
   CEF_CPAIT_PRICE_INSIGHTS,
   CEF_CPAIT_PRICE_READ_ANYTHING,
-  CEF_CPAIT_MAX_VALUE = CEF_CPAIT_PRICE_READ_ANYTHING,
+  CEF_CPAIT_PRODUCT_SPECIFICATIONS,
+  CEF_CPAIT_MAX_VALUE = CEF_CPAIT_PRODUCT_SPECIFICATIONS,
 } cef_chrome_page_action_icon_type_t;
 
 ///
@@ -3642,12 +3633,14 @@ typedef enum {
   CEF_PERMISSION_TYPE_MIDI_SYSEX = 1 << 13,
   CEF_PERMISSION_TYPE_MULTIPLE_DOWNLOADS = 1 << 14,
   CEF_PERMISSION_TYPE_NOTIFICATIONS = 1 << 15,
-  CEF_PERMISSION_TYPE_PROTECTED_MEDIA_IDENTIFIER = 1 << 16,
-  CEF_PERMISSION_TYPE_REGISTER_PROTOCOL_HANDLER = 1 << 17,
-  CEF_PERMISSION_TYPE_STORAGE_ACCESS = 1 << 18,
-  CEF_PERMISSION_TYPE_VR_SESSION = 1 << 19,
-  CEF_PERMISSION_TYPE_WINDOW_MANAGEMENT = 1 << 20,
-  CEF_PERMISSION_TYPE_FILE_SYSTEM_ACCESS = 1 << 21,
+  CEF_PERMISSION_TYPE_KEYBOARD_LOCK = 1 << 16,
+  CEF_PERMISSION_TYPE_POINTER_LOCK = 1 << 17,
+  CEF_PERMISSION_TYPE_PROTECTED_MEDIA_IDENTIFIER = 1 << 18,
+  CEF_PERMISSION_TYPE_REGISTER_PROTOCOL_HANDLER = 1 << 19,
+  CEF_PERMISSION_TYPE_STORAGE_ACCESS = 1 << 20,
+  CEF_PERMISSION_TYPE_VR_SESSION = 1 << 21,
+  CEF_PERMISSION_TYPE_WINDOW_MANAGEMENT = 1 << 22,
+  CEF_PERMISSION_TYPE_FILE_SYSTEM_ACCESS = 1 << 23,
 } cef_permission_request_types_t;
 
 ///

include/test/cef_test_helpers.h

@@ -67,4 +67,12 @@ void CefExecuteJavaScriptWithUserGestureForTests(CefRefPtr<CefFrame> frame,
 /*--cef()--*/
 void CefSetDataDirectoryForTests(const CefString& dir);
 
+///
+/// Returns true if |feature_name| is enabled by default, command line or field
+/// trial. This supports a short list of curated values that are queried by unit
+/// tests.
+///
+/*--cef()--*/
+bool CefIsFeatureEnabledForTests(const CefString& feature_name);
+
 #endif  // CEF_INCLUDE_TEST_CEF_TEST_HELPERS_H_

libcef/browser/alloy/alloy_browser_context.cc

@@ -194,6 +194,10 @@ void AlloyBrowserContext::Shutdown() {
 
   ChromePluginServiceFilter::GetInstance()->UnregisterProfile(this);
 
+  // Clear this reference before the associated KeyedServiceFactory is destroyed
+  // by PerformInterlockedTwoPhaseShutdown().
+  extension_system_ = nullptr;
+
   // Remove any BrowserContextKeyedServiceFactory associations. This must be
   // called before the ProxyService owned by AlloyBrowserContext is destroyed.
   // The SimpleDependencyManager should always be passed after the
@@ -428,6 +432,11 @@ AlloyBrowserContext::GetProfileCloudPolicyManager() {
   return nullptr;
 }
 
+policy::CloudPolicyManager* AlloyBrowserContext::GetCloudPolicyManager() {
+  DCHECK(false);
+  return nullptr;
+}
+
 policy::ProfilePolicyConnector*
 AlloyBrowserContext::GetProfilePolicyConnector() {
   DCHECK(false);

libcef/browser/alloy/alloy_browser_context.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_ALLOY_ALLOY_BROWSER_CONTEXT_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "cef/include/cef_request_context_handler.h"
 #include "cef/libcef/browser/alloy/chrome_profile_alloy.h"
 #include "cef/libcef/browser/browser_context.h"
@@ -93,6 +94,7 @@ class AlloyBrowserContext : public ChromeProfileAlloy,
   policy::SchemaRegistryService* GetPolicySchemaRegistryService() override;
   policy::UserCloudPolicyManager* GetUserCloudPolicyManager() override;
   policy::ProfileCloudPolicyManager* GetProfileCloudPolicyManager() override;
+  policy::CloudPolicyManager* GetCloudPolicyManager() override;
   policy::ProfilePolicyConnector* GetProfilePolicyConnector() override;
   const policy::ProfilePolicyConnector* GetProfilePolicyConnector()
       const override;
@@ -131,10 +133,10 @@ class AlloyBrowserContext : public ChromeProfileAlloy,
   std::unique_ptr<CefSSLHostStateDelegate> ssl_host_state_delegate_;
   std::unique_ptr<visitedlink::VisitedLinkWriter> visitedlink_master_;
   // |visitedlink_listener_| is owned by visitedlink_master_.
-  CefVisitedLinkListener* visitedlink_listener_ = nullptr;
+  raw_ptr<CefVisitedLinkListener> visitedlink_listener_ = nullptr;
 
   // Owned by the KeyedService system.
-  extensions::CefExtensionSystem* extension_system_ = nullptr;
+  raw_ptr<extensions::CefExtensionSystem> extension_system_ = nullptr;
 
   // The key to index KeyedService instances created by
   // SimpleKeyedServiceFactory.

libcef/browser/alloy/alloy_browser_host_impl.cc

@@ -581,17 +581,6 @@ void AlloyBrowserHostImpl::DestroyBrowser() {
 
   destruction_state_ = DESTRUCTION_STATE_COMPLETED;
 
-  // Notify that this browser has been destroyed. These must be delivered in
-  // the expected order.
-
-  // 1. Notify the platform delegate. With Views this will result in a call to
-  // CefBrowserViewDelegate::OnBrowserDestroyed().
-  platform_delegate_->NotifyBrowserDestroyed();
-
-  // 2. Notify the browser's LifeSpanHandler. This must always be the last
-  // notification for this browser.
-  OnBeforeClose();
-
   // Destroy any platform constructs first.
   if (javascript_dialog_manager_.get()) {
     javascript_dialog_manager_->Destroy();
@@ -600,16 +589,8 @@ void AlloyBrowserHostImpl::DestroyBrowser() {
     menu_manager_->Destroy();
   }
 
-  // Notify any observers that may have state associated with this browser.
-  OnBrowserDestroyed();
-
-  // If the WebContents still exists at this point, signal destruction before
-  // browser destruction.
-  if (web_contents()) {
-    WebContentsDestroyed();
-  }
-
-  // Disassociate the platform delegate from this browser.
+  // Disassociate the platform delegate from this browser. This will trigger
+  // WebContents destruction in most cases.
   platform_delegate_->BrowserDestroyed(this);
 
   // Delete objects created by the platform delegate that may be referenced by
@@ -1384,34 +1365,46 @@ void AlloyBrowserHostImpl::OnRecentlyAudibleTimerFired() {
 }
 
 void AlloyBrowserHostImpl::AccessibilityEventReceived(
-    const content::AXEventNotificationDetails& content_event_bundle) {
+    const ui::AXUpdatesAndEvents& details) {
   // Only needed in windowless mode.
   if (IsWindowless()) {
     if (!web_contents() || !platform_delegate_) {
       return;
     }
 
-    platform_delegate_->AccessibilityEventReceived(content_event_bundle);
+    platform_delegate_->AccessibilityEventReceived(details);
   }
 }
 
 void AlloyBrowserHostImpl::AccessibilityLocationChangesReceived(
-    const std::vector<content::AXLocationChangeNotificationDetails>& locData) {
+    const std::vector<ui::AXLocationChanges>& details) {
   // Only needed in windowless mode.
   if (IsWindowless()) {
     if (!web_contents() || !platform_delegate_) {
       return;
     }
 
-    platform_delegate_->AccessibilityLocationChangesReceived(locData);
+    platform_delegate_->AccessibilityLocationChangesReceived(details);
   }
 }
 
 void AlloyBrowserHostImpl::WebContentsDestroyed() {
+  // In case we're notified before the CefBrowserContentsDelegate,
+  // reset it first for consistent state in DestroyWebContents.
+  if (GetWebContents()) {
+    contents_delegate_->WebContentsDestroyed();
+  }
+
   auto wc = web_contents();
   content::WebContentsObserver::Observe(nullptr);
-  if (platform_delegate_) {
-    platform_delegate_->WebContentsDestroyed(wc);
+  DestroyWebContents(wc);
+
+  if (destruction_state_ < DESTRUCTION_STATE_COMPLETED) {
+    // We were not called via DestroyBrowser. This can occur when (for example)
+    // a pending popup WebContents is destroyed during parent WebContents
+    // destruction. Try to close the associated browser now.
+    CEF_POST_TASK(CEF_UIT, base::BindOnce(&AlloyBrowserHostImpl::CloseBrowser,
+                                          this, /*force_close=*/true));
   }
 }
 

libcef/browser/alloy/alloy_browser_host_impl.h

@@ -303,10 +303,9 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
       content::NavigationHandle* navigation_handle) override;
   void OnAudioStateChanged(bool audible) override;
   void AccessibilityEventReceived(
-      const content::AXEventNotificationDetails& content_event_bundle) override;
+      const ui::AXUpdatesAndEvents& details) override;
   void AccessibilityLocationChangesReceived(
-      const std::vector<content::AXLocationChangeNotificationDetails>& locData)
-      override;
+      const std::vector<ui::AXLocationChanges>& details) override;
   void WebContentsDestroyed() override;
 
  private:

libcef/browser/alloy/alloy_browser_main.cc

@@ -50,6 +50,7 @@
 #include "ui/native_theme/native_theme.h"
 
 #if BUILDFLAG(IS_LINUX)
+#include "components/password_manager/core/browser/password_manager_switches.h"
 #include "ui/base/ozone_buildflags.h"
 #if defined(USE_AURA) && BUILDFLAG(IS_OZONE_X11)
 #include "ui/events/devices/x11/touch_factory_x11.h"
@@ -283,12 +284,13 @@ void AlloyBrowserMainParts::PostCreateMainMessageLoop() {
   std::unique_ptr<os_crypt::Config> config =
       std::make_unique<os_crypt::Config>();
   // Forward to os_crypt the flag to use a specific password store.
-  config->store = command_line->GetSwitchValueASCII(switches::kPasswordStore);
-  // Forward the product name (defaults to "Chromium").
+  config->store =
+      command_line->GetSwitchValueASCII(password_manager::kPasswordStore);
+  // Forward the product name
   config->product_name = l10n_util::GetStringUTF8(IDS_PRODUCT_NAME);
   // OSCrypt can be disabled in a special settings file.
   config->should_use_preference =
-      command_line->HasSwitch(switches::kEnableEncryptionSelection);
+      command_line->HasSwitch(password_manager::kEnableEncryptionSelection);
   base::PathService::Get(chrome::DIR_USER_DATA, &config->user_data_path);
   DCHECK(!config->user_data_path.empty());
   OSCrypt::SetConfig(std::move(config));

libcef/browser/alloy/alloy_browser_main.h

@@ -9,6 +9,7 @@
 #include <string_view>
 
 #include "base/command_line.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "cef/libcef/browser/request_context_impl.h"
 #include "components/prefs/pref_service.h"
@@ -79,7 +80,7 @@ class AlloyBrowserMainParts : public content::BrowserMainParts {
 #endif  // BUILDFLAG(IS_WIN)
 
   CefRefPtr<CefRequestContextImpl> global_request_context_;
-  CefDevToolsDelegate* devtools_delegate_ = nullptr;  // Deletes itself.
+  raw_ptr<CefDevToolsDelegate> devtools_delegate_ = nullptr;  // Deletes itself.
 
   // Blocking task runners exposed via CefTaskRunner. For consistency with
   // previous named thread behavior always execute all pending tasks before

libcef/browser/alloy/alloy_content_browser_client.cc

@@ -384,6 +384,10 @@ AlloyContentBrowserClient::AlloyContentBrowserClient() = default;
 
 AlloyContentBrowserClient::~AlloyContentBrowserClient() = default;
 
+void AlloyContentBrowserClient::CleanupOnUIThread() {
+  browser_main_parts_ = nullptr;
+}
+
 std::unique_ptr<content::BrowserMainParts>
 AlloyContentBrowserClient::CreateBrowserMainParts(
     bool /* is_integration_test */) {

libcef/browser/alloy/alloy_content_browser_client.h

@@ -9,6 +9,7 @@
 #include <string>
 #include <utility>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "build/build_config.h"
 #include "cef/include/cef_request_context_handler.h"
@@ -33,6 +34,8 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
   AlloyContentBrowserClient();
   ~AlloyContentBrowserClient() override;
 
+  void CleanupOnUIThread();
+
   // ContentBrowserClient implementation.
   std::unique_ptr<content::BrowserMainParts> CreateBrowserMainParts(
       bool is_integration_test) override;
@@ -278,7 +281,7 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
   const extensions::Extension* GetExtension(
       content::SiteInstance* site_instance);
 
-  AlloyBrowserMainParts* browser_main_parts_ = nullptr;
+  raw_ptr<AlloyBrowserMainParts> browser_main_parts_ = nullptr;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_ALLOY_ALLOY_CONTENT_BROWSER_CLIENT_H_

libcef/browser/alloy/alloy_web_contents_view_delegate.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_ALLOY_ALLOY_WEB_CONTENTS_VIEW_DELEGATE_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "cef/include/internal/cef_ptr.h"
 #include "content/public/browser/web_contents_view_delegate.h"
 
@@ -26,7 +27,7 @@ class AlloyWebContentsViewDelegate : public content::WebContentsViewDelegate {
                        const content::ContextMenuParams& params) override;
 
  private:
-  content::WebContents* const web_contents_;
+  const raw_ptr<content::WebContents> web_contents_;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_ALLOY_ALLOY_WEB_CONTENTS_VIEW_DELEGATE_H_

libcef/browser/alloy/browser_platform_delegate_alloy.cc

@@ -213,7 +213,7 @@ void CefBrowserPlatformDelegateAlloy::CreateExtensionHost(
   DCHECK(browser_);
   DCHECK(!extension_host_);
 
-  auto alloy_browser = AlloyBrowserHostImpl::FromBaseChecked(browser_);
+  auto alloy_browser = AlloyBrowserHostImpl::FromBaseChecked(browser_.get());
 
   if (host_type == extensions::mojom::ViewType::kExtensionPopup) {
     // Create an extension host that we own.

libcef/browser/alloy/browser_platform_delegate_alloy.h

@@ -6,6 +6,7 @@
 #ifndef CEF_LIBCEF_BROWSER_ALLOY_BROWSER_PLATFORM_DELEGATE_ALLOY_H_
 #define CEF_LIBCEF_BROWSER_ALLOY_BROWSER_PLATFORM_DELEGATE_ALLOY_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/alloy/dialogs/alloy_web_contents_dialog_helper.h"
 #include "cef/libcef/browser/browser_platform_delegate.h"
@@ -114,7 +115,7 @@ class CefBrowserPlatformDelegateAlloy : public CefBrowserPlatformDelegate {
 
 #if BUILDFLAG(ENABLE_ALLOY_BOOTSTRAP)
   // Used when the browser is hosting an extension.
-  extensions::ExtensionHost* extension_host_ = nullptr;
+  raw_ptr<extensions::ExtensionHost> extension_host_ = nullptr;
   bool is_background_host_ = false;
 #endif
 

libcef/browser/alloy/chrome_browser_process_alloy.cc

@@ -154,6 +154,7 @@ void ChromeBrowserProcessAlloy::CleanupOnUIThread() {
     }
   }
 
+  os_crypt_async_.reset();
   local_state_.reset();
   browser_policy_connector_.reset();
   background_printing_manager_.reset();
@@ -444,6 +445,12 @@ os_crypt_async::OSCryptAsync* ChromeBrowserProcessAlloy::os_crypt_async() {
   return os_crypt_async_.get();
 }
 
+void ChromeBrowserProcessAlloy::set_additional_os_crypt_async_provider_for_test(
+    size_t precedence,
+    std::unique_ptr<os_crypt_async::KeyProvider> provider) {
+  DCHECK(false);
+}
+
 BuildState* ChromeBrowserProcessAlloy::GetBuildState() {
   DCHECK(false);
   return nullptr;

libcef/browser/alloy/chrome_browser_process_alloy.h

@@ -109,6 +109,9 @@ class ChromeBrowserProcessAlloy : public BrowserProcess {
   resource_coordinator::ResourceCoordinatorParts* resource_coordinator_parts()
       override;
   os_crypt_async::OSCryptAsync* os_crypt_async() override;
+  void set_additional_os_crypt_async_provider_for_test(
+      size_t precedence,
+      std::unique_ptr<os_crypt_async::KeyProvider> provider) override;
   BuildState* GetBuildState() override;
   SerialPolicyAllowedPorts* serial_policy_allowed_ports() override;
   HidSystemTrayIcon* hid_system_tray_icon() override;

libcef/browser/alloy/chrome_profile_alloy.cc

@@ -5,6 +5,7 @@
 
 #include "cef/libcef/browser/alloy/chrome_profile_alloy.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/no_destructor.h"
 #include "components/profile_metrics/browser_profile_type.h"
 #include "components/variations/variations_client.h"
@@ -31,7 +32,7 @@ class CefVariationsClient : public variations::VariationsClient {
   }
 
  private:
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
 };
 
 }  // namespace

libcef/browser/alloy/devtools/alloy_devtools_window_runner.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_ALLOY_DEVTOOLS_ALLOY_DEVTOOLS_WINDOW_RUNNER_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/devtools/devtools_window_runner.h"
 
@@ -31,7 +32,7 @@ class AlloyDevToolsWindowRunner : public CefDevToolsWindowRunner {
 
   // CefDevToolsFrontend will delete itself when the frontend WebContents is
   // destroyed.
-  CefDevToolsFrontend* devtools_frontend_ = nullptr;
+  raw_ptr<CefDevToolsFrontend> devtools_frontend_ = nullptr;
 
   base::WeakPtrFactory<AlloyDevToolsWindowRunner> weak_ptr_factory_{this};
 };

libcef/browser/alloy/devtools/devtools_file_manager.h

@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 
 namespace base {
@@ -70,8 +71,8 @@ class CefDevToolsFileManager {
                           const base::Value* arg3);
 
   // Guaranteed to outlive this object.
-  AlloyBrowserHostImpl* browser_impl_;
-  PrefService* prefs_;
+  raw_ptr<AlloyBrowserHostImpl> browser_impl_;
+  raw_ptr<PrefService> prefs_;
 
   using PathsMap = std::map<std::string, base::FilePath>;
   PathsMap saved_files_;

libcef/browser/alloy/devtools/devtools_frontend.cc

@@ -17,6 +17,7 @@
 #include "base/json/json_writer.h"
 #include "base/json/string_escape.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -229,7 +230,7 @@ class CefDevToolsFrontend::NetworkResourceLoader
   void OnRetry(base::OnceClosure start_retry) override { DCHECK(false); }
 
   const int stream_id_;
-  CefDevToolsFrontend* const bindings_;
+  const raw_ptr<CefDevToolsFrontend> bindings_;
   std::unique_ptr<network::SimpleURLLoader> loader_;
   int request_id_;
   scoped_refptr<net::HttpResponseHeaders> response_headers_;

libcef/browser/alloy/devtools/devtools_frontend.h

@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/values.h"
@@ -91,7 +92,7 @@ class CefDevToolsFrontend : public content::WebContentsObserver,
   PrefService* GetPrefs() const;
 
   CefRefPtr<AlloyBrowserHostImpl> frontend_browser_;
-  content::WebContents* inspected_contents_;
+  raw_ptr<content::WebContents> inspected_contents_;
   scoped_refptr<content::DevToolsAgentHost> agent_host_;
   CefPoint inspect_element_at_;
   base::OnceClosure frontend_destroyed_callback_;

libcef/browser/alloy/dialogs/alloy_web_contents_dialog_helper.h

@@ -7,6 +7,7 @@
 #pragma once
 
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "components/web_modal/modal_dialog_host.h"
@@ -40,7 +41,7 @@ class AlloyWebContentsDialogHelper
  private:
   void OnBoundsChanged();
 
-  CefBrowserPlatformDelegate* const browser_delegate_;
+  const raw_ptr<CefBrowserPlatformDelegate> browser_delegate_;
 
   // Used to notify WebContentsModalDialog.
   base::ObserverList<web_modal::ModalDialogHostObserver>::Unchecked

libcef/browser/audio_capturer.cc

@@ -116,7 +116,10 @@ void CefAudioCapturer::OnCaptureError(
     media::AudioCapturerSource::ErrorCode code,
     const std::string& message) {
   audio_handler_->OnAudioStreamError(browser_, message);
-  StopStream();
+
+  if (code != media::AudioCapturerSource::ErrorCode::kSocketError) {
+    StopStream();
+  }
 }
 
 void CefAudioCapturer::StopStream() {

libcef/browser/browser_contents_delegate.cc

@@ -4,6 +4,7 @@
 
 #include "cef/libcef/browser/browser_contents_delegate.h"
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/browser_host_base.h"
 #include "cef/libcef/browser/browser_platform_delegate.h"
 #include "cef/libcef/browser/browser_util.h"
@@ -73,8 +74,8 @@ class CefWidgetHostInterceptor
 
  private:
   CefRefPtr<CefBrowser> const browser_;
-  content::RenderWidgetHost* const render_widget_host_;
-  blink::mojom::WidgetHost* const impl_;
+  const raw_ptr<content::RenderWidgetHost> render_widget_host_;
+  const raw_ptr<blink::mojom::WidgetHost> impl_;
 };
 
 }  // namespace
@@ -340,7 +341,7 @@ void CefBrowserContentsDelegate::RenderFrameCreated(
 void CefBrowserContentsDelegate::RenderFrameHostChanged(
     content::RenderFrameHost* old_host,
     content::RenderFrameHost* new_host) {
-  // Just in case RenderFrameCreated wasn't called for some reason.
+  // Update tracking for the RFH.
   RenderFrameCreated(new_host);
 }
 
@@ -493,6 +494,11 @@ void CefBrowserContentsDelegate::DidFinishNavigation(
     return;
   }
 
+  if (browser_info_->IsClosing()) {
+    // Ignore notifications when the browser is closing.
+    return;
+  }
+
   if (navigation_handle->IsInPrimaryMainFrame() &&
       navigation_handle->HasCommitted()) {
     // A primary main frame navigation has occured.
@@ -505,21 +511,15 @@ void CefBrowserContentsDelegate::DidFinishNavigation(
   const GURL& url =
       (error_code == net::OK ? navigation_handle->GetURL() : GURL());
 
-  auto browser_info = browser_info_;
-  if (!browser_info->browser()) {
-    // Ignore notifications when the browser is closing.
-    return;
-  }
-
   // May return NULL when starting a new navigation if the previous navigation
   // caused the renderer process to crash during load.
   CefRefPtr<CefFrameHostImpl> frame =
-      browser_info->GetFrameForGlobalId(global_id);
+      browser_info_->GetFrameForGlobalId(global_id);
   if (!frame) {
     if (is_main_frame) {
-      frame = browser_info->GetMainFrame();
+      frame = browser_info_->GetMainFrame();
     } else {
-      frame = browser_info->CreateTempSubFrame(frame_util::InvalidGlobalId());
+      frame = browser_info_->CreateTempSubFrame(frame_util::InvalidGlobalId());
     }
   }
   frame->RefreshAttributes();

libcef/browser/browser_context.cc

@@ -132,7 +132,7 @@ class ImplManager {
     return all_.end();
   }
 
-  using PathMap = std::map<base::FilePath, CefBrowserContext*>;
+  using PathMap = std::map<base::FilePath, raw_ptr<CefBrowserContext>>;
   PathMap map_;
 
   Vector all_;
@@ -419,12 +419,12 @@ CefRefPtr<CefRequestContextImpl> CefBrowserContext::GetAnyRequestContext(
   if (prefer_no_handler) {
     for (const auto& request_context : request_context_set_) {
       if (!request_context->GetHandler()) {
-        return request_context;
+        return request_context.get();
       }
     }
   }
 
-  return *request_context_set_.begin();
+  return request_context_set_.begin()->get();
 }
 
 CefBrowserContext::CookieableSchemes CefBrowserContext::GetCookieableSchemes()

libcef/browser/browser_context.h

@@ -235,7 +235,7 @@ class CefBrowserContext {
   std::unique_ptr<CefMediaRouterManager> media_router_manager_;
 
   // CefRequestContextImpl objects referencing this object.
-  std::set<CefRequestContextImpl*> request_context_set_;
+  std::set<raw_ptr<CefRequestContextImpl>> request_context_set_;
 
   // Map IDs to CefRequestContextHandler objects.
   CefRequestContextHandlerMap handler_map_;

libcef/browser/browser_host_base.cc

@@ -262,17 +262,47 @@ void CefBrowserHostBase::InitializeBrowser() {
   WebContentsUserDataAdapter::Register(this);
 }
 
+void CefBrowserHostBase::DestroyWebContents(
+    content::WebContents* web_contents) {
+  CEF_REQUIRE_UIT();
+
+  // GetWebContents() should return nullptr at this point.
+  DCHECK(!GetWebContents());
+
+  // Notify that this browser has been destroyed. These must be delivered in
+  // the expected order.
+
+  // 1. Notify the platform delegate. With Views this will result in a call to
+  // CefBrowserViewDelegate::OnBrowserDestroyed().
+  platform_delegate_->NotifyBrowserDestroyed();
+
+  // 2. Notify the browser's LifeSpanHandler. This must always be the last
+  // notification for this browser.
+  OnBeforeClose();
+
+  // Notify any observers that may have state associated with this browser.
+  OnBrowserDestroyed();
+
+  // Free objects that may have references to the WebContents.
+  devtools_protocol_manager_.reset();
+  devtools_window_runner_.reset();
+  context_menu_observer_ = nullptr;
+
+  browser_info_->WebContentsDestroyed();
+  platform_delegate_->WebContentsDestroyed(web_contents);
+}
+
 void CefBrowserHostBase::DestroyBrowser() {
   CEF_REQUIRE_UIT();
 
-  devtools_protocol_manager_.reset();
-  devtools_window_runner_.reset();
+  // The WebContents should no longer be observed.
+  DCHECK(!contents_delegate_->web_contents());
+
   media_stream_registrar_.reset();
 
   platform_delegate_.reset();
 
   contents_delegate_->RemoveObserver(this);
-  contents_delegate_->ObserveWebContents(nullptr);
 
   if (unresponsive_process_callback_) {
     hang_monitor::Detach(unresponsive_process_callback_);
@@ -280,7 +310,7 @@ void CefBrowserHostBase::DestroyBrowser() {
   }
 
   CefBrowserInfoManager::GetInstance()->RemoveBrowserInfo(browser_info_);
-  browser_info_->SetBrowser(nullptr);
+  browser_info_->BrowserDestroyed();
 }
 
 CefRefPtr<CefBrowser> CefBrowserHostBase::GetBrowser() {
@@ -889,7 +919,7 @@ void CefBrowserHostBase::SendMouseWheelEvent(const CefMouseEvent& event,
 }
 
 bool CefBrowserHostBase::IsValid() {
-  return browser_info_->browser() == this;
+  return browser_info_->IsValid();
 }
 
 CefRefPtr<CefBrowserHost> CefBrowserHostBase::GetHost() {

libcef/browser/browser_host_base.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_BROWSER_HOST_BASE_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "base/synchronization/lock.h"
 #include "cef/include/cef_browser.h"
@@ -120,7 +121,7 @@ struct CefBrowserCreateParams {
   // Used when explicitly creating the browser as an extension host via
   // ProcessManager::CreateBackgroundHost. Currently used with the alloy
   // runtime only.
-  const extensions::Extension* extension = nullptr;
+  raw_ptr<const extensions::Extension> extension = nullptr;
   extensions::mojom::ViewType extension_host_type =
       extensions::mojom::ViewType::kInvalid;
 #endif
@@ -200,9 +201,32 @@ class CefBrowserHostBase : public CefBrowserHost,
   // the UI thread only.
   virtual bool WillBeDestroyed() const = 0;
 
-  // Called on the UI thread after the associated WebContents is destroyed.
-  // Also called from CefBrowserInfoManager::DestroyAllBrowsers if the browser
-  // was not properly shut down.
+  // Called on the UI thread to complete WebContents tear-down. In most cases
+  // this will be called via WebContentsObserver::WebContentsDestroyed. Any
+  // remaining objects that reference the WebContents (including RFH, etc)
+  // should be cleared in this callback.
+  virtual void DestroyWebContents(content::WebContents* web_contents);
+
+  // Called on the UI thread to complete CefBrowserHost tear-down.
+  //
+  // With Chrome style the WebContents is owned by the Browser's TabStripModel
+  // and will usually be destroyed first: CloseBrowser -> (async) DoCloseBrowser
+  // -> [TabStripModel deletes the WebContents] -> OnWebContentsDestroyed ->
+  // DestroyWebContents -> (async) DestroyBrowser.
+  //
+  // With Alloy style the WebContents is owned by the
+  // CefBrowserPlatformDelegateAlloy and will usually be destroyed at the same
+  // time: CloseBrowser -> [OS/platform logic] -> (async) DestroyBrowser ->
+  // [CefBrowserPlatformDelegateAlloy deletes the WebContents]
+  // -> WebContentsDestroyed -> DestoyWebContents.
+  //
+  // There are a few exceptions to the above rules:
+  // 1. If the CefBrowserHost still exists at CefShutdown, in which case
+  //    DestroyBrowser will be called first via
+  //    CefBrowserInfoManager::DestroyAllBrowsers.
+  // 2. If a popup WebContents is still pending when the parent WebContents is
+  //    destroyed, in which case WebContentsDestroyed will be called first via
+  //    the parent WebContents destructor.
   virtual void DestroyBrowser();
 
   // CefBrowserHost methods:
@@ -438,7 +462,7 @@ class CefBrowserHostBase : public CefBrowserHost,
   // Only accessed on the UI thread.
   std::unique_ptr<CefBrowserContentsDelegate> contents_delegate_;
   CefRefPtr<CefUnresponsiveProcessCallback> unresponsive_process_callback_;
-  RenderViewContextMenuObserver* context_menu_observer_ = nullptr;
+  raw_ptr<RenderViewContextMenuObserver> context_menu_observer_ = nullptr;
 
   // Observers that want to be notified of changes to this object.
   // Only accessed on the UI thread.

libcef/browser/browser_info.cc

@@ -55,43 +55,72 @@ CefBrowserInfo::~CefBrowserInfo() {
 
 CefRefPtr<CefBrowserHostBase> CefBrowserInfo::browser() const {
   base::AutoLock lock_scope(lock_);
-  if (!is_closing_) {
-    return browser_;
-  }
-  return nullptr;
+  return browser_;
+}
+
+bool CefBrowserInfo::IsValid() const {
+  base::AutoLock lock_scope(lock_);
+  return browser_ && !is_closing_;
+}
+
+bool CefBrowserInfo::IsClosing() const {
+  base::AutoLock lock_scope(lock_);
+  return is_closing_;
 }
 
 void CefBrowserInfo::SetBrowser(CefRefPtr<CefBrowserHostBase> browser) {
-  NotificationStateLock lock_scope(this);
+  base::AutoLock lock_scope(lock_);
+  DCHECK(browser);
+  DCHECK(!browser_);
 
-  if (browser) {
-    DCHECK(!browser_);
-
-    // Cache the associated frame handler.
-    if (auto client = browser->GetClient()) {
-      frame_handler_ = client->GetFrameHandler();
-    }
-  } else {
-    DCHECK(browser_);
-  }
-
-  auto old_browser = browser_;
   browser_ = browser;
 
-  if (!browser_) {
-    RemoveAllFrames(old_browser);
-
-    // Any future calls to MaybeExecuteFrameNotification will now fail.
-    // NotificationStateLock already took a reference for the delivery of any
-    // notifications that are currently queued due to RemoveAllFrames.
-    frame_handler_ = nullptr;
+  // Cache the associated frame handler.
+  if (auto client = browser->GetClient()) {
+    frame_handler_ = client->GetFrameHandler();
   }
 }
 
 void CefBrowserInfo::SetClosing() {
   base::AutoLock lock_scope(lock_);
-  DCHECK(!is_closing_);
-  is_closing_ = true;
+
+  // In most cases WebContentsDestroyed will be called first, except if the
+  // browser still exits at CefShitdown.
+  if (!is_closing_) {
+    is_closing_ = true;
+  }
+}
+
+void CefBrowserInfo::WebContentsDestroyed() {
+  NotificationStateLock lock_scope(this);
+
+  // Always called before BrowserDestroyed.
+  DCHECK(browser_);
+
+  // We want GetMainFrame() to return nullptr at this point, but browser()
+  // should still be valid so as not to interfere with the net_service
+  // DestructionObserver.
+  if (!is_closing_) {
+    is_closing_ = true;
+  }
+
+  RemoveAllFrames(browser_);
+
+  // Any future calls to MaybeExecuteFrameNotification will now fail.
+  // NotificationStateLock already took a reference for the delivery of any
+  // notifications that are currently queued due to RemoveAllFrames.
+  frame_handler_ = nullptr;
+}
+
+void CefBrowserInfo::BrowserDestroyed() {
+  base::AutoLock lock_scope(lock_);
+
+  // Always called after SetClosing and WebContentsDestroyed.
+  DCHECK(is_closing_);
+  DCHECK(frame_info_set_.empty());
+
+  DCHECK(browser_);
+  browser_ = nullptr;
 }
 
 void CefBrowserInfo::MaybeCreateFrame(content::RenderFrameHost* host) {
@@ -130,6 +159,9 @@ void CefBrowserInfo::MaybeCreateFrame(content::RenderFrameHost* host) {
     DCHECK_EQ(info->is_main_frame_, is_main_frame);
 #endif
 
+    // Update the associated RFH, which may have changed.
+    info->frame_->MaybeReAttach(this, host, /*require_detached=*/false);
+
     if (info->is_speculative_ && !is_speculative) {
       // Upgrade the frame info from speculative to non-speculative.
       if (info->is_main_frame_) {
@@ -142,7 +174,6 @@ void CefBrowserInfo::MaybeCreateFrame(content::RenderFrameHost* host) {
   }
 
   auto frame_info = new FrameInfo;
-  frame_info->host_ = host;
   frame_info->global_id_ = global_id;
   frame_info->is_main_frame_ = is_main_frame;
   frame_info->is_speculative_ = is_speculative;
@@ -183,7 +214,7 @@ void CefBrowserInfo::FrameHostStateChanged(
       new_state == content::RenderFrameHost::LifecycleState::kActive) {
     if (auto frame = GetFrameForHost(host)) {
       // Update the associated RFH, which may have changed.
-      frame->MaybeReAttach(this, host);
+      frame->MaybeReAttach(this, host, /*require_detached=*/true);
 
       if (frame->IsMain()) {
         // Update the main frame object.
@@ -519,8 +550,7 @@ void CefBrowserInfo::RemoveAllFrames(
   // Make sure any callbacks will see the correct state (e.g. like
   // CefBrowser::GetMainFrame returning nullptr and CefBrowser::IsValid
   // returning false).
-  DCHECK(!browser_);
-  DCHECK(old_browser);
+  DCHECK(is_closing_);
 
   // Clear the lookup maps.
   frame_id_map_.clear();

libcef/browser/browser_info.h

@@ -12,6 +12,7 @@
 
 #include "base/containers/unique_ptr_adapters.h"
 #include "base/functional/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/synchronization/lock.h"
@@ -48,21 +49,30 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
   bool print_preview_enabled() const { return print_preview_enabled_; }
   CefRefPtr<CefDictionaryValue> extra_info() const { return extra_info_; }
 
-  // May return NULL if the browser has not yet been created or if the browser
-  // has been destroyed.
+  // May return nullptr if the browser has not yet been created (before
+  // SetBrowser) or if the browser has been destroyed (after BrowserDestroyed).
   CefRefPtr<CefBrowserHostBase> browser() const;
 
-  // Set or clear the browser. Called from CefBrowserHostBase InitializeBrowser
-  // (to set) and DestroyBrowser (to clear).
+  // Returns true if the browser has been created (after SetBrowser) and is not
+  // yet closing (before SetClosing or WebContentsDestroyed).
+  bool IsValid() const;
+
+  // Returns true if the browser is closing (after SetClosing or
+  // WebContentsDestroyed).
+  bool IsClosing() const;
+
+  // Called from CefBrowserHostBase constructor.
   void SetBrowser(CefRefPtr<CefBrowserHostBase> browser);
 
-  // Called after OnBeforeClose and before SetBrowser(nullptr). This will cause
-  // browser() and GetMainFrame() to return nullptr as expected by
-  // CefFrameHandler callbacks. Note that this differs from calling
-  // SetBrowser(nullptr) because the WebContents has not yet been destroyed and
-  // further frame-related callbacks are expected.
+  // Called from CefBrowserHostBase::OnBeforeClose.
   void SetClosing();
 
+  // Called from CefBrowserHostBase::DestroyWebContents.
+  void WebContentsDestroyed();
+
+  // Called from CefBrowserHostBase::DestroyBrowser.
+  void BrowserDestroyed();
+
   // Ensure that a frame record exists for |host|. Called for the main frame
   // when the RenderView is created, or for a sub-frame when the associated
   // RenderFrame is created in the renderer process.
@@ -169,7 +179,6 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
       return frame_ && is_main_frame_ && !is_speculative_ && !is_in_bfcache_;
     }
 
-    content::RenderFrameHost* host_;
     content::GlobalRenderFrameHostId global_id_;
     bool is_main_frame_;
     bool is_speculative_;
@@ -210,7 +219,7 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
 
    protected:
     friend class CefBrowserInfo;
-    CefBrowserInfo* const browser_info_;
+    const raw_ptr<CefBrowserInfo> browser_info_;
     CefRefPtr<CefFrameHandler> frame_handler_;
     std::unique_ptr<base::AutoLock> browser_info_lock_scope_;
     std::queue<FrameNotifyOnceAction> queue_;
@@ -219,7 +228,7 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
   mutable base::Lock notification_lock_;
 
   // These members must be protected by |notification_lock_|.
-  NotificationStateLock* notification_state_lock_ = nullptr;
+  raw_ptr<NotificationStateLock> notification_state_lock_ = nullptr;
   CefRefPtr<CefFrameHandler> frame_handler_;
 
   mutable base::Lock lock_;

libcef/browser/browser_info_manager.h

@@ -11,6 +11,7 @@
 #include <memory>
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "base/synchronization/lock.h"
 #include "base/task/sequenced_task_runner.h"
 #include "cef/include/cef_client.h"
@@ -209,7 +210,7 @@ class CefBrowserInfoManager : public content::RenderProcessHostObserver {
     bool use_default_browser_creation = false;
 
     // The newly created WebContents (set in WebContentsCreated).
-    content::WebContents* new_contents = nullptr;
+    raw_ptr<content::WebContents> new_contents = nullptr;
   };
 
   // Manage pending popups. Only called on the UI thread.

libcef/browser/browser_platform_delegate.cc

@@ -495,12 +495,12 @@ void CefBrowserPlatformDelegate::DragSourceSystemDragEnded() {
 }
 
 void CefBrowserPlatformDelegate::AccessibilityEventReceived(
-    const content::AXEventNotificationDetails& eventData) {
+    const ui::AXUpdatesAndEvents& details) {
   DCHECK(false);
 }
 
 void CefBrowserPlatformDelegate::AccessibilityLocationChangesReceived(
-    const std::vector<content::AXLocationChangeNotificationDetails>& locData) {
+    const std::vector<ui::AXLocationChanges>& details) {
   DCHECK(false);
 }
 

libcef/browser/browser_platform_delegate.h

@@ -10,6 +10,7 @@
 #include <vector>
 
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "cef/include/cef_client.h"
 #include "cef/include/cef_drag_data.h"
 #include "cef/include/internal/cef_types.h"
@@ -40,8 +41,6 @@ class WindowFeatures;
 }  // namespace blink
 
 namespace content {
-struct AXEventNotificationDetails;
-struct AXLocationChangeNotificationDetails;
 struct DropData;
 struct NativeWebKeyboardEvent;
 class RenderViewHost;
@@ -66,6 +65,11 @@ class Size;
 class Vector2d;
 }  // namespace gfx
 
+namespace ui {
+struct AXLocationChanges;
+struct AXUpdatesAndEvents;
+}  // namespace ui
+
 namespace views {
 class Widget;
 }
@@ -381,9 +385,9 @@ class CefBrowserPlatformDelegate {
   virtual void DragSourceEndedAt(int x, int y, cef_drag_operations_mask_t op);
   virtual void DragSourceSystemDragEnded();
   virtual void AccessibilityEventReceived(
-      const content::AXEventNotificationDetails& eventData);
+      const ui::AXUpdatesAndEvents& details);
   virtual void AccessibilityLocationChangesReceived(
-      const std::vector<content::AXLocationChangeNotificationDetails>& locData);
+      const std::vector<ui::AXLocationChanges>& details);
   virtual gfx::Point GetDialogPosition(const gfx::Size& size);
   virtual gfx::Size GetMaximumDialogSize();
 
@@ -409,8 +413,8 @@ class CefBrowserPlatformDelegate {
   static int TranslateWebEventModifiers(uint32_t cef_modifiers);
 
   // Not owned by this object.
-  content::WebContents* web_contents_ = nullptr;
-  CefBrowserHostBase* browser_ = nullptr;
+  raw_ptr<content::WebContents> web_contents_ = nullptr;
+  raw_ptr<CefBrowserHostBase> browser_ = nullptr;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_BROWSER_PLATFORM_DELEGATE_H_

libcef/browser/chrome/browser_platform_delegate_chrome.h

@@ -5,6 +5,7 @@
 #ifndef CEF_LIBCEF_BROWSER_CHROME_BROWSER_PLATFORM_DELEGATE_CHROME_H_
 #define CEF_LIBCEF_BROWSER_CHROME_BROWSER_PLATFORM_DELEGATE_CHROME_H_
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/browser_platform_delegate.h"
 #include "cef/libcef/browser/native/browser_platform_delegate_native.h"
 
@@ -60,7 +61,7 @@ class CefBrowserPlatformDelegateChrome
 
   std::unique_ptr<CefBrowserPlatformDelegateNative> native_delegate_;
 
-  Browser* chrome_browser_ = nullptr;
+  raw_ptr<Browser> chrome_browser_ = nullptr;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_CHROME_BROWSER_PLATFORM_DELEGATE_CHROME_H_

libcef/browser/chrome/chrome_browser_context.cc

@@ -133,7 +133,8 @@ void ChromeBrowserContext::Shutdown() {
   // |g_browser_process| may be nullptr during shutdown.
   if (g_browser_process) {
     if (should_destroy_) {
-      GetPrimaryUserProfile()->DestroyOffTheRecordProfile(profile_);
+      GetPrimaryUserProfile()->DestroyOffTheRecordProfile(
+          profile_.ExtractAsDangling());
     } else if (profile_) {
       OnProfileWillBeDestroyed(profile_);
     }

libcef/browser/chrome/chrome_browser_context.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_CHROME_CHROME_BROWSER_CONTEXT_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/browser_context.h"
 #include "chrome/browser/profiles/profile_manager.h"
@@ -55,7 +56,7 @@ class ChromeBrowserContext : public CefBrowserContext, public ProfileObserver {
   void ProfileCreated(CreateStatus status, Profile* profile);
 
   base::OnceClosure initialized_cb_;
-  Profile* profile_ = nullptr;
+  raw_ptr<Profile> profile_ = nullptr;
   bool should_destroy_ = false;
 
   bool destroyed_ = false;

libcef/browser/chrome/chrome_browser_delegate.cc

@@ -244,7 +244,7 @@ void ChromeBrowserDelegate::SetAsDelegate(content::WebContents* web_contents,
 
   if (browser_host) {
     // We already have a browser host, so just change the associated Browser.
-    browser_host->SetBrowser(set_delegate ? browser_ : nullptr);
+    browser_host->SetBrowser(set_delegate ? browser_.get() : nullptr);
     return;
   }
 

libcef/browser/chrome/chrome_browser_delegate.h

@@ -9,6 +9,7 @@
 #include <memory>
 #include <optional>
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/browser_host_base.h"
 #include "cef/libcef/browser/browser_info.h"
 #include "cef/libcef/browser/chrome/browser_delegate.h"
@@ -161,7 +162,7 @@ class ChromeBrowserDelegate : public cef::BrowserDelegate {
   CefWindowImpl* GetCefWindowImpl() const;
   CefWindowView* GetCefWindowView() const;
 
-  Browser* const browser_;
+  const raw_ptr<Browser> browser_;
   base::WeakPtr<ChromeBrowserHostImpl> opener_host_;
 
   // Used when creating a new browser host.

libcef/browser/chrome/chrome_browser_host_impl.cc

@@ -146,16 +146,9 @@ void ChromeBrowserHostImpl::AddNewContents(
 
 void ChromeBrowserHostImpl::OnWebContentsDestroyed(
     content::WebContents* web_contents) {
-  // GetWebContents() should return nullptr at this point.
-  DCHECK(!GetWebContents());
-
-  // In most cases WebContents destruction will trigger browser destruction.
-  // The exception is if the browser still exists at CefShutdown, in which
-  // case DestroyBrowser() will be called first via
-  // CefBrowserInfoManager::DestroyAllBrowsers().
-  if (platform_delegate_) {
-    platform_delegate_->WebContentsDestroyed(web_contents);
+  DestroyWebContents(web_contents);
 
+  if (!is_destroying_browser_) {
     // Destroy the browser asynchronously to allow the current call stack
     // to unwind (we may have been called via the TabStripModel owned by the
     // Browser).
@@ -568,24 +561,14 @@ bool ChromeBrowserHostImpl::WillBeDestroyed() const {
 void ChromeBrowserHostImpl::DestroyBrowser() {
   CEF_REQUIRE_UIT();
 
-  // Notify that this browser has been destroyed. These must be delivered in
-  // the expected order.
+  is_destroying_browser_ = true;
 
-  // 1. Notify the platform delegate. With Views this will result in a call to
-  // CefBrowserViewDelegate::OnBrowserDestroyed().
-  platform_delegate_->NotifyBrowserDestroyed();
-
-  // 2. Notify the browser's LifeSpanHandler. This must always be the last
-  // notification for this browser.
-  OnBeforeClose();
-
-  // Notify any observers that may have state associated with this browser.
-  OnBrowserDestroyed();
-
-  // If the WebContents still exists at this point, signal destruction before
-  // browser destruction.
-  if (auto web_contents = GetWebContents()) {
-    platform_delegate_->WebContentsDestroyed(web_contents);
+  // If the WebContents still exists at this point, close the Browser and
+  // WebContents first. See comments on CefBrowserHostBase::DestroyBrowser.
+  if (GetWebContents()) {
+    // Triggers a call to OnWebContentsDestroyed.
+    DoCloseBrowser(/*force_close=*/true);
+    DCHECK(!GetWebContents());
   }
 
   // Disassociate the platform delegate from this browser.
@@ -604,6 +587,7 @@ void ChromeBrowserHostImpl::DoCloseBrowser(bool force_close) {
     // Like chrome::CloseTab() but specifying the WebContents.
     const int tab_index = GetCurrentTabIndex();
     if (tab_index != TabStripModel::kNoTab) {
+      // This will trigger destruction of the Browser and WebContents.
       // TODO(chrome): Handle the case where this method returns false,
       // indicating that the contents were not closed immediately.
       browser_->tab_strip_model()->CloseWebContentsAt(

libcef/browser/chrome/chrome_browser_host_impl.h

@@ -8,6 +8,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/browser_host_base.h"
 #include "cef/libcef/browser/chrome/browser_delegate.h"
@@ -174,8 +175,9 @@ class ChromeBrowserHostImpl : public CefBrowserHostBase {
   // TabStripModel::kNoTab if not found.
   int GetCurrentTabIndex() const;
 
-  Browser* browser_ = nullptr;
+  raw_ptr<Browser> browser_ = nullptr;
   CefWindowHandle host_window_handle_ = kNullWindowHandle;
+  bool is_destroying_browser_ = false;
 
   base::WeakPtrFactory<ChromeBrowserHostImpl> weak_ptr_factory_{this};
 };

libcef/browser/chrome/chrome_content_browser_client_cef.cc

@@ -84,6 +84,11 @@ void HandleExternalProtocolHelper(
 ChromeContentBrowserClientCef::ChromeContentBrowserClientCef() = default;
 ChromeContentBrowserClientCef::~ChromeContentBrowserClientCef() = default;
 
+void ChromeContentBrowserClientCef::CleanupOnUIThread() {
+  browser_main_parts_ = nullptr;
+  ChromeContentBrowserClient::CleanupOnUIThread();
+}
+
 std::unique_ptr<content::BrowserMainParts>
 ChromeContentBrowserClientCef::CreateBrowserMainParts(
     bool is_integration_test) {

libcef/browser/chrome/chrome_content_browser_client_cef.h

@@ -8,6 +8,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/request_context_impl.h"
 #include "chrome/browser/chrome_content_browser_client.h"
 #include "content/public/browser/web_contents_view_delegate.h"
@@ -25,6 +26,8 @@ class ChromeContentBrowserClientCef : public ChromeContentBrowserClient {
 
   ~ChromeContentBrowserClientCef() override;
 
+  void CleanupOnUIThread() override;
+
   // ChromeContentBrowserClient overrides.
   std::unique_ptr<content::BrowserMainParts> CreateBrowserMainParts(
       bool is_integration_test) override;
@@ -140,7 +143,7 @@ class ChromeContentBrowserClientCef : public ChromeContentBrowserClient {
   static std::unique_ptr<content::WebContentsViewDelegate>
   CreateWebContentsViewDelegate(content::WebContents* web_contents);
 
-  ChromeBrowserMainExtraPartsCef* browser_main_parts_ = nullptr;
+  raw_ptr<ChromeBrowserMainExtraPartsCef> browser_main_parts_ = nullptr;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_CHROME_CHROME_CONTENT_BROWSER_CLIENT_CEF_

libcef/browser/chrome/chrome_context_menu_handler.cc

@@ -4,6 +4,7 @@
 
 #include "cef/libcef/browser/chrome/chrome_context_menu_handler.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/alloy/alloy_browser_host_impl.h"
 #include "cef/libcef/browser/browser_host_base.h"
@@ -271,7 +272,7 @@ class CefContextMenuObserver : public RenderViewContextMenuObserver,
     OnMenuClosed();
   }
 
-  RenderViewContextMenu* const context_menu_;
+  const raw_ptr<RenderViewContextMenu> context_menu_;
   CefRefPtr<CefBrowserHostBase> browser_;
   CefRefPtr<CefContextMenuHandler> handler_;
   CefRefPtr<CefContextMenuParams> params_;

libcef/browser/chrome/chrome_web_contents_view_delegate_cef.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_CHROME_CHROME_WEB_CONTENTS_VIEW_DELEGATE_CEF_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 
 #if BUILDFLAG(IS_MAC)
@@ -31,7 +32,7 @@ class ChromeWebContentsViewDelegateCef
                        const content::ContextMenuParams& params) override;
 
  private:
-  content::WebContents* const web_contents_;
+  const raw_ptr<content::WebContents> web_contents_;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_CHROME_CHROME_WEB_CONTENTS_VIEW_DELEGATE_CEF_H_

libcef/browser/chrome/extensions/chrome_extension_util.cc

@@ -63,4 +63,12 @@ bool GetAlloyTabById(int tab_id,
   return false;
 }
 
+bool IsAlloyContents(content::WebContents* contents, bool primary_only) {
+  auto browser = CefBrowserHostBase::GetBrowserForContents(contents);
+  if (browser && browser->IsAlloyStyle()) {
+    return !primary_only || browser->GetWebContents() == contents;
+  }
+  return false;
+}
+
 }  // namespace cef

libcef/browser/chrome/extensions/chrome_extension_util.h

@@ -21,6 +21,10 @@ bool GetAlloyTabById(int tab_id,
                      bool include_incognito,
                      content::WebContents** contents);
 
+// Returns true if |contents| is owned by an Alloy style CefBrowserHost.
+// If |primary_only| is false then guest contents will also be matched.
+bool IsAlloyContents(content::WebContents* contents, bool primary_only);
+
 }  // namespace cef
 
 #endif  // CEF_LIBCEF_BROWSER_CHROME_EXTENSIONS_CHROME_EXTENSION_UTIL_H_

libcef/browser/chrome/extensions/chrome_mime_handler_view_guest_delegate_cef.h

@@ -6,6 +6,7 @@
 #ifndef CEF_LIBCEF_BROWSER_CHROME_EXTENSIONS_CHROME_MIME_HANDLER_VIEW_GUEST_DELEGATE_CEF_H_
 #define CEF_LIBCEF_BROWSER_CHROME_EXTENSIONS_CHROME_MIME_HANDLER_VIEW_GUEST_DELEGATE_CEF_H_
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/guest_view/mime_handler_view/chrome_mime_handler_view_guest_delegate.h"
 
 namespace extensions {
@@ -31,7 +32,7 @@ class ChromeMimeHandlerViewGuestDelegateCef
                          const content::ContextMenuParams& params) override;
 
  private:
-  content::WebContents* owner_web_contents_;
+  raw_ptr<content::WebContents> owner_web_contents_;
 };
 
 }  // namespace extensions

libcef/browser/chrome/views/browser_platform_delegate_chrome_views.cc

@@ -48,7 +48,7 @@ void CefBrowserPlatformDelegateChromeViews::BrowserCreated(
 
 void CefBrowserPlatformDelegateChromeViews::NotifyBrowserCreated() {
   if (auto delegate = browser_view_->delegate()) {
-    delegate->OnBrowserCreated(browser_view_, browser_);
+    delegate->OnBrowserCreated(browser_view_, browser_.get());
 
     // DevTools windows hide the notification bubble by default. However, we
     // don't currently have the ability to intercept WebContents creation via
@@ -76,7 +76,8 @@ void CefBrowserPlatformDelegateChromeViews::NotifyBrowserCreated() {
 
 void CefBrowserPlatformDelegateChromeViews::NotifyBrowserDestroyed() {
   if (browser_view_->delegate()) {
-    browser_view_->delegate()->OnBrowserDestroyed(browser_view_, browser_);
+    browser_view_->delegate()->OnBrowserDestroyed(browser_view_,
+                                                  browser_.get());
   }
 }
 

libcef/browser/chrome/views/chrome_browser_frame.cc

@@ -31,11 +31,10 @@ void ChromeBrowserFrame::Init(BrowserView* browser_view,
   DCHECK(browser_view);
   DCHECK(browser);
 
-  DCHECK(!browser_view_);
-  browser_view_ = browser_view;
+  DCHECK(!BrowserFrame::browser_view());
 
   // Initialize BrowserFrame state.
-  InitBrowserView(browser_view);
+  SetBrowserView(browser_view);
 
   // Initialize BrowserView state.
   browser_view->InitBrowser(std::move(browser));
@@ -73,7 +72,7 @@ void ChromeBrowserFrame::AddAssociatedProfile(Profile* profile) {
 
   // Always call ThemeChanged() when the Chrome style BrowserView is added.
   bool call_theme_changed =
-      browser_view_ && browser_view_->GetProfile() == profile;
+      browser_view() && browser_view()->GetProfile() == profile;
 
   ProfileMap::iterator it = associated_profiles_.find(profile);
   if (it != associated_profiles_.end()) {
@@ -127,8 +126,8 @@ void ChromeBrowserFrame::RemoveAssociatedProfile(Profile* profile) {
 
 Profile* ChromeBrowserFrame::GetThemeProfile() const {
   // Always prefer the Browser Profile, if any.
-  if (browser_view_) {
-    return browser_view_->GetProfile();
+  if (browser_view()) {
+    return browser_view()->GetProfile();
   }
   if (!associated_profiles_.empty()) {
     return associated_profiles_.begin()->first;
@@ -137,9 +136,9 @@ Profile* ChromeBrowserFrame::GetThemeProfile() const {
 }
 
 bool ChromeBrowserFrame::ToggleFullscreenMode() {
-  if (browser_view_) {
+  if (browser_view()) {
     // Toggle fullscreen mode via the Chrome command for consistent behavior.
-    chrome::ToggleFullscreenMode(browser_view_->browser());
+    chrome::ToggleFullscreenMode(browser_view()->browser());
     return true;
   }
   return false;
@@ -167,10 +166,10 @@ ChromeBrowserFrame::CreateNonClientFrameView() {
 }
 
 void ChromeBrowserFrame::Activate() {
-  if (browser_view_ && browser_view_->browser() &&
-      browser_view_->browser()->is_type_devtools()) {
+  if (browser_view() && browser_view()->browser() &&
+      browser_view()->browser()->is_type_devtools()) {
     if (auto browser_host = ChromeBrowserHostImpl::GetBrowserForBrowser(
-            browser_view_->browser())) {
+            browser_view()->browser())) {
       if (browser_host->platform_delegate()->HasExternalParent()) {
         // Handle activation of DevTools with external parent via the platform
         // delegate. On Windows the default platform implementation
@@ -189,6 +188,7 @@ void ChromeBrowserFrame::Activate() {
 
 void ChromeBrowserFrame::OnNativeWidgetDestroyed() {
   window_view_ = nullptr;
+  SetBrowserView(nullptr);
   BrowserFrame::OnNativeWidgetDestroyed();
 }
 
@@ -207,7 +207,7 @@ void ChromeBrowserFrame::OnNativeThemeUpdated(ui::NativeTheme* observed_theme) {
 }
 
 ui::ColorProviderKey ChromeBrowserFrame::GetColorProviderKey() const {
-  if (browser_view_) {
+  if (browser_view()) {
     // Use the default Browser implementation.
     return BrowserFrame::GetColorProviderKey();
   }
@@ -220,7 +220,7 @@ ui::ColorProviderKey ChromeBrowserFrame::GetColorProviderKey() const {
 }
 
 void ChromeBrowserFrame::OnThemeChanged() {
-  if (browser_view_) {
+  if (browser_view()) {
     // Ignore these notifications if we have a Browser.
     return;
   }

libcef/browser/chrome/views/chrome_browser_frame.h

@@ -8,6 +8,7 @@
 
 #include <map>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/views/color_provider_tracker.h"
 #include "cef/libcef/browser/views/widget.h"
@@ -140,22 +141,19 @@ class ChromeBrowserFrame : public BrowserFrame,
   // ThemeServiceObserver methods:
   void OnThemeChanged() override;
 
-  BrowserView* browser_view() const { return browser_view_; }
-
  private:
   // CefColorProviderTracker::Observer methods:
   void OnColorProviderCacheResetMissed() override;
 
   void NotifyThemeColorsChanged(bool chrome_theme);
 
-  CefWindowView* window_view_;
-  BrowserView* browser_view_ = nullptr;
+  raw_ptr<CefWindowView> window_view_;
 
   bool initialized_ = false;
   bool native_theme_change_ = false;
 
   // Map of Profile* to count.
-  using ProfileMap = std::map<Profile*, size_t>;
+  using ProfileMap = std::map<raw_ptr<Profile>, size_t>;
   ProfileMap associated_profiles_;
 
   CefColorProviderTracker color_provider_tracker_{this};

libcef/browser/chrome/views/chrome_browser_view.cc

@@ -76,7 +76,8 @@ void ChromeBrowserView::OnGestureEvent(ui::GestureEvent* event) {
 
 ToolbarView* ChromeBrowserView::OverrideCreateToolbar() {
   if (cef_delegate()) {
-    auto toolbar_type = cef_delegate()->GetChromeToolbarType(cef_browser_view_);
+    auto toolbar_type =
+        cef_delegate()->GetChromeToolbarType(cef_browser_view_.get());
     std::optional<ToolbarView::DisplayMode> display_mode;
     switch (toolbar_type) {
       case CEF_CTT_NORMAL:
@@ -99,3 +100,11 @@ ToolbarView* ChromeBrowserView::OverrideCreateToolbar() {
 
   return nullptr;
 }
+
+void ChromeBrowserView::WillDestroyToolbar() {
+  BrowserView::WillDestroyToolbar();
+  if (cef_toolbar_) {
+    cef_toolbar_->Destroyed();
+    cef_toolbar_ = nullptr;
+  }
+}

libcef/browser/chrome/views/chrome_browser_view.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_CHROME_VIEWS_CHROME_BROWSER_VIEW_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "cef/include/views/cef_browser_view.h"
 #include "cef/include/views/cef_browser_view_delegate.h"
 #include "cef/libcef/browser/chrome/views/toolbar_view_impl.h"
@@ -47,14 +48,15 @@ class ChromeBrowserView
 
   // BrowserView methods:
   ToolbarView* OverrideCreateToolbar() override;
+  void WillDestroyToolbar() override;
 
   CefRefPtr<CefToolbarViewImpl> cef_toolbar() const { return cef_toolbar_; }
   CefBrowserViewImpl* cef_browser_view() const { return cef_browser_view_; }
 
  private:
-  CefBrowserViewImpl* const cef_browser_view_;
+  const raw_ptr<CefBrowserViewImpl> cef_browser_view_;
 
-  views::WebView* web_view_ = nullptr;
+  raw_ptr<views::WebView> web_view_ = nullptr;
 
   bool destroyed_ = false;
 

libcef/browser/chrome/views/toolbar_view_impl.cc

@@ -30,6 +30,11 @@ CefToolbarViewImpl::CefToolbarViewImpl(
       browser_view_(browser_view),
       display_mode_(display_mode) {}
 
+void CefToolbarViewImpl::Destroyed() {
+  browser_ = nullptr;
+  browser_view_ = nullptr;
+}
+
 CefToolbarViewView* CefToolbarViewImpl::CreateRootView() {
   return new CefToolbarViewView(delegate(), browser_, browser_view_,
                                 display_mode_);

libcef/browser/chrome/views/toolbar_view_impl.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_CHROME_VIEWS_TOOLBAR_VIEW_IMPL_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "cef/include/views/cef_view_delegate.h"
 #include "cef/libcef/browser/chrome/views/toolbar_view_view.h"
 #include "cef/libcef/browser/views/view_impl.h"
@@ -21,6 +22,8 @@ class CefToolbarViewImpl
   CefToolbarViewImpl(const CefToolbarViewImpl&) = delete;
   CefToolbarViewImpl& operator=(const CefToolbarViewImpl&) = delete;
 
+  void Destroyed();
+
   // Create a new CefToolbarViewImpl instance. |delegate| may be nullptr.
   static CefRefPtr<CefToolbarViewImpl> Create(
       CefRefPtr<CefViewDelegate> delegate,
@@ -46,8 +49,8 @@ class CefToolbarViewImpl
   CefToolbarViewView* CreateRootView() override;
   void InitializeRootView() override;
 
-  Browser* const browser_;
-  BrowserView* const browser_view_;
+  raw_ptr<Browser> browser_;
+  raw_ptr<BrowserView> browser_view_;
   std::optional<ToolbarView::DisplayMode> const display_mode_;
 
   IMPLEMENT_REFCOUNTING_DELETE_ON_UIT(CefToolbarViewImpl);

libcef/browser/devtools/devtools_controller.h

@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "base/containers/span.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
@@ -68,7 +69,7 @@ class CefDevToolsController : public content::DevToolsAgentHostClient {
 
   bool EnsureAgentHost();
 
-  content::WebContents* const inspected_contents_;
+  const raw_ptr<content::WebContents> inspected_contents_;
   scoped_refptr<content::DevToolsAgentHost> agent_host_;
   int next_message_id_ = 1;
 

libcef/browser/devtools/devtools_protocol_manager.cc

@@ -4,6 +4,7 @@
 
 #include "cef/libcef/browser/devtools/devtools_protocol_manager.h"
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/browser_host_base.h"
 #include "cef/libcef/browser/devtools/devtools_controller.h"
 #include "cef/libcef/browser/thread_util.h"
@@ -51,7 +52,7 @@ class CefDevToolsRegistrationImpl : public CefRegistration,
   // CefDevToolsController::Observer methods:
   bool OnDevToolsMessage(const std::string_view& message) override {
     CEF_REQUIRE_UIT();
-    return observer_->OnDevToolsMessage(browser_, message.data(),
+    return observer_->OnDevToolsMessage(browser_.get(), message.data(),
                                         message.size());
   }
 
@@ -59,25 +60,25 @@ class CefDevToolsRegistrationImpl : public CefRegistration,
                               bool success,
                               const std::string_view& result) override {
     CEF_REQUIRE_UIT();
-    observer_->OnDevToolsMethodResult(browser_, message_id, success,
+    observer_->OnDevToolsMethodResult(browser_.get(), message_id, success,
                                       result.data(), result.size());
   }
 
   void OnDevToolsEvent(const std::string_view& method,
                        const std::string_view& params) override {
     CEF_REQUIRE_UIT();
-    observer_->OnDevToolsEvent(browser_, std::string(method), params.data(),
-                               params.size());
+    observer_->OnDevToolsEvent(browser_.get(), std::string(method),
+                               params.data(), params.size());
   }
 
   void OnDevToolsAgentAttached() override {
     CEF_REQUIRE_UIT();
-    observer_->OnDevToolsAgentAttached(browser_);
+    observer_->OnDevToolsAgentAttached(browser_.get());
   }
 
   void OnDevToolsAgentDetached() override {
     CEF_REQUIRE_UIT();
-    observer_->OnDevToolsAgentDetached(browser_);
+    observer_->OnDevToolsAgentDetached(browser_.get());
   }
 
   void OnDevToolsControllerDestroyed() override {
@@ -88,7 +89,7 @@ class CefDevToolsRegistrationImpl : public CefRegistration,
 
   CefRefPtr<CefDevToolsMessageObserver> observer_;
 
-  CefBrowserHostBase* browser_ = nullptr;
+  raw_ptr<CefBrowserHostBase> browser_ = nullptr;
   base::WeakPtr<CefDevToolsController> controller_;
 
   IMPLEMENT_REFCOUNTING_DELETE_ON_UIT(CefDevToolsRegistrationImpl);

libcef/browser/devtools/devtools_protocol_manager.h

@@ -8,6 +8,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "cef/include/cef_browser.h"
 
 class CefBrowserHostBase;
@@ -48,7 +49,7 @@ class CefDevToolsProtocolManager {
  private:
   bool EnsureController();
 
-  CefBrowserHostBase* const inspected_browser_;
+  const raw_ptr<CefBrowserHostBase> inspected_browser_;
 
   std::unique_ptr<CefDevToolsController> devtools_controller_;
 };

libcef/browser/download_manager_delegate_impl.cc

@@ -438,7 +438,7 @@ CefDownloadManagerDelegateImpl::GetOrAssociateBrowser(
     download::DownloadItem* item) {
   ItemBrowserMap::const_iterator it = item_browser_map_.find(item);
   if (it != item_browser_map_.end()) {
-    return it->second;
+    return it->second.get();
   }
 
   CefRefPtr<CefBrowserHostBase> browser;
@@ -469,7 +469,7 @@ CefRefPtr<CefBrowserHostBase> CefDownloadManagerDelegateImpl::GetBrowser(
     DownloadItem* item) {
   ItemBrowserMap::const_iterator it = item_browser_map_.find(item);
   if (it != item_browser_map_.end()) {
-    return it->second;
+    return it->second.get();
   }
 
   // If the download is rejected (e.g. ALT+click on an invalid protocol link)

libcef/browser/download_manager_delegate_impl.h

@@ -8,6 +8,7 @@
 
 #include <set>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/browser_host_base.h"
 #include "cef/libcef/browser/download_manager_delegate.h"
@@ -57,14 +58,15 @@ class CefDownloadManagerDelegateImpl
 
   void ResetManager();
 
-  content::DownloadManager* manager_;
+  raw_ptr<content::DownloadManager> manager_;
   base::WeakPtrFactory<content::DownloadManager> manager_ptr_factory_;
   const bool alloy_bootstrap_;
 
   // Map of DownloadItem to originating CefBrowserHostBase. Maintaining this
   // map is necessary because DownloadItem::GetWebContents() may return NULL if
   // the browser navigates while the download is in progress.
-  using ItemBrowserMap = std::map<download::DownloadItem*, CefBrowserHostBase*>;
+  using ItemBrowserMap =
+      std::map<raw_ptr<download::DownloadItem>, raw_ptr<CefBrowserHostBase>>;
   ItemBrowserMap item_browser_map_;
 };
 

libcef/browser/extension_impl.cc

@@ -57,7 +57,7 @@ CefRefPtr<CefRequestContext> CefExtensionImpl::GetLoaderContext() {
     return nullptr;
   }
 
-  return loader_context_;
+  return loader_context_.get();
 }
 
 bool CefExtensionImpl::IsLoaded() {

libcef/browser/extension_impl.h

@@ -8,6 +8,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "cef/include/cef_extension.h"
 #include "cef/include/cef_extension_handler.h"
 #include "cef/include/cef_request_context.h"
@@ -48,7 +49,7 @@ class CefExtensionImpl : public CefExtension {
   CefString path_;
   CefRefPtr<CefDictionaryValue> manifest_;
 
-  CefRequestContext* loader_context_;
+  raw_ptr<CefRequestContext> loader_context_;
   CefRefPtr<CefExtensionHandler> handler_;
 
   // Only accessed on the UI thread.

libcef/browser/extensions/api/tabs/tabs_api.h

@@ -5,6 +5,7 @@
 #ifndef CEF_LIBCEF_BROWSER_EXTENSIONS_API_TABS_TABS_API_H_
 #define CEF_LIBCEF_BROWSER_EXTENSIONS_API_TABS_TABS_API_H_
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/extensions/extension_function_details.h"
 #include "chrome/common/extensions/api/tabs.h"
 #include "extensions/browser/api/execute_code_function.h"
@@ -68,7 +69,7 @@ class TabsUpdateFunction : public BaseAPIFunction {
   DECLARE_EXTENSION_FUNCTION("tabs.update", TABS_UPDATE)
 
   int tab_id_ = -1;
-  content::WebContents* web_contents_ = nullptr;
+  raw_ptr<content::WebContents> web_contents_ = nullptr;
 };
 
 // Implement API calls tabs.executeScript, tabs.insertCSS, and tabs.removeCSS.

libcef/browser/extensions/browser_platform_delegate_background.cc

@@ -28,8 +28,9 @@ void CefBrowserPlatformDelegateBackground::CloseHostWindow() {
   // No host window, so continue browser destruction now. Do it asynchronously
   // so the call stack has a chance to unwind.
   CEF_POST_TASK(
-      CEF_UIT, base::BindOnce(&AlloyBrowserHostImpl::WindowDestroyed,
-                              AlloyBrowserHostImpl::FromBaseChecked(browser_)));
+      CEF_UIT,
+      base::BindOnce(&AlloyBrowserHostImpl::WindowDestroyed,
+                     AlloyBrowserHostImpl::FromBaseChecked(browser_.get())));
 }
 
 CefWindowHandle CefBrowserPlatformDelegateBackground::GetHostWindowHandle()

libcef/browser/extensions/extension_function_details.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_EXTENSIONS_EXTENSION_FUNCTION_DETAILS_H_
 
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "cef/include/cef_extension.h"
 #include "cef/libcef/browser/alloy/alloy_browser_host_impl.h"
 #include "chrome/common/extensions/api/tabs.h"
@@ -136,7 +137,7 @@ class CefExtensionFunctionDetails {
  private:
   // The function for which these details have been created. Must outlive the
   // CefExtensionFunctionDetails instance.
-  ExtensionFunction* function_;
+  raw_ptr<ExtensionFunction> function_;
 
   mutable CefRefPtr<CefExtension> cef_extension_;
 

libcef/browser/extensions/extension_system.cc

@@ -255,9 +255,7 @@ void CefExtensionSystem::Init() {
   //    any, are handled in the guest renderer process by ChromePDFPrintClient
   //    and CefPrintRenderFrameHelperDelegate.
   // 20.When navigating away from the PDF file or closing the owner CefBrowser
-  //    the guest WebContents will be destroyed. This triggers a call to
-  //    CefMimeHandlerViewGuestDelegate::OnGuestDetached which removes the
-  //    routing ID association with the owner CefBrowser.
+  //    the guest WebContents will be destroyed.
   if (PdfExtensionEnabled()) {
     if (auto manifest = ParseManifest(pdf_extension_util::GetManifest())) {
       LoadExtension(std::move(*manifest),
@@ -392,6 +390,7 @@ void CefExtensionSystem::Shutdown() {
     DCHECK(!cef_extension->loader_context());
   }
 #endif
+  renderer_helper_ = nullptr;
   extension_map_.clear();
 }
 

libcef/browser/extensions/extension_system.h

@@ -9,6 +9,7 @@
 #include <map>
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/one_shot_event.h"
 #include "cef/include/cef_extension_handler.h"
@@ -152,7 +153,7 @@ class CefExtensionSystem : public ExtensionSystem {
   void NotifyExtensionUnloaded(const Extension* extension,
                                UnloadedExtensionReason reason);
 
-  content::BrowserContext* browser_context_;  // Not owned.
+  raw_ptr<content::BrowserContext> browser_context_;  // Not owned.
 
   bool initialized_ = false;
 
@@ -169,11 +170,11 @@ class CefExtensionSystem : public ExtensionSystem {
   base::OneShotEvent ready_;
 
   // Sets of enabled/disabled/terminated/blacklisted extensions. Not owned.
-  ExtensionRegistry* registry_;
+  raw_ptr<ExtensionRegistry> registry_;
 
   // The associated RendererStartupHelper. Guaranteed to outlive the
   // ExtensionSystem, and thus us.
-  extensions::RendererStartupHelper* renderer_helper_;
+  raw_ptr<extensions::RendererStartupHelper> renderer_helper_;
 
   // Map of extension ID to CEF extension object.
   ExtensionMap extension_map_;

libcef/browser/extensions/extensions_browser_client.cc

@@ -247,6 +247,7 @@ ProcessManagerDelegate* CefExtensionsBrowserClient::GetProcessManagerDelegate()
 
 mojo::PendingRemote<network::mojom::URLLoaderFactory>
 CefExtensionsBrowserClient::GetControlledFrameEmbedderURLLoader(
+    const url::Origin& app_origin,
     int frame_tree_node_id,
     content::BrowserContext* browser_context) {
   return mojo::PendingRemote<network::mojom::URLLoaderFactory>();

libcef/browser/extensions/extensions_browser_client.h

@@ -85,6 +85,7 @@ class CefExtensionsBrowserClient : public ExtensionsBrowserClient {
   ProcessManagerDelegate* GetProcessManagerDelegate() const override;
   mojo::PendingRemote<network::mojom::URLLoaderFactory>
   GetControlledFrameEmbedderURLLoader(
+      const url::Origin& app_origin,
       int frame_tree_node_id,
       content::BrowserContext* browser_context) override;
   std::unique_ptr<ExtensionHostDelegate> CreateExtensionHostDelegate() override;

libcef/browser/extensions/mime_handler_view_guest_delegate.h

@@ -6,6 +6,7 @@
 #ifndef CEF_LIBCEF_BROWSER_EXTENSIONS_MIME_HANDLER_VIEW_GUEST_DELEGATE_H_
 #define CEF_LIBCEF_BROWSER_EXTENSIONS_MIME_HANDLER_VIEW_GUEST_DELEGATE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest_delegate.h"
 
 namespace content {
@@ -34,7 +35,7 @@ class CefMimeHandlerViewGuestDelegate : public MimeHandlerViewGuestDelegate {
                          const content::ContextMenuParams& params) override;
 
  private:
-  content::WebContents* owner_web_contents_;
+  raw_ptr<content::WebContents> owner_web_contents_;
 };
 
 }  // namespace extensions

libcef/browser/extensions/value_store/cef_value_store_factory.h

@@ -10,6 +10,7 @@
 #include <memory>
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "components/value_store/value_store_factory.h"
 
 namespace value_store {
@@ -48,7 +49,8 @@ class CefValueStoreFactory : public ValueStoreFactory {
   std::unique_ptr<ValueStore> CreateStore();
 
   base::FilePath db_path_;
-  ValueStore* last_created_store_ = nullptr;
+  raw_ptr<ValueStore, AcrossTasksDanglingUntriaged> last_created_store_ =
+      nullptr;
 
   // A mapping from directories to their ValueStore. None of these value
   // stores are owned by this factory, so care must be taken when calling

libcef/browser/file_dialog_manager.cc

@@ -7,6 +7,7 @@
 
 #include <utility>
 
+#include "base/memory/raw_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "cef/include/cef_dialog_handler.h"
 #include "cef/libcef/browser/browser_host_base.h"
@@ -140,16 +141,19 @@ FileChooserParams SelectFileToFileChooserParams(
   params.title = title;
   params.default_file_name = default_path;
 
-  // Note that this translation will lose any mime-type based filters that
-  // may have existed in the original FileChooserParams::accept_types if this
-  // dialog was created via FileSelectHelper::RunFileChooser.
   if (file_types) {
-    // A list of allowed extensions. For example, it might be
+    // |file_types| comes from FileSelectHelper::GetFileTypesFromAcceptType.
+    // |extensions| is a list of allowed extensions. For example, it might be
     //   { { "htm", "html" }, { "txt" } }
-    for (auto& vec : file_types->extensions) {
-      for (auto& ext : vec) {
-        params.accept_types.push_back(
-            FilePathTypeToString16(FILE_PATH_LITERAL(".") + ext));
+    for (size_t i = 0; i < file_types->extensions.size(); ++i) {
+      if (!file_types->extension_mimetypes[i].empty()) {
+        // Use the original mime type.
+        params.accept_types.push_back(file_types->extension_mimetypes[i]);
+      } else if (file_types->extensions[i].size() == 1) {
+        // Use the single file extension. We ignore the "Custom Files" filter
+        // which is the only instance of multiple file extensions.
+        params.accept_types.push_back(FilePathTypeToString16(
+            FILE_PATH_LITERAL(".") + file_types->extensions[i][0]));
       }
     }
   }
@@ -229,7 +233,7 @@ class CefSelectFileDialogListener : public ui::SelectFileDialog::Listener {
                     void* params) override {
     DCHECK_EQ(params, params_);
     executing_ = true;
-    listener_->FileSelected(file, index, params);
+    listener_.ExtractAsDangling()->FileSelected(file, index, params);
     Destroy();
   }
 
@@ -237,14 +241,14 @@ class CefSelectFileDialogListener : public ui::SelectFileDialog::Listener {
                           void* params) override {
     DCHECK_EQ(params, params_);
     executing_ = true;
-    listener_->MultiFilesSelected(files, params);
+    listener_.ExtractAsDangling()->MultiFilesSelected(files, params);
     Destroy();
   }
 
   void FileSelectionCanceled(void* params) override {
     DCHECK_EQ(params, params_);
     executing_ = true;
-    listener_->FileSelectionCanceled(params);
+    listener_.ExtractAsDangling()->FileSelectionCanceled(params);
     Destroy();
   }
 
@@ -253,8 +257,8 @@ class CefSelectFileDialogListener : public ui::SelectFileDialog::Listener {
     delete this;
   }
 
-  ui::SelectFileDialog::Listener* const listener_;
-  void* const params_;
+  raw_ptr<ui::SelectFileDialog::Listener> listener_;
+  const raw_ptr<void> params_;
   base::OnceClosure callback_;
 
   // Used to avoid re-entrancy from Cancel().
@@ -327,8 +331,10 @@ void CefFileDialogManager::RunFileChooser(
   // handled here there will be another call to the delegate from RunSelectFile.
   // It might be better to execute the delegate only the single time here, but
   // we don't currently have sufficient state in RunSelectFile to know that the
-  // delegate has already been executed.
-  callback = MaybeRunDelegate(params, std::move(callback));
+  // delegate has already been executed. Also, we haven't retrieved file
+  // extension data at this point.
+  callback = MaybeRunDelegate(params, Extensions(), Descriptions(),
+                              std::move(callback));
   if (callback.is_null()) {
     // The delegate kept the callback.
     return;
@@ -376,14 +382,15 @@ void CefFileDialogManager::RunSelectFile(
 
   active_listeners_.insert(listener);
 
-  // This will not be an exact representation of the original params.
   auto chooser_params =
       SelectFileToFileChooserParams(type, title, default_path, file_types);
   auto callback =
       base::BindOnce(&CefFileDialogManager::SelectFileDoneByDelegateCallback,
                      weak_ptr_factory_.GetWeakPtr(), base::Unretained(listener),
                      base::Unretained(params));
-  callback = MaybeRunDelegate(chooser_params, std::move(callback));
+  callback = MaybeRunDelegate(chooser_params, file_types->extensions,
+                              file_types->extension_description_overrides,
+                              std::move(callback));
   if (callback.is_null()) {
     // The delegate kept the callback.
     return;
@@ -455,7 +462,15 @@ void CefFileDialogManager::SelectFileListenerDestroyed(
 CefFileDialogManager::RunFileChooserCallback
 CefFileDialogManager::MaybeRunDelegate(
     const blink::mojom::FileChooserParams& params,
+    const Extensions& extensions,
+    const Descriptions& descriptions,
     RunFileChooserCallback callback) {
+  // |extensions| and |descriptions| may be empty, or may contain 1 additional
+  // entry for the "Custom Files" filter.
+  DCHECK(extensions.empty() || extensions.size() >= params.accept_types.size());
+  DCHECK(descriptions.empty() ||
+         descriptions.size() >= params.accept_types.size());
+
   if (auto client = browser_->client()) {
     if (auto handler = browser_->client()->GetDialogHandler()) {
       int mode = FILE_DIALOG_OPEN;
@@ -477,22 +492,51 @@ CefFileDialogManager::MaybeRunDelegate(
           break;
       }
 
-      std::vector<std::u16string>::const_iterator it;
-
       std::vector<CefString> accept_filters;
-      it = params.accept_types.begin();
-      for (; it != params.accept_types.end(); ++it) {
-        accept_filters.push_back(*it);
+      for (auto& accept_type : params.accept_types) {
+        accept_filters.push_back(accept_type);
+      }
+
+      std::vector<CefString> accept_extensions;
+      std::vector<CefString> accept_descriptions;
+      if (extensions.empty()) {
+        // We don't know the expansion of mime type values at this time,
+        // so only include the single file extensions.
+        for (auto& accept_type : params.accept_types) {
+          accept_extensions.push_back(
+              accept_type.ends_with(u"/*") ? std::u16string() : accept_type);
+        }
+        // Empty descriptions.
+        accept_descriptions.resize(params.accept_types.size());
+      } else {
+        // There may be 1 additional entry in |extensions| and |descriptions|
+        // that we want to ignore (for the "Custom Files" filter).
+        for (size_t i = 0; i < params.accept_types.size(); ++i) {
+          const auto& extension_list = extensions[i];
+          std::u16string ext_str;
+          for (auto& ext : extension_list) {
+            if (!ext_str.empty()) {
+              ext_str += u";";
+            }
+            ext_str += FilePathTypeToString16(FILE_PATH_LITERAL(".") + ext);
+          }
+          accept_extensions.push_back(ext_str);
+          accept_descriptions.push_back(descriptions[i]);
+        }
       }
 
       CefRefPtr<CefFileDialogCallbackImpl> callbackImpl(
           new CefFileDialogCallbackImpl(std::move(callback)));
       const bool handled = handler->OnFileDialog(
-          browser_, static_cast<cef_file_dialog_mode_t>(mode), params.title,
-          params.default_file_name.value(), accept_filters, callbackImpl.get());
+          browser_.get(), static_cast<cef_file_dialog_mode_t>(mode),
+          params.title, params.default_file_name.value(), accept_filters,
+          accept_extensions, accept_descriptions, callbackImpl.get());
       if (!handled) {
         // May return nullptr if the client has already executed the callback.
         callback = callbackImpl->Disconnect();
+        LOG_IF(ERROR, callback.is_null())
+            << "Should return true from OnFileDialog when executing the "
+               "callback";
       }
     }
   }

libcef/browser/file_dialog_manager.h

@@ -10,6 +10,7 @@
 #include <memory>
 #include <set>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "cef/include/cef_browser.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
@@ -72,8 +73,12 @@ class CefFileDialogManager {
   void SelectFileListenerDestroyed(ui::SelectFileDialog::Listener* listener);
 
  private:
+  using Extensions = std::vector<std::vector<base::FilePath::StringType>>;
+  using Descriptions = std::vector<std::u16string>;
   [[nodiscard]] RunFileChooserCallback MaybeRunDelegate(
       const blink::mojom::FileChooserParams& params,
+      const Extensions& extensions,
+      const Descriptions& descriptions,
       RunFileChooserCallback callback);
 
   void SelectFileDoneByDelegateCallback(
@@ -83,14 +88,14 @@ class CefFileDialogManager {
   void SelectFileDoneByListenerCallback(bool listener_destroyed);
 
   // CefBrowserHostBase pointer is guaranteed to outlive this object.
-  CefBrowserHostBase* const browser_;
+  const raw_ptr<CefBrowserHostBase> browser_;
 
   // Used when running a platform dialog via RunSelectFile.
   scoped_refptr<ui::SelectFileDialog> dialog_;
-  CefSelectFileDialogListener* dialog_listener_ = nullptr;
+  raw_ptr<CefSelectFileDialogListener> dialog_listener_ = nullptr;
 
   // List of all currently active listeners.
-  std::set<ui::SelectFileDialog::Listener*> active_listeners_;
+  std::set<raw_ptr<ui::SelectFileDialog::Listener>> active_listeners_;
 
   base::WeakPtrFactory<CefFileDialogManager> weak_ptr_factory_{this};
 };

libcef/browser/frame_host_impl.cc

@@ -521,7 +521,7 @@ bool CefFrameHostImpl::Detach(DetachReason reason) {
   bool first_detach = false;
 
   // Should not be called for temporary frames.
-  DCHECK(!is_temporary());
+  CHECK(!is_temporary());
 
   {
     base::AutoLock lock_scope(state_lock_);
@@ -548,17 +548,32 @@ bool CefFrameHostImpl::Detach(DetachReason reason) {
 
 void CefFrameHostImpl::MaybeReAttach(
     scoped_refptr<CefBrowserInfo> browser_info,
-    content::RenderFrameHost* render_frame_host) {
+    content::RenderFrameHost* render_frame_host,
+    bool require_detached) {
   CEF_REQUIRE_UIT();
   if (render_frame_.is_bound() && render_frame_host_ == render_frame_host) {
     // Nothing to do here.
     return;
   }
 
-  // We expect that Detach() was called previously.
+  // Should not be called for temporary frames.
   CHECK(!is_temporary());
-  CHECK(!render_frame_.is_bound());
-  CHECK(!render_frame_host_);
+
+  if (require_detached) {
+    // We expect that Detach() was called previously.
+    CHECK(!render_frame_.is_bound());
+    CHECK(!render_frame_host_);
+  } else if (render_frame_host_) {
+    // Intentionally not clearing |queued_renderer_actions_|, as we may be
+    // changing RFH during initial browser navigation.
+    VLOG(1) << GetDebugString()
+            << " detached (reason=RENDER_FRAME_CHANGED, is_connected="
+            << render_frame_.is_bound() << ")";
+    if (render_frame_.is_bound()) {
+      render_frame_->FrameDetached();
+    }
+    render_frame_.reset();
+  }
 
   // The RFH may change but the frame token should remain the same.
   CHECK(*frame_token_ == render_frame_host->GetGlobalFrameToken());

libcef/browser/frame_host_impl.h

@@ -11,6 +11,7 @@
 #include <queue>
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "base/synchronization/lock.h"
 #include "cef/include/cef_frame.h"
 #include "cef/libcef/common/mojom/cef.mojom.h"
@@ -143,7 +144,8 @@ class CefFrameHostImpl : public CefFrame, public cef::mojom::BrowserFrame {
   // cache. We may need to re-attach if the RFH has changed. See
   // https://crbug.com/1179502#c8 for additional background.
   void MaybeReAttach(scoped_refptr<CefBrowserInfo> browser_info,
-                     content::RenderFrameHost* render_frame_host);
+                     content::RenderFrameHost* render_frame_host,
+                     bool require_detached);
 
   // cef::mojom::BrowserFrame methods forwarded from CefBrowserFrame.
   void SendMessage(const std::string& name,
@@ -195,7 +197,7 @@ class CefFrameHostImpl : public CefFrame, public cef::mojom::BrowserFrame {
   std::optional<content::GlobalRenderFrameHostToken> parent_frame_token_;
 
   // The following members are only accessed on the UI thread.
-  content::RenderFrameHost* render_frame_host_ = nullptr;
+  raw_ptr<content::RenderFrameHost> render_frame_host_ = nullptr;
 
   std::queue<std::pair<std::string, RenderFrameAction>>
       queued_renderer_actions_;

libcef/browser/frame_service_base.h

@@ -9,6 +9,7 @@
 
 #include "base/functional/bind.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/threading/thread_checker.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/render_frame_host.h"
@@ -116,7 +117,7 @@ class FrameServiceBase : public Interface, public WebContentsObserver {
     delete this;
   }
 
-  RenderFrameHost* const render_frame_host_ = nullptr;
+  const raw_ptr<RenderFrameHost> render_frame_host_ = nullptr;
   const url::Origin origin_;
   mojo::Receiver<Interface> receiver_;
 };

libcef/browser/hang_monitor.cc

@@ -4,6 +4,7 @@
 
 #include "cef/libcef/browser/hang_monitor.h"
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "cef/include/cef_client.h"
 #include "cef/libcef/browser/browser_host_base.h"
@@ -87,7 +88,7 @@ class CefUnresponsiveProcessCallbackImpl
     }
   }
 
-  content::RenderWidgetHost* render_widget_host_;
+  raw_ptr<content::RenderWidgetHost> render_widget_host_;
   base::RepeatingClosure hang_monitor_restarter_;
 
   IMPLEMENT_REFCOUNTING(CefUnresponsiveProcessCallbackImpl);

libcef/browser/javascript_dialog_manager.cc

@@ -124,7 +124,7 @@ void CefJavaScriptDialogManager::RunJavaScriptDialog(
 
       // Execute the user callback.
       bool handled = handler->OnJSDialog(
-          browser_, origin_url.spec(),
+          browser_.get(), origin_url.spec(),
           static_cast<cef_jsdialog_type_t>(message_type), message_text,
           default_prompt_text, callbackPtr.get(), *did_suppress_message);
       if (handled) {
@@ -206,7 +206,7 @@ void CefJavaScriptDialogManager::RunBeforeUnloadDialog(
 
       // Execute the user callback.
       bool handled = handler->OnBeforeUnloadDialog(
-          browser_, message_text, is_reload, callbackPtr.get());
+          browser_.get(), message_text, is_reload, callbackPtr.get());
       if (handled) {
         return;
       }
@@ -281,7 +281,7 @@ void CefJavaScriptDialogManager::CancelDialogs(
     bool reset_state) {
   if (handler_) {
     if (reset_state) {
-      handler_->OnResetDialogState(browser_);
+      handler_->OnResetDialogState(browser_.get());
     }
     handler_ = nullptr;
     return;
@@ -314,7 +314,7 @@ void CefJavaScriptDialogManager::DialogClosed(
     bool success,
     const std::u16string& user_input) {
   if (handler_) {
-    handler_->OnDialogClosed(browser_);
+    handler_->OnDialogClosed(browser_.get());
     // Call OnResetDialogState.
     CancelDialogs(/*web_contents=*/nullptr, /*reset_state=*/true);
   }

libcef/browser/javascript_dialog_manager.h

@@ -10,6 +10,7 @@
 #include <memory>
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/include/cef_jsdialog_handler.h"
 #include "cef/libcef/browser/javascript_dialog_runner.h"
@@ -60,7 +61,7 @@ class CefJavaScriptDialogManager : public content::JavaScriptDialogManager {
   bool CanUseChromeDialogs() const;
 
   // CefBrowserHostBase pointer is guaranteed to outlive this object.
-  CefBrowserHostBase* const browser_;
+  const raw_ptr<CefBrowserHostBase> browser_;
 
   CefRefPtr<CefJSDialogHandler> handler_;
 

libcef/browser/main_runner.cc

@@ -9,6 +9,7 @@
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/sequence_checker.h"
 #include "base/synchronization/lock.h"
@@ -236,7 +237,7 @@ class CefUIThread : public base::PlatformThread::Delegate {
 #endif
   }
 
-  CefMainRunner* const runner_;
+  const raw_ptr<CefMainRunner> runner_;
   base::OnceClosure setup_callback_;
   base::OnceClosure shutdown_callback_;
 

libcef/browser/media_router/media_router_manager.cc

@@ -4,6 +4,7 @@
 
 #include "cef/libcef/browser/media_router/media_router_manager.h"
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/browser_context.h"
 #include "cef/libcef/browser/thread_util.h"
 #include "components/media_router/browser/media_router_factory.h"
@@ -34,7 +35,7 @@ class CefMediaRoutesObserver : public media_router::MediaRoutesObserver {
   }
 
  private:
-  CefMediaRouterManager* const manager_;
+  const raw_ptr<CefMediaRouterManager> manager_;
 };
 
 // Used to receive messages if PresentationConnection is not supported.
@@ -61,7 +62,7 @@ class CefPresentationConnectionMessageObserver
   }
 
  private:
-  CefMediaRouterManager* const manager_;
+  const raw_ptr<CefMediaRouterManager> manager_;
   const media_router::MediaRoute route_;
 };
 
@@ -118,7 +119,7 @@ class CefPresentationConnection : public blink::mojom::PresentationConnection {
   }
 
  private:
-  CefMediaRouterManager* const manager_;
+  const raw_ptr<CefMediaRouterManager> manager_;
   const media_router::MediaRoute route_;
 
   // Used to receive messages from the MRP.

libcef/browser/media_router/media_router_manager.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_MEDIA_ROUTER_MEDIA_ROUTER_MANAGER_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "cef/include/cef_media_router.h"
@@ -107,7 +108,7 @@ class CefMediaRouterManager
   RouteState* GetRouteState(const media_router::MediaRoute::Id& route_id);
   void RemoveRouteState(const media_router::MediaRoute::Id& route_id);
 
-  content::BrowserContext* const browser_context_;
+  const raw_ptr<content::BrowserContext> browser_context_;
 
   base::ObserverList<Observer> observers_;
 

libcef/browser/media_stream_registrar.cc

@@ -105,7 +105,7 @@ void CefMediaStreamRegistrar::NotifyMediaStreamChange() {
 
   if (auto client = browser_->GetClient()) {
     if (auto handler = client->GetDisplayHandler()) {
-      handler->OnMediaAccessChange(browser_, video, audio);
+      handler->OnMediaAccessChange(browser_.get(), video, audio);
     }
   }
 }

libcef/browser/media_stream_registrar.h

@@ -10,6 +10,7 @@
 #include <memory>
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "content/public/browser/media_stream_request.h"
 
@@ -37,7 +38,7 @@ class CefMediaStreamRegistrar {
   void NotifyMediaStreamChange();
 
   // Guaranteed to outlive this object.
-  CefBrowserHostBase* const browser_;
+  const raw_ptr<CefBrowserHostBase> browser_;
 
   struct MediaStreamInfo {
     bool video;

libcef/browser/menu_manager.cc

@@ -151,7 +151,7 @@ bool CefMenuManager::CreateContextMenu(
           new CefContextMenuParamsImpl(&params_));
       CefRefPtr<CefFrame> frame = browser_->GetFocusedFrame();
 
-      handler->OnBeforeContextMenu(browser_, frame, paramsPtr.get(),
+      handler->OnBeforeContextMenu(browser_.get(), frame, paramsPtr.get(),
                                    model_.get());
 
       MenuWillShow(model_);
@@ -166,7 +166,7 @@ bool CefMenuManager::CreateContextMenu(
         // the callback object is deleted.
         custom_menu_callback_ = callbackImpl.get();
 
-        if (handler->RunContextMenu(browser_, frame, paramsPtr.get(),
+        if (handler->RunContextMenu(browser_.get(), frame, paramsPtr.get(),
                                     model_.get(), callbackImpl.get())) {
           custom_menu = true;
         } else {
@@ -224,8 +224,8 @@ void CefMenuManager::ExecuteCommand(CefRefPtr<CefMenuModelImpl> source,
           new CefContextMenuParamsImpl(&params_));
 
       bool handled = handler->OnContextMenuCommand(
-          browser_, browser_->GetFocusedFrame(), paramsPtr.get(), command_id,
-          event_flags);
+          browser_.get(), browser_->GetFocusedFrame(), paramsPtr.get(),
+          command_id, event_flags);
 
       // Do not keep references to the parameters in the callback.
       std::ignore = paramsPtr->Detach(nullptr);
@@ -277,7 +277,8 @@ void CefMenuManager::MenuClosed(CefRefPtr<CefMenuModelImpl> source) {
   if (client.get()) {
     CefRefPtr<CefContextMenuHandler> handler = client->GetContextMenuHandler();
     if (handler.get()) {
-      handler->OnContextMenuDismissed(browser_, browser_->GetFocusedFrame());
+      handler->OnContextMenuDismissed(browser_.get(),
+                                      browser_->GetFocusedFrame());
     }
   }
 

libcef/browser/menu_manager.h

@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_MENU_MANAGER_H_
 #pragma once
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/menu_model_impl.h"
 #include "cef/libcef/browser/menu_runner.h"
@@ -62,7 +63,7 @@ class CefMenuManager : public CefMenuModelImpl::Delegate,
   bool IsCustomContextMenuCommand(int command_id);
 
   // AlloyBrowserHostImpl pointer is guaranteed to outlive this object.
-  AlloyBrowserHostImpl* browser_;
+  raw_ptr<AlloyBrowserHostImpl> browser_;
 
   std::unique_ptr<CefMenuRunner> runner_;
 
@@ -70,7 +71,7 @@ class CefMenuManager : public CefMenuModelImpl::Delegate,
   content::ContextMenuParams params_;
 
   // Not owned by this class.
-  CefRunContextMenuCallback* custom_menu_callback_ = nullptr;
+  raw_ptr<CefRunContextMenuCallback> custom_menu_callback_ = nullptr;
 
   // Must be the last member.
   base::WeakPtrFactory<CefMenuManager> weak_ptr_factory_;

libcef/browser/menu_model_impl.cc

@@ -10,6 +10,7 @@
 
 #include "base/functional/bind.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/thread_util.h"
 #include "cef/libcef/common/task_runner_impl.h"
 #include "third_party/blink/public/mojom/context_menu/context_menu.mojom.h"
@@ -169,7 +170,7 @@ class CefSimpleMenuModel : public ui::MenuModel {
   void MenuWillClose() override { impl_->MenuWillClose(); }
 
  private:
-  CefMenuModelImpl* impl_;
+  raw_ptr<CefMenuModelImpl> impl_;
 };
 
 cef_menu_color_type_t GetMenuColorType(bool is_text,

libcef/browser/menu_model_impl.h

@@ -9,6 +9,7 @@
 
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "base/threading/platform_thread.h"
 #include "cef/include/cef_menu_model.h"
 #include "cef/include/cef_menu_model_delegate.h"
@@ -213,7 +214,7 @@ class CefMenuModelImpl : public CefMenuModel {
   base::PlatformThreadId supported_thread_id_;
 
   // Used when created via CefMenuManager.
-  Delegate* delegate_;
+  raw_ptr<Delegate> delegate_;
 
   // Used when created via CefMenuModel::CreateMenuModel().
   CefRefPtr<CefMenuModelDelegate> menu_model_delegate_;

libcef/browser/native/browser_platform_delegate_native.h

@@ -5,6 +5,7 @@
 #ifndef CEF_LIBCEF_BROWSER_NATIVE_BROWSER_PLATFORM_DELEGATE_NATIVE_H_
 #define CEF_LIBCEF_BROWSER_NATIVE_BROWSER_PLATFORM_DELEGATE_NATIVE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/alloy/browser_platform_delegate_alloy.h"
 
 // Base implementation of native browser functionality.
@@ -70,7 +71,7 @@ class CefBrowserPlatformDelegateNative
   const SkColor background_color_;
 
   // Not owned by this object.
-  WindowlessHandler* windowless_handler_ = nullptr;
+  raw_ptr<WindowlessHandler> windowless_handler_ = nullptr;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_NATIVE_BROWSER_PLATFORM_DELEGATE_NATIVE_H_

libcef/browser/native/browser_platform_delegate_native_aura.h

@@ -5,6 +5,7 @@
 #ifndef CEF_LIBCEF_BROWSER_NATIVE_BROWSER_PLATFORM_DELEGATE_NATIVE_AURA_H_
 #define CEF_LIBCEF_BROWSER_NATIVE_BROWSER_PLATFORM_DELEGATE_NATIVE_AURA_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "cef/libcef/browser/native/browser_platform_delegate_native.h"
 #include "ui/events/event.h"
@@ -79,7 +80,7 @@ class CefBrowserPlatformDelegateNativeAura
 
   // Widget hosting the web contents. It will be deleted automatically when the
   // associated root window is destroyed.
-  views::Widget* window_widget_ = nullptr;
+  raw_ptr<views::Widget> window_widget_ = nullptr;
 
  private:
   // Will only be called if the Widget is deleted before

libcef/browser/native/browser_platform_delegate_native_linux.cc

@@ -65,7 +65,7 @@ bool CefBrowserPlatformDelegateNativeLinux::CreateHostWindow() {
   // Create a new window object. It will delete itself when the associated X11
   // window is destroyed.
   window_x11_ =
-      new CefWindowX11(browser_, parent_window, rect,
+      new CefWindowX11(browser_.get(), parent_window, rect,
                        CefString(&window_info_.window_name).ToString());
   DCHECK_NE(window_x11_->xwindow(), x11::Window::None);
   window_info_.window =

libcef/browser/native/browser_platform_delegate_native_linux.h

@@ -5,6 +5,7 @@
 #ifndef CEF_LIBCEF_BROWSER_NATIVE_BROWSER_PLATFORM_DELEGATE_NATIVE_LINUX_H_
 #define CEF_LIBCEF_BROWSER_NATIVE_BROWSER_PLATFORM_DELEGATE_NATIVE_LINUX_H_
 
+#include "base/memory/raw_ptr.h"
 #include "cef/libcef/browser/native/browser_platform_delegate_native_aura.h"
 #include "ui/base/ozone_buildflags.h"
 
@@ -44,7 +45,7 @@ class CefBrowserPlatformDelegateNativeLinux
   bool host_window_created_ = false;
 
 #if BUILDFLAG(IS_OZONE_X11)
-  CefWindowX11* window_x11_ = nullptr;
+  raw_ptr<CefWindowX11> window_x11_ = nullptr;
 #endif
 };