Fix ExecuteJavaScript failure with null CefRenderProcessHandler (see issue #2421 )

When CefApp::GetRenderProcessHandler returned null CefRenderFrameObserver::DidCreateScriptContext was returning early (not calling CefFrameImpl::OnContextCreated) and consequently queued actions such as JavaScript were never executed.
Update to Chromium version 92.0.4515.159
2025-06-05 21:39:12 +02:00 · 2021-08-18 18:05:18 -04:00 · 2021-08-17 15:59:55 +00:00 · 2021-08-04 15:19:32 -04:00 · 2021-08-04 18:46:00 +00:00 · 2021-08-04 14:20:31 -04:00
494 changed files with 12578 additions and 7052 deletions
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -125,7 +125,6 @@ if (is_mac) {
  import("//build/config/mac/rules.gni")
  import("//build/util/version.gni")
  import("//media/cdm/library_cdm/cdm_paths.gni")
-  import("//build/config/mac/base_rules.gni")

  # Template to compile .xib and .storyboard files.
  #
@@ -262,12 +261,6 @@ if (is_clang) {
  assert(!clang_use_chrome_plugins)
 }

-if (is_mac) {
-  # Always generate dSYM files. The make_distrib script will fail if
-  # enable_dsyms=true is not explicitly set when is_official_build=false.
-  assert(enable_dsyms)
-}
-

 #
 # Local variables.
@@ -364,6 +357,9 @@ if (is_win) {

      # Required by content_switches.cc
      "//media:media_buildflags",
+
+      # Required by crash_keys.cc (from base/stl_util.h)
+      "//third_party/abseil-cpp:absl",
    ]
  }
 }
@@ -432,6 +428,8 @@ static_library("libcef_static") {
    "libcef/browser/browser_context.h",
    "libcef/browser/browser_context_keyed_service_factories.cc",
    "libcef/browser/browser_context_keyed_service_factories.h",
+    "libcef/browser/browser_frame.cc",
+    "libcef/browser/browser_frame.h",
    "libcef/browser/browser_host_base.cc",
    "libcef/browser/browser_host_base.h",
    "libcef/browser/browser_host_create.cc",
@@ -439,8 +437,8 @@ static_library("libcef_static") {
    "libcef/browser/browser_info.h",
    "libcef/browser/browser_info_manager.cc",
    "libcef/browser/browser_info_manager.h",
-    "libcef/browser/browser_message_filter.cc",
-    "libcef/browser/browser_message_filter.h",
+    "libcef/browser/browser_manager.cc",
+    "libcef/browser/browser_manager.h",
    "libcef/browser/browser_message_loop.cc",
    "libcef/browser/browser_message_loop.h",
    "libcef/browser/browser_platform_delegate.cc",
@@ -461,6 +459,8 @@ static_library("libcef_static") {
    "libcef/browser/chrome/chrome_browser_main_extra_parts_cef.h",
    "libcef/browser/chrome/chrome_content_browser_client_cef.cc",
    "libcef/browser/chrome/chrome_content_browser_client_cef.h",
+    "libcef/browser/chrome/chrome_context_menu_handler.cc",
+    "libcef/browser/chrome/chrome_context_menu_handler.h",
    "libcef/browser/chrome_crash_reporter_client_stub.cc",
    "libcef/browser/context.cc",
    "libcef/browser/context.h",
@@ -486,6 +486,8 @@ static_library("libcef_static") {
    "libcef/browser/extensions/api/storage/sync_value_store_cache.h",
    "libcef/browser/extensions/api/tabs/tabs_api.cc",
    "libcef/browser/extensions/api/tabs/tabs_api.h",
+    "libcef/browser/extensions/alloy_extensions_util.cc",
+    "libcef/browser/extensions/alloy_extensions_util.h",
    "libcef/browser/extensions/browser_extensions_util.cc",
    "libcef/browser/extensions/browser_extensions_util.h",
    "libcef/browser/extensions/browser_platform_delegate_background.cc",
@@ -559,8 +561,6 @@ static_library("libcef_static") {
    "libcef/browser/native/browser_platform_delegate_native.h",
    "libcef/browser/native/cursor_util.h",
    "libcef/browser/native/cursor_util.cc",
-    "libcef/browser/navigate_params.cc",
-    "libcef/browser/navigate_params.h",
    "libcef/browser/navigation_entry_impl.cc",
    "libcef/browser/navigation_entry_impl.h",
    "libcef/browser/net/chrome_scheme_handler.cc",
@@ -637,6 +637,8 @@ static_library("libcef_static") {
    "libcef/browser/scheme_impl.cc",
    "libcef/browser/server_impl.cc",
    "libcef/browser/server_impl.h",
+    "libcef/browser/simple_menu_model_impl.cc",
+    "libcef/browser/simple_menu_model_impl.h",
    "libcef/browser/speech_recognition_manager_delegate.cc",
    "libcef/browser/speech_recognition_manager_delegate.h",
    "libcef/browser/ssl_host_state_delegate.cc",
@@ -672,10 +674,6 @@ static_library("libcef_static") {
    "libcef/common/app_manager.cc",
    "libcef/common/app_manager.h",
    "libcef/common/base_impl.cc",
-    "libcef/common/cef_message_generator.cc",
-    "libcef/common/cef_message_generator.h",
-    "libcef/common/cef_messages.cc",
-    "libcef/common/cef_messages.h",
    "libcef/common/cef_switches.cc",
    "libcef/common/cef_switches.h",
    "libcef/common/chrome/chrome_content_client_cef.cc",
@@ -712,10 +710,8 @@ static_library("libcef_static") {
    "libcef/common/net/net_resource_provider.h",
    "libcef/common/net/scheme_registration.cc",
    "libcef/common/net/scheme_registration.h",
-    "libcef/common/net/upload_data.cc",
-    "libcef/common/net/upload_data.h",
-    "libcef/common/net/upload_element.cc",
-    "libcef/common/net/upload_element.h",
+    "libcef/common/net/url_util.cc",
+    "libcef/common/net/url_util.h",
    "libcef/common/net_service/net_service_util.cc",
    "libcef/common/net_service/net_service_util.h",
    "libcef/common/parser_impl.cc",
@@ -731,14 +727,14 @@ static_library("libcef_static") {
    "libcef/common/resource_util.h",
    "libcef/common/response_impl.cc",
    "libcef/common/response_impl.h",
-    "libcef/common/response_manager.cc",
-    "libcef/common/response_manager.h",
    "libcef/common/scheme_registrar_impl.cc",
    "libcef/common/scheme_registrar_impl.h",
    "libcef/common/string_list_impl.cc",
    "libcef/common/string_map_impl.cc",
    "libcef/common/string_multimap_impl.cc",
    "libcef/common/string_types_impl.cc",
+    "libcef/common/string_util.cc",
+    "libcef/common/string_util.h",
    "libcef/common/task_impl.cc",
    "libcef/common/task_runner_impl.cc",
    "libcef/common/task_runner_impl.h",
@@ -764,16 +760,12 @@ static_library("libcef_static") {
    "libcef/features/runtime_checks.h",
    "libcef/renderer/alloy/alloy_content_renderer_client.cc",
    "libcef/renderer/alloy/alloy_content_renderer_client.h",
-    "libcef/renderer/alloy/alloy_render_frame_observer.cc",
-    "libcef/renderer/alloy/alloy_render_frame_observer.h",
    "libcef/renderer/alloy/alloy_render_thread_observer.cc",
    "libcef/renderer/alloy/alloy_render_thread_observer.h",
    "libcef/renderer/alloy/url_loader_throttle_provider_impl.cc",
    "libcef/renderer/alloy/url_loader_throttle_provider_impl.h",
    "libcef/renderer/browser_impl.cc",
    "libcef/renderer/browser_impl.h",
-    "libcef/renderer/browser_manager.cc",
-    "libcef/renderer/browser_manager.h",
    "libcef/renderer/chrome/chrome_content_renderer_client_cef.cc",
    "libcef/renderer/chrome/chrome_content_renderer_client_cef.h",
    "libcef/renderer/dom_document_impl.cc",
@@ -792,8 +784,8 @@ static_library("libcef_static") {
    "libcef/renderer/render_frame_observer.h",
    "libcef/renderer/render_frame_util.cc",
    "libcef/renderer/render_frame_util.h",
-    "libcef/renderer/render_thread_observer.cc",
-    "libcef/renderer/render_thread_observer.h",
+    "libcef/renderer/render_manager.cc",
+    "libcef/renderer/render_manager.h",
    "libcef/renderer/render_urlrequest_impl.cc",
    "libcef/renderer/render_urlrequest_impl.h",
    "libcef/renderer/thread_util.h",
@@ -803,6 +795,10 @@ static_library("libcef_static") {
    # For Chrome runtime support.
    "//chrome/app/chrome_main_delegate.cc",
    "//chrome/app/chrome_main_delegate.h",
+
+    # Part of //content//test::test_support which is testingonly.
+    "//content/public/test/scoped_web_ui_controller_factory_registration.cc",
+    "//content/public/test/scoped_web_ui_controller_factory_registration.h",
  ]

  configs += [
@@ -829,6 +825,7 @@ static_library("libcef_static") {

  deps = [
    ":cef_make_headers",
+    "libcef/common/mojom",

    ":libcef_static_unittested",

@@ -1064,6 +1061,10 @@ static_library("libcef_static") {
      "libcef/browser/chrome/views/chrome_browser_frame.h",
      "libcef/browser/chrome/views/chrome_browser_view.cc",
      "libcef/browser/chrome/views/chrome_browser_view.h",
+      "libcef/browser/chrome/views/toolbar_view_impl.cc",
+      "libcef/browser/chrome/views/toolbar_view_impl.h",
+      "libcef/browser/chrome/views/toolbar_view_view.cc",
+      "libcef/browser/chrome/views/toolbar_view_view.h",
      "libcef/browser/native/window_delegate_view.cc",
      "libcef/browser/native/window_delegate_view.h",
      "libcef/browser/views/basic_label_button_impl.cc",
@@ -1653,6 +1654,29 @@ if (is_mac) {
 # Executable/app targets.
 #

+# Source files for TeamCity GTest integration.
+# See tests/gtest/teamcity/README.cef for details.
+source_set("gtest_teamcity") {
+  testonly = true
+
+  sources = [
+    "tests/gtest/teamcity/include/teamcity_gtest.h",
+    "tests/gtest/teamcity/src/teamcity_gtest.cpp",
+    "tests/gtest/teamcity/src/teamcity_gtest.h",
+    "tests/gtest/teamcity/src/teamcity_messages.cpp",
+    "tests/gtest/teamcity/src/teamcity_messages.h",
+  ]
+
+  deps = [
+    "//testing/gtest",
+  ]
+
+  configs += [
+    "libcef/features:config",
+    "//build/config:precompiled_headers",
+  ]
+}
+
 if (is_mac) {
  # Helper for generating the CEF app bundle.
  template("cef_app") {
@@ -1774,6 +1798,7 @@ if (is_mac) {

      public_deps = [ ":libcef_dll_wrapper" ]
      deps = [
+        ":cef_make_headers",
        ":libcef_dll_wrapper",
        ":${app_name}_framework_bundle_data",
      ]
@@ -1979,6 +2004,7 @@ if (is_mac) {
                     gypi_paths2.shared_sources_mac_helper +
                     gypi_paths2.ceftests_sources_mac_helper
    helper_deps = [
+      ":gtest_teamcity",
      "//testing/gtest",
    ]
    helper_defines = [
@@ -1999,6 +2025,7 @@ if (is_mac) {
      ":ceftests_resources_bundle_data",
      ":ceftests_resources_bundle_data_english",
      ":ceftests_xibs",
+      ":gtest_teamcity",
      "//testing/gtest",
    ]
    frameworks = [
@@ -2217,6 +2244,7 @@ if (is_mac) {
    deps = [
      ":libcef",
      ":libcef_dll_wrapper",
+      ":gtest_teamcity",
      "//testing/gtest",
    ]

--- a/CHROMIUM_BUILD_COMPATIBILITY.txt
+++ b/CHROMIUM_BUILD_COMPATIBILITY.txt
@@ -7,5 +7,6 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding

 {
-  'chromium_checkout': 'refs/tags/90.0.4430.0'
+  'chromium_checkout': 'refs/tags/92.0.4515.159',
+  'depot_tools_checkout': '58542b7fef'
 }
--- a/cef_paths.gypi
+++ b/cef_paths.gypi
@@ -8,7 +8,7 @@
 # by hand. See the translator.README.txt file in the tools directory for
 # more information.
 #
-# $hash=f1877c7a493342351e284cb6c14e6f223461facb$
+# $hash=d723a9f6637cec523b158a6750d3a64698b407c3$
 #

 {
@@ -40,6 +40,7 @@
      'include/cef_find_handler.h',
      'include/cef_focus_handler.h',
      'include/cef_frame.h',
+      'include/cef_frame_handler.h',
      'include/cef_image.h',
      'include/cef_jsdialog_handler.h',
      'include/cef_keyboard_handler.h',
@@ -137,6 +138,7 @@
      'include/capi/cef_find_handler_capi.h',
      'include/capi/cef_focus_handler_capi.h',
      'include/capi/cef_frame_capi.h',
+      'include/capi/cef_frame_handler_capi.h',
      'include/capi/cef_image_capi.h',
      'include/capi/cef_jsdialog_handler_capi.h',
      'include/capi/cef_keyboard_handler_capi.h',
@@ -300,6 +302,8 @@
      'libcef_dll/ctocpp/focus_handler_ctocpp.h',
      'libcef_dll/cpptoc/frame_cpptoc.cc',
      'libcef_dll/cpptoc/frame_cpptoc.h',
+      'libcef_dll/ctocpp/frame_handler_ctocpp.cc',
+      'libcef_dll/ctocpp/frame_handler_ctocpp.h',
      'libcef_dll/cpptoc/get_extension_resource_callback_cpptoc.cc',
      'libcef_dll/cpptoc/get_extension_resource_callback_cpptoc.h',
      'libcef_dll/cpptoc/image_cpptoc.cc',
@@ -610,6 +614,8 @@
      'libcef_dll/cpptoc/focus_handler_cpptoc.h',
      'libcef_dll/ctocpp/frame_ctocpp.cc',
      'libcef_dll/ctocpp/frame_ctocpp.h',
+      'libcef_dll/cpptoc/frame_handler_cpptoc.cc',
+      'libcef_dll/cpptoc/frame_handler_cpptoc.h',
      'libcef_dll/ctocpp/get_extension_resource_callback_ctocpp.cc',
      'libcef_dll/ctocpp/get_extension_resource_callback_ctocpp.h',
      'libcef_dll/ctocpp/image_ctocpp.cc',
--- a/cef_paths2.gypi
+++ b/cef_paths2.gypi
@@ -22,7 +22,6 @@
      'include/base/cef_platform_thread.h',
      'include/base/cef_ref_counted.h',
      'include/base/cef_scoped_ptr.h',
-      'include/base/cef_string16.h',
      'include/base/cef_template_util.h',
      'include/base/cef_thread_checker.h',
      'include/base/cef_trace_event.h',
@@ -128,7 +127,6 @@
      'libcef_dll/base/cef_lock_impl.cc',
      'libcef_dll/base/cef_logging.cc',
      'libcef_dll/base/cef_ref_counted.cc',
-      'libcef_dll/base/cef_string16.cc',
      'libcef_dll/base/cef_thread_checker_impl.cc',
      'libcef_dll/base/cef_weak_ptr.cc',
    ],
@@ -473,6 +471,7 @@
      'tests/ceftests/extensions/extension_test_handler.h',
      'tests/ceftests/extensions/view_unittest.cc',
      'tests/ceftests/file_util_unittest.cc',
+      'tests/ceftests/frame_handler_unittest.cc',
      'tests/ceftests/frame_unittest.cc',
      'tests/ceftests/image_unittest.cc',
      'tests/ceftests/image_util.cc',
@@ -563,6 +562,7 @@
      'tests/ceftests/audio_output_unittest.cc',
      'tests/ceftests/client_app_delegates.cc',
      'tests/ceftests/cookie_unittest.cc',
+      'tests/ceftests/cors_unittest.cc',
      'tests/ceftests/dom_unittest.cc',
      'tests/ceftests/frame_unittest.cc',
      'tests/ceftests/message_router_unittest.cc',
--- a/cmake/cef_variables.cmake.in
+++ b/cmake/cef_variables.cmake.in
@@ -491,6 +491,9 @@ if(OS_WINDOWS)
      PSAPI_VERSION=1   # Required by cef_sandbox.lib
      CEF_USE_SANDBOX   # Used by apps to test if the sandbox is enabled
      )
+    list(APPEND CEF_COMPILER_DEFINES_DEBUG
+      _HAS_ITERATOR_DEBUGGING=0   # Disable iterator debugging
+      )

    # Libraries required by cef_sandbox.lib.
    set(CEF_SANDBOX_STANDARD_LIBS
--- a/include/base/cef_basictypes.h
+++ b/include/base/cef_basictypes.h
@@ -75,7 +75,6 @@ typedef unsigned short uint16;
 #endif

 // UTF-16 character type.
-// This should be kept synchronized with base/strings/string16.h
 #ifndef char16
 #if defined(WCHAR_T_IS_UTF16)
 typedef wchar_t char16;
--- a/include/base/cef_string16.h
+++ b/include/base/cef_string16.h
@@ -1,223 +0,0 @@
-// Copyright (c) 2014 Marshall A. Greenblatt. Portions copyright (c) 2013
-// Google Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//    * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//    * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//    * Neither the name of Google Inc. nor the name Chromium Embedded
-// Framework nor the names of its contributors may be used to endorse
-// or promote products derived from this software without specific prior
-// written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-#ifndef CEF_INCLUDE_BASE_CEF_STRING16_H_
-#define CEF_INCLUDE_BASE_CEF_STRING16_H_
-#pragma once
-
-#if defined(BASE_STRINGS_STRING16_H_)
-// Do nothing if the Chromium header has already been included.
-// This can happen in cases where Chromium code is used directly by the
-// client application. When using Chromium code directly always include
-// the Chromium header first to avoid type conflicts.
-#elif defined(USING_CHROMIUM_INCLUDES)
-// When building CEF include the Chromium header directly.
-#include "base/strings/string16.h"
-#else  // !USING_CHROMIUM_INCLUDES
-// The following is substantially similar to the Chromium implementation.
-// If the Chromium implementation diverges the below implementation should be
-// updated to match.
-// WHAT:
-// A version of std::basic_string that provides 2-byte characters even when
-// wchar_t is not implemented as a 2-byte type. You can access this class as
-// string16. We also define char16, which string16 is based upon.
-//
-// WHY:
-// On Windows, wchar_t is 2 bytes, and it can conveniently handle UTF-16/UCS-2
-// data. Plenty of existing code operates on strings encoded as UTF-16.
-//
-// On many other platforms, sizeof(wchar_t) is 4 bytes by default. We can make
-// it 2 bytes by using the GCC flag -fshort-wchar. But then std::wstring fails
-// at run time, because it calls some functions (like wcslen) that come from
-// the system's native C library -- which was built with a 4-byte wchar_t!
-// It's wasteful to use 4-byte wchar_t strings to carry UTF-16 data, and it's
-// entirely improper on those systems where the encoding of wchar_t is defined
-// as UTF-32.
-//
-// Here, we define string16, which is similar to std::wstring but replaces all
-// libc functions with custom, 2-byte-char compatible routines. It is capable
-// of carrying UTF-16-encoded data.
-
-#include <stdio.h>
-#include <string>
-
-#include "include/base/cef_basictypes.h"
-
-#if defined(WCHAR_T_IS_UTF16)
-
-namespace base {
-
-typedef wchar_t char16;
-typedef std::wstring string16;
-typedef std::char_traits<wchar_t> string16_char_traits;
-
-}  // namespace base
-
-#elif defined(WCHAR_T_IS_UTF32)
-
-#include <stdint.h>  // For uint16_t
-
-#include "include/base/cef_macros.h"
-
-namespace cef {
-namespace base {
-
-typedef uint16_t char16;
-
-// char16 versions of the functions required by string16_char_traits; these
-// are based on the wide character functions of similar names ("w" or "wcs"
-// instead of "c16").
-int c16memcmp(const char16* s1, const char16* s2, size_t n);
-size_t c16len(const char16* s);
-const char16* c16memchr(const char16* s, char16 c, size_t n);
-char16* c16memmove(char16* s1, const char16* s2, size_t n);
-char16* c16memcpy(char16* s1, const char16* s2, size_t n);
-char16* c16memset(char16* s, char16 c, size_t n);
-
-struct string16_char_traits {
-  typedef char16 char_type;
-  typedef int int_type;
-
-  // int_type needs to be able to hold each possible value of char_type, and in
-  // addition, the distinct value of eof().
-  COMPILE_ASSERT(sizeof(int_type) > sizeof(char_type), unexpected_type_width);
-
-  typedef std::streamoff off_type;
-  typedef mbstate_t state_type;
-  typedef std::fpos<state_type> pos_type;
-
-  static void assign(char_type& c1, const char_type& c2) { c1 = c2; }
-
-  static bool eq(const char_type& c1, const char_type& c2) { return c1 == c2; }
-  static bool lt(const char_type& c1, const char_type& c2) { return c1 < c2; }
-
-  static int compare(const char_type* s1, const char_type* s2, size_t n) {
-    return c16memcmp(s1, s2, n);
-  }
-
-  static size_t length(const char_type* s) { return c16len(s); }
-
-  static const char_type* find(const char_type* s,
-                               size_t n,
-                               const char_type& a) {
-    return c16memchr(s, a, n);
-  }
-
-  static char_type* move(char_type* s1, const char_type* s2, int_type n) {
-    return c16memmove(s1, s2, n);
-  }
-
-  static char_type* copy(char_type* s1, const char_type* s2, size_t n) {
-    return c16memcpy(s1, s2, n);
-  }
-
-  static char_type* assign(char_type* s, size_t n, char_type a) {
-    return c16memset(s, a, n);
-  }
-
-  static int_type not_eof(const int_type& c) {
-    return eq_int_type(c, eof()) ? 0 : c;
-  }
-
-  static char_type to_char_type(const int_type& c) { return char_type(c); }
-
-  static int_type to_int_type(const char_type& c) { return int_type(c); }
-
-  static bool eq_int_type(const int_type& c1, const int_type& c2) {
-    return c1 == c2;
-  }
-
-  static int_type eof() { return static_cast<int_type>(EOF); }
-};
-
-typedef std::basic_string<char16, string16_char_traits> string16;
-
-}  // namespace base
-}  // namespace cef
-
-namespace base {
-
-typedef cef::base::char16 char16;
-typedef cef::base::string16 string16;
-
-extern std::ostream& operator<<(std::ostream& out, const string16& str);
-
-// This is required by googletest to print a readable output on test failures.
-extern void PrintTo(const string16& str, std::ostream* out);
-
-}  // namespace base
-
-// The string class will be explicitly instantiated only once, in string16.cc.
-//
-// std::basic_string<> in GNU libstdc++ contains a static data member,
-// _S_empty_rep_storage, to represent empty strings.  When an operation such
-// as assignment or destruction is performed on a string, causing its existing
-// data member to be invalidated, it must not be freed if this static data
-// member is being used.  Otherwise, it counts as an attempt to free static
-// (and not allocated) data, which is a memory error.
-//
-// Generally, due to C++ template magic, _S_empty_rep_storage will be marked
-// as a coalesced symbol, meaning that the linker will combine multiple
-// instances into a single one when generating output.
-//
-// If a string class is used by multiple shared libraries, a problem occurs.
-// Each library will get its own copy of _S_empty_rep_storage.  When strings
-// are passed across a library boundary for alteration or destruction, memory
-// errors will result.  GNU libstdc++ contains a configuration option,
-// --enable-fully-dynamic-string (_GLIBCXX_FULLY_DYNAMIC_STRING), which
-// disables the static data member optimization, but it's a good optimization
-// and non-STL code is generally at the mercy of the system's STL
-// configuration.  Fully-dynamic strings are not the default for GNU libstdc++
-// libstdc++ itself or for the libstdc++ installations on the systems we care
-// about, such as Mac OS X and relevant flavors of Linux.
-//
-// See also http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24196 .
-//
-// To avoid problems, string classes need to be explicitly instantiated only
-// once, in exactly one library.  All other string users see it via an "extern"
-// declaration.  This is precisely how GNU libstdc++ handles
-// std::basic_string<char> (string) and std::basic_string<wchar_t> (wstring).
-//
-// This also works around a Mac OS X linker bug in ld64-85.2.1 (Xcode 3.1.2),
-// in which the linker does not fully coalesce symbols when dead code
-// stripping is enabled.  This bug causes the memory errors described above
-// to occur even when a std::basic_string<> does not cross shared library
-// boundaries, such as in statically-linked executables.
-//
-// TODO(mark): File this bug with Apple and update this note with a bug number.
-
-extern template class std::basic_string<cef::base::char16,
-                                        cef::base::string16_char_traits>;
-
-#endif  // WCHAR_T_IS_UTF32
-
-#endif  // !USING_CHROMIUM_INCLUDES
-
-#endif  // CEF_INCLUDE_BASE_CEF_STRING16_H_
--- a/include/capi/cef_browser_capi.h
+++ b/include/capi/cef_browser_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=09b6ebd4116e983b4af634f1efa17b326a3fc517$
+// $hash=6e192c6e8a59c37e98e458578a287dd36b8ed90f$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_BROWSER_CAPI_H_
@@ -57,10 +57,10 @@ struct _cef_browser_host_t;
 struct _cef_client_t;

 ///
-// Structure used to represent a browser window. When used in the browser
-// process the functions of this structure may be called on any thread unless
-// otherwise indicated in the comments. When used in the render process the
-// functions of this structure may only be called on the main thread.
+// Structure used to represent a browser. When used in the browser process the
+// functions of this structure may be called on any thread unless otherwise
+// indicated in the comments. When used in the render process the functions of
+// this structure may only be called on the main thread.
 ///
 typedef struct _cef_browser_t {
  ///
@@ -68,6 +68,12 @@ typedef struct _cef_browser_t {
  ///
  cef_base_ref_counted_t base;

+  ///
+  // True if this object is currently valid. This will return false (0) after
+  // cef_life_span_handler_t::OnBeforeClose is called.
+  ///
+  int(CEF_CALLBACK* is_valid)(struct _cef_browser_t* self);
+
  ///
  // Returns the browser host object. This function can only be called in the
  // browser process.
@@ -129,7 +135,7 @@ typedef struct _cef_browser_t {
                             struct _cef_browser_t* that);

  ///
-  // Returns true (1) if the window is a popup window.
+  // Returns true (1) if the browser is a popup.
  ///
  int(CEF_CALLBACK* is_popup)(struct _cef_browser_t* self);

@@ -139,13 +145,19 @@ typedef struct _cef_browser_t {
  int(CEF_CALLBACK* has_document)(struct _cef_browser_t* self);

  ///
-  // Returns the main (top-level) frame for the browser window.
+  // Returns the main (top-level) frame for the browser. In the browser process
+  // this will return a valid object until after
+  // cef_life_span_handler_t::OnBeforeClose is called. In the renderer process
+  // this will return NULL if the main frame is hosted in a different renderer
+  // process (e.g. for cross-origin sub-frames). The main frame object will
+  // change during cross-origin navigation or re-navigation after renderer
+  // process termination (due to crashes, etc).
  ///
  struct _cef_frame_t*(CEF_CALLBACK* get_main_frame)(
      struct _cef_browser_t* self);

  ///
-  // Returns the focused frame for the browser window.
+  // Returns the focused frame for the browser.
  ///
  struct _cef_frame_t*(CEF_CALLBACK* get_focused_frame)(
      struct _cef_browser_t* self);
@@ -274,10 +286,10 @@ typedef struct _cef_download_image_callback_t {
 } cef_download_image_callback_t;

 ///
-// Structure used to represent the browser process aspects of a browser window.
-// The functions of this structure can only be called in the browser process.
-// They may be called on any thread in that process unless otherwise indicated
-// in the comments.
+// Structure used to represent the browser process aspects of a browser. The
+// functions of this structure can only be called in the browser process. They
+// may be called on any thread in that process unless otherwise indicated in the
+// comments.
 ///
 typedef struct _cef_browser_host_t {
  ///
@@ -306,11 +318,12 @@ typedef struct _cef_browser_host_t {

  ///
  // Helper for closing a browser. Call this function from the top-level window
-  // close handler. Internally this calls CloseBrowser(false (0)) if the close
-  // has not yet been initiated. This function returns false (0) while the close
-  // is pending and true (1) after the close has completed. See close_browser()
-  // and cef_life_span_handler_t::do_close() documentation for additional usage
-  // information. This function must be called on the browser process UI thread.
+  // close handler (if any). Internally this calls CloseBrowser(false (0)) if
+  // the close has not yet been initiated. This function returns false (0) while
+  // the close is pending and true (1) after the close has completed. See
+  // close_browser() and cef_life_span_handler_t::do_close() documentation for
+  // additional usage information. This function must be called on the browser
+  // process UI thread.
  ///
  int(CEF_CALLBACK* try_close_browser)(struct _cef_browser_host_t* self);

@@ -320,18 +333,19 @@ typedef struct _cef_browser_host_t {
  void(CEF_CALLBACK* set_focus)(struct _cef_browser_host_t* self, int focus);

  ///
-  // Retrieve the window handle for this browser. If this browser is wrapped in
-  // a cef_browser_view_t this function should be called on the browser process
-  // UI thread and it will return the handle for the top-level native window.
+  // Retrieve the window handle (if any) for this browser. If this browser is
+  // wrapped in a cef_browser_view_t this function should be called on the
+  // browser process UI thread and it will return the handle for the top-level
+  // native window.
  ///
  cef_window_handle_t(CEF_CALLBACK* get_window_handle)(
      struct _cef_browser_host_t* self);

  ///
-  // Retrieve the window handle of the browser that opened this browser. Will
-  // return NULL for non-popup windows or if this browser is wrapped in a
-  // cef_browser_view_t. This function can be used in combination with custom
-  // handling of modal windows.
+  // Retrieve the window handle (if any) of the browser that opened this
+  // browser. Will return NULL for non-popup browsers or if this browser is
+  // wrapped in a cef_browser_view_t. This function can be used in combination
+  // with custom handling of modal windows.
  ///
  cef_window_handle_t(CEF_CALLBACK* get_opener_window_handle)(
      struct _cef_browser_host_t* self);
@@ -909,9 +923,9 @@ typedef struct _cef_browser_host_t {
 } cef_browser_host_t;

 ///
-// Create a new browser window using the window parameters specified by
-// |windowInfo|. All values will be copied internally and the actual window will
-// be created on the UI thread. If |request_context| is NULL the global request
+// Create a new browser using the window parameters specified by |windowInfo|.
+// All values will be copied internally and the actual window (if any) will be
+// created on the UI thread. If |request_context| is NULL the global request
 // context will be used. This function can be called on any browser process
 // thread and will not block. The optional |extra_info| parameter provides an
 // opportunity to specify extra information specific to the created browser that
@@ -927,11 +941,11 @@ CEF_EXPORT int cef_browser_host_create_browser(
    struct _cef_request_context_t* request_context);

 ///
-// Create a new browser window using the window parameters specified by
-// |windowInfo|. If |request_context| is NULL the global request context will be
-// used. This function can only be called on the browser process UI thread. The
-// optional |extra_info| parameter provides an opportunity to specify extra
-// information specific to the created browser that will be passed to
+// Create a new browser using the window parameters specified by |windowInfo|.
+// If |request_context| is NULL the global request context will be used. This
+// function can only be called on the browser process UI thread. The optional
+// |extra_info| parameter provides an opportunity to specify extra information
+// specific to the created browser that will be passed to
 // cef_render_process_handler_t::on_browser_created() in the render process.
 ///
 CEF_EXPORT cef_browser_t* cef_browser_host_create_browser_sync(
--- a/include/capi/cef_browser_process_handler_capi.h
+++ b/include/capi/cef_browser_process_handler_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=f0cd169568e9ea5bcc8bf2aa891691b76c05356d$
+// $hash=ade537f836add7fe0b5fd94ceba26d678abb3e43$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_BROWSER_PROCESS_HANDLER_CAPI_H_
@@ -43,7 +43,6 @@
 #include "include/capi/cef_base_capi.h"
 #include "include/capi/cef_client_capi.h"
 #include "include/capi/cef_command_line_capi.h"
-#include "include/capi/cef_print_handler_capi.h"
 #include "include/capi/cef_values_capi.h"

 #ifdef __cplusplus
@@ -61,25 +60,6 @@ typedef struct _cef_browser_process_handler_t {
  ///
  cef_base_ref_counted_t base;

-  ///
-  // Called on the browser process UI thread to retrieve the list of schemes
-  // that should support cookies. If |include_defaults| is true (1) the default
-  // schemes ("http", "https", "ws" and "wss") will also be supported. Providing
-  // an NULL |schemes| value and setting |include_defaults| to false (0) will
-  // disable all loading and saving of cookies.
-  //
-  // This state will apply to the cef_cookie_manager_t associated with the
-  // global cef_request_context_t. It will also be used as the initial state for
-  // any new cef_request_context_ts created by the client. After creating a new
-  // cef_request_context_t the cef_cookie_manager_t::SetSupportedSchemes
-  // function may be called on the associated cef_cookie_manager_t to futher
-  // override these values.
-  ///
-  void(CEF_CALLBACK* get_cookieable_schemes)(
-      struct _cef_browser_process_handler_t* self,
-      cef_string_list_t schemes,
-      int* include_defaults);
-
  ///
  // Called on the browser process UI thread immediately after the CEF context
  // has been initialized.
@@ -98,13 +78,6 @@ typedef struct _cef_browser_process_handler_t {
      struct _cef_browser_process_handler_t* self,
      struct _cef_command_line_t* command_line);

-  ///
-  // Return the handler for printing on Linux. If a print handler is not
-  // provided then printing will not be supported on the Linux platform.
-  ///
-  struct _cef_print_handler_t*(CEF_CALLBACK* get_print_handler)(
-      struct _cef_browser_process_handler_t* self);
-
  ///
  // Called from any thread when work has been scheduled for the browser process
  // main (UI) thread. This callback is used in combination with CefSettings.
--- a/include/capi/cef_client_capi.h
+++ b/include/capi/cef_client_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=4cfcac55d2a1dee466a2a0753f30fb34a78ef3b2$
+// $hash=845a1d1dda63a06f4ae33ed39acfd2599b46a885$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_CLIENT_CAPI_H_
@@ -49,10 +49,12 @@
 #include "include/capi/cef_drag_handler_capi.h"
 #include "include/capi/cef_find_handler_capi.h"
 #include "include/capi/cef_focus_handler_capi.h"
+#include "include/capi/cef_frame_handler_capi.h"
 #include "include/capi/cef_jsdialog_handler_capi.h"
 #include "include/capi/cef_keyboard_handler_capi.h"
 #include "include/capi/cef_life_span_handler_capi.h"
 #include "include/capi/cef_load_handler_capi.h"
+#include "include/capi/cef_print_handler_capi.h"
 #include "include/capi/cef_process_message_capi.h"
 #include "include/capi/cef_render_handler_capi.h"
 #include "include/capi/cef_request_handler_capi.h"
@@ -121,6 +123,14 @@ typedef struct _cef_client_t {
  struct _cef_focus_handler_t*(CEF_CALLBACK* get_focus_handler)(
      struct _cef_client_t* self);

+  ///
+  // Return the handler for events related to cef_frame_t lifespan. This
+  // function will be called once during cef_browser_t creation and the result
+  // will be cached for performance reasons.
+  ///
+  struct _cef_frame_handler_t*(CEF_CALLBACK* get_frame_handler)(
+      struct _cef_client_t* self);
+
  ///
  // Return the handler for JavaScript dialogs. If no handler is provided the
  // default implementation will be used.
@@ -146,6 +156,13 @@ typedef struct _cef_client_t {
  struct _cef_load_handler_t*(CEF_CALLBACK* get_load_handler)(
      struct _cef_client_t* self);

+  ///
+  // Return the handler for printing on Linux. If a print handler is not
+  // provided then printing will not be supported on the Linux platform.
+  ///
+  struct _cef_print_handler_t*(CEF_CALLBACK* get_print_handler)(
+      struct _cef_client_t* self);
+
  ///
  // Return the handler for off-screen rendering events.
  ///
@@ -160,8 +177,8 @@ typedef struct _cef_client_t {

  ///
  // Called when a new message is received from a different process. Return true
-  // (1) if the message was handled or false (0) otherwise. Do not keep a
-  // reference to or attempt to access the message outside of this callback.
+  // (1) if the message was handled or false (0) otherwise.  It is safe to keep
+  // a reference to |message| outside of this callback.
  ///
  int(CEF_CALLBACK* on_process_message_received)(
      struct _cef_client_t* self,
--- a/include/capi/cef_cookie_capi.h
+++ b/include/capi/cef_cookie_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=20ba58ac3e861344ee738b58433869223c757e24$
+// $hash=b19ef1c8a781f8d59276357609fe64370bb8a107$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_COOKIE_CAPI_H_
@@ -61,21 +61,6 @@ typedef struct _cef_cookie_manager_t {
  ///
  cef_base_ref_counted_t base;

-  ///
-  // Set the schemes supported by this manager. If |include_defaults| is true
-  // (1) the default schemes ("http", "https", "ws" and "wss") will also be
-  // supported. Calling this function with an NULL |schemes| value and
-  // |include_defaults| set to false (0) will disable all loading and saving of
-  // cookies for this manager. If |callback| is non-NULL it will be executed
-  // asnychronously on the UI thread after the change has been applied. Must be
-  // called before any cookies are accessed.
-  ///
-  void(CEF_CALLBACK* set_supported_schemes)(
-      struct _cef_cookie_manager_t* self,
-      cef_string_list_t schemes,
-      int include_defaults,
-      struct _cef_completion_callback_t* callback);
-
  ///
  // Visit all cookies on the UI thread. The returned cookies are ordered by
  // longest path, then by earliest creation date. Returns false (0) if cookies
--- a/include/capi/cef_frame_capi.h
+++ b/include/capi/cef_frame_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=bce865a34f45e6dee8f413f0d6bd7f4c37ab55c0$
+// $hash=872fd1e811d41f56f03da0da75a8f2e89cad40cd$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_FRAME_CAPI_H_
@@ -242,10 +242,12 @@ typedef struct _cef_frame_t {
      struct _cef_urlrequest_client_t* client);

  ///
-  // Send a message to the specified |target_process|. Message delivery is not
-  // guaranteed in all cases (for example, if the browser is closing,
-  // navigating, or if the target process crashes). Send an ACK message back
-  // from the target process if confirmation is required.
+  // Send a message to the specified |target_process|. Ownership of the message
+  // contents will be transferred and the |message| reference will be
+  // invalidated. Message delivery is not guaranteed in all cases (for example,
+  // if the browser is closing, navigating, or if the target process crashes).
+  // Send an ACK message back from the target process if confirmation is
+  // required.
  ///
  void(CEF_CALLBACK* send_process_message)(
      struct _cef_frame_t* self,
--- a/include/capi/cef_frame_handler_capi.h
+++ b/include/capi/cef_frame_handler_capi.h
@@ -0,0 +1,191 @@
+// Copyright (c) 2021 Marshall A. Greenblatt. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the name Chromium Embedded
+// Framework nor the names of its contributors may be used to endorse
+// or promote products derived from this software without specific prior
+// written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// ---------------------------------------------------------------------------
+//
+// This file was generated by the CEF translator tool and should not edited
+// by hand. See the translator.README.txt file in the tools directory for
+// more information.
+//
+// $hash=503984bf98aa52ff67ce52f26a560bbb1d4439bc$
+//
+
+#ifndef CEF_INCLUDE_CAPI_CEF_FRAME_HANDLER_CAPI_H_
+#define CEF_INCLUDE_CAPI_CEF_FRAME_HANDLER_CAPI_H_
+#pragma once
+
+#include "include/capi/cef_base_capi.h"
+#include "include/capi/cef_browser_capi.h"
+#include "include/capi/cef_frame_capi.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+///
+// Implement this structure to handle events related to cef_frame_t life span.
+// The order of callbacks is:
+//
+// (1) During initial cef_browser_host_t creation and navigation of the main
+// frame: - cef_frame_handler_t::OnFrameCreated => The initial main frame object
+// has been
+//   created. Any commands will be queued until the frame is attached.
+// - cef_frame_handler_t::OnMainFrameChanged => The initial main frame object
+// has
+//   been assigned to the browser.
+// - cef_life_span_handler_t::OnAfterCreated => The browser is now valid and can
+// be
+//   used.
+// - cef_frame_handler_t::OnFrameAttached => The initial main frame object is
+// now
+//   connected to its peer in the renderer process. Commands can be routed.
+//
+// (2) During further cef_browser_host_t navigation/loading of the main frame
+// and/or sub-frames: - cef_frame_handler_t::OnFrameCreated => A new main frame
+// or sub-frame object has
+//   been created. Any commands will be queued until the frame is attached.
+// - cef_frame_handler_t::OnFrameAttached => A new main frame or sub-frame
+// object is
+//   now connected to its peer in the renderer process. Commands can be routed.
+// - cef_frame_handler_t::OnFrameDetached => An existing main frame or sub-frame
+//   object has lost its connection to the renderer process. If multiple objects
+//   are detached at the same time then notifications will be sent for any
+//   sub-frame objects before the main frame object. Commands can no longer be
+//   routed and will be discarded.
+// - cef_frame_handler_t::OnMainFrameChanged => A new main frame object has been
+//   assigned to the browser. This will only occur with cross-origin navigation
+//   or re-navigation after renderer process termination (due to crashes, etc).
+//
+// (3) During final cef_browser_host_t destruction of the main frame: -
+// cef_frame_handler_t::OnFrameDetached => Any sub-frame objects have lost their
+//   connection to the renderer process. Commands can no longer be routed and
+//   will be discarded.
+// - cef_life_span_handler_t::OnBeforeClose => The browser has been destroyed. -
+// cef_frame_handler_t::OnFrameDetached => The main frame object have lost its
+//   connection to the renderer process. Notifications will be sent for any
+//   sub-frame objects before the main frame object. Commands can no longer be
+//   routed and will be discarded.
+// - cef_frame_handler_t::OnMainFrameChanged => The final main frame object has
+// been
+//   removed from the browser.
+//
+// Cross-origin navigation and/or loading receives special handling.
+//
+// When the main frame navigates to a different origin the OnMainFrameChanged
+// callback (2) will be executed with the old and new main frame objects.
+//
+// When a new sub-frame is loaded in, or an existing sub-frame is navigated to,
+// a different origin from the parent frame, a temporary sub-frame object will
+// first be created in the parent's renderer process. That temporary sub-frame
+// will then be discarded after the real cross-origin sub-frame is created in
+// the new/target renderer process. The client will receive cross-origin
+// navigation callbacks (2) for the transition from the temporary sub-frame to
+// the real sub-frame. The temporary sub-frame will not recieve or execute
+// commands during this transitional period (any sent commands will be
+// discarded).
+//
+// When a new popup browser is created in a different origin from the parent
+// browser, a temporary main frame object for the popup will first be created in
+// the parent's renderer process. That temporary main frame will then be
+// discarded after the real cross-origin main frame is created in the new/target
+// renderer process. The client will recieve creation and initial navigation
+// callbacks (1) for the temporary main frame, followed by cross-origin
+// navigation callbacks (2) for the transition from the temporary main frame to
+// the real main frame. The temporary main frame may receive and execute
+// commands during this transitional period (any sent commands may be executed,
+// but the behavior is potentially undesirable since they execute in the parent
+// browser's renderer process and not the new/target renderer process).
+//
+// Callbacks will not be executed for placeholders that may be created during
+// pre-commit navigation for sub-frames that do not yet exist in the renderer
+// process. Placeholders will have cef_frame_t::get_identifier() == -4.
+//
+// The functions of this structure will be called on the UI thread unless
+// otherwise indicated.
+///
+typedef struct _cef_frame_handler_t {
+  ///
+  // Base structure.
+  ///
+  cef_base_ref_counted_t base;
+
+  ///
+  // Called when a new frame is created. This will be the first notification
+  // that references |frame|. Any commands that require transport to the
+  // associated renderer process (LoadRequest, SendProcessMessage, GetSource,
+  // etc.) will be queued until OnFrameAttached is called for |frame|.
+  ///
+  void(CEF_CALLBACK* on_frame_created)(struct _cef_frame_handler_t* self,
+                                       struct _cef_browser_t* browser,
+                                       struct _cef_frame_t* frame);
+
+  ///
+  // Called when a frame can begin routing commands to/from the associated
+  // renderer process. Any commands that were queued have now been dispatched.
+  ///
+  void(CEF_CALLBACK* on_frame_attached)(struct _cef_frame_handler_t* self,
+                                        struct _cef_browser_t* browser,
+                                        struct _cef_frame_t* frame);
+
+  ///
+  // Called when a frame loses its connection to the renderer process and will
+  // be destroyed. Any pending or future commands will be discarded and
+  // cef_frame_t::is_valid() will now return false (0) for |frame|. If called
+  // after cef_life_span_handler_t::on_before_close() during browser destruction
+  // then cef_browser_t::is_valid() will return false (0) for |browser|.
+  ///
+  void(CEF_CALLBACK* on_frame_detached)(struct _cef_frame_handler_t* self,
+                                        struct _cef_browser_t* browser,
+                                        struct _cef_frame_t* frame);
+
+  ///
+  // Called when the main frame changes due to (a) initial browser creation, (b)
+  // final browser destruction, (c) cross-origin navigation or (d) re-navigation
+  // after renderer process termination (due to crashes, etc). |old_frame| will
+  // be NULL and |new_frame| will be non-NULL when a main frame is assigned to
+  // |browser| for the first time. |old_frame| will be non-NULL and |new_frame|
+  // will be NULL and  when a main frame is removed from |browser| for the last
+  // time. Both |old_frame| and |new_frame| will be non-NULL for cross-origin
+  // navigations or re-navigation after renderer process termination. This
+  // function will be called after on_frame_created() for |new_frame| and/or
+  // after on_frame_detached() for |old_frame|. If called after
+  // cef_life_span_handler_t::on_before_close() during browser destruction then
+  // cef_browser_t::is_valid() will return false (0) for |browser|.
+  ///
+  void(CEF_CALLBACK* on_main_frame_changed)(struct _cef_frame_handler_t* self,
+                                            struct _cef_browser_t* browser,
+                                            struct _cef_frame_t* old_frame,
+                                            struct _cef_frame_t* new_frame);
+} cef_frame_handler_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  // CEF_INCLUDE_CAPI_CEF_FRAME_HANDLER_CAPI_H_
--- a/include/capi/cef_life_span_handler_capi.h
+++ b/include/capi/cef_life_span_handler_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=d7521ac4f73dabd876344400a165d15954c770b0$
+// $hash=e44bb89a337942c82bfa246275b4b033821b2782$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_LIFE_SPAN_HANDLER_CAPI_H_
@@ -101,8 +101,10 @@ typedef struct _cef_life_span_handler_t {
      int* no_javascript_access);

  ///
-  // Called after a new browser is created. This callback will be the first
-  // notification that references |browser|.
+  // Called after a new browser is created. It is now safe to begin performing
+  // actions with |browser|. cef_frame_handler_t callbacks related to initial
+  // main frame creation will arrive before this callback. See
+  // cef_frame_handler_t documentation for additional usage information.
  ///
  void(CEF_CALLBACK* on_after_created)(struct _cef_life_span_handler_t* self,
                                       struct _cef_browser_t* browser);
@@ -202,13 +204,14 @@ typedef struct _cef_life_span_handler_t {
  ///
  // Called just before a browser is destroyed. Release all references to the
  // browser object and do not attempt to execute any functions on the browser
-  // object (other than GetIdentifier or IsSame) after this callback returns.
-  // This callback will be the last notification that references |browser| on
-  // the UI thread. Any in-progress network requests associated with |browser|
-  // will be aborted when the browser is destroyed, and
+  // object (other than IsValid, GetIdentifier or IsSame) after this callback
+  // returns. cef_frame_handler_t callbacks related to final main frame
+  // destruction will arrive after this callback and cef_browser_t::IsValid will
+  // return false (0) at that time. Any in-progress network requests associated
+  // with |browser| will be aborted when the browser is destroyed, and
  // cef_resource_request_handler_t callbacks related to those requests may
-  // still arrive on the IO thread after this function is called. See do_close()
-  // documentation for additional usage information.
+  // still arrive on the IO thread after this callback. See cef_frame_handler_t
+  // and do_close() documentation for additional usage information.
  ///
  void(CEF_CALLBACK* on_before_close)(struct _cef_life_span_handler_t* self,
                                      struct _cef_browser_t* browser);
--- a/include/capi/cef_media_router_capi.h
+++ b/include/capi/cef_media_router_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=3767c7759578cd4abc1c2ecef504e7ed60775abb$
+// $hash=79e4e38c732c0cfeef495c8a9726e105054012bb$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_MEDIA_ROUTER_CAPI_H_
@@ -41,6 +41,7 @@
 #pragma once

 #include "include/capi/cef_base_capi.h"
+#include "include/capi/cef_callback_capi.h"
 #include "include/capi/cef_registration_capi.h"

 #ifdef __cplusplus
@@ -110,11 +111,14 @@ typedef struct _cef_media_router_t {
 } cef_media_router_t;

 ///
-// Returns the MediaRouter object associated with the global request context.
-// Equivalent to calling cef_request_context_t::cef_request_context_get_global_c
-// ontext()->get_media_router().
+// Returns the MediaRouter object associated with the global request context. If
+// |callback| is non-NULL it will be executed asnychronously on the UI thread
+// after the manager's storage has been initialized. Equivalent to calling cef_r
+// equest_context_t::cef_request_context_get_global_context()->get_media_router(
+// ).
 ///
-CEF_EXPORT cef_media_router_t* cef_media_router_get_global();
+CEF_EXPORT cef_media_router_t* cef_media_router_get_global(
+    struct _cef_completion_callback_t* callback);

 ///
 // Implemented by the client to observe MediaRouter events and registered via
--- a/include/capi/cef_print_handler_capi.h
+++ b/include/capi/cef_print_handler_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=54ed1e16c5c1d133bcd097350c5f5871228efd4f$
+// $hash=84fc58b3898f25476d9cdd260553390ba5e0b30b$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_PRINT_HANDLER_CAPI_H_
@@ -148,6 +148,7 @@ typedef struct _cef_print_handler_t {
  ///
  cef_size_t(CEF_CALLBACK* get_pdf_paper_size)(
      struct _cef_print_handler_t* self,
+      struct _cef_browser_t* browser,
      int device_units_per_inch);
 } cef_print_handler_t;

--- a/include/capi/cef_render_process_handler_capi.h
+++ b/include/capi/cef_render_process_handler_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=41339414bca54054046a8f7fbce402a0e0dd8020$
+// $hash=4ebf99611a11cc8714d710c37417fbd9f50f0618$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_RENDER_PROCESS_HANDLER_CAPI_H_
@@ -73,7 +73,7 @@ typedef struct _cef_render_process_handler_t {
  ///
  // Called after a browser has been created. When browsing cross-origin a new
  // browser will be created before the old browser with the same identifier is
-  // destroyed. |extra_info| is a read-only value originating from
+  // destroyed. |extra_info| is an optional read-only value originating from
  // cef_browser_host_t::cef_browser_host_create_browser(),
  // cef_browser_host_t::cef_browser_host_create_browser_sync(),
  // cef_life_span_handler_t::on_before_popup() or
@@ -150,8 +150,8 @@ typedef struct _cef_render_process_handler_t {

  ///
  // Called when a new message is received from a different process. Return true
-  // (1) if the message was handled or false (0) otherwise. Do not keep a
-  // reference to or attempt to access the message outside of this callback.
+  // (1) if the message was handled or false (0) otherwise. It is safe to keep a
+  // reference to |message| outside of this callback.
  ///
  int(CEF_CALLBACK* on_process_message_received)(
      struct _cef_render_process_handler_t* self,
--- a/include/capi/cef_request_context_capi.h
+++ b/include/capi/cef_request_context_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=d5079b6a5146ccd2085c3bbf948925c009d329ed$
+// $hash=2e42334fc22050e207e5a0af6fe290a592e4105f$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_REQUEST_CONTEXT_CAPI_H_
@@ -132,7 +132,7 @@ typedef struct _cef_request_context_t {

  ///
  // Returns the cookie manager for this object. If |callback| is non-NULL it
-  // will be executed asnychronously on the IO thread after the manager's
+  // will be executed asnychronously on the UI thread after the manager's
  // storage has been initialized.
  ///
  struct _cef_cookie_manager_t*(CEF_CALLBACK* get_cookie_manager)(
@@ -356,10 +356,13 @@ typedef struct _cef_request_context_t {
      const cef_string_t* extension_id);

  ///
-  // Returns the MediaRouter object associated with this context.
+  // Returns the MediaRouter object associated with this context.  If |callback|
+  // is non-NULL it will be executed asnychronously on the UI thread after the
+  // manager's context has been initialized.
  ///
  struct _cef_media_router_t*(CEF_CALLBACK* get_media_router)(
-      struct _cef_request_context_t* self);
+      struct _cef_request_context_t* self,
+      struct _cef_completion_callback_t* callback);
 } cef_request_context_t;

 ///
--- a/include/capi/cef_web_plugin_capi.h
+++ b/include/capi/cef_web_plugin_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=d8b5b641cc036a9cd9375442254d558b066ada69$
+// $hash=f74bf4d33914d56d760f1bf5aadcf2651740c711$
 //

 #ifndef CEF_INCLUDE_CAPI_CEF_WEB_PLUGIN_CAPI_H_
@@ -214,7 +214,7 @@ CEF_EXPORT void cef_is_web_plugin_unstable(
 //   D. "x-cdm-interface-versions": Interface API version (e.g. "8").
 //   E. "x-cdm-host-versions": Host API version (e.g. "8").
 //   F. "version": CDM version (e.g. "1.4.8.903").
-//   G. "x-cdm-codecs": List of supported codecs (e.g. "vp8,vp9.0,avc1").
+//   G. "x-cdm-codecs": List of supported codecs (e.g. "vp8,vp09,avc1").
 //
 // A through E are used to verify compatibility with the current Chromium
 // version. If the CDM is not compatible the registration will fail and
--- a/include/capi/views/cef_browser_view_capi.h
+++ b/include/capi/views/cef_browser_view_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=0fbd582ed5d0231550840ebf3eed2e488ac546d4$
+// $hash=3e4eb9ed3a0cb28ae0459a50f20c8405c7722437$
 //

 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_BROWSER_VIEW_CAPI_H_
@@ -65,6 +65,17 @@ typedef struct _cef_browser_view_t {
  struct _cef_browser_t*(CEF_CALLBACK* get_browser)(
      struct _cef_browser_view_t* self);

+  ///
+  // Returns the Chrome toolbar associated with this BrowserView. Only supported
+  // when using the Chrome runtime. The cef_browser_view_delegate_t::
+  // get_chrome_toolbar_type() function must return a value other than
+  // CEF_CTT_NONE and the toolbar will not be available until after this
+  // BrowserView is added to a cef_window_t and
+  // cef_view_delegate_t::on_window_changed() has been called.
+  ///
+  struct _cef_view_t*(CEF_CALLBACK* get_chrome_toolbar)(
+      struct _cef_browser_view_t* self);
+
  ///
  // Sets whether accelerators registered with cef_window_t::SetAccelerator are
  // triggered before or after the event is sent to the cef_browser_t. If
--- a/include/capi/views/cef_browser_view_delegate_capi.h
+++ b/include/capi/views/cef_browser_view_delegate_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=37bbfadf761b3a1996276885d593d27d3fed5f8d$
+// $hash=220a126af3682f716f10b9019e8d1461702aa7c9$
 //

 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_BROWSER_VIEW_DELEGATE_CAPI_H_
@@ -112,6 +112,14 @@ typedef struct _cef_browser_view_delegate_t {
      struct _cef_browser_view_t* browser_view,
      struct _cef_browser_view_t* popup_browser_view,
      int is_devtools);
+
+  ///
+  // Returns the Chrome toolbar type that will be available via
+  // cef_browser_view_t::get_chrome_toolbar(). See that function for related
+  // documentation.
+  ///
+  cef_chrome_toolbar_type_t(CEF_CALLBACK* get_chrome_toolbar_type)(
+      struct _cef_browser_view_delegate_t* self);
 } cef_browser_view_delegate_t;

 #ifdef __cplusplus
--- a/include/capi/views/cef_view_delegate_capi.h
+++ b/include/capi/views/cef_view_delegate_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=8bd92dd03af4f5cf8c359c45a2d6d013565c2ead$
+// $hash=a060cb3c53317d758e7f6b4a275288cd08f086e7$
 //

 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_VIEW_DELEGATE_CAPI_H_
@@ -114,6 +114,13 @@ typedef struct _cef_view_delegate_t {
                                            int added,
                                            struct _cef_view_t* child);

+  ///
+  // Called when |view| is added or removed from the cef_window_t.
+  ///
+  void(CEF_CALLBACK* on_window_changed)(struct _cef_view_delegate_t* self,
+                                        struct _cef_view_t* view,
+                                        int added);
+
  ///
  // Called when |view| gains focus.
  ///
--- a/include/cef_api_hash.h
+++ b/include/cef_api_hash.h
@@ -42,13 +42,13 @@
 // way that may cause binary incompatibility with other builds. The universal
 // hash value will change if any platform is affected whereas the platform hash
 // values will change only if that particular platform is affected.
-#define CEF_API_HASH_UNIVERSAL "694bc8d68956bd174529f72fea5710929ac8bbf0"
+#define CEF_API_HASH_UNIVERSAL "7fb6a7510f39c359767b3a893c9ebfb5fb5973d7"
 #if defined(OS_WIN)
-#define CEF_API_HASH_PLATFORM "597ae4ad020de2665469e7de990d784bfda8d514"
+#define CEF_API_HASH_PLATFORM "0a848e5b676ddc931dbb5b174a64eb7be7f7dfbf"
 #elif defined(OS_MAC)
-#define CEF_API_HASH_PLATFORM "fa3b4a918791bf53a4a8715ac9f0c843a3c08061"
+#define CEF_API_HASH_PLATFORM "4c666fab20ab43dddf2f7ac6543197a1fecee389"
 #elif defined(OS_LINUX)
-#define CEF_API_HASH_PLATFORM "83ff6d6fb2e0ac8447f68fa6141091cc9f666ca0"
+#define CEF_API_HASH_PLATFORM "5f756efd08c6e10629fe1f81e9266c7af71aa5ce"
 #endif

 #ifdef __cplusplus
--- a/include/cef_browser.h
+++ b/include/cef_browser.h
@@ -52,14 +52,21 @@ class CefBrowserHost;
 class CefClient;

 ///
-// Class used to represent a browser window. When used in the browser process
-// the methods of this class may be called on any thread unless otherwise
-// indicated in the comments. When used in the render process the methods of
-// this class may only be called on the main thread.
+// Class used to represent a browser. When used in the browser process the
+// methods of this class may be called on any thread unless otherwise indicated
+// in the comments. When used in the render process the methods of this class
+// may only be called on the main thread.
 ///
 /*--cef(source=library)--*/
 class CefBrowser : public virtual CefBaseRefCounted {
 public:
+  ///
+  // True if this object is currently valid. This will return false after
+  // CefLifeSpanHandler::OnBeforeClose is called.
+  ///
+  /*--cef()--*/
+  virtual bool IsValid() = 0;
+
  ///
  // Returns the browser host object. This method can only be called in the
  // browser process.
@@ -130,7 +137,7 @@ class CefBrowser : public virtual CefBaseRefCounted {
  virtual bool IsSame(CefRefPtr<CefBrowser> that) = 0;

  ///
-  // Returns true if the window is a popup window.
+  // Returns true if the browser is a popup.
  ///
  /*--cef()--*/
  virtual bool IsPopup() = 0;
@@ -142,13 +149,19 @@ class CefBrowser : public virtual CefBaseRefCounted {
  virtual bool HasDocument() = 0;

  ///
-  // Returns the main (top-level) frame for the browser window.
+  // Returns the main (top-level) frame for the browser. In the browser process
+  // this will return a valid object until after
+  // CefLifeSpanHandler::OnBeforeClose is called. In the renderer process this
+  // will return NULL if the main frame is hosted in a different renderer
+  // process (e.g. for cross-origin sub-frames). The main frame object will
+  // change during cross-origin navigation or re-navigation after renderer
+  // process termination (due to crashes, etc).
  ///
  /*--cef()--*/
  virtual CefRefPtr<CefFrame> GetMainFrame() = 0;

  ///
-  // Returns the focused frame for the browser window.
+  // Returns the focused frame for the browser.
  ///
  /*--cef()--*/
  virtual CefRefPtr<CefFrame> GetFocusedFrame() = 0;
@@ -261,10 +274,9 @@ class CefDownloadImageCallback : public virtual CefBaseRefCounted {
 };

 ///
-// Class used to represent the browser process aspects of a browser window. The
-// methods of this class can only be called in the browser process. They may be
-// called on any thread in that process unless otherwise indicated in the
-// comments.
+// Class used to represent the browser process aspects of a browser. The methods
+// of this class can only be called in the browser process. They may be called
+// on any thread in that process unless otherwise indicated in the comments.
 ///
 /*--cef(source=library)--*/
 class CefBrowserHost : public virtual CefBaseRefCounted {
@@ -275,14 +287,14 @@ class CefBrowserHost : public virtual CefBaseRefCounted {
  typedef cef_paint_element_type_t PaintElementType;

  ///
-  // Create a new browser window using the window parameters specified by
-  // |windowInfo|. All values will be copied internally and the actual window
-  // will be created on the UI thread. If |request_context| is empty the
-  // global request context will be used. This method can be called on any
-  // browser process thread and will not block. The optional |extra_info|
-  // parameter provides an opportunity to specify extra information specific
-  // to the created browser that will be passed to
-  // CefRenderProcessHandler::OnBrowserCreated() in the render process.
+  // Create a new browser using the window parameters specified by |windowInfo|.
+  // All values will be copied internally and the actual window (if any) will be
+  // created on the UI thread. If |request_context| is empty the global request
+  // context will be used. This method can be called on any browser process
+  // thread and will not block. The optional |extra_info| parameter provides an
+  // opportunity to specify extra information specific to the created browser
+  // that will be passed to CefRenderProcessHandler::OnBrowserCreated() in the
+  // render process.
  ///
  /*--cef(optional_param=client,optional_param=url,
          optional_param=request_context,optional_param=extra_info)--*/
@@ -294,13 +306,12 @@ class CefBrowserHost : public virtual CefBaseRefCounted {
                            CefRefPtr<CefRequestContext> request_context);

  ///
-  // Create a new browser window using the window parameters specified by
-  // |windowInfo|. If |request_context| is empty the global request context
-  // will be used. This method can only be called on the browser process UI
-  // thread. The optional |extra_info| parameter provides an opportunity to
-  // specify extra information specific to the created browser that will be
-  // passed to CefRenderProcessHandler::OnBrowserCreated() in the render
-  // process.
+  // Create a new browser using the window parameters specified by |windowInfo|.
+  // If |request_context| is empty the global request context will be used. This
+  // method can only be called on the browser process UI thread. The optional
+  // |extra_info| parameter provides an opportunity to specify extra information
+  // specific to the created browser that will be passed to
+  // CefRenderProcessHandler::OnBrowserCreated() in the render process.
  ///
  /*--cef(optional_param=client,optional_param=url,
          optional_param=request_context,optional_param=extra_info)--*/
@@ -333,9 +344,9 @@ class CefBrowserHost : public virtual CefBaseRefCounted {

  ///
  // Helper for closing a browser. Call this method from the top-level window
-  // close handler. Internally this calls CloseBrowser(false) if the close has
-  // not yet been initiated. This method returns false while the close is
-  // pending and true after the close has completed. See CloseBrowser() and
+  // close handler (if any). Internally this calls CloseBrowser(false) if the
+  // close has not yet been initiated. This method returns false while the close
+  // is pending and true after the close has completed. See CloseBrowser() and
  // CefLifeSpanHandler::DoClose() documentation for additional usage
  // information. This method must be called on the browser process UI thread.
  ///
@@ -349,18 +360,19 @@ class CefBrowserHost : public virtual CefBaseRefCounted {
  virtual void SetFocus(bool focus) = 0;

  ///
-  // Retrieve the window handle for this browser. If this browser is wrapped in
-  // a CefBrowserView this method should be called on the browser process UI
-  // thread and it will return the handle for the top-level native window.
+  // Retrieve the window handle (if any) for this browser. If this browser is
+  // wrapped in a CefBrowserView this method should be called on the browser
+  // process UI thread and it will return the handle for the top-level native
+  // window.
  ///
  /*--cef()--*/
  virtual CefWindowHandle GetWindowHandle() = 0;

  ///
-  // Retrieve the window handle of the browser that opened this browser. Will
-  // return NULL for non-popup windows or if this browser is wrapped in a
-  // CefBrowserView. This method can be used in combination with custom handling
-  // of modal windows.
+  // Retrieve the window handle (if any) of the browser that opened this
+  // browser. Will return NULL for non-popup browsers or if this browser is
+  // wrapped in a CefBrowserView. This method can be used in combination with
+  // custom handling of modal windows.
  ///
  /*--cef()--*/
  virtual CefWindowHandle GetOpenerWindowHandle() = 0;
--- a/include/cef_browser_process_handler.h
+++ b/include/cef_browser_process_handler.h
@@ -41,7 +41,6 @@
 #include "include/cef_base.h"
 #include "include/cef_client.h"
 #include "include/cef_command_line.h"
-#include "include/cef_print_handler.h"
 #include "include/cef_values.h"

 ///
@@ -51,23 +50,6 @@
 /*--cef(source=client,no_debugct_check)--*/
 class CefBrowserProcessHandler : public virtual CefBaseRefCounted {
 public:
-  ///
-  // Called on the browser process UI thread to retrieve the list of schemes
-  // that should support cookies. If |include_defaults| is true the default
-  // schemes ("http", "https", "ws" and "wss") will also be supported. Providing
-  // an empty |schemes| value and setting |include_defaults| to false will
-  // disable all loading and saving of cookies.
-  //
-  // This state will apply to the CefCookieManager associated with the global
-  // CefRequestContext. It will also be used as the initial state for any new
-  // CefRequestContexts created by the client. After creating a new
-  // CefRequestContext the CefCookieManager::SetSupportedSchemes method may be
-  // called on the associated CefCookieManager to futher override these values.
-  ///
-  /*--cef()--*/
-  virtual void GetCookieableSchemes(std::vector<CefString>& schemes,
-                                    bool& include_defaults) {}
-
  ///
  // Called on the browser process UI thread immediately after the CEF context
  // has been initialized.
@@ -86,13 +68,6 @@ class CefBrowserProcessHandler : public virtual CefBaseRefCounted {
  virtual void OnBeforeChildProcessLaunch(
      CefRefPtr<CefCommandLine> command_line) {}

-  ///
-  // Return the handler for printing on Linux. If a print handler is not
-  // provided then printing will not be supported on the Linux platform.
-  ///
-  /*--cef()--*/
-  virtual CefRefPtr<CefPrintHandler> GetPrintHandler() { return nullptr; }
-
  ///
  // Called from any thread when work has been scheduled for the browser process
  // main (UI) thread. This callback is used in combination with CefSettings.
--- a/include/cef_client.h
+++ b/include/cef_client.h
@@ -47,10 +47,12 @@
 #include "include/cef_drag_handler.h"
 #include "include/cef_find_handler.h"
 #include "include/cef_focus_handler.h"
+#include "include/cef_frame_handler.h"
 #include "include/cef_jsdialog_handler.h"
 #include "include/cef_keyboard_handler.h"
 #include "include/cef_life_span_handler.h"
 #include "include/cef_load_handler.h"
+#include "include/cef_print_handler.h"
 #include "include/cef_process_message.h"
 #include "include/cef_render_handler.h"
 #include "include/cef_request_handler.h"
@@ -114,6 +116,14 @@ class CefClient : public virtual CefBaseRefCounted {
  /*--cef()--*/
  virtual CefRefPtr<CefFocusHandler> GetFocusHandler() { return nullptr; }

+  ///
+  // Return the handler for events related to CefFrame lifespan. This method
+  // will be called once during CefBrowser creation and the result will be
+  // cached for performance reasons.
+  ///
+  /*--cef()--*/
+  virtual CefRefPtr<CefFrameHandler> GetFrameHandler() { return nullptr; }
+
  ///
  // Return the handler for JavaScript dialogs. If no handler is provided the
  // default implementation will be used.
@@ -139,6 +149,13 @@ class CefClient : public virtual CefBaseRefCounted {
  /*--cef()--*/
  virtual CefRefPtr<CefLoadHandler> GetLoadHandler() { return nullptr; }

+  ///
+  // Return the handler for printing on Linux. If a print handler is not
+  // provided then printing will not be supported on the Linux platform.
+  ///
+  /*--cef()--*/
+  virtual CefRefPtr<CefPrintHandler> GetPrintHandler() { return nullptr; }
+
  ///
  // Return the handler for off-screen rendering events.
  ///
@@ -153,8 +170,8 @@ class CefClient : public virtual CefBaseRefCounted {

  ///
  // Called when a new message is received from a different process. Return true
-  // if the message was handled or false otherwise. Do not keep a reference to
-  // or attempt to access the message outside of this callback.
+  // if the message was handled or false otherwise.  It is safe to keep a
+  // reference to |message| outside of this callback.
  ///
  /*--cef()--*/
  virtual bool OnProcessMessageReceived(CefRefPtr<CefBrowser> browser,
--- a/include/cef_cookie.h
+++ b/include/cef_cookie.h
@@ -64,21 +64,6 @@ class CefCookieManager : public virtual CefBaseRefCounted {
  static CefRefPtr<CefCookieManager> GetGlobalManager(
      CefRefPtr<CefCompletionCallback> callback);

-  ///
-  // Set the schemes supported by this manager. If |include_defaults| is true
-  // the default schemes ("http", "https", "ws" and "wss") will also be
-  // supported. Calling this method with an empty |schemes| value and
-  // |include_defaults| set to false will disable all loading and saving of
-  // cookies for this manager. If |callback| is non-NULL it will be executed
-  // asnychronously on the UI thread after the change has been applied. Must be
-  // called before any cookies are accessed.
-  ///
-  /*--cef(optional_param=callback)--*/
-  virtual void SetSupportedSchemes(
-      const std::vector<CefString>& schemes,
-      bool include_defaults,
-      CefRefPtr<CefCompletionCallback> callback) = 0;
-
  ///
  // Visit all cookies on the UI thread. The returned cookies are ordered by
  // longest path, then by earliest creation date. Returns false if cookies
--- a/include/cef_frame.h
+++ b/include/cef_frame.h
@@ -246,10 +246,12 @@ class CefFrame : public virtual CefBaseRefCounted {
      CefRefPtr<CefURLRequestClient> client) = 0;

  ///
-  // Send a message to the specified |target_process|. Message delivery is not
-  // guaranteed in all cases (for example, if the browser is closing,
-  // navigating, or if the target process crashes). Send an ACK message back
-  // from the target process if confirmation is required.
+  // Send a message to the specified |target_process|. Ownership of the message
+  // contents will be transferred and the |message| reference will be
+  // invalidated. Message delivery is not guaranteed in all cases (for example,
+  // if the browser is closing, navigating, or if the target process crashes).
+  // Send an ACK message back from the target process if confirmation is
+  // required.
  ///
  /*--cef()--*/
  virtual void SendProcessMessage(CefProcessId target_process,
--- a/include/cef_frame_handler.h
+++ b/include/cef_frame_handler.h
@@ -0,0 +1,172 @@
+// Copyright (c) 2021 Marshall A. Greenblatt. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the name Chromium Embedded
+// Framework nor the names of its contributors may be used to endorse
+// or promote products derived from this software without specific prior
+// written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// ---------------------------------------------------------------------------
+//
+// The contents of this file must follow a specific format in order to
+// support the CEF translator tool. See the translator.README.txt file in the
+// tools directory for more information.
+//
+
+#ifndef CEF_INCLUDE_CEF_FRAME_HANDLER_H_
+#define CEF_INCLUDE_CEF_FRAME_HANDLER_H_
+#pragma once
+
+#include "include/cef_base.h"
+#include "include/cef_browser.h"
+#include "include/cef_frame.h"
+
+///
+// Implement this interface to handle events related to CefFrame life span. The
+// order of callbacks is:
+//
+// (1) During initial CefBrowserHost creation and navigation of the main frame:
+// - CefFrameHandler::OnFrameCreated => The initial main frame object has been
+//   created. Any commands will be queued until the frame is attached.
+// - CefFrameHandler::OnMainFrameChanged => The initial main frame object has
+//   been assigned to the browser.
+// - CefLifeSpanHandler::OnAfterCreated => The browser is now valid and can be
+//   used.
+// - CefFrameHandler::OnFrameAttached => The initial main frame object is now
+//   connected to its peer in the renderer process. Commands can be routed.
+//
+// (2) During further CefBrowserHost navigation/loading of the main frame and/or
+// sub-frames:
+// - CefFrameHandler::OnFrameCreated => A new main frame or sub-frame object has
+//   been created. Any commands will be queued until the frame is attached.
+// - CefFrameHandler::OnFrameAttached => A new main frame or sub-frame object is
+//   now connected to its peer in the renderer process. Commands can be routed.
+// - CefFrameHandler::OnFrameDetached => An existing main frame or sub-frame
+//   object has lost its connection to the renderer process. If multiple objects
+//   are detached at the same time then notifications will be sent for any
+//   sub-frame objects before the main frame object. Commands can no longer be
+//   routed and will be discarded.
+// - CefFrameHandler::OnMainFrameChanged => A new main frame object has been
+//   assigned to the browser. This will only occur with cross-origin navigation
+//   or re-navigation after renderer process termination (due to crashes, etc).
+//
+// (3) During final CefBrowserHost destruction of the main frame:
+// - CefFrameHandler::OnFrameDetached => Any sub-frame objects have lost their
+//   connection to the renderer process. Commands can no longer be routed and
+//   will be discarded.
+// - CefLifeSpanHandler::OnBeforeClose => The browser has been destroyed.
+// - CefFrameHandler::OnFrameDetached => The main frame object have lost its
+//   connection to the renderer process. Notifications will be sent for any
+//   sub-frame objects before the main frame object. Commands can no longer be
+//   routed and will be discarded.
+// - CefFrameHandler::OnMainFrameChanged => The final main frame object has been
+//   removed from the browser.
+//
+// Cross-origin navigation and/or loading receives special handling.
+//
+// When the main frame navigates to a different origin the OnMainFrameChanged
+// callback (2) will be executed with the old and new main frame objects.
+//
+// When a new sub-frame is loaded in, or an existing sub-frame is navigated to,
+// a different origin from the parent frame, a temporary sub-frame object will
+// first be created in the parent's renderer process. That temporary sub-frame
+// will then be discarded after the real cross-origin sub-frame is created in
+// the new/target renderer process. The client will receive cross-origin
+// navigation callbacks (2) for the transition from the temporary sub-frame to
+// the real sub-frame. The temporary sub-frame will not recieve or execute
+// commands during this transitional period (any sent commands will be
+// discarded).
+//
+// When a new popup browser is created in a different origin from the parent
+// browser, a temporary main frame object for the popup will first be created in
+// the parent's renderer process. That temporary main frame will then be
+// discarded after the real cross-origin main frame is created in the new/target
+// renderer process. The client will recieve creation and initial navigation
+// callbacks (1) for the temporary main frame, followed by cross-origin
+// navigation callbacks (2) for the transition from the temporary main frame to
+// the real main frame. The temporary main frame may receive and execute
+// commands during this transitional period (any sent commands may be executed,
+// but the behavior is potentially undesirable since they execute in the parent
+// browser's renderer process and not the new/target renderer process).
+//
+// Callbacks will not be executed for placeholders that may be created during
+// pre-commit navigation for sub-frames that do not yet exist in the renderer
+// process. Placeholders will have CefFrame::GetIdentifier() == -4.
+//
+// The methods of this class will be called on the UI thread unless otherwise
+// indicated.
+///
+/*--cef(source=client)--*/
+class CefFrameHandler : public virtual CefBaseRefCounted {
+ public:
+  ///
+  // Called when a new frame is created. This will be the first notification
+  // that references |frame|. Any commands that require transport to the
+  // associated renderer process (LoadRequest, SendProcessMessage, GetSource,
+  // etc.) will be queued until OnFrameAttached is called for |frame|.
+  ///
+  /*--cef()--*/
+  virtual void OnFrameCreated(CefRefPtr<CefBrowser> browser,
+                              CefRefPtr<CefFrame> frame) {}
+
+  ///
+  // Called when a frame can begin routing commands to/from the associated
+  // renderer process. Any commands that were queued have now been dispatched.
+  ///
+  /*--cef()--*/
+  virtual void OnFrameAttached(CefRefPtr<CefBrowser> browser,
+                               CefRefPtr<CefFrame> frame) {}
+
+  ///
+  // Called when a frame loses its connection to the renderer process and will
+  // be destroyed. Any pending or future commands will be discarded and
+  // CefFrame::IsValid() will now return false for |frame|. If called after
+  // CefLifeSpanHandler::OnBeforeClose() during browser destruction then
+  // CefBrowser::IsValid() will return false for |browser|.
+  ///
+  /*--cef()--*/
+  virtual void OnFrameDetached(CefRefPtr<CefBrowser> browser,
+                               CefRefPtr<CefFrame> frame) {}
+
+  ///
+  // Called when the main frame changes due to (a) initial browser creation, (b)
+  // final browser destruction, (c) cross-origin navigation or (d) re-navigation
+  // after renderer process termination (due to crashes, etc). |old_frame| will
+  // be NULL and |new_frame| will be non-NULL when a main frame is assigned to
+  // |browser| for the first time. |old_frame| will be non-NULL and |new_frame|
+  // will be NULL and  when a main frame is removed from |browser| for the last
+  // time. Both |old_frame| and |new_frame| will be non-NULL for cross-origin
+  // navigations or re-navigation after renderer process termination. This
+  // method will be called after OnFrameCreated() for |new_frame| and/or after
+  // OnFrameDetached() for |old_frame|. If called after
+  // CefLifeSpanHandler::OnBeforeClose() during browser destruction then
+  // CefBrowser::IsValid() will return false for |browser|.
+  ///
+  /*--cef(optional_param=old_frame,optional_param=new_frame)--*/
+  virtual void OnMainFrameChanged(CefRefPtr<CefBrowser> browser,
+                                  CefRefPtr<CefFrame> old_frame,
+                                  CefRefPtr<CefFrame> new_frame) {}
+};
+
+#endif  // CEF_INCLUDE_CEF_FRAME_HANDLER_H_
--- a/include/cef_life_span_handler.h
+++ b/include/cef_life_span_handler.h
@@ -95,8 +95,10 @@ class CefLifeSpanHandler : public virtual CefBaseRefCounted {
  }

  ///
-  // Called after a new browser is created. This callback will be the first
-  // notification that references |browser|.
+  // Called after a new browser is created. It is now safe to begin performing
+  // actions with |browser|. CefFrameHandler callbacks related to initial main
+  // frame creation will arrive before this callback. See CefFrameHandler
+  // documentation for additional usage information.
  ///
  /*--cef()--*/
  virtual void OnAfterCreated(CefRefPtr<CefBrowser> browser) {}
@@ -195,13 +197,14 @@ class CefLifeSpanHandler : public virtual CefBaseRefCounted {
  ///
  // Called just before a browser is destroyed. Release all references to the
  // browser object and do not attempt to execute any methods on the browser
-  // object (other than GetIdentifier or IsSame) after this callback returns.
-  // This callback will be the last notification that references |browser| on
-  // the UI thread. Any in-progress network requests associated with |browser|
+  // object (other than IsValid, GetIdentifier or IsSame) after this callback
+  // returns. CefFrameHandler callbacks related to final main frame destruction
+  // will arrive after this callback and CefBrowser::IsValid will return false
+  // at that time. Any in-progress network requests associated with |browser|
  // will be aborted when the browser is destroyed, and
  // CefResourceRequestHandler callbacks related to those requests may still
-  // arrive on the IO thread after this method is called. See DoClose()
-  // documentation for additional usage information.
+  // arrive on the IO thread after this callback. See CefFrameHandler and
+  // DoClose() documentation for additional usage information.
  ///
  /*--cef()--*/
  virtual void OnBeforeClose(CefRefPtr<CefBrowser> browser) {}
--- a/include/cef_media_router.h
+++ b/include/cef_media_router.h
@@ -40,6 +40,7 @@

 #include <vector>
 #include "include/cef_base.h"
+#include "include/cef_callback.h"
 #include "include/cef_registration.h"

 class CefMediaObserver;
@@ -59,11 +60,13 @@ class CefMediaRouter : public virtual CefBaseRefCounted {
 public:
  ///
  // Returns the MediaRouter object associated with the global request context.
-  // Equivalent to calling
-  // CefRequestContext::GetGlobalContext()->GetMediaRouter().
+  // If |callback| is non-NULL it will be executed asnychronously on the UI
+  // thread after the manager's storage has been initialized. Equivalent to
+  // calling CefRequestContext::GetGlobalContext()->GetMediaRouter().
  ///
-  /*--cef()--*/
-  static CefRefPtr<CefMediaRouter> GetGlobalMediaRouter();
+  /*--cef(optional_param=callback)--*/
+  static CefRefPtr<CefMediaRouter> GetGlobalMediaRouter(
+      CefRefPtr<CefCompletionCallback> callback);

  ///
  // Add an observer for MediaRouter events. The observer will remain registered
--- a/include/cef_print_handler.h
+++ b/include/cef_print_handler.h
@@ -133,7 +133,8 @@ class CefPrintHandler : public virtual CefBaseRefCounted {
  // CefBrowserHost::PrintToPDF().
  ///
  /*--cef()--*/
-  virtual CefSize GetPdfPaperSize(int device_units_per_inch) {
+  virtual CefSize GetPdfPaperSize(CefRefPtr<CefBrowser> browser,
+                                  int device_units_per_inch) {
    return CefSize();
  }
 };
--- a/include/cef_render_process_handler.h
+++ b/include/cef_render_process_handler.h
@@ -66,11 +66,11 @@ class CefRenderProcessHandler : public virtual CefBaseRefCounted {
  ///
  // Called after a browser has been created. When browsing cross-origin a new
  // browser will be created before the old browser with the same identifier is
-  // destroyed. |extra_info| is a read-only value originating from
+  // destroyed. |extra_info| is an optional read-only value originating from
  // CefBrowserHost::CreateBrowser(), CefBrowserHost::CreateBrowserSync(),
  // CefLifeSpanHandler::OnBeforePopup() or CefBrowserView::CreateBrowserView().
  ///
-  /*--cef()--*/
+  /*--cef(optional_param=extra_info)--*/
  virtual void OnBrowserCreated(CefRefPtr<CefBrowser> browser,
                                CefRefPtr<CefDictionaryValue> extra_info) {}

@@ -134,8 +134,8 @@ class CefRenderProcessHandler : public virtual CefBaseRefCounted {

  ///
  // Called when a new message is received from a different process. Return true
-  // if the message was handled or false otherwise. Do not keep a reference to
-  // or attempt to access the message outside of this callback.
+  // if the message was handled or false otherwise. It is safe to keep a
+  // reference to |message| outside of this callback.
  ///
  /*--cef()--*/
  virtual bool OnProcessMessageReceived(CefRefPtr<CefBrowser> browser,
--- a/include/cef_request_context.h
+++ b/include/cef_request_context.h
@@ -146,7 +146,7 @@ class CefRequestContext : public virtual CefBaseRefCounted {

  ///
  // Returns the cookie manager for this object. If |callback| is non-NULL it
-  // will be executed asnychronously on the IO thread after the manager's
+  // will be executed asnychronously on the UI thread after the manager's
  // storage has been initialized.
  ///
  /*--cef(optional_param=callback)--*/
@@ -364,10 +364,13 @@ class CefRequestContext : public virtual CefBaseRefCounted {
      const CefString& extension_id) = 0;

  ///
-  // Returns the MediaRouter object associated with this context.
+  // Returns the MediaRouter object associated with this context.  If |callback|
+  // is non-NULL it will be executed asnychronously on the UI thread after the
+  // manager's context has been initialized.
  ///
-  /*--cef()--*/
-  virtual CefRefPtr<CefMediaRouter> GetMediaRouter() = 0;
+  /*--cef(optional_param=callback)--*/
+  virtual CefRefPtr<CefMediaRouter> GetMediaRouter(
+      CefRefPtr<CefCompletionCallback> callback) = 0;
 };

 #endif  // CEF_INCLUDE_CEF_REQUEST_CONTEXT_H_
--- a/include/cef_web_plugin.h
+++ b/include/cef_web_plugin.h
@@ -191,7 +191,7 @@ class CefRegisterCdmCallback : public virtual CefBaseRefCounted {
 //   D. "x-cdm-interface-versions": Interface API version (e.g. "8").
 //   E. "x-cdm-host-versions": Host API version (e.g. "8").
 //   F. "version": CDM version (e.g. "1.4.8.903").
-//   G. "x-cdm-codecs": List of supported codecs (e.g. "vp8,vp9.0,avc1").
+//   G. "x-cdm-codecs": List of supported codecs (e.g. "vp8,vp09,avc1").
 //
 // A through E are used to verify compatibility with the current Chromium
 // version. If the CDM is not compatible the registration will fail and
--- a/include/internal/cef_string_wrappers.h
+++ b/include/internal/cef_string_wrappers.h
@@ -34,7 +34,6 @@
 #include <memory.h>
 #include <string>

-#include "include/base/cef_string16.h"
 #include "include/internal/cef_string_types.h"

 #if defined(USING_CHROMIUM_INCLUDES)
@@ -80,45 +79,63 @@ struct CefStringTraitsWide {
    cef_string_utf8_clear(&cstr);
    return str;
  }
+  static inline bool from_string(const std::string::value_type* data,
+                                 size_t length,
+                                 struct_type* s) {
+    return cef_string_utf8_to_wide(data, length, s) ? true : false;
+  }
  static inline bool from_string(const std::string& str, struct_type* s) {
-    return cef_string_utf8_to_wide(str.c_str(), str.length(), s) ? true : false;
+    return from_string(str.data(), str.length(), s);
  }
  static inline std::wstring to_wstring(const struct_type* s) {
    return std::wstring(s->str, s->length);
  }
+  static inline bool from_wstring(const std::wstring::value_type* data,
+                                  size_t length,
+                                  struct_type* s) {
+    return cef_string_wide_set(data, length, s, true) ? true : false;
+  }
  static inline bool from_wstring(const std::wstring& str, struct_type* s) {
-    return cef_string_wide_set(str.c_str(), str.length(), s, true) ? true
-                                                                   : false;
+    return from_wstring(str.data(), str.length(), s);
  }
 #if defined(WCHAR_T_IS_UTF32)
-  static inline base::string16 to_string16(const struct_type* s) {
+  static inline std::u16string to_string16(const struct_type* s) {
    cef_string_utf16_t cstr;
    memset(&cstr, 0, sizeof(cstr));
    cef_string_wide_to_utf16(s->str, s->length, &cstr);
-    base::string16 str;
+    std::u16string str;
    if (cstr.length > 0) {
-      str = base::string16(
-          reinterpret_cast<base::string16::value_type*>(cstr.str), cstr.length);
+      str = std::u16string(
+          reinterpret_cast<std::u16string::value_type*>(cstr.str), cstr.length);
    }
    cef_string_utf16_clear(&cstr);
    return str;
  }
-  static inline bool from_string16(const base::string16& str, struct_type* s) {
-    return cef_string_utf16_to_wide(
-               reinterpret_cast<const char16*>(str.c_str()), str.length(), s)
+  static inline bool from_string16(const std::u16string::value_type* data,
+                                   size_t length,
+                                   struct_type* s) {
+    return cef_string_utf16_to_wide(reinterpret_cast<const char16*>(data),
+                                    length, s)
               ? true
               : false;
  }
 #else   // WCHAR_T_IS_UTF32
-  static inline base::string16 to_string16(const struct_type* s) {
-    return base::string16(
-        reinterpret_cast<const base::string16::value_type*>(s->str), s->length);
+  static inline std::u16string to_string16(const struct_type* s) {
+    return std::u16string(
+        reinterpret_cast<const std::u16string::value_type*>(s->str), s->length);
  }
-  static inline bool from_string16(const base::string16& str, struct_type* s) {
-    return cef_string_wide_set(str.c_str(), str.length(), s, true) ? true
-                                                                   : false;
+  static inline bool from_string16(const std::u16string::value_type* data,
+                                   size_t length,
+                                   struct_type* s) {
+    return cef_string_wide_set(reinterpret_cast<const wchar_t*>(data), length,
+                               s, true)
+               ? true
+               : false;
  }
 #endif  // WCHAR_T_IS_UTF32
+  static inline bool from_string16(const std::u16string& str, struct_type* s) {
+    return from_string16(str.data(), str.length(), s);
+  }
 };

 ///
@@ -153,8 +170,13 @@ struct CefStringTraitsUTF8 {
  static inline std::string to_string(const struct_type* s) {
    return std::string(s->str, s->length);
  }
+  static inline bool from_string(const std::string::value_type* data,
+                                 size_t length,
+                                 struct_type* s) {
+    return cef_string_utf8_copy(data, length, s) ? true : false;
+  }
  static inline bool from_string(const std::string& str, struct_type* s) {
-    return cef_string_utf8_copy(str.c_str(), str.length(), s) ? true : false;
+    return from_string(str.c_str(), str.length(), s);
  }
  static inline std::wstring to_wstring(const struct_type* s) {
    cef_string_wide_t cstr;
@@ -166,27 +188,37 @@ struct CefStringTraitsUTF8 {
    cef_string_wide_clear(&cstr);
    return str;
  }
-  static inline bool from_wstring(const std::wstring& str, struct_type* s) {
-    return cef_string_wide_to_utf8(str.c_str(), str.length(), s) ? true : false;
+  static inline bool from_wstring(const std::wstring::value_type* data,
+                                  size_t length,
+                                  struct_type* s) {
+    return cef_string_wide_to_utf8(data, length, s) ? true : false;
  }
-  static inline base::string16 to_string16(const struct_type* s) {
+  static inline bool from_wstring(const std::wstring& str, struct_type* s) {
+    return from_wstring(str.data(), str.length(), s);
+  }
+  static inline std::u16string to_string16(const struct_type* s) {
    cef_string_utf16_t cstr;
    memset(&cstr, 0, sizeof(cstr));
    cef_string_utf8_to_utf16(s->str, s->length, &cstr);
-    base::string16 str;
+    std::u16string str;
    if (cstr.length > 0) {
-      str = base::string16(
-          reinterpret_cast<base::string16::value_type*>(cstr.str), cstr.length);
+      str = std::u16string(
+          reinterpret_cast<std::u16string::value_type*>(cstr.str), cstr.length);
    }
    cef_string_utf16_clear(&cstr);
    return str;
  }
-  static inline bool from_string16(const base::string16& str, struct_type* s) {
-    return cef_string_utf16_to_utf8(
-               reinterpret_cast<const char16*>(str.c_str()), str.length(), s)
+  static inline bool from_string16(const std::u16string::value_type* data,
+                                   size_t length,
+                                   struct_type* s) {
+    return cef_string_utf16_to_utf8(reinterpret_cast<const char16*>(data),
+                                    length, s)
               ? true
               : false;
  }
+  static inline bool from_string16(const std::u16string& str, struct_type* s) {
+    return from_string16(str.data(), str.length(), s);
+  }
 };

 ///
@@ -228,9 +260,13 @@ struct CefStringTraitsUTF16 {
    cef_string_utf8_clear(&cstr);
    return str;
  }
+  static inline bool from_string(const std::string::value_type* data,
+                                 size_t length,
+                                 struct_type* s) {
+    return cef_string_utf8_to_utf16(data, length, s) ? true : false;
+  }
  static inline bool from_string(const std::string& str, struct_type* s) {
-    return cef_string_utf8_to_utf16(str.c_str(), str.length(), s) ? true
-                                                                  : false;
+    return from_string(str.data(), str.length(), s);
  }
 #if defined(WCHAR_T_IS_UTF32)
  static inline std::wstring to_wstring(const struct_type* s) {
@@ -243,29 +279,39 @@ struct CefStringTraitsUTF16 {
    cef_string_wide_clear(&cstr);
    return str;
  }
-  static inline bool from_wstring(const std::wstring& str, struct_type* s) {
-    return cef_string_wide_to_utf16(str.c_str(), str.length(), s) ? true
-                                                                  : false;
+  static inline bool from_wstring(const std::wstring::value_type* data,
+                                  size_t length,
+                                  struct_type* s) {
+    return cef_string_wide_to_utf16(data, length, s) ? true : false;
  }
 #else   // WCHAR_T_IS_UTF32
  static inline std::wstring to_wstring(const struct_type* s) {
    return std::wstring(s->str, s->length);
  }
-  static inline bool from_wstring(const std::wstring& str, struct_type* s) {
-    return cef_string_utf16_set(str.c_str(), str.length(), s, true) ? true
-                                                                    : false;
+  static inline bool from_wstring(const std::wstring::value_type* data,
+                                  size_t length,
+                                  struct_type* s) {
+    return cef_string_utf16_set(data, length, s, true) ? true : false;
  }
 #endif  // WCHAR_T_IS_UTF32
-  static inline base::string16 to_string16(const struct_type* s) {
-    return base::string16(
-        reinterpret_cast<const base::string16::value_type*>(s->str), s->length);
+  static inline bool from_wstring(const std::wstring& str, struct_type* s) {
+    return from_wstring(str.data(), str.length(), s);
  }
-  static inline bool from_string16(const base::string16& str, struct_type* s) {
-    return cef_string_utf16_set(reinterpret_cast<const char16*>(str.c_str()),
-                                str.length(), s, true)
+  static inline std::u16string to_string16(const struct_type* s) {
+    return std::u16string(
+        reinterpret_cast<const std::u16string::value_type*>(s->str), s->length);
+  }
+  static inline bool from_string16(const std::u16string::value_type* data,
+                                   size_t length,
+                                   struct_type* s) {
+    return cef_string_utf16_set(reinterpret_cast<const char16*>(data), length,
+                                s, true)
               ? true
               : false;
  }
+  static inline bool from_string16(const std::u16string& str, struct_type* s) {
+    return from_string16(str.data(), str.length(), s);
+  }
 };

 ///
@@ -323,9 +369,10 @@ class CefStringBase {
  CefStringBase(const std::string& src) : string_(NULL), owner_(false) {
    FromString(src);
  }
-  CefStringBase(const char* src) : string_(NULL), owner_(false) {
+  CefStringBase(const char* src, size_t length = 0)
+      : string_(NULL), owner_(false) {
    if (src)
-      FromString(std::string(src));
+      FromString(src, length);
  }

  ///
@@ -336,24 +383,32 @@ class CefStringBase {
  CefStringBase(const std::wstring& src) : string_(NULL), owner_(false) {
    FromWString(src);
  }
-  CefStringBase(const wchar_t* src) : string_(NULL), owner_(false) {
+  CefStringBase(const wchar_t* src, size_t length = 0)
+      : string_(NULL), owner_(false) {
    if (src)
-      FromWString(std::wstring(src));
+      FromWString(src, length);
  }

-#if defined(WCHAR_T_IS_UTF32)
  ///
  // Create a new string from an existing string16. Data will be always
  // copied. Translation will occur if necessary based on the underlying string
  // type.
  ///
-  CefStringBase(const base::string16& src) : string_(NULL), owner_(false) {
+  CefStringBase(const std::u16string& src) : string_(NULL), owner_(false) {
    FromString16(src);
  }
-  CefStringBase(const char16* src) : string_(NULL), owner_(false) {
+  CefStringBase(const std::u16string::value_type* src, size_t length = 0)
+      : string_(NULL), owner_(false) {
    if (src)
-      FromString16(base::string16(
-          reinterpret_cast<const base::string16::value_type*>(src)));
+      FromString16(src, length);
+  }
+#if defined(WCHAR_T_IS_UTF32)
+  CefStringBase(const char16* src, size_t length = 0)
+      : string_(NULL), owner_(false) {
+    if (src) {
+      FromString16(reinterpret_cast<const std::u16string::value_type*>(src),
+                   length);
+    }
  }
 #endif  // WCHAR_T_IS_UTF32

@@ -592,6 +647,23 @@ class CefStringBase {
    return traits::from_string(str, string_);
  }

+  ///
+  // Set this string's data from existing |data| and optional |length|. Data
+  // will be always copied. Translation will occur if necessary based on the
+  // underlying string type.
+  ///
+  bool FromString(const std::string::value_type* data, size_t length = 0) {
+    if (data && length == 0) {
+      length = std::char_traits<std::string::value_type>::length(data);
+    }
+    if (!data || length == 0) {
+      clear();
+      return true;
+    }
+    AllocIfNeeded();
+    return traits::from_string(data, length, string_);
+  }
+
  ///
  // Return this string's data as a std::wstring. Translation will occur if
  // necessary based on the underlying string type.
@@ -616,13 +688,29 @@ class CefStringBase {
    return traits::from_wstring(str, string_);
  }

+  ///
+  // Set this string's data from existing |data| and optional |length|. Data
+  // will be always copied. Translation will occur if necessary based on the
+  // underlying string type.
+  ///
+  bool FromWString(const std::wstring::value_type* data, size_t length = 0) {
+    if (data && length == 0) {
+      length = std::char_traits<std::wstring::value_type>::length(data);
+    }
+    if (!data || length == 0) {
+      clear();
+      return true;
+    }
+    AllocIfNeeded();
+    return traits::from_wstring(data, length, string_);
+  }
  ///
  // Return this string's data as a string16. Translation will occur if
  // necessary based on the underlying string type.
  ///
-  base::string16 ToString16() const {
+  std::u16string ToString16() const {
    if (empty())
-      return base::string16();
+      return std::u16string();
    return traits::to_string16(string_);
  }

@@ -631,7 +719,7 @@ class CefStringBase {
  // copied. Translation will occur if necessary based on the underlying string
  // type.
  ///
-  bool FromString16(const base::string16& str) {
+  bool FromString16(const std::u16string& str) {
    if (str.empty()) {
      clear();
      return true;
@@ -640,6 +728,23 @@ class CefStringBase {
    return traits::from_string16(str, string_);
  }

+  ///
+  // Set this string's data from existing |data| and optional |length|. Data
+  // will be always copied. Translation will occur if necessary based on the
+  // underlying string type.
+  ///
+  bool FromString16(const std::u16string::value_type* data, size_t length = 0) {
+    if (data && length == 0) {
+      length = std::char_traits<std::u16string::value_type>::length(data);
+    }
+    if (!data || length == 0) {
+      clear();
+      return true;
+    }
+    AllocIfNeeded();
+    return traits::from_string16(data, length, string_);
+  }
+
  ///
  // Comparison operator overloads.
  ///
@@ -670,8 +775,8 @@ class CefStringBase {
    FromString(str);
    return *this;
  }
-  CefStringBase& operator=(const char* str) {
-    FromString(std::string(str));
+  CefStringBase& operator=(const std::string::value_type* str) {
+    FromString(str);
    return *this;
  }
  operator std::wstring() const { return ToWString(); }
@@ -679,19 +784,22 @@ class CefStringBase {
    FromWString(str);
    return *this;
  }
-  CefStringBase& operator=(const wchar_t* str) {
-    FromWString(std::wstring(str));
+  CefStringBase& operator=(const std::wstring::value_type* str) {
+    FromWString(str);
    return *this;
  }
-#if defined(WCHAR_T_IS_UTF32)
-  operator base::string16() const { return ToString16(); }
-  CefStringBase& operator=(const base::string16& str) {
+  operator std::u16string() const { return ToString16(); }
+  CefStringBase& operator=(const std::u16string& str) {
    FromString16(str);
    return *this;
  }
+  CefStringBase& operator=(const std::u16string::value_type* str) {
+    FromString16(str);
+    return *this;
+  }
+#if defined(WCHAR_T_IS_UTF32)
  CefStringBase& operator=(const char16* str) {
-    FromString16(base::string16(
-        reinterpret_cast<const base::string16::value_type*>(str)));
+    FromString16(reinterpret_cast<const std::u16string::value_type*>(str));
    return *this;
  }
 #endif  // WCHAR_T_IS_UTF32
--- a/include/internal/cef_types.h
+++ b/include/internal/cef_types.h
@@ -242,7 +242,9 @@ typedef struct _cef_settings_t {
  // in-memory caches are used for storage and no data is persisted to disk.
  // HTML5 databases such as localStorage will only persist across sessions if a
  // cache path is specified. Can be overridden for individual CefRequestContext
-  // instances via the CefRequestContextSettings.cache_path value.
+  // instances via the CefRequestContextSettings.cache_path value. When using
+  // the Chrome runtime the "default" profile will be used if |cache_path| and
+  // |root_cache_path| have the same value.
  ///
  cef_string_t cache_path;

@@ -264,7 +266,8 @@ typedef struct _cef_settings_t {
  // directory on Linux, "~/Library/Application Support/CEF/User Data" directory
  // on Mac OS X, "Local Settings\Application Data\CEF\User Data" directory
  // under the user profile directory on Windows). If this value is non-empty
-  // then it must be an absolute path.
+  // then it must be an absolute path. When using the Chrome runtime this value
+  // will be ignored in favor of the |root_cache_path| value.
  ///
  cef_string_t user_data_path;

@@ -301,9 +304,9 @@ typedef struct _cef_settings_t {
  // Value that will be inserted as the product portion of the default
  // User-Agent string. If empty the Chromium product version will be used. If
  // |userAgent| is specified this value will be ignored. Also configurable
-  // using the "product-version" command-line switch.
+  // using the "user-agent-product" command-line switch.
  ///
-  cef_string_t product_version;
+  cef_string_t user_agent_product;

  ///
  // The locale string that will be passed to WebKit. If empty the default
@@ -419,6 +422,20 @@ typedef struct _cef_settings_t {
  ///
  cef_string_t accept_language_list;

+  ///
+  // Comma delimited list of schemes supported by the associated
+  // CefCookieManager. If |cookieable_schemes_exclude_defaults| is false (0) the
+  // default schemes ("http", "https", "ws" and "wss") will also be supported.
+  // Specifying a |cookieable_schemes_list| value and setting
+  // |cookieable_schemes_exclude_defaults| to true (1) will disable all loading
+  // and saving of cookies for this manager. Can be overridden
+  // for individual CefRequestContext instances via the
+  // CefRequestContextSettings.cookieable_schemes_list and
+  // CefRequestContextSettings.cookieable_schemes_exclude_defaults values.
+  ///
+  cef_string_t cookieable_schemes_list;
+  int cookieable_schemes_exclude_defaults;
+
  ///
  // GUID string used for identifying the application. This is passed to the
  // system AV function for scanning downloaded files. By default, the GUID
@@ -487,6 +504,18 @@ typedef struct _cef_request_context_settings_t {
  // ignored if |cache_path| matches the CefSettings.cache_path value.
  ///
  cef_string_t accept_language_list;
+
+  ///
+  // Comma delimited list of schemes supported by the associated
+  // CefCookieManager. If |cookieable_schemes_exclude_defaults| is false (0) the
+  // default schemes ("http", "https", "ws" and "wss") will also be supported.
+  // Specifying a |cookieable_schemes_list| value and setting
+  // |cookieable_schemes_exclude_defaults| to true (1) will disable all loading
+  // and saving of cookies for this manager. These values will be ignored if
+  // |cache_path| matches the CefSettings.cache_path value.
+  ///
+  cef_string_t cookieable_schemes_list;
+  int cookieable_schemes_exclude_defaults;
 } cef_request_context_settings_t;

 ///
@@ -585,14 +614,6 @@ typedef struct _cef_browser_settings_t {
  ///
  cef_state_t file_access_from_file_urls;

-  ///
-  // Controls whether web security restrictions (same-origin policy) will be
-  // enforced. Disabling this setting is not recommend as it will allow risky
-  // security behavior such as cross-site scripting (XSS). Also configurable
-  // using the "disable-web-security" command-line switch.
-  ///
-  cef_state_t web_security;
-
  ///
  // Controls whether image URLs will be loaded from the network. A cached image
  // will still be rendered if requested. Also configurable using the
@@ -659,7 +680,7 @@ typedef struct _cef_browser_settings_t {
  ///
  // Comma delimited ordered list of language codes without any whitespace that
  // will be used in the "Accept-Language" HTTP header. May be set globally
-  // using the CefBrowserSettings.accept_language_list value. If both values are
+  // using the CefSettings.accept_language_list value. If both values are
  // empty then "en-US,en" will be used.
  ///
  cef_string_t accept_language_list;
@@ -1437,7 +1458,6 @@ typedef enum {
  // CefShutdown() are guaranteed to run.
  ///
  TID_FILE_BACKGROUND,
-  TID_FILE = TID_FILE_BACKGROUND,

  ///
  // Used for blocking tasks (e.g. file system access) that affect UI or
@@ -3193,6 +3213,15 @@ typedef enum {
  CEF_TFC_SELECT_ALL,
 } cef_text_field_commands_t;

+///
+// Supported Chrome toolbar types.
+///
+typedef enum {
+  CEF_CTT_NONE = 1,
+  CEF_CTT_NORMAL,
+  CEF_CTT_LOCATION,
+} cef_chrome_toolbar_type_t;
+
 #ifdef __cplusplus
 }
 #endif
--- a/include/internal/cef_types_wrappers.h
+++ b/include/internal/cef_types_wrappers.h
@@ -151,10 +151,9 @@ class CefPoint : public CefStructBase<CefPointTraits> {
 public:
  typedef CefStructBase<CefPointTraits> parent;

-  CefPoint() : parent() {}
+  CefPoint() {}
  CefPoint(const cef_point_t& r) : parent(r) {}
-  CefPoint(const CefPoint& r) : parent(r) {}
-  CefPoint(int x, int y) : parent() { Set(x, y); }
+  CefPoint(int x, int y) { Set(x, y); }

  bool IsEmpty() const { return x <= 0 && y <= 0; }
  void Set(int x_val, int y_val) { x = x_val, y = y_val; }
@@ -188,12 +187,9 @@ class CefRect : public CefStructBase<CefRectTraits> {
 public:
  typedef CefStructBase<CefRectTraits> parent;

-  CefRect() : parent() {}
+  CefRect() {}
  CefRect(const cef_rect_t& r) : parent(r) {}
-  CefRect(const CefRect& r) : parent(r) {}
-  CefRect(int x, int y, int width, int height) : parent() {
-    Set(x, y, width, height);
-  }
+  CefRect(int x, int y, int width, int height) { Set(x, y, width, height); }

  bool IsEmpty() const { return width <= 0 || height <= 0; }
  void Set(int x_val, int y_val, int width_val, int height_val) {
@@ -240,10 +236,9 @@ class CefSize : public CefStructBase<CefSizeTraits> {
 public:
  typedef CefStructBase<CefSizeTraits> parent;

-  CefSize() : parent() {}
+  CefSize() {}
  CefSize(const cef_size_t& r) : parent(r) {}
-  CefSize(const CefSize& r) : parent(r) {}
-  CefSize(int width, int height) : parent() { Set(width, height); }
+  CefSize(int width, int height) { Set(width, height); }

  bool IsEmpty() const { return width <= 0 || height <= 0; }
  void Set(int width_val, int height_val) {
@@ -279,10 +274,9 @@ class CefRange : public CefStructBase<CefRangeTraits> {
 public:
  typedef CefStructBase<CefRangeTraits> parent;

-  CefRange() : parent() {}
+  CefRange() {}
  CefRange(const cef_range_t& r) : parent(r) {}
-  CefRange(const CefRange& r) : parent(r) {}
-  CefRange(int from, int to) : parent() { Set(from, to); }
+  CefRange(int from, int to) { Set(from, to); }

  void Set(int from_val, int to_val) { from = from_val, to = to_val; }
 };
@@ -315,10 +309,9 @@ class CefInsets : public CefStructBase<CefInsetsTraits> {
 public:
  typedef CefStructBase<CefInsetsTraits> parent;

-  CefInsets() : parent() {}
+  CefInsets() {}
  CefInsets(const cef_insets_t& r) : parent(r) {}
-  CefInsets(const CefInsets& r) : parent(r) {}
-  CefInsets(int top, int left, int bottom, int right) : parent() {
+  CefInsets(int top, int left, int bottom, int right) {
    Set(top, left, bottom, right);
  }

@@ -356,10 +349,9 @@ class CefDraggableRegion : public CefStructBase<CefDraggableRegionTraits> {
 public:
  typedef CefStructBase<CefDraggableRegionTraits> parent;

-  CefDraggableRegion() : parent() {}
+  CefDraggableRegion() {}
  CefDraggableRegion(const cef_draggable_region_t& r) : parent(r) {}
-  CefDraggableRegion(const CefDraggableRegion& r) : parent(r) {}
-  CefDraggableRegion(const CefRect& bounds, bool draggable) : parent() {
+  CefDraggableRegion(const CefRect& bounds, bool draggable) {
    Set(bounds, draggable);
  }

@@ -405,16 +397,14 @@ class CefScreenInfo : public CefStructBase<CefScreenInfoTraits> {
 public:
  typedef CefStructBase<CefScreenInfoTraits> parent;

-  CefScreenInfo() : parent() {}
+  CefScreenInfo() {}
  CefScreenInfo(const cef_screen_info_t& r) : parent(r) {}
-  CefScreenInfo(const CefScreenInfo& r) : parent(r) {}
  CefScreenInfo(float device_scale_factor,
                int depth,
                int depth_per_component,
                bool is_monochrome,
                const CefRect& rect,
-                const CefRect& available_rect)
-      : parent() {
+                const CefRect& available_rect) {
    Set(device_scale_factor, depth, depth_per_component, is_monochrome, rect,
        available_rect);
  }
@@ -548,13 +538,14 @@ struct CefSettingsTraits {
    cef_string_clear(&s->root_cache_path);
    cef_string_clear(&s->user_data_path);
    cef_string_clear(&s->user_agent);
-    cef_string_clear(&s->product_version);
+    cef_string_clear(&s->user_agent_product);
    cef_string_clear(&s->locale);
    cef_string_clear(&s->log_file);
    cef_string_clear(&s->javascript_flags);
    cef_string_clear(&s->resources_dir_path);
    cef_string_clear(&s->locales_dir_path);
    cef_string_clear(&s->accept_language_list);
+    cef_string_clear(&s->cookieable_schemes_list);
    cef_string_clear(&s->application_client_id_for_file_scanning);
  }

@@ -586,8 +577,8 @@ struct CefSettingsTraits {

    cef_string_set(src->user_agent.str, src->user_agent.length,
                   &target->user_agent, copy);
-    cef_string_set(src->product_version.str, src->product_version.length,
-                   &target->product_version, copy);
+    cef_string_set(src->user_agent_product.str, src->user_agent_product.length,
+                   &target->user_agent_product, copy);
    cef_string_set(src->locale.str, src->locale.length, &target->locale, copy);

    cef_string_set(src->log_file.str, src->log_file.length, &target->log_file,
@@ -609,6 +600,13 @@ struct CefSettingsTraits {
    cef_string_set(src->accept_language_list.str,
                   src->accept_language_list.length,
                   &target->accept_language_list, copy);
+
+    cef_string_set(src->cookieable_schemes_list.str,
+                   src->cookieable_schemes_list.length,
+                   &target->cookieable_schemes_list, copy);
+    target->cookieable_schemes_exclude_defaults =
+        src->cookieable_schemes_exclude_defaults;
+
    cef_string_set(src->application_client_id_for_file_scanning.str,
                   src->application_client_id_for_file_scanning.length,
                   &target->application_client_id_for_file_scanning, copy);
@@ -628,6 +626,7 @@ struct CefRequestContextSettingsTraits {
  static inline void clear(struct_type* s) {
    cef_string_clear(&s->cache_path);
    cef_string_clear(&s->accept_language_list);
+    cef_string_clear(&s->cookieable_schemes_list);
  }

  static inline void set(const struct_type* src,
@@ -641,6 +640,12 @@ struct CefRequestContextSettingsTraits {
    cef_string_set(src->accept_language_list.str,
                   src->accept_language_list.length,
                   &target->accept_language_list, copy);
+
+    cef_string_set(src->cookieable_schemes_list.str,
+                   src->cookieable_schemes_list.length,
+                   &target->cookieable_schemes_list, copy);
+    target->cookieable_schemes_exclude_defaults =
+        src->cookieable_schemes_exclude_defaults;
  }
 };

@@ -705,7 +710,6 @@ struct CefBrowserSettingsTraits {
    target->universal_access_from_file_urls =
        src->universal_access_from_file_urls;
    target->file_access_from_file_urls = src->file_access_from_file_urls;
-    target->web_security = src->web_security;
    target->image_loading = src->image_loading;
    target->image_shrink_standalone_to_fit =
        src->image_shrink_standalone_to_fit;
@@ -792,11 +796,10 @@ class CefTime : public CefStructBase<CefTimeTraits> {
 public:
  typedef CefStructBase<CefTimeTraits> parent;

-  CefTime() : parent() {}
+  CefTime() {}
  CefTime(const cef_time_t& r) : parent(r) {}
-  CefTime(const CefTime& r) : parent(r) {}
-  explicit CefTime(time_t r) : parent() { SetTimeT(r); }
-  explicit CefTime(double r) : parent() { SetDoubleT(r); }
+  explicit CefTime(time_t r) { SetTimeT(r); }
+  explicit CefTime(double r) { SetDoubleT(r); }

  // Converts to/from time_t.
  void SetTimeT(time_t r) { cef_time_from_timet(r, this); }
--- a/include/views/cef_browser_view.h
+++ b/include/views/cef_browser_view.h
@@ -80,6 +80,17 @@ class CefBrowserView : public CefView {
  /*--cef()--*/
  virtual CefRefPtr<CefBrowser> GetBrowser() = 0;

+  ///
+  // Returns the Chrome toolbar associated with this BrowserView. Only supported
+  // when using the Chrome runtime. The CefBrowserViewDelegate::
+  // GetChromeToolbarType() method must return a value other than
+  // CEF_CTT_NONE and the toolbar will not be available until after this
+  // BrowserView is added to a CefWindow and CefViewDelegate::OnWindowChanged()
+  // has been called.
+  ///
+  /*--cef()--*/
+  virtual CefRefPtr<CefView> GetChromeToolbar() = 0;
+
  ///
  // Sets whether accelerators registered with CefWindow::SetAccelerator are
  // triggered before or after the event is sent to the CefBrowser. If
--- a/include/views/cef_browser_view_delegate.h
+++ b/include/views/cef_browser_view_delegate.h
@@ -52,6 +52,8 @@ class CefBrowserView;
 /*--cef(source=client)--*/
 class CefBrowserViewDelegate : public CefViewDelegate {
 public:
+  typedef cef_chrome_toolbar_type_t ChromeToolbarType;
+
  ///
  // Called when |browser| associated with |browser_view| is created. This
  // method will be called after CefLifeSpanHandler::OnAfterCreated() is called
@@ -104,6 +106,14 @@ class CefBrowserViewDelegate : public CefViewDelegate {
      bool is_devtools) {
    return false;
  }
+
+  ///
+  // Returns the Chrome toolbar type that will be available via
+  // CefBrowserView::GetChromeToolbar(). See that method for related
+  // documentation.
+  ///
+  /*--cef(default_retval=CEF_CTT_NONE)--*/
+  virtual ChromeToolbarType GetChromeToolbarType() { return CEF_CTT_NONE; }
 };

 #endif  // CEF_INCLUDE_VIEWS_CEF_BROWSER_VIEW_DELEGATE_H_
--- a/include/views/cef_view_delegate.h
+++ b/include/views/cef_view_delegate.h
@@ -105,6 +105,12 @@ class CefViewDelegate : public virtual CefBaseRefCounted {
                                  bool added,
                                  CefRefPtr<CefView> child) {}

+  ///
+  // Called when |view| is added or removed from the CefWindow.
+  ///
+  /*--cef(optional_param=window)--*/
+  virtual void OnWindowChanged(CefRefPtr<CefView> view, bool added) {}
+
  ///
  // Called when |view| gains focus.
  ///
--- a/include/wrapper/cef_helpers.h
+++ b/include/wrapper/cef_helpers.h
@@ -48,7 +48,12 @@

 #define CEF_REQUIRE_UI_THREAD() DCHECK(CefCurrentlyOn(TID_UI));
 #define CEF_REQUIRE_IO_THREAD() DCHECK(CefCurrentlyOn(TID_IO));
-#define CEF_REQUIRE_FILE_THREAD() DCHECK(CefCurrentlyOn(TID_FILE));
+#define CEF_REQUIRE_FILE_BACKGROUND_THREAD() \
+  DCHECK(CefCurrentlyOn(TID_FILE_BACKGROUND));
+#define CEF_REQUIRE_FILE_USER_VISIBLE_THREAD() \
+  DCHECK(CefCurrentlyOn(TID_FILE_USER_VISIBLE));
+#define CEF_REQUIRE_FILE_USER_BLOCKING_THREAD() \
+  DCHECK(CefCurrentlyOn(TID_FILE_USER_BLOCKING));
 #define CEF_REQUIRE_RENDERER_THREAD() DCHECK(CefCurrentlyOn(TID_RENDERER));

 // Use this struct in conjuction with refcounted types to ensure that an
@@ -86,7 +91,12 @@ struct CefDeleteOnThread {

 struct CefDeleteOnUIThread : public CefDeleteOnThread<TID_UI> {};
 struct CefDeleteOnIOThread : public CefDeleteOnThread<TID_IO> {};
-struct CefDeleteOnFileThread : public CefDeleteOnThread<TID_FILE> {};
+struct CefDeleteOnFileBackgroundThread
+    : public CefDeleteOnThread<TID_FILE_BACKGROUND> {};
+struct CefDeleteOnFileUserVisibleThread
+    : public CefDeleteOnThread<TID_FILE_USER_VISIBLE> {};
+struct CefDeleteOnFileUserBlockingThread
+    : public CefDeleteOnThread<TID_FILE_USER_BLOCKING> {};
 struct CefDeleteOnRendererThread : public CefDeleteOnThread<TID_RENDERER> {};

 // Same as IMPLEMENT_REFCOUNTING() but using the specified Destructor.
@@ -114,7 +124,6 @@ struct CefDeleteOnRendererThread : public CefDeleteOnThread<TID_RENDERER> {};
 #define IMPLEMENT_REFCOUNTING_DELETE_ON_IOT(ClassName) \
  IMPLEMENT_REFCOUNTING_EX(ClassName, CefDeleteOnIOThread)

-
 ///
 // Helper class to manage a scoped copy of |argv|.
 ///
--- a/include/wrapper/cef_message_router.h
+++ b/include/wrapper/cef_message_router.h
@@ -46,7 +46,7 @@
 // The below classes implement support for routing aynchronous messages between
 // JavaScript running in the renderer process and C++ running in the browser
 // process. An application interacts with the router by passing it data from
-// standard CEF C++ callbacks (OnBeforeBrowse, OnProcessMessageRecieved,
+// standard CEF C++ callbacks (OnBeforeBrowse, OnProcessMessageReceived,
 // OnContextCreated, etc). The renderer-side router supports generic JavaScript
 // callback registration and execution while the browser-side router supports
 // application-specific logic via one or more application-provided Handler
--- a/libcef/browser/alloy/alloy_browser_context.cc
+++ b/libcef/browser/alloy/alloy_browser_context.cc
@@ -113,6 +113,18 @@ AlloyBrowserContext::~AlloyBrowserContext() {
  }
 }

+bool AlloyBrowserContext::IsInitialized() const {
+  CEF_REQUIRE_UIT();
+  return !!key_;
+}
+
+void AlloyBrowserContext::StoreOrTriggerInitCallback(
+    base::OnceClosure callback) {
+  CEF_REQUIRE_UIT();
+  // Initialization is always synchronous.
+  std::move(callback).Run();
+}
+
 void AlloyBrowserContext::Initialize() {
  CefBrowserContext::Initialize();

@@ -297,25 +309,14 @@ AlloyBrowserContext::GetClientHintsControllerDelegate() {
  return nullptr;
 }

-void AlloyBrowserContext::SetCorsOriginAccessListForOrigin(
-    TargetBrowserContexts target_mode,
-    const url::Origin& source_origin,
-    std::vector<network::mojom::CorsOriginPatternPtr> allow_patterns,
-    std::vector<network::mojom::CorsOriginPatternPtr> block_patterns,
-    base::OnceClosure closure) {
-  // This method is called for Extension support.
-  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, std::move(closure));
-}
-
 ChromeZoomLevelPrefs* AlloyBrowserContext::GetZoomLevelPrefs() {
  return static_cast<ChromeZoomLevelPrefs*>(
-      GetStoragePartition(this, nullptr)->GetZoomLevelDelegate());
+      GetStoragePartition(nullptr)->GetZoomLevelDelegate());
 }

 scoped_refptr<network::SharedURLLoaderFactory>
 AlloyBrowserContext::GetURLLoaderFactory() {
-  return GetDefaultStoragePartition(this)
-      ->GetURLLoaderFactoryForBrowserProcess();
+  return GetDefaultStoragePartition()->GetURLLoaderFactoryForBrowserProcess();
 }

 base::FilePath AlloyBrowserContext::GetPath() {
@@ -337,18 +338,11 @@ AlloyBrowserContext::CreateZoomLevelDelegate(
      zoom::ZoomEventManager::GetForBrowserContext(this)->GetWeakPtr()));
 }

-bool AlloyBrowserContext::IsOffTheRecord() const {
-  // Alloy contexts are never flagged as off-the-record. It causes problems
-  // for the extension system.
-  return false;
-}
-
 content::DownloadManagerDelegate*
 AlloyBrowserContext::GetDownloadManagerDelegate() {
  if (!download_manager_delegate_) {
-    content::DownloadManager* manager =
-        BrowserContext::GetDownloadManager(this);
-    download_manager_delegate_.reset(new CefDownloadManagerDelegate(manager));
+    download_manager_delegate_.reset(
+        new CefDownloadManagerDelegate(GetDownloadManager()));
  }
  return download_manager_delegate_.get();
 }
--- a/libcef/browser/alloy/alloy_browser_context.h
+++ b/libcef/browser/alloy/alloy_browser_context.h
@@ -42,6 +42,8 @@ class AlloyBrowserContext : public ChromeProfileAlloy,
  // CefBrowserContext overrides.
  content::BrowserContext* AsBrowserContext() override { return this; }
  Profile* AsProfile() override { return this; }
+  bool IsInitialized() const override;
+  void StoreOrTriggerInitCallback(base::OnceClosure callback) override;
  void Initialize() override;
  void Shutdown() override;
  void RemoveCefRequestContext(CefRequestContextImpl* context) override;
@@ -58,17 +60,10 @@ class AlloyBrowserContext : public ChromeProfileAlloy,
  content::ResourceContext* GetResourceContext() override;
  content::ClientHintsControllerDelegate* GetClientHintsControllerDelegate()
      override;
-  void SetCorsOriginAccessListForOrigin(
-      TargetBrowserContexts target_mode,
-      const url::Origin& source_origin,
-      std::vector<network::mojom::CorsOriginPatternPtr> allow_patterns,
-      std::vector<network::mojom::CorsOriginPatternPtr> block_patterns,
-      base::OnceClosure closure) override;
  base::FilePath GetPath() override;
  base::FilePath GetPath() const override;
  std::unique_ptr<content::ZoomLevelDelegate> CreateZoomLevelDelegate(
      const base::FilePath& partition_path) override;
-  bool IsOffTheRecord() const override;
  content::DownloadManagerDelegate* GetDownloadManagerDelegate() override;
  content::BrowserPluginGuestManager* GetGuestManager() override;
  storage::SpecialStoragePolicy* GetSpecialStoragePolicy() override;
--- a/libcef/browser/alloy/alloy_browser_host_impl.cc
+++ b/libcef/browser/alloy/alloy_browser_host_impl.cc
@@ -21,9 +21,9 @@
 #include "libcef/browser/osr/osr_util.h"
 #include "libcef/browser/request_context_impl.h"
 #include "libcef/browser/thread_util.h"
-#include "libcef/common/cef_messages.h"
 #include "libcef/common/cef_switches.h"
 #include "libcef/common/drag_data_impl.h"
+#include "libcef/common/net/url_util.h"
 #include "libcef/common/request_impl.h"
 #include "libcef/common/values_impl.h"
 #include "libcef/features/runtime_checks.h"
@@ -175,12 +175,13 @@ CefRefPtr<AlloyBrowserHostImpl> AlloyBrowserHostImpl::Create(
  if (!browser)
    return nullptr;

+  GURL url = url_util::MakeGURL(create_params.url, /*fixup=*/true);
+
  if (create_params.extension) {
    platform_delegate_ptr->CreateExtensionHost(
-        create_params.extension, create_params.url,
-        create_params.extension_host_type);
-  } else if (!create_params.url.is_empty()) {
-    content::OpenURLParams params(create_params.url, content::Referrer(),
+        create_params.extension, url, create_params.extension_host_type);
+  } else if (!url.is_empty()) {
+    content::OpenURLParams params(url, content::Referrer(),
                                  WindowOpenDisposition::CURRENT_TAB,
                                  CefFrameHostImpl::kPageTransitionExplicit,
                                  /*is_renderer_initiated=*/false);
@@ -638,7 +639,7 @@ void AlloyBrowserHostImpl::SendExternalBeginFrame() {
  if (!CEF_CURRENTLY_ON_UIT()) {
    CEF_POST_TASK(
        CEF_UIT,
-        base::Bind(&AlloyBrowserHostImpl::SendExternalBeginFrame, this));
+        base::BindOnce(&AlloyBrowserHostImpl::SendExternalBeginFrame, this));
    return;
  }

@@ -653,8 +654,8 @@ void AlloyBrowserHostImpl::SendTouchEvent(const CefTouchEvent& event) {
  }

  if (!CEF_CURRENTLY_ON_UIT()) {
-    CEF_POST_TASK(CEF_UIT, base::Bind(&AlloyBrowserHostImpl::SendTouchEvent,
-                                      this, event));
+    CEF_POST_TASK(CEF_UIT, base::BindOnce(&AlloyBrowserHostImpl::SendTouchEvent,
+                                          this, event));
    return;
  }

@@ -799,10 +800,10 @@ bool AlloyBrowserHostImpl::MaybeAllowNavigation(
    // The PDF viewer will load the PDF extension in the guest view, and print
    // preview will load chrome://print in the guest view. All other navigations
    // are passed to the owner browser.
-    CEF_POST_TASK(
-        CEF_UIT,
-        base::Bind(base::IgnoreResult(&AlloyBrowserHostImpl::OpenURLFromTab),
-                   this, nullptr, params));
+    CEF_POST_TASK(CEF_UIT,
+                  base::BindOnce(
+                      base::IgnoreResult(&AlloyBrowserHostImpl::OpenURLFromTab),
+                      this, nullptr, params));

    return false;
  }
@@ -810,12 +811,6 @@ bool AlloyBrowserHostImpl::MaybeAllowNavigation(
  return true;
 }

-SkColor AlloyBrowserHostImpl::GetBackgroundColor() const {
-  // Don't use |platform_delegate_| because it's not thread-safe.
-  return CefContext::Get()->GetBackgroundColor(
-      &settings_, is_windowless_ ? STATE_ENABLED : STATE_DISABLED);
-}
-
 extensions::ExtensionHost* AlloyBrowserHostImpl::GetExtensionHost() const {
  CEF_REQUIRE_UIT();
  DCHECK(platform_delegate_);
@@ -1082,8 +1077,8 @@ void AlloyBrowserHostImpl::DragSourceEndedAt(

 void AlloyBrowserHostImpl::SetAudioMuted(bool mute) {
  if (!CEF_CURRENTLY_ON_UIT()) {
-    CEF_POST_TASK(CEF_UIT,
-                  base::Bind(&AlloyBrowserHostImpl::SetAudioMuted, this, mute));
+    CEF_POST_TASK(CEF_UIT, base::BindOnce(&AlloyBrowserHostImpl::SetAudioMuted,
+                                          this, mute));
    return;
  }
  if (!web_contents())
@@ -1195,9 +1190,9 @@ void AlloyBrowserHostImpl::UpdateTargetURL(content::WebContents* source,
 bool AlloyBrowserHostImpl::DidAddMessageToConsole(
    content::WebContents* source,
    blink::mojom::ConsoleMessageLevel level,
-    const base::string16& message,
+    const std::u16string& message,
    int32_t line_no,
-    const base::string16& source_id) {
+    const std::u16string& source_id) {
  return contents_delegate_->DidAddMessageToConsole(source, level, message,
                                                    line_no, source_id);
 }
--- a/libcef/browser/alloy/alloy_browser_host_impl.h
+++ b/libcef/browser/alloy/alloy_browser_host_impl.h
@@ -22,12 +22,11 @@
 #include "libcef/browser/menu_manager.h"
 #include "libcef/browser/request_context_impl.h"

-#include "base/strings/string16.h"
 #include "base/synchronization/lock.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "extensions/common/view_type.h"
+#include "extensions/common/mojom/view_type.mojom-forward.h"

 class CefAudioCapturer;
 class CefBrowserInfo;
@@ -151,7 +150,7 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
  bool IsBackgroundHost() override;

  // Returns true if windowless rendering is enabled.
-  bool IsWindowless() const;
+  bool IsWindowless() const override;

  // Returns true if this browser supports picture-in-picture.
  bool IsPictureInPictureSupported() const;
@@ -182,9 +181,6 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
                     content::RenderWidgetHostImpl* source_rwh);
  void UpdateDragCursor(ui::mojom::DragOperation operation);

-  // Thread safe accessors.
-  SkColor GetBackgroundColor() const;
-
  // Accessors that must be called on the UI thread.
  extensions::ExtensionHost* GetExtensionHost() const;

@@ -225,9 +221,9 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
  void UpdateTargetURL(content::WebContents* source, const GURL& url) override;
  bool DidAddMessageToConsole(content::WebContents* source,
                              blink::mojom::ConsoleMessageLevel log_level,
-                              const base::string16& message,
+                              const std::u16string& message,
                              int32_t line_no,
-                              const base::string16& source_id) override;
+                              const std::u16string& source_id) override;
  void BeforeUnloadFired(content::WebContents* source,
                         bool proceed,
                         bool* proceed_to_fire_unload) override;
--- a/libcef/browser/alloy/alloy_browser_main.cc
+++ b/libcef/browser/alloy/alloy_browser_main.cc
@@ -25,6 +25,7 @@
 #include "base/bind.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/task/post_task.h"
+#include "base/task/thread_pool.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/media/router/chrome_media_router_factory.h"
 #include "chrome/browser/net/system_network_context_manager.h"
@@ -108,7 +109,7 @@ void AlloyBrowserMainParts::ToolkitInitialized() {
 #endif  // defined(TOOLKIT_VIEWS)
 }

-void AlloyBrowserMainParts::PreMainMessageLoopStart() {
+void AlloyBrowserMainParts::PreCreateMainMessageLoop() {
 #if defined(USE_AURA) && defined(USE_X11)
  ui::TouchFactory::SetTouchDeviceListFromCommandLine();
 #endif
@@ -128,7 +129,7 @@ void AlloyBrowserMainParts::PreMainMessageLoopStart() {
  media_router::ChromeMediaRouterFactory::DoPlatformInit();
 }

-void AlloyBrowserMainParts::PostMainMessageLoopStart() {
+void AlloyBrowserMainParts::PostCreateMainMessageLoop() {
 #if defined(OS_LINUX)
  printing::PrintingContextLinux::SetCreatePrintDialogFunction(
      &CefPrintDialogLinux::CreatePrintDialog);
@@ -152,9 +153,10 @@ int AlloyBrowserMainParts::PreCreateThreads() {
  return 0;
 }

-void AlloyBrowserMainParts::PreMainMessageLoopRun() {
+int AlloyBrowserMainParts::PreMainMessageLoopRun() {
 #if defined(USE_AURA)
-  display::Screen::SetScreenInstance(views::CreateDesktopScreen());
+  screen_ = views::CreateDesktopScreen();
+  display::Screen::SetScreenInstance(screen_.get());
 #endif

  if (extensions::ExtensionsEnabled()) {
@@ -173,14 +175,14 @@ void AlloyBrowserMainParts::PreMainMessageLoopRun() {
  // ChromeBrowserMainExtraPartsProfiles for details.
  cef::EnsureBrowserContextKeyedServiceFactoriesBuilt();

-  background_task_runner_ = base::CreateSingleThreadTaskRunner(
-      {base::ThreadPool(), base::TaskPriority::BEST_EFFORT,
+  background_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+      {base::TaskPriority::BEST_EFFORT,
       base::TaskShutdownBehavior::BLOCK_SHUTDOWN, base::MayBlock()});
-  user_visible_task_runner_ = base::CreateSingleThreadTaskRunner(
-      {base::ThreadPool(), base::TaskPriority::USER_VISIBLE,
+  user_visible_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+      {base::TaskPriority::USER_VISIBLE,
       base::TaskShutdownBehavior::BLOCK_SHUTDOWN, base::MayBlock()});
-  user_blocking_task_runner_ = base::CreateSingleThreadTaskRunner(
-      {base::ThreadPool(), base::TaskPriority::USER_BLOCKING,
+  user_blocking_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+      {base::TaskPriority::USER_BLOCKING,
       base::TaskShutdownBehavior::BLOCK_SHUTDOWN, base::MayBlock()});

  CefRequestContextSettings settings;
@@ -204,6 +206,8 @@ void AlloyBrowserMainParts::PreMainMessageLoopRun() {
  PluginFinder::GetInstance()->Init();

  scheme::RegisterWebUIControllerFactory();
+
+  return content::RESULT_CODE_NORMAL_EXIT;
 }

 void AlloyBrowserMainParts::PostMainMessageLoopRun() {
--- a/libcef/browser/alloy/alloy_browser_main.h
+++ b/libcef/browser/alloy/alloy_browser_main.h
@@ -24,6 +24,9 @@ class ExtensionsClient;
 }  // namespace extensions

 #if defined(USE_AURA)
+namespace display {
+class Screen;
+}
 namespace wm {
 class WMState;
 }
@@ -47,10 +50,10 @@ class AlloyBrowserMainParts : public content::BrowserMainParts {

  int PreEarlyInitialization() override;
  void ToolkitInitialized() override;
-  void PreMainMessageLoopStart() override;
-  void PostMainMessageLoopStart() override;
+  void PreCreateMainMessageLoop() override;
+  void PostCreateMainMessageLoop() override;
  int PreCreateThreads() override;
-  void PreMainMessageLoopRun() override;
+  int PreMainMessageLoopRun() override;
  void PostMainMessageLoopRun() override;
  void PostDestroyThreads() override;

@@ -91,6 +94,7 @@ class AlloyBrowserMainParts : public content::BrowserMainParts {
  scoped_refptr<base::SingleThreadTaskRunner> user_blocking_task_runner_;

 #if defined(USE_AURA)
+  std::unique_ptr<display::Screen> screen_;
  std::unique_ptr<wm::WMState> wm_state_;
 #endif

--- a/libcef/browser/alloy/alloy_content_browser_client.cc
+++ b/libcef/browser/alloy/alloy_content_browser_client.cc
@@ -12,9 +12,10 @@
 #include "libcef/browser/alloy/alloy_browser_host_impl.h"
 #include "libcef/browser/alloy/alloy_browser_main.h"
 #include "libcef/browser/browser_context.h"
+#include "libcef/browser/browser_frame.h"
 #include "libcef/browser/browser_info.h"
 #include "libcef/browser/browser_info_manager.h"
-#include "libcef/browser/browser_message_filter.h"
+#include "libcef/browser/browser_manager.h"
 #include "libcef/browser/browser_platform_delegate.h"
 #include "libcef/browser/context.h"
 #include "libcef/browser/devtools/devtools_manager_delegate.h"
@@ -35,7 +36,6 @@
 #include "libcef/browser/x509_certificate_impl.h"
 #include "libcef/common/alloy/alloy_content_client.h"
 #include "libcef/common/app_manager.h"
-#include "libcef/common/cef_messages.h"
 #include "libcef/common/cef_switches.h"
 #include "libcef/common/command_line_impl.h"
 #include "libcef/common/extensions/extensions_util.h"
@@ -98,6 +98,7 @@
 #include "content/public/common/storage_quota_params.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/user_agent.h"
+#include "extensions/browser/event_router.h"
 #include "extensions/browser/extension_message_filter.h"
 #include "extensions/browser/extension_protocols.h"
 #include "extensions/browser/extension_registry.h"
@@ -238,9 +239,10 @@ class CefAllowCertificateErrorCallbackImpl : public CefRequestCallback {
        RunNow(std::move(callback_), allow);
      }
    } else {
-      CEF_POST_TASK(CEF_UIT,
-                    base::Bind(&CefAllowCertificateErrorCallbackImpl::Continue,
-                               this, allow));
+      CEF_POST_TASK(
+          CEF_UIT,
+          base::BindOnce(&CefAllowCertificateErrorCallbackImpl::Continue, this,
+                         allow));
    }
  }

@@ -253,7 +255,7 @@ class CefAllowCertificateErrorCallbackImpl : public CefRequestCallback {
    CEF_REQUIRE_UIT();
    std::move(callback).Run(
        allow ? content::CERTIFICATE_REQUEST_RESULT_TYPE_CONTINUE
-              : content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL);
+              : content::CERTIFICATE_REQUEST_RESULT_TYPE_DENY);
  }

  CallbackType callback_;
@@ -502,8 +504,6 @@ void AlloyContentBrowserClient::RenderProcessWillLaunch(
  const int id = host->GetID();
  Profile* profile = Profile::FromBrowserContext(host->GetBrowserContext());

-  host->AddFilter(new CefBrowserMessageFilter(id));
-
  if (extensions::ExtensionsEnabled()) {
    host->AddFilter(new extensions::ExtensionMessageFilter(id, profile));
    host->AddFilter(
@@ -695,9 +695,9 @@ void AlloyContentBrowserClient::AppendExtraCommandLineSwitches(
      switches::kLocalesDirPath,
      switches::kLogFile,
      switches::kLogSeverity,
-      switches::kProductVersion,
      switches::kResourcesDirPath,
      embedder_support::kUserAgent,
+      switches::kUserAgentProductAndVersion,
    };
    command_line->CopySwitchesFrom(*browser_cmd, kSwitchNames,
                                   base::size(kSwitchNames));
@@ -782,7 +782,7 @@ void AlloyContentBrowserClient::AppendExtraCommandLineSwitches(
      CefRefPtr<CefCommandLineImpl> commandLinePtr(
          new CefCommandLineImpl(command_line, false, false));
      handler->OnBeforeChildProcessLaunch(commandLinePtr.get());
-      commandLinePtr->Detach(nullptr);
+      ignore_result(commandLinePtr->Detach(nullptr));
    }
  }
 }
@@ -855,7 +855,7 @@ void AlloyContentBrowserClient::AllowCertificateError(
    // A sub-resource has a certificate error. The user doesn't really
    // have a context for making the right decision, so block the request
    // hard.
-    std::move(callback).Run(content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL);
+    std::move(callback).Run(content::CERTIFICATE_REQUEST_RESULT_TYPE_DENY);
    return;
  }

@@ -882,7 +882,7 @@ void AlloyContentBrowserClient::AllowCertificateError(
    // |callback| may be null if the user executed it despite returning false.
    callback = callbackImpl->Disconnect();
    if (!callback.is_null()) {
-      std::move(callback).Run(content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL);
+      std::move(callback).Run(content::CERTIFICATE_REQUEST_RESULT_TYPE_DENY);
    }
  }
 }
@@ -988,9 +988,9 @@ void AlloyContentBrowserClient::DidCreatePpapiPlugin(
          new ChromeBrowserPepperHostFactory(browser_host)));
 }

-content::DevToolsManagerDelegate*
-AlloyContentBrowserClient::GetDevToolsManagerDelegate() {
-  return new CefDevToolsManagerDelegate();
+std::unique_ptr<content::DevToolsManagerDelegate>
+AlloyContentBrowserClient::CreateDevToolsManagerDelegate() {
+  return std::make_unique<CefDevToolsManagerDelegate>();
 }

 std::vector<std::unique_ptr<content::NavigationThrottle>>
@@ -1044,6 +1044,14 @@ void AlloyContentBrowserClient::ExposeInterfacesToRenderer(
    content::RenderProcessHost* host) {
  associated_registry->AddInterface(
      base::BindRepeating(&BindPluginInfoHost, host->GetID()));
+
+  if (extensions::ExtensionsEnabled()) {
+    associated_registry->AddInterface(base::BindRepeating(
+        &extensions::EventRouter::BindForRenderer, host->GetID()));
+  }
+
+  CefBrowserManager::ExposeInterfacesToRenderer(registry, associated_registry,
+                                                host);
 }

 std::unique_ptr<net::ClientCertStore>
@@ -1151,7 +1159,7 @@ bool AlloyContentBrowserClient::WillCreateURLLoaderFactory(
    int render_process_id,
    URLLoaderFactoryType type,
    const url::Origin& request_initiator,
-    base::Optional<int64_t> navigation_id,
+    absl::optional<int64_t> navigation_id,
    ukm::SourceIdObj ukm_source_id,
    mojo::PendingReceiver<network::mojom::URLLoaderFactory>* factory_receiver,
    mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>*
@@ -1244,11 +1252,12 @@ bool AlloyContentBrowserClient::HandleExternalProtocol(
    const GURL& url,
    content::WebContents::OnceGetter web_contents_getter,
    int child_id,
+    int frame_tree_node_id,
    content::NavigationUIData* navigation_data,
    bool is_main_frame,
    ui::PageTransition page_transition,
    bool has_user_gesture,
-    const base::Optional<url::Origin>& initiating_origin,
+    const absl::optional<url::Origin>& initiating_origin,
    mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory) {
  // Call the other HandleExternalProtocol variant.
  return false;
@@ -1267,8 +1276,8 @@ bool AlloyContentBrowserClient::HandleExternalProtocol(
  // nothing handles the request.
  auto request_handler = net_service::CreateInterceptedRequestHandler(
      web_contents_getter, frame_tree_node_id, resource_request,
-      base::Bind(CefBrowserPlatformDelegate::HandleExternalProtocol,
-                 resource_request.url));
+      base::BindRepeating(CefBrowserPlatformDelegate::HandleExternalProtocol,
+                          resource_request.url));

  net_service::ProxyURLLoaderFactory::CreateProxy(
      web_contents_getter, std::move(receiver), std::move(request_handler));
@@ -1291,6 +1300,8 @@ void AlloyContentBrowserClient::RegisterBrowserInterfaceBindersForFrame(
    content::RenderFrameHost* render_frame_host,
    mojo::BinderMapWithContext<content::RenderFrameHost*>* map) {
  PopulateChromeFrameBinders(map);
+  CefBrowserFrame::RegisterBrowserInterfaceBindersForFrame(render_frame_host,
+                                                           map);

  if (!extensions::ExtensionsEnabled())
    return;
@@ -1362,7 +1373,7 @@ bool AlloyContentBrowserClient::ArePersistentMediaDeviceIDsAllowed(
    content::BrowserContext* browser_context,
    const GURL& url,
    const GURL& site_for_cookies,
-    const base::Optional<url::Origin>& top_frame_origin) {
+    const absl::optional<url::Origin>& top_frame_origin) {
  // Persistent MediaDevice IDs are allowed if cookies are allowed.
  return CookieSettingsFactory::GetForProfile(
             Profile::FromBrowserContext(browser_context))
--- a/libcef/browser/alloy/alloy_content_browser_client.h
+++ b/libcef/browser/alloy/alloy_content_browser_client.h
@@ -109,7 +109,8 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
  void BrowserURLHandlerCreated(content::BrowserURLHandler* handler) override;
  std::string GetDefaultDownloadName() override;
  void DidCreatePpapiPlugin(content::BrowserPpapiHost* browser_host) override;
-  content::DevToolsManagerDelegate* GetDevToolsManagerDelegate() override;
+  std::unique_ptr<content::DevToolsManagerDelegate>
+  CreateDevToolsManagerDelegate() override;
  std::vector<std::unique_ptr<content::NavigationThrottle>>
  CreateThrottlesForNavigation(
      content::NavigationHandle* navigation_handle) override;
@@ -157,7 +158,7 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
      int render_process_id,
      URLLoaderFactoryType type,
      const url::Origin& request_initiator,
-      base::Optional<int64_t> navigation_id,
+      absl::optional<int64_t> navigation_id,
      ukm::SourceIdObj ukm_source_id,
      mojo::PendingReceiver<network::mojom::URLLoaderFactory>* factory_receiver,
      mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>*
@@ -179,11 +180,12 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
      const GURL& url,
      content::WebContents::OnceGetter web_contents_getter,
      int child_id,
+      int frame_tree_node_id,
      content::NavigationUIData* navigation_data,
      bool is_main_frame,
      ui::PageTransition page_transition,
      bool has_user_gesture,
-      const base::Optional<url::Origin>& initiating_origin,
+      const absl::optional<url::Origin>& initiating_origin,
      mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory)
      override;
  bool HandleExternalProtocol(
@@ -209,7 +211,7 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
      content::BrowserContext* browser_context,
      const GURL& scope,
      const GURL& site_for_cookies,
-      const base::Optional<url::Origin>& top_frame_origin) override;
+      const absl::optional<url::Origin>& top_frame_origin) override;
  bool ShouldAllowPluginCreation(
      const url::Origin& embedder_origin,
      const content::PepperPluginInfo& plugin_info) override;
--- a/libcef/browser/alloy/browser_platform_delegate_alloy.cc
+++ b/libcef/browser/alloy/browser_platform_delegate_alloy.cc
@@ -12,6 +12,7 @@
 #include "libcef/browser/extensions/extension_web_contents_observer.h"
 #include "libcef/browser/printing/print_view_manager.h"
 #include "libcef/common/extensions/extensions_util.h"
+#include "libcef/common/net/url_util.h"
 #include "libcef/features/runtime_checks.h"

 #include "base/logging.h"
@@ -58,18 +59,20 @@ content::WebContents* CefBrowserPlatformDelegateAlloy::CreateWebContents(
  }

  scoped_refptr<content::SiteInstance> site_instance;
-  if (extensions::ExtensionsEnabled() && !create_params.url.is_empty()) {
+  if (extensions::ExtensionsEnabled() && !create_params.url.empty()) {
+    GURL gurl = url_util::MakeGURL(create_params.url, /*fixup=*/true);
    if (!create_params.extension) {
      // We might be loading an extension app view where the extension URL is
      // provided by the client.
      create_params.extension =
-          extensions::GetExtensionForUrl(browser_context, create_params.url);
+          extensions::GetExtensionForUrl(browser_context, gurl);
    }
    if (create_params.extension) {
-      if (create_params.extension_host_type == extensions::VIEW_TYPE_INVALID) {
+      if (create_params.extension_host_type ==
+          extensions::mojom::ViewType::kInvalid) {
        // Default to dialog behavior.
        create_params.extension_host_type =
-            extensions::VIEW_TYPE_EXTENSION_DIALOG;
+            extensions::mojom::ViewType::kExtensionDialog;
      }

      // Extension resources will fail to load if we don't use a SiteInstance
@@ -79,7 +82,7 @@ content::WebContents* CefBrowserPlatformDelegateAlloy::CreateWebContents(
      // ExtensionProtocolHandler::MaybeCreateJob will return false resulting in
      // ERR_BLOCKED_BY_CLIENT).
      site_instance = extensions::ProcessManager::Get(browser_context)
-                          ->GetSiteInstanceForURL(create_params.url);
+                          ->GetSiteInstanceForURL(gurl);
      DCHECK(site_instance);
    }
  }
@@ -189,7 +192,7 @@ void CefBrowserPlatformDelegateAlloy::BrowserCreated(
 void CefBrowserPlatformDelegateAlloy::CreateExtensionHost(
    const extensions::Extension* extension,
    const GURL& url,
-    extensions::ViewType host_type) {
+    extensions::mojom::ViewType host_type) {
  REQUIRE_ALLOY_RUNTIME();
  DCHECK(primary_);

@@ -200,14 +203,15 @@ void CefBrowserPlatformDelegateAlloy::CreateExtensionHost(

  auto alloy_browser = static_cast<AlloyBrowserHostImpl*>(browser_);

-  if (host_type == extensions::VIEW_TYPE_EXTENSION_DIALOG ||
-      host_type == extensions::VIEW_TYPE_EXTENSION_POPUP) {
+  if (host_type == extensions::mojom::ViewType::kExtensionDialog ||
+      host_type == extensions::mojom::ViewType::kExtensionPopup) {
    // Create an extension host that we own.
    extension_host_ = new extensions::CefExtensionViewHost(
        alloy_browser, extension, web_contents_, url, host_type);
    // Trigger load of the extension URL.
    extension_host_->CreateRendererSoon();
-  } else if (host_type == extensions::VIEW_TYPE_EXTENSION_BACKGROUND_PAGE) {
+  } else if (host_type ==
+             extensions::mojom::ViewType::kExtensionBackgroundPage) {
    is_background_host_ = true;
    alloy_browser->is_background_host_ = true;
    // Create an extension host that will be owned by ProcessManager.
@@ -375,12 +379,12 @@ void CefBrowserPlatformDelegateAlloy::PrintToPDF(
    return;
  printing::CefPrintViewManager::PdfPrintCallback pdf_callback;
  if (callback.get()) {
-    pdf_callback = base::Bind(&CefPdfPrintCallback::OnPdfPrintFinished,
-                              callback.get(), path);
+    pdf_callback = base::BindOnce(&CefPdfPrintCallback::OnPdfPrintFinished,
+                                  callback.get(), path);
  }
  GetPrintViewManager(actionable_contents)
      ->PrintToPDF(actionable_contents->GetMainFrame(), base::FilePath(path),
-                   settings, pdf_callback);
+                   settings, std::move(pdf_callback));
 }

 void CefBrowserPlatformDelegateAlloy::Find(int identifier,
@@ -449,7 +453,7 @@ void CefBrowserPlatformDelegateAlloy::DestroyExtensionHost() {
  if (!extension_host_)
    return;
  if (extension_host_->extension_host_type() ==
-      extensions::VIEW_TYPE_EXTENSION_BACKGROUND_PAGE) {
+      extensions::mojom::ViewType::kExtensionBackgroundPage) {
    DCHECK(is_background_host_);
    // Close notification for background pages arrives via CloseContents.
    // The extension host will be deleted by
--- a/libcef/browser/alloy/browser_platform_delegate_alloy.h
+++ b/libcef/browser/alloy/browser_platform_delegate_alloy.h
@@ -33,7 +33,7 @@ class CefBrowserPlatformDelegateAlloy : public CefBrowserPlatformDelegate {
  void BrowserCreated(CefBrowserHostBase* browser) override;
  void CreateExtensionHost(const extensions::Extension* extension,
                           const GURL& url,
-                           extensions::ViewType host_type) override;
+                           extensions::mojom::ViewType host_type) override;
  extensions::ExtensionHost* GetExtensionHost() const override;
  void BrowserDestroyed(CefBrowserHostBase* browser) override;
  void SendCaptureLostEvent() override;
--- a/libcef/browser/alloy/chrome_profile_alloy.cc
+++ b/libcef/browser/alloy/chrome_profile_alloy.cc
@@ -6,6 +6,7 @@
 #include "libcef/browser/alloy/chrome_profile_alloy.h"

 #include "base/no_destructor.h"
+#include "components/profile_metrics/browser_profile_type.h"
 #include "components/variations/variations_client.h"
 #include "components/variations/variations_ids_provider.h"
 #include "net/url_request/url_request_context.h"
@@ -35,7 +36,10 @@ class CefVariationsClient : public variations::VariationsClient {

 }  // namespace

-ChromeProfileAlloy::ChromeProfileAlloy() {}
+ChromeProfileAlloy::ChromeProfileAlloy() {
+  profile_metrics::SetBrowserProfileType(
+      this, profile_metrics::BrowserProfileType::kRegular);
+}

 ChromeProfileAlloy::~ChromeProfileAlloy() {}

@@ -44,13 +48,15 @@ bool ChromeProfileAlloy::IsOffTheRecord() {
 }

 bool ChromeProfileAlloy::IsOffTheRecord() const {
+  // Alloy contexts are never flagged as off-the-record. It causes problems
+  // for the extension system.
  return false;
 }

 const Profile::OTRProfileID& ChromeProfileAlloy::GetOTRProfileID() const {
  NOTREACHED();
  static base::NoDestructor<Profile::OTRProfileID> otr_profile_id(
-      "ProfileImp::NoOTRProfileID");
+      Profile::OTRProfileID::PrimaryID());
  return *otr_profile_id;
 }

@@ -71,7 +77,8 @@ std::string ChromeProfileAlloy::GetProfileUserName() const {
 }

 Profile* ChromeProfileAlloy::GetOffTheRecordProfile(
-    const Profile::OTRProfileID& otr_profile_id) {
+    const Profile::OTRProfileID& otr_profile_id,
+    bool create_if_needed) {
  NOTREACHED();
  return nullptr;
 }
@@ -115,11 +122,6 @@ ChromeProfileAlloy::GetExtensionSpecialStoragePolicy() {
  return nullptr;
 }

-PrefService* ChromeProfileAlloy::GetOffTheRecordPrefs() {
-  NOTREACHED();
-  return nullptr;
-}
-
 bool ChromeProfileAlloy::IsSameOrParent(Profile* profile) {
  NOTREACHED();
  return false;
--- a/libcef/browser/alloy/chrome_profile_alloy.h
+++ b/libcef/browser/alloy/chrome_profile_alloy.h
@@ -26,8 +26,8 @@ class ChromeProfileAlloy : public Profile {
  variations::VariationsClient* GetVariationsClient() override;
  scoped_refptr<base::SequencedTaskRunner> GetIOTaskRunner() override;
  std::string GetProfileUserName() const override;
-  Profile* GetOffTheRecordProfile(
-      const Profile::OTRProfileID& otr_profile_id) override;
+  Profile* GetOffTheRecordProfile(const Profile::OTRProfileID& otr_profile_id,
+                                  bool create_if_needed) override;
  std::vector<Profile*> GetAllOffTheRecordProfiles() override;
  void DestroyOffTheRecordProfile(Profile* otr_profile) override;
  bool HasOffTheRecordProfile(
@@ -38,7 +38,6 @@ class ChromeProfileAlloy : public Profile {
  bool IsSupervised() const override;
  bool IsChild() const override;
  ExtensionSpecialStoragePolicy* GetExtensionSpecialStoragePolicy() override;
-  PrefService* GetOffTheRecordPrefs() override;
  bool IsSameOrParent(Profile* profile) override;
  base::Time GetStartTime() const override;
  base::FilePath last_selected_directory() override;
--- a/libcef/browser/alloy/chrome_profile_manager_alloy.cc
+++ b/libcef/browser/alloy/chrome_profile_manager_alloy.cc
@@ -56,10 +56,3 @@ bool ChromeProfileManagerAlloy::IsValidProfile(const void* profile) {
  return !!CefBrowserContext::FromBrowserContext(
      static_cast<const content::BrowserContext*>(profile));
 }
-
-Profile* ChromeProfileManagerAlloy::GetLastUsedProfile(
-    const base::FilePath& user_data_dir) {
-  // Override this method to avoid having to register prefs::kProfileLastUsed,
-  // usage of which doesn't make sense for CEF.
-  return GetActiveBrowserContext()->AsProfile();
-}
--- a/libcef/browser/alloy/chrome_profile_manager_alloy.h
+++ b/libcef/browser/alloy/chrome_profile_manager_alloy.h
@@ -18,7 +18,6 @@ class ChromeProfileManagerAlloy : public ProfileManager {

  Profile* GetProfile(const base::FilePath& profile_dir) override;
  bool IsValidProfile(const void* profile) override;
-  Profile* GetLastUsedProfile(const base::FilePath& user_data_dir) override;

 private:
  DISALLOW_COPY_AND_ASSIGN(ChromeProfileManagerAlloy);
--- a/libcef/browser/audio_capturer.cc
+++ b/libcef/browser/audio_capturer.cc
@@ -110,7 +110,9 @@ void CefAudioCapturer::Capture(const media::AudioBus* source,
                                      pts.InMilliseconds());
 }

-void CefAudioCapturer::OnCaptureError(const std::string& message) {
+void CefAudioCapturer::OnCaptureError(
+    media::AudioCapturerSource::ErrorCode code,
+    const std::string& message) {
  audio_handler_->OnAudioStreamError(browser_, message);
  StopStream();
 }
--- a/libcef/browser/audio_capturer.h
+++ b/libcef/browser/audio_capturer.h
@@ -33,7 +33,8 @@ class CefAudioCapturer : public media::AudioCapturerSource::CaptureCallback {
               base::TimeTicks audio_capture_time,
               double volume,
               bool key_pressed) override;
-  void OnCaptureError(const std::string& message) override;
+  void OnCaptureError(media::AudioCapturerSource::ErrorCode code,
+                      const std::string& message) override;
  void OnCaptureMuted(bool is_muted) override {}

  void StopStream();
--- a/libcef/browser/audio_loopback_stream_creator.cc
+++ b/libcef/browser/audio_loopback_stream_creator.cc
@@ -44,7 +44,7 @@ class StreamCreatedCallbackAdapter final
          client_receiver,
      media::mojom::ReadOnlyAudioDataPipePtr data_pipe,
      bool initially_muted,
-      const base::Optional<base::UnguessableToken>& stream_id) override {
+      const absl::optional<base::UnguessableToken>& stream_id) override {
    DCHECK(!initially_muted);  // Loopback streams shouldn't be started muted.
    callback_.Run(std::move(stream), std::move(client_receiver),
                  std::move(data_pipe));
--- a/libcef/browser/browser_contents_delegate.cc
+++ b/libcef/browser/browser_contents_delegate.cc
@@ -8,6 +8,7 @@
 #include "libcef/browser/browser_platform_delegate.h"
 #include "libcef/browser/browser_util.h"

+#include "content/public/browser/focused_node_details.h"
 #include "content/public/browser/keyboard_event_processing_result.h"
 #include "content/public/browser/native_web_keyboard_event.h"
 #include "content/public/browser/navigation_entry.h"
@@ -16,6 +17,8 @@
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_view_host.h"
+#include "third_party/blink/public/mojom/favicon/favicon_url.mojom.h"
+#include "third_party/blink/public/mojom/input/focus_type.mojom-blink.h"

 using content::KeyboardEventProcessingResult;

@@ -68,9 +71,12 @@ content::WebContents* CefBrowserContentsDelegate::OpenURLFromTab(

  if (auto c = client()) {
    if (auto handler = c->GetRequestHandler()) {
+      // May return nullptr for omnibox navigations.
+      auto frame = browser()->GetFrame(params.frame_tree_node_id);
+      if (!frame)
+        frame = browser()->GetMainFrame();
      cancel = handler->OnOpenURLFromTab(
-          browser(), browser()->GetFrame(params.frame_tree_node_id),
-          params.url.spec(),
+          browser(), frame, params.url.spec(),
          static_cast<cef_window_open_disposition_t>(params.disposition),
          params.user_gesture);
    }
@@ -105,6 +111,7 @@ void CefBrowserContentsDelegate::LoadingStateChanged(

  if (auto c = client()) {
    if (auto handler = c->GetLoadHandler()) {
+      auto navigation_lock = browser_info_->CreateNavigationLock();
      handler->OnLoadingStateChange(browser(), is_loading, can_go_back,
                                    can_go_forward);
    }
@@ -123,9 +130,9 @@ void CefBrowserContentsDelegate::UpdateTargetURL(content::WebContents* source,
 bool CefBrowserContentsDelegate::DidAddMessageToConsole(
    content::WebContents* source,
    blink::mojom::ConsoleMessageLevel log_level,
-    const base::string16& message,
+    const std::u16string& message,
    int32_t line_no,
-    const base::string16& source_id) {
+    const std::u16string& source_id) {
  if (auto c = client()) {
    if (auto handler = c->GetDisplayHandler()) {
      // Use LOGSEVERITY_DEBUG for unrecognized |level| values.
@@ -227,18 +234,6 @@ bool CefBrowserContentsDelegate::HandleKeyboardEvent(
 void CefBrowserContentsDelegate::RenderFrameCreated(
    content::RenderFrameHost* render_frame_host) {
  browser_info_->MaybeCreateFrame(render_frame_host, false /* is_guest_view */);
-
-  if (render_frame_host->GetParent() == nullptr) {
-    // May be already registered if the renderer crashed previously.
-    auto render_view_host = render_frame_host->GetRenderViewHost();
-    if (!registrar_->IsRegistered(
-            this, content::NOTIFICATION_FOCUS_CHANGED_IN_PAGE,
-            content::Source<content::RenderViewHost>(render_view_host))) {
-      registrar_->Add(
-          this, content::NOTIFICATION_FOCUS_CHANGED_IN_PAGE,
-          content::Source<content::RenderViewHost>(render_view_host));
-    }
-  }
 }

 void CefBrowserContentsDelegate::RenderFrameHostChanged(
@@ -248,6 +243,13 @@ void CefBrowserContentsDelegate::RenderFrameHostChanged(
  RenderFrameCreated(new_host);
 }

+void CefBrowserContentsDelegate::RenderFrameHostStateChanged(
+    content::RenderFrameHost* host,
+    content::RenderFrameHost::LifecycleState old_state,
+    content::RenderFrameHost::LifecycleState new_state) {
+  browser_info_->FrameHostStateChanged(host, old_state, new_state);
+}
+
 void CefBrowserContentsDelegate::RenderFrameDeleted(
    content::RenderFrameHost* render_frame_host) {
  const auto frame_id = CefFrameHostImpl::MakeFrameId(render_frame_host);
@@ -259,17 +261,6 @@ void CefBrowserContentsDelegate::RenderFrameDeleted(
  }
 }

-void CefBrowserContentsDelegate::RenderViewDeleted(
-    content::RenderViewHost* render_view_host) {
-  if (registrar_->IsRegistered(
-          this, content::NOTIFICATION_FOCUS_CHANGED_IN_PAGE,
-          content::Source<content::RenderViewHost>(render_view_host))) {
-    registrar_->Remove(
-        this, content::NOTIFICATION_FOCUS_CHANGED_IN_PAGE,
-        content::Source<content::RenderViewHost>(render_view_host));
-  }
-}
-
 void CefBrowserContentsDelegate::RenderViewReady() {
  if (auto c = client()) {
    if (auto handler = c->GetRequestHandler()) {
@@ -324,7 +315,8 @@ void CefBrowserContentsDelegate::OnFrameFocused(
  OnStateChanged(State::kFocusedFrame);
 }

-void CefBrowserContentsDelegate::DocumentAvailableInMainFrame() {
+void CefBrowserContentsDelegate::DocumentAvailableInMainFrame(
+    content::RenderFrameHost* render_frame_host) {
  has_document_ = true;
  OnStateChanged(State::kDocument);

@@ -420,18 +412,6 @@ void CefBrowserContentsDelegate::DidFailLoad(
  OnLoadEnd(frame, validated_url, error_code);
 }

-bool CefBrowserContentsDelegate::OnMessageReceived(
-    const IPC::Message& message,
-    content::RenderFrameHost* render_frame_host) {
-  // Messages may arrive after a frame is detached. Ignore those messages.
-  auto frame = browser_info_->GetFrameForHost(render_frame_host);
-  if (frame) {
-    return static_cast<CefFrameHostImpl*>(frame.get())
-        ->OnMessageReceived(message);
-  }
-  return false;
-}
-
 void CefBrowserContentsDelegate::TitleWasSet(content::NavigationEntry* entry) {
  // |entry| may be NULL if a popup is created via window.open and never
  // navigated.
@@ -478,6 +458,13 @@ void CefBrowserContentsDelegate::OnWebContentsFocused(
  }
 }

+void CefBrowserContentsDelegate::OnFocusChangedInPage(
+    content::FocusedNodeDetails* details) {
+  focus_on_editable_field_ =
+      details->focus_type != blink::mojom::blink::FocusType::kNone &&
+      details->is_editable_node;
+}
+
 void CefBrowserContentsDelegate::WebContentsDestroyed() {
  auto wc = web_contents();
  ObserveWebContents(nullptr);
@@ -490,15 +477,12 @@ void CefBrowserContentsDelegate::Observe(
    int type,
    const content::NotificationSource& source,
    const content::NotificationDetails& details) {
-  DCHECK(type == content::NOTIFICATION_LOAD_STOP ||
-         type == content::NOTIFICATION_FOCUS_CHANGED_IN_PAGE);
+  DCHECK_EQ(type, content::NOTIFICATION_LOAD_STOP);

  if (type == content::NOTIFICATION_LOAD_STOP) {
    content::NavigationController* controller =
        content::Source<content::NavigationController>(source).ptr();
    OnTitleChange(controller->GetWebContents()->GetTitle());
-  } else if (type == content::NOTIFICATION_FOCUS_CHANGED_IN_PAGE) {
-    focus_on_editable_field_ = *content::Details<bool>(details).ptr();
  }
 }

@@ -507,6 +491,7 @@ void CefBrowserContentsDelegate::OnLoadEnd(CefRefPtr<CefFrame> frame,
                                           int http_status_code) {
  if (auto c = client()) {
    if (auto handler = c->GetLoadHandler()) {
+      auto navigation_lock = browser_info_->CreateNavigationLock();
      handler->OnLoadEnd(browser(), frame, http_status_code);
    }
  }
@@ -565,6 +550,7 @@ void CefBrowserContentsDelegate::OnLoadStart(
    ui::PageTransition transition_type) {
  if (auto c = client()) {
    if (auto handler = c->GetLoadHandler()) {
+      auto navigation_lock = browser_info_->CreateNavigationLock();
      // On the handler that loading has started.
      handler->OnLoadStart(browser(), frame,
                           static_cast<cef_transition_type_t>(transition_type));
@@ -586,7 +572,7 @@ void CefBrowserContentsDelegate::OnLoadError(CefRefPtr<CefFrame> frame,
  }
 }

-void CefBrowserContentsDelegate::OnTitleChange(const base::string16& title) {
+void CefBrowserContentsDelegate::OnTitleChange(const std::u16string& title) {
  if (auto c = client()) {
    if (auto handler = c->GetDisplayHandler()) {
      handler->OnTitleChange(browser(), title);
--- a/libcef/browser/browser_contents_delegate.h
+++ b/libcef/browser/browser_contents_delegate.h
@@ -10,6 +10,7 @@

 #include "libcef/browser/frame_host_impl.h"

+#include "base/callback_list.h"
 #include "base/observer_list.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
@@ -87,9 +88,9 @@ class CefBrowserContentsDelegate : public content::WebContentsDelegate,
  void UpdateTargetURL(content::WebContents* source, const GURL& url) override;
  bool DidAddMessageToConsole(content::WebContents* source,
                              blink::mojom::ConsoleMessageLevel log_level,
-                              const base::string16& message,
+                              const std::u16string& message,
                              int32_t line_no,
-                              const base::string16& source_id) override;
+                              const std::u16string& source_id) override;
  void DidNavigateMainFramePostCommit(
      content::WebContents* web_contents) override;
  void EnterFullscreenModeForTab(
@@ -107,12 +108,16 @@ class CefBrowserContentsDelegate : public content::WebContentsDelegate,
  void RenderFrameCreated(content::RenderFrameHost* render_frame_host) override;
  void RenderFrameHostChanged(content::RenderFrameHost* old_host,
                              content::RenderFrameHost* new_host) override;
+  void RenderFrameHostStateChanged(
+      content::RenderFrameHost* host,
+      content::RenderFrameHost::LifecycleState old_state,
+      content::RenderFrameHost::LifecycleState new_state) override;
  void RenderFrameDeleted(content::RenderFrameHost* render_frame_host) override;
-  void RenderViewDeleted(content::RenderViewHost* render_view_host) override;
  void RenderViewReady() override;
  void RenderProcessGone(base::TerminationStatus status) override;
  void OnFrameFocused(content::RenderFrameHost* render_frame_host) override;
-  void DocumentAvailableInMainFrame() override;
+  void DocumentAvailableInMainFrame(
+      content::RenderFrameHost* render_frame_host) override;
  void LoadProgressChanged(double progress) override;
  void DidStopLoading() override;
  void DidFinishNavigation(
@@ -120,8 +125,6 @@ class CefBrowserContentsDelegate : public content::WebContentsDelegate,
  void DidFailLoad(content::RenderFrameHost* render_frame_host,
                   const GURL& validated_url,
                   int error_code) override;
-  bool OnMessageReceived(const IPC::Message& message,
-                         content::RenderFrameHost* render_frame_host) override;
  void TitleWasSet(content::NavigationEntry* entry) override;
  void PluginCrashed(const base::FilePath& plugin_path,
                     base::ProcessId plugin_pid) override;
@@ -130,6 +133,7 @@ class CefBrowserContentsDelegate : public content::WebContentsDelegate,
      const std::vector<blink::mojom::FaviconURLPtr>& candidates) override;
  void OnWebContentsFocused(
      content::RenderWidgetHost* render_widget_host) override;
+  void OnFocusChangedInPage(content::FocusedNodeDetails* details) override;
  void WebContentsDestroyed() override;

  // NotificationObserver methods.
@@ -163,7 +167,7 @@ class CefBrowserContentsDelegate : public content::WebContentsDelegate,
  void OnLoadStart(CefRefPtr<CefFrame> frame,
                   ui::PageTransition transition_type);
  void OnLoadError(CefRefPtr<CefFrame> frame, const GURL& url, int error_code);
-  void OnTitleChange(const base::string16& title);
+  void OnTitleChange(const std::u16string& title);
  void OnFullscreenModeChange(bool fullscreen);

  void OnStateChanged(State state_changed);
--- a/libcef/browser/browser_context.cc
+++ b/libcef/browser/browser_context.cc
@@ -7,16 +7,20 @@
 #include <map>
 #include <utility>

-#include "libcef/browser/iothread_state.h"
+#include "libcef/browser/context.h"
 #include "libcef/browser/media_router/media_router_manager.h"
 #include "libcef/browser/request_context_impl.h"
 #include "libcef/browser/thread_util.h"
 #include "libcef/common/cef_switches.h"
+#include "libcef/features/runtime.h"

 #include "base/files/file_util.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
+#include "base/no_destructor.h"
+#include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
+#include "chrome/browser/profiles/profile.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -141,6 +145,28 @@ CefBrowserContext* GetSelf(base::WeakPtr<CefBrowserContext> self) {
  return self.get();
 }

+CefBrowserContext::CookieableSchemes MakeSupportedSchemes(
+    const CefString& schemes_list,
+    bool include_defaults) {
+  std::vector<std::string> all_schemes;
+  if (!schemes_list.empty()) {
+    all_schemes =
+        base::SplitString(schemes_list.ToString(), std::string(","),
+                          base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
+  }
+
+  if (include_defaults) {
+    // Add default schemes that should always support cookies.
+    // This list should match CookieMonster::kDefaultCookieableSchemes.
+    all_schemes.push_back("http");
+    all_schemes.push_back("https");
+    all_schemes.push_back("ws");
+    all_schemes.push_back("wss");
+  }
+
+  return base::make_optional(all_schemes);
+}
+
 }  // namespace

 CefBrowserContext::CefBrowserContext(const CefRequestContextSettings& settings)
@@ -154,13 +180,6 @@ CefBrowserContext::~CefBrowserContext() {
 #if DCHECK_IS_ON()
  DCHECK(is_shutdown_);
 #endif
-
-  if (iothread_state_) {
-    // Destruction of the CefIOThreadState will trigger destruction of all
-    // associated network requests.
-    content::BrowserThread::DeleteSoon(content::BrowserThread::IO, FROM_HERE,
-                                       iothread_state_.release());
-  }
 }

 void CefBrowserContext::Initialize() {
@@ -169,7 +188,14 @@ void CefBrowserContext::Initialize() {
  if (!cache_path_.empty())
    g_manager.Get().SetImplPath(this, cache_path_);

-  iothread_state_ = std::make_unique<CefIOThreadState>();
+  iothread_state_ = base::MakeRefCounted<CefIOThreadState>();
+
+  if (settings_.cookieable_schemes_list.length > 0 ||
+      settings_.cookieable_schemes_exclude_defaults) {
+    cookieable_schemes_ =
+        MakeSupportedSchemes(CefString(&settings_.cookieable_schemes_list),
+                             !settings_.cookieable_schemes_exclude_defaults);
+  }
 }

 void CefBrowserContext::Shutdown() {
@@ -203,7 +229,9 @@ void CefBrowserContext::RemoveCefRequestContext(
  // Delete ourselves when the reference count reaches zero.
  if (request_context_set_.empty()) {
    Shutdown();
-    delete this;
+
+    // Allow the current call stack to unwind before deleting |this|.
+    content::BrowserThread::DeleteSoon(CEF_UIT, FROM_HERE, this);
  }
 }

@@ -229,6 +257,25 @@ CefBrowserContext* CefBrowserContext::FromBrowserContext(
  return g_manager.Get().GetImplFromBrowserContext(context);
 }

+// static
+CefBrowserContext* CefBrowserContext::FromProfile(const Profile* profile) {
+  auto* cef_context = FromBrowserContext(profile);
+  if (cef_context)
+    return cef_context;
+
+  if (cef::IsChromeRuntimeEnabled()) {
+    auto* original_profile = profile->GetOriginalProfile();
+    if (original_profile != profile) {
+      // With the Chrome runtime if the user launches an incognito window via
+      // the UI we might be associated with the original Profile instead of the
+      // (current) incognito profile.
+      return FromBrowserContext(original_profile);
+    }
+  }
+
+  return nullptr;
+}
+
 // static
 std::vector<CefBrowserContext*> CefBrowserContext::GetAll() {
  return g_manager.Get().GetAllImpl();
@@ -254,15 +301,10 @@ void CefBrowserContext::OnRenderFrameCreated(
    handler_map_.AddHandler(render_process_id, render_frame_id,
                            frame_tree_node_id, handler);

-    if (iothread_state_) {
-      // Using base::Unretained() is safe because both this callback and
-      // possible deletion of |iothread_state_| will execute on the IO thread,
-      // and this callback will be executed first.
-      CEF_POST_TASK(CEF_IOT, base::Bind(&CefIOThreadState::AddHandler,
-                                        base::Unretained(iothread_state_.get()),
-                                        render_process_id, render_frame_id,
-                                        frame_tree_node_id, handler));
-    }
+    CEF_POST_TASK(CEF_IOT,
+                  base::BindOnce(&CefIOThreadState::AddHandler, iothread_state_,
+                                 render_process_id, render_frame_id,
+                                 frame_tree_node_id, handler));
  }
 }

@@ -292,15 +334,9 @@ void CefBrowserContext::OnRenderFrameDeleted(
    handler_map_.RemoveHandler(render_process_id, render_frame_id,
                               frame_tree_node_id);

-    if (iothread_state_) {
-      // Using base::Unretained() is safe because both this callback and
-      // possible deletion of |iothread_state_| will execute on the IO thread,
-      // and this callback will be executed first.
-      CEF_POST_TASK(CEF_IOT, base::Bind(&CefIOThreadState::RemoveHandler,
-                                        base::Unretained(iothread_state_.get()),
-                                        render_process_id, render_frame_id,
-                                        frame_tree_node_id));
-    }
+    CEF_POST_TASK(CEF_IOT, base::BindOnce(&CefIOThreadState::RemoveHandler,
+                                          iothread_state_, render_process_id,
+                                          render_frame_id, frame_tree_node_id));
  }

  if (is_main_frame) {
@@ -404,26 +440,16 @@ void CefBrowserContext::RegisterSchemeHandlerFactory(
    const CefString& scheme_name,
    const CefString& domain_name,
    CefRefPtr<CefSchemeHandlerFactory> factory) {
-  if (iothread_state_) {
-    // Using base::Unretained() is safe because both this callback and possible
-    // deletion of |iothread_state_| will execute on the IO thread, and this
-    // callback will be executed first.
-    CEF_POST_TASK(CEF_IOT,
-                  base::Bind(&CefIOThreadState::RegisterSchemeHandlerFactory,
-                             base::Unretained(iothread_state_.get()),
-                             scheme_name, domain_name, factory));
-  }
+  CEF_POST_TASK(
+      CEF_IOT,
+      base::BindOnce(&CefIOThreadState::RegisterSchemeHandlerFactory,
+                     iothread_state_, scheme_name, domain_name, factory));
 }

 void CefBrowserContext::ClearSchemeHandlerFactories() {
-  if (iothread_state_) {
-    // Using base::Unretained() is safe because both this callback and possible
-    // deletion of |iothread_state_| will execute on the IO thread, and this
-    // callback will be executed first.
-    CEF_POST_TASK(CEF_IOT,
-                  base::Bind(&CefIOThreadState::ClearSchemeHandlerFactories,
-                             base::Unretained(iothread_state_.get())));
-  }
+  CEF_POST_TASK(CEF_IOT,
+                base::BindOnce(&CefIOThreadState::ClearSchemeHandlerFactories,
+                               iothread_state_));
 }

 void CefBrowserContext::LoadExtension(
@@ -459,8 +485,7 @@ bool CefBrowserContext::IsPrintPreviewSupported() const {
 network::mojom::NetworkContext* CefBrowserContext::GetNetworkContext() {
  CEF_REQUIRE_UIT();
  auto browser_context = AsBrowserContext();
-  return browser_context->GetDefaultStoragePartition(browser_context)
-      ->GetNetworkContext();
+  return browser_context->GetDefaultStoragePartition()->GetNetworkContext();
 }

 CefMediaRouterManager* CefBrowserContext::GetMediaRouterManager() {
@@ -477,5 +502,24 @@ CefBrowserContext::CookieableSchemes CefBrowserContext::GetCookieableSchemes()
  if (cookieable_schemes_)
    return cookieable_schemes_;

-  return CefCookieManagerImpl::GetGlobalCookieableSchemes();
+  return GetGlobalCookieableSchemes();
+}
+
+// static
+CefBrowserContext::CookieableSchemes
+CefBrowserContext::GetGlobalCookieableSchemes() {
+  CEF_REQUIRE_UIT();
+
+  static base::NoDestructor<CookieableSchemes> schemes(
+      []() -> CookieableSchemes {
+        const auto& settings = CefContext::Get()->settings();
+        if (settings.cookieable_schemes_list.length > 0 ||
+            settings.cookieable_schemes_exclude_defaults) {
+          return MakeSupportedSchemes(
+              CefString(&settings.cookieable_schemes_list),
+              !settings.cookieable_schemes_exclude_defaults);
+        }
+        return absl::nullopt;
+      }());
+  return *schemes;
 }
--- a/libcef/browser/browser_context.h
+++ b/libcef/browser/browser_context.h
@@ -10,14 +10,16 @@
 #include <vector>

 #include "include/cef_request_context_handler.h"
+#include "libcef/browser/iothread_state.h"
 #include "libcef/browser/request_context_handler_map.h"

 #include "base/callback.h"
 #include "base/files/file_path.h"
 #include "base/memory/weak_ptr.h"
-#include "base/optional.h"
+#include "base/sequenced_task_runner_helpers.h"
 #include "chrome/common/plugin.mojom.h"
 #include "services/network/public/mojom/network_context.mojom.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 #include "url/origin.h"

 /*
@@ -80,7 +82,6 @@ class BrowserContext;

 class CefMediaRouterManager;
 class CefRequestContextImpl;
-class CefIOThreadState;
 class Profile;

 // Main entry point for configuring behavior on a per-RequestContext basis. The
@@ -103,6 +104,7 @@ class CefBrowserContext {
  // Returns the underlying CefBrowserContext if any.
  static CefBrowserContext* FromBrowserContext(
      const content::BrowserContext* context);
+  static CefBrowserContext* FromProfile(const Profile* profile);

  // Returns all existing CefBrowserContext.
  static std::vector<CefBrowserContext*> GetAll();
@@ -111,6 +113,13 @@ class CefBrowserContext {
  virtual content::BrowserContext* AsBrowserContext() = 0;
  virtual Profile* AsProfile() = 0;

+  // Returns true if the context is fully initialized.
+  virtual bool IsInitialized() const = 0;
+
+  // If the context is fully initialized execute |callback|, otherwise
+  // store it until the context is fully initialized.
+  virtual void StoreOrTriggerInitCallback(base::OnceClosure callback) = 0;
+
  // Called from CefRequestContextImpl to track associated objects. This
  // object will delete itself when the count reaches zero.
  void AddCefRequestContext(CefRequestContextImpl* context);
@@ -192,22 +201,20 @@ class CefBrowserContext {

  CefMediaRouterManager* GetMediaRouterManager();

-  using CookieableSchemes = base::Optional<std::vector<std::string>>;
+  using CookieableSchemes = absl::optional<std::vector<std::string>>;

  // Returns the schemes associated with this context specifically, or the
  // global configuration if unset.
  CookieableSchemes GetCookieableSchemes() const;
-
-  // Set the schemes associated with this context specifically.
-  void set_cookieable_schemes(const CookieableSchemes& schemes) {
-    cookieable_schemes_ = schemes;
-  }
+  static CookieableSchemes GetGlobalCookieableSchemes();

  // These accessors are safe to call from any thread because the values don't
  // change during this object's lifespan.
  const CefRequestContextSettings& settings() const { return settings_; }
  base::FilePath cache_path() const { return cache_path_; }
-  CefIOThreadState* iothread_state() const { return iothread_state_.get(); }
+  scoped_refptr<CefIOThreadState> iothread_state() const {
+    return iothread_state_;
+  }

  // Used to hold a WeakPtr reference to this this object. The Getter returns
  // nullptr if this object has already been destroyed.
@@ -230,7 +237,10 @@ class CefBrowserContext {
  base::FilePath cache_path_;

 private:
-  std::unique_ptr<CefIOThreadState> iothread_state_;
+  // For DeleteSoon().
+  friend class base::DeleteHelper<CefBrowserContext>;
+
+  scoped_refptr<CefIOThreadState> iothread_state_;
  CookieableSchemes cookieable_schemes_;
  std::unique_ptr<CefMediaRouterManager> media_router_manager_;

--- a/libcef/browser/browser_frame.cc
+++ b/libcef/browser/browser_frame.cc
@@ -0,0 +1,77 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "libcef/browser/browser_frame.h"
+
+#include "libcef/browser/browser_host_base.h"
+#include "libcef/browser/thread_util.h"
+
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+
+CefBrowserFrame::CefBrowserFrame(
+    content::RenderFrameHost* render_frame_host,
+    mojo::PendingReceiver<cef::mojom::BrowserFrame> receiver)
+    : FrameServiceBase(render_frame_host, std::move(receiver)) {}
+
+CefBrowserFrame::~CefBrowserFrame() = default;
+
+// static
+void CefBrowserFrame::RegisterBrowserInterfaceBindersForFrame(
+    content::RenderFrameHost* render_frame_host,
+    mojo::BinderMapWithContext<content::RenderFrameHost*>* map) {
+  map->Add<cef::mojom::BrowserFrame>(base::BindRepeating(
+      [](content::RenderFrameHost* frame_host,
+         mojo::PendingReceiver<cef::mojom::BrowserFrame> receiver) {
+        // This object is bound to the lifetime of |frame_host| and the mojo
+        // connection. See FrameServiceBase for details.
+        new CefBrowserFrame(frame_host, std::move(receiver));
+      }));
+}
+
+void CefBrowserFrame::SendMessage(const std::string& name,
+                                  base::Value arguments) {
+  // Always associate with the newly created RFH, which may be speculative when
+  // navigating cross-origin.
+  if (auto host = GetFrameHost(/*prefer_speculative=*/true)) {
+    host->SendMessage(name, std::move(arguments));
+  }
+}
+
+void CefBrowserFrame::FrameAttached() {
+  // Always send to the newly created RFH, which may be speculative when
+  // navigating cross-origin.
+  if (auto host = GetFrameHost(/*prefer_speculative=*/true)) {
+    host->FrameAttached();
+  }
+}
+
+void CefBrowserFrame::DidFinishFrameLoad(const GURL& validated_url,
+                                         int http_status_code) {
+  if (auto host = GetFrameHost()) {
+    host->DidFinishFrameLoad(validated_url, http_status_code);
+  }
+}
+
+void CefBrowserFrame::UpdateDraggableRegions(
+    absl::optional<std::vector<cef::mojom::DraggableRegionEntryPtr>> regions) {
+  if (auto host = GetFrameHost()) {
+    host->UpdateDraggableRegions(std::move(regions));
+  }
+}
+
+CefRefPtr<CefFrameHostImpl> CefBrowserFrame::GetFrameHost(
+    bool prefer_speculative) const {
+  CEF_REQUIRE_UIT();
+  auto rfh = render_frame_host();
+  if (auto browser = CefBrowserHostBase::GetBrowserForHost(rfh)) {
+    return browser->browser_info()->GetFrameForHost(rfh, nullptr,
+                                                    prefer_speculative);
+  }
+  NOTREACHED();
+  return nullptr;
+}
--- a/libcef/browser/browser_frame.h
+++ b/libcef/browser/browser_frame.h
@@ -0,0 +1,51 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_BROWSER_FRAME_H_
+#define CEF_LIBCEF_BROWSER_BROWSER_FRAME_H_
+#pragma once
+
+#include "libcef/browser/frame_host_impl.h"
+
+#include "cef/libcef/common/mojom/cef.mojom.h"
+#include "content/public/browser/frame_service_base.h"
+#include "mojo/public/cpp/bindings/binder_map.h"
+
+// Implementation of the BrowserFrame mojo interface.
+// This is implemented separately from CefFrameHostImpl to better manage the
+// association with the RenderFrameHost (which may be speculative, etc.), and so
+// that messages are always routed to the most appropriate CefFrameHostImpl
+// instance. Lifespan is tied to the RFH via FrameServiceBase.
+class CefBrowserFrame
+    : public content::FrameServiceBase<cef::mojom::BrowserFrame> {
+ public:
+  CefBrowserFrame(content::RenderFrameHost* render_frame_host,
+                  mojo::PendingReceiver<cef::mojom::BrowserFrame> receiver);
+  ~CefBrowserFrame() override;
+
+  // Called from the ContentBrowserClient method of the same name.
+  static void RegisterBrowserInterfaceBindersForFrame(
+      content::RenderFrameHost* render_frame_host,
+      mojo::BinderMapWithContext<content::RenderFrameHost*>* map);
+
+ private:
+  // cef::mojom::BrowserFrame methods:
+  void SendMessage(const std::string& name, base::Value arguments) override;
+  void FrameAttached() override;
+  void DidFinishFrameLoad(const GURL& validated_url,
+                          int32_t http_status_code) override;
+  void UpdateDraggableRegions(
+      absl::optional<std::vector<cef::mojom::DraggableRegionEntryPtr>> regions)
+      override;
+
+  // FrameServiceBase methods:
+  bool ShouldCloseOnFinishNavigation() const override { return false; }
+
+  CefRefPtr<CefFrameHostImpl> GetFrameHost(
+      bool prefer_speculative = false) const;
+
+  DISALLOW_COPY_AND_ASSIGN(CefBrowserFrame);
+};
+
+#endif  // CEF_LIBCEF_BROWSER_BROWSER_FRAME_H_
--- a/libcef/browser/browser_host_base.cc
+++ b/libcef/browser/browser_host_base.cc
@@ -6,16 +6,17 @@

 #include "libcef/browser/browser_info_manager.h"
 #include "libcef/browser/browser_platform_delegate.h"
+#include "libcef/browser/context.h"
 #include "libcef/browser/image_impl.h"
 #include "libcef/browser/navigation_entry_impl.h"
 #include "libcef/browser/thread_util.h"
+#include "libcef/common/net/url_util.h"

 #include "base/logging.h"
 #include "chrome/browser/spellchecker/spellcheck_factory.h"
 #include "chrome/browser/spellchecker/spellcheck_service.h"
 #include "components/favicon/core/favicon_url.h"
 #include "components/spellcheck/common/spellcheck_features.h"
-#include "components/url_formatter/url_fixer.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/download_manager.h"
 #include "content/public/browser/download_request_utils.h"
@@ -231,8 +232,7 @@ void CefBrowserHostBase::StartDownload(const CefString& url) {
  if (!browser_context)
    return;

-  content::DownloadManager* manager =
-      content::BrowserContext::GetDownloadManager(browser_context);
+  content::DownloadManager* manager = browser_context->GetDownloadManager();
  if (!manager)
    return;

@@ -366,7 +366,7 @@ void CefBrowserHostBase::GetNavigationEntries(
    CefRefPtr<CefNavigationEntryImpl> entry =
        new CefNavigationEntryImpl(controller.GetEntryAtIndex(current));
    visitor->Visit(entry.get(), true, current, total);
-    entry->Detach(nullptr);
+    ignore_result(entry->Detach(nullptr));
  } else {
    // Visit all entries.
    bool cont = true;
@@ -374,7 +374,7 @@ void CefBrowserHostBase::GetNavigationEntries(
      CefRefPtr<CefNavigationEntryImpl> entry =
          new CefNavigationEntryImpl(controller.GetEntryAtIndex(i));
      cont = visitor->Visit(entry.get(), (i == current), i, total);
-      entry->Detach(nullptr);
+      ignore_result(entry->Detach(nullptr));
    }
  }
 }
@@ -496,6 +496,10 @@ void CefBrowserHostBase::SendMouseWheelEvent(const CefMouseEvent& event,
  }
 }

+bool CefBrowserHostBase::IsValid() {
+  return browser_info_->browser() == this;
+}
+
 CefRefPtr<CefBrowserHost> CefBrowserHostBase::GetHost() {
  return this;
 }
@@ -761,16 +765,9 @@ bool CefBrowserHostBase::Navigate(const content::OpenURLParams& params) {
  CEF_REQUIRE_UIT();
  auto web_contents = GetWebContents();
  if (web_contents) {
-    // Fix common problems with user-typed text. Among other things, this:
-    // - Converts absolute file paths to "file://" URLs.
-    // - Normalizes "about:" and "chrome:" to "chrome://" URLs.
-    // - Adds the "http://" scheme if none was specified.
-    GURL gurl = url_formatter::FixupURL(params.url.possibly_invalid_spec(),
-                                        std::string());
-    if (!gurl.is_valid()) {
-      LOG(ERROR) << "Invalid URL: " << params.url.possibly_invalid_spec();
+    GURL gurl = params.url;
+    if (!url_util::FixupGURL(gurl))
      return false;
-    }

    web_contents->GetController().LoadURL(
        gurl, params.referrer, params.transition, params.extra_headers);
@@ -833,6 +830,16 @@ int CefBrowserHostBase::browser_id() const {
  return browser_info_->browser_id();
 }

+SkColor CefBrowserHostBase::GetBackgroundColor() const {
+  // Don't use |platform_delegate_| because it's not thread-safe.
+  return CefContext::Get()->GetBackgroundColor(
+      &settings_, IsWindowless() ? STATE_ENABLED : STATE_DISABLED);
+}
+
+bool CefBrowserHostBase::IsWindowless() const {
+  return false;
+}
+
 content::WebContents* CefBrowserHostBase::GetWebContents() const {
  CEF_REQUIRE_UIT();
  return contents_delegate_->web_contents();
--- a/libcef/browser/browser_host_base.h
+++ b/libcef/browser/browser_host_base.h
@@ -18,7 +18,7 @@

 #include "base/observer_list.h"
 #include "base/synchronization/lock.h"
-#include "extensions/common/view_type.h"
+#include "extensions/common/mojom/view_type.mojom.h"

 namespace extensions {
 class Extension;
@@ -51,8 +51,13 @@ struct CefBrowserCreateParams {

 #if defined(TOOLKIT_VIEWS)
  // The BrowserView that will own a Views-hosted browser. Will be nullptr for
-  // popup browsers (the BrowserView will be created later in that case).
+  // popup browsers.
  CefRefPtr<CefBrowserView> browser_view;
+
+  // True if this browser is a popup and has a Views-hosted opener, in which
+  // case the BrowserView for this browser will be created later (from
+  // PopupWebContentsCreated).
+  bool popup_with_views_hosted_opener = false;
 #endif

  // Client implementation. May be nullptr.
@@ -60,7 +65,7 @@ struct CefBrowserCreateParams {

  // Initial URL to load. May be empty. If this is a valid extension URL then
  // the browser will be created as an app view extension host.
-  GURL url;
+  CefString url;

  // Browser settings.
  CefBrowserSettings settings;
@@ -81,7 +86,8 @@ struct CefBrowserCreateParams {
  // ProcessManager::CreateBackgroundHost. Currently used with the alloy
  // runtime only.
  const extensions::Extension* extension = nullptr;
-  extensions::ViewType extension_host_type = extensions::VIEW_TYPE_INVALID;
+  extensions::mojom::ViewType extension_host_type =
+      extensions::mojom::ViewType::kInvalid;
 };

 // Base class for CefBrowserHost implementations. Includes functionality that is
@@ -177,6 +183,7 @@ class CefBrowserHostBase : public CefBrowserHost,
  CefRefPtr<CefNavigationEntry> GetVisibleNavigationEntry() override;

  // CefBrowser methods:
+  bool IsValid() override;
  CefRefPtr<CefBrowserHost> GetHost() override;
  bool CanGoBack() override;
  void GoBack() override;
@@ -241,6 +248,10 @@ class CefBrowserHostBase : public CefBrowserHost,
    return request_context_;
  }
  bool is_views_hosted() const { return is_views_hosted_; }
+  SkColor GetBackgroundColor() const;
+
+  // Returns true if windowless rendering is enabled.
+  virtual bool IsWindowless() const;

  // Accessors that must be called on the UI thread.
  content::WebContents* GetWebContents() const;
--- a/libcef/browser/browser_host_create.cc
+++ b/libcef/browser/browser_host_create.cc
@@ -27,6 +27,11 @@ class CreateBrowserHelper {
        extra_info_(extra_info),
        request_context_(request_context) {}

+  void Run() {
+    CefBrowserHost::CreateBrowserSync(window_info_, client_, url_, settings_,
+                                      extra_info_, request_context_);
+  }
+
  CefWindowInfo window_info_;
  CefRefPtr<CefClient> client_;
  CefString url_;
@@ -71,19 +76,25 @@ bool CefBrowserHost::CreateBrowser(
                  "reduced performance or runtime errors.";
  }

-  // Create the browser on the UI thread.
-  CreateBrowserHelper* helper = new CreateBrowserHelper(
+  if (!request_context) {
+    request_context = CefRequestContext::GetGlobalContext();
+  }
+
+  auto helper = std::make_unique<CreateBrowserHelper>(
      windowInfo, client, url, settings, extra_info, request_context);
-  CEF_POST_TASK(CEF_UIT, base::BindOnce(
-                             [](CreateBrowserHelper* helper) {
-                               CefBrowserHost::CreateBrowserSync(
-                                   helper->window_info_, helper->client_,
-                                   helper->url_, helper->settings_,
-                                   helper->extra_info_,
-                                   helper->request_context_);
-                               delete helper;
-                             },
-                             helper));
+
+  auto request_context_impl =
+      static_cast<CefRequestContextImpl*>(request_context.get());
+
+  // Wait for the browser context to be initialized before creating the browser.
+  request_context_impl->ExecuteWhenBrowserContextInitialized(base::BindOnce(
+      [](std::unique_ptr<CreateBrowserHelper> helper) {
+        // Always execute asynchronously to avoid potential issues if we're
+        // being called synchronously during app initialization.
+        CEF_POST_TASK(CEF_UIT, base::BindOnce(&CreateBrowserHelper::Run,
+                                              std::move(helper)));
+      },
+      std::move(helper)));

  return true;
 }
@@ -108,9 +119,14 @@ CefRefPtr<CefBrowser> CefBrowserHost::CreateBrowserSync(
    return nullptr;
  }

-  // Verify that this method is being called on the UI thread.
-  if (!CEF_CURRENTLY_ON_UIT()) {
-    NOTREACHED() << "called on invalid thread";
+  if (!request_context) {
+    request_context = CefRequestContext::GetGlobalContext();
+  }
+
+  // Verify that the browser context is valid.
+  auto request_context_impl =
+      static_cast<CefRequestContextImpl*>(request_context.get());
+  if (!request_context_impl->VerifyBrowserContext()) {
    return nullptr;
  }

@@ -124,12 +140,7 @@ CefRefPtr<CefBrowser> CefBrowserHost::CreateBrowserSync(
  CefBrowserCreateParams create_params;
  create_params.window_info.reset(new CefWindowInfo(windowInfo));
  create_params.client = client;
-  create_params.url = GURL(url.ToString());
-  if (!url.empty() && !create_params.url.is_valid() &&
-      !create_params.url.has_scheme()) {
-    std::string new_url = std::string("http://") + url.ToString();
-    create_params.url = GURL(new_url);
-  }
+  create_params.url = url;
  create_params.settings = settings;
  create_params.extra_info = extra_info;
  create_params.request_context = request_context;
--- a/libcef/browser/browser_info.cc
+++ b/libcef/browser/browser_info.cc
@@ -15,10 +15,12 @@
 #include "ipc/ipc_message.h"

 CefBrowserInfo::FrameInfo::~FrameInfo() {
-  if (frame_ && !is_main_frame_) {
-    // Disassociate sub-frames from the browser.
-    frame_->Detach();
+#if DCHECK_IS_ON()
+  if (frame_ && !IsCurrentMainFrame()) {
+    // Should already be Detached.
+    DCHECK(!frame_->GetRenderFrameHost());
  }
+#endif
 }

 CefBrowserInfo::CefBrowserInfo(int browser_id,
@@ -32,7 +34,9 @@ CefBrowserInfo::CefBrowserInfo(int browser_id,
  DCHECK_GT(browser_id, 0);
 }

-CefBrowserInfo::~CefBrowserInfo() {}
+CefBrowserInfo::~CefBrowserInfo() {
+  DCHECK(frame_info_set_.empty());
+}

 CefRefPtr<CefBrowserHostBase> CefBrowserInfo::browser() const {
  base::AutoLock lock_scope(lock_);
@@ -40,11 +44,29 @@ CefRefPtr<CefBrowserHostBase> CefBrowserInfo::browser() const {
 }

 void CefBrowserInfo::SetBrowser(CefRefPtr<CefBrowserHostBase> browser) {
-  base::AutoLock lock_scope(lock_);
+  NotificationStateLock lock_scope(this);
+
+  if (browser) {
+    DCHECK(!browser_);
+
+    // Cache the associated frame handler.
+    if (auto client = browser->GetClient()) {
+      frame_handler_ = client->GetFrameHandler();
+    }
+  } else {
+    DCHECK(browser_);
+  }
+
+  auto old_browser = browser_;
  browser_ = browser;

-  if (!browser) {
-    RemoveAllFrames();
+  if (!browser_) {
+    RemoveAllFrames(old_browser);
+
+    // Any future calls to MaybeExecuteFrameNotification will now fail.
+    // NotificationStateLock already took a reference for the delivery of any
+    // notifications that are currently queued due to RemoveAllFrames.
+    frame_handler_ = nullptr;
  }
 }

@@ -68,7 +90,7 @@ void CefBrowserInfo::MaybeCreateFrame(content::RenderFrameHost* host,
                                   ->render_manager()
                                   ->current_frame_host() != host);

-  base::AutoLock lock_scope(lock_);
+  NotificationStateLock lock_scope(this);
  DCHECK(browser_);

  const auto it = frame_id_map_.find(frame_id);
@@ -86,14 +108,8 @@ void CefBrowserInfo::MaybeCreateFrame(content::RenderFrameHost* host,
    if (!info->is_guest_view_ && info->is_speculative_ && !is_speculative) {
      // Upgrade the frame info from speculative to non-speculative.
      if (info->is_main_frame_) {
-        if (main_frame_) {
-          // Update the existing main frame object.
-          main_frame_->SetRenderFrameHost(host);
-          info->frame_ = main_frame_;
-        } else {
-          // Set the main frame object.
-          main_frame_ = info->frame_;
-        }
+        // Set the main frame object.
+        SetMainFrame(browser_, info->frame_);
      }
      info->is_speculative_ = false;
      MaybeUpdateFrameTreeNodeIdMap(info);
@@ -111,17 +127,13 @@ void CefBrowserInfo::MaybeCreateFrame(content::RenderFrameHost* host,

  // Guest views don't get their own CefBrowser or CefFrame objects.
  if (!is_guest_view) {
-    if (is_main_frame && main_frame_ && !is_speculative) {
-      // Update the existing main frame object.
-      main_frame_->SetRenderFrameHost(host);
-      frame_info->frame_ = main_frame_;
-    } else {
-      // Create a new frame object.
-      frame_info->frame_ = new CefFrameHostImpl(this, host);
-      if (is_main_frame && !is_speculative) {
-        main_frame_ = frame_info->frame_;
-      }
+    // Create a new frame object.
+    frame_info->frame_ = new CefFrameHostImpl(this, host);
+    MaybeNotifyFrameCreated(frame_info->frame_);
+    if (is_main_frame && !is_speculative) {
+      SetMainFrame(browser_, frame_info->frame_);
    }
+
 #if DCHECK_IS_ON()
    // Check that the frame info hasn't changed unexpectedly.
    DCHECK_EQ(frame_id, frame_info->frame_->GetIdentifier());
@@ -141,10 +153,36 @@ void CefBrowserInfo::MaybeCreateFrame(content::RenderFrameHost* host,
  frame_info_set_.insert(base::WrapUnique(frame_info));
 }

+void CefBrowserInfo::FrameHostStateChanged(
+    content::RenderFrameHost* host,
+    content::RenderFrameHost::LifecycleState old_state,
+    content::RenderFrameHost::LifecycleState new_state) {
+  CEF_REQUIRE_UIT();
+
+  // We currently only care about BackForwardCache state changes.
+  bool added_to_bfcache =
+      new_state ==
+      content::RenderFrameHost::LifecycleState::kInBackForwardCache;
+  bool removed_from_bfcache =
+      old_state ==
+      content::RenderFrameHost::LifecycleState::kInBackForwardCache;
+  if (!added_to_bfcache && !removed_from_bfcache)
+    return;
+
+  base::AutoLock lock_scope(lock_);
+
+  const auto frame_id = CefFrameHostImpl::MakeFrameId(host);
+  auto it = frame_id_map_.find(frame_id);
+  DCHECK(it != frame_id_map_.end());
+  DCHECK((!it->second->is_in_bfcache_ && added_to_bfcache) ||
+         (it->second->is_in_bfcache_ && removed_from_bfcache));
+  it->second->is_in_bfcache_ = added_to_bfcache;
+}
+
 void CefBrowserInfo::RemoveFrame(content::RenderFrameHost* host) {
  CEF_REQUIRE_UIT();

-  base::AutoLock lock_scope(lock_);
+  NotificationStateLock lock_scope(this);

  const auto frame_id = CefFrameHostImpl::MakeFrameId(host);

@@ -174,19 +212,25 @@ void CefBrowserInfo::RemoveFrame(content::RenderFrameHost* host) {
  // And finally delete the frame info.
  {
    auto it2 = frame_info_set_.find(frame_info);
+
+    // Explicitly Detach everything but the current main frame.
+    const auto& frame_info = *it2;
+    if (frame_info->frame_ && !frame_info->IsCurrentMainFrame()) {
+      if (frame_info->frame_->Detach())
+        MaybeNotifyFrameDetached(browser_, frame_info->frame_);
+    }
+
    frame_info_set_.erase(it2);
  }
 }

 CefRefPtr<CefFrameHostImpl> CefBrowserInfo::GetMainFrame() {
-  base::AutoLock lock_scope(lock_);
-  DCHECK(browser_);
-  if (!main_frame_) {
-    // Create a temporary object that will eventually be updated with real
-    // routing information.
-    main_frame_ =
-        new CefFrameHostImpl(this, true, CefFrameHostImpl::kInvalidFrameId);
-  }
+  NotificationStateLock lock_scope(this);
+  // Early exit if called post-destruction.
+  if (!browser_)
+    return nullptr;
+
+  CHECK(main_frame_);
  return main_frame_;
 }

@@ -195,25 +239,29 @@ CefRefPtr<CefFrameHostImpl> CefBrowserInfo::CreateTempSubFrame(
  CefRefPtr<CefFrameHostImpl> parent = GetFrameForId(parent_frame_id);
  if (!parent)
    parent = GetMainFrame();
-  return new CefFrameHostImpl(this, false, parent->GetIdentifier());
+  // Intentionally not notifying for temporary frames.
+  return new CefFrameHostImpl(this, parent->GetIdentifier());
 }

 CefRefPtr<CefFrameHostImpl> CefBrowserInfo::GetFrameForHost(
    const content::RenderFrameHost* host,
-    bool* is_guest_view) const {
+    bool* is_guest_view,
+    bool prefer_speculative) const {
  if (is_guest_view)
    *is_guest_view = false;

  if (!host)
    return nullptr;

-  return GetFrameForId(CefFrameHostImpl::MakeFrameId(host), is_guest_view);
+  return GetFrameForId(CefFrameHostImpl::MakeFrameId(host), is_guest_view,
+                       prefer_speculative);
 }

 CefRefPtr<CefFrameHostImpl> CefBrowserInfo::GetFrameForRoute(
    int32_t render_process_id,
    int32_t render_routing_id,
-    bool* is_guest_view) const {
+    bool* is_guest_view,
+    bool prefer_speculative) const {
  if (is_guest_view)
    *is_guest_view = false;

@@ -222,12 +270,13 @@ CefRefPtr<CefFrameHostImpl> CefBrowserInfo::GetFrameForRoute(

  return GetFrameForId(
      CefFrameHostImpl::MakeFrameId(render_process_id, render_routing_id),
-      is_guest_view);
+      is_guest_view, prefer_speculative);
 }

 CefRefPtr<CefFrameHostImpl> CefBrowserInfo::GetFrameForId(
    int64_t frame_id,
-    bool* is_guest_view) const {
+    bool* is_guest_view,
+    bool prefer_speculative) const {
  if (is_guest_view)
    *is_guest_view = false;

@@ -246,7 +295,7 @@ CefRefPtr<CefFrameHostImpl> CefBrowserInfo::GetFrameForId(
      return nullptr;
    }

-    if (info->is_speculative_) {
+    if (info->is_speculative_ && !prefer_speculative) {
      if (info->is_main_frame_ && main_frame_) {
        // Always prefer the non-speculative main frame.
        return main_frame_;
@@ -291,8 +340,9 @@ CefBrowserInfo::FrameHostList CefBrowserInfo::GetAllFrames() const {
  base::AutoLock lock_scope(lock_);
  FrameHostList frames;
  for (const auto& info : frame_info_set_) {
-    if (info->frame_ && !info->is_speculative_)
+    if (info->frame_ && !info->is_speculative_ && !info->is_in_bfcache_) {
      frames.insert(info->frame_);
+    }
  }
  return frames;
 }
@@ -328,6 +378,30 @@ bool CefBrowserInfo::IsNavigationLocked(base::OnceClosure pending_action) {
  return false;
 }

+void CefBrowserInfo::MaybeExecuteFrameNotification(
+    FrameNotifyOnceAction pending_action) {
+  CefRefPtr<CefFrameHandler> frame_handler;
+
+  {
+    base::AutoLock lock_scope_(notification_lock_);
+    if (!frame_handler_) {
+      // No notifications will be executed.
+      return;
+    }
+
+    if (notification_state_lock_) {
+      // Queue the notification until the lock is released.
+      notification_state_lock_->queue_.push(std::move(pending_action));
+      return;
+    }
+
+    frame_handler = frame_handler_;
+  }
+
+  // Execute immediately if not locked.
+  std::move(pending_action).Run(frame_handler);
+}
+
 void CefBrowserInfo::MaybeUpdateFrameTreeNodeIdMap(FrameInfo* info) {
  lock_.AssertAcquired();

@@ -381,24 +455,150 @@ CefRefPtr<CefFrameHostImpl> CefBrowserInfo::GetFrameForFrameTreeNodeInternal(
  return nullptr;
 }

-void CefBrowserInfo::RemoveAllFrames() {
+// Passing in |browser| here because |browser_| may already be cleared.
+void CefBrowserInfo::SetMainFrame(CefRefPtr<CefBrowserHostBase> browser,
+                                  CefRefPtr<CefFrameHostImpl> frame) {
  lock_.AssertAcquired();
+  DCHECK(browser);
+  DCHECK(!frame || frame->IsMain());
+
+  CefRefPtr<CefFrameHostImpl> old_frame;
+  if (main_frame_) {
+    old_frame = main_frame_;
+    if (old_frame->Detach())
+      MaybeNotifyFrameDetached(browser, old_frame);
+  }
+
+  main_frame_ = frame;
+
+  MaybeNotifyMainFrameChanged(browser, old_frame, main_frame_);
+}
+
+void CefBrowserInfo::MaybeNotifyFrameCreated(
+    CefRefPtr<CefFrameHostImpl> frame) {
+  CEF_REQUIRE_UIT();
+
+  // Never notify for temporary objects.
+  DCHECK(!frame->is_temporary());
+
+  MaybeExecuteFrameNotification(base::BindOnce(
+      [](scoped_refptr<CefBrowserInfo> self, CefRefPtr<CefFrameHostImpl> frame,
+         CefRefPtr<CefFrameHandler> handler) {
+        if (auto browser = self->browser()) {
+          handler->OnFrameCreated(browser, frame);
+        }
+      },
+      scoped_refptr<CefBrowserInfo>(this), frame));
+}
+
+// Passing in |browser| here because |browser_| may already be cleared.
+void CefBrowserInfo::MaybeNotifyFrameDetached(
+    CefRefPtr<CefBrowserHostBase> browser,
+    CefRefPtr<CefFrameHostImpl> frame) {
+  CEF_REQUIRE_UIT();
+
+  // Never notify for temporary objects.
+  DCHECK(!frame->is_temporary());
+
+  MaybeExecuteFrameNotification(base::BindOnce(
+      [](CefRefPtr<CefBrowserHostBase> browser,
+         CefRefPtr<CefFrameHostImpl> frame,
+         CefRefPtr<CefFrameHandler> handler) {
+        handler->OnFrameDetached(browser, frame);
+      },
+      browser, frame));
+}
+
+// Passing in |browser| here because |browser_| may already be cleared.
+void CefBrowserInfo::MaybeNotifyMainFrameChanged(
+    CefRefPtr<CefBrowserHostBase> browser,
+    CefRefPtr<CefFrameHostImpl> old_frame,
+    CefRefPtr<CefFrameHostImpl> new_frame) {
+  CEF_REQUIRE_UIT();
+
+  // Never notify for temporary objects.
+  DCHECK(!old_frame || !old_frame->is_temporary());
+  DCHECK(!new_frame || !new_frame->is_temporary());
+
+  MaybeExecuteFrameNotification(base::BindOnce(
+      [](CefRefPtr<CefBrowserHostBase> browser,
+         CefRefPtr<CefFrameHostImpl> old_frame,
+         CefRefPtr<CefFrameHostImpl> new_frame,
+         CefRefPtr<CefFrameHandler> handler) {
+        handler->OnMainFrameChanged(browser, old_frame, new_frame);
+      },
+      browser, old_frame, new_frame));
+}
+
+void CefBrowserInfo::RemoveAllFrames(
+    CefRefPtr<CefBrowserHostBase> old_browser) {
+  lock_.AssertAcquired();
+
+  // Make sure any callbacks will see the correct state (e.g. like
+  // CefBrowser::GetMainFrame returning nullptr and CefBrowser::IsValid
+  // returning false).
+  DCHECK(!browser_);
+  DCHECK(old_browser);

  // Clear the lookup maps.
  frame_id_map_.clear();
  frame_tree_node_id_map_.clear();

-  // Explicitly Detach main frames.
+  // Explicitly Detach everything but the current main frame.
  for (auto& info : frame_info_set_) {
-    if (info->frame_ && info->is_main_frame_)
-      info->frame_->Detach();
+    if (info->frame_ && !info->IsCurrentMainFrame()) {
+      if (info->frame_->Detach())
+        MaybeNotifyFrameDetached(old_browser, info->frame_);
+    }
  }

-  if (main_frame_) {
-    main_frame_->Detach();
-    main_frame_ = nullptr;
-  }
+  if (main_frame_)
+    SetMainFrame(old_browser, nullptr);

  // And finally delete the frame info.
  frame_info_set_.clear();
 }
+
+CefBrowserInfo::NotificationStateLock::NotificationStateLock(
+    CefBrowserInfo* browser_info)
+    : browser_info_(browser_info) {
+  // Take the navigation state lock.
+  {
+    base::AutoLock lock_scope_(browser_info_->notification_lock_);
+    CHECK(!browser_info_->notification_state_lock_);
+    browser_info_->notification_state_lock_ = this;
+    // We may need this on destruction, and the original might be cleared.
+    frame_handler_ = browser_info_->frame_handler_;
+  }
+
+  // Take the browser info state lock.
+  browser_info_lock_scope_.reset(new base::AutoLock(browser_info_->lock_));
+}
+
+CefBrowserInfo::NotificationStateLock::~NotificationStateLock() {
+  // Unlock in reverse order.
+  browser_info_lock_scope_.reset();
+
+  {
+    base::AutoLock lock_scope_(browser_info_->notification_lock_);
+    CHECK_EQ(this, browser_info_->notification_state_lock_);
+    browser_info_->notification_state_lock_ = nullptr;
+  }
+
+  if (!queue_.empty()) {
+    DCHECK(frame_handler_);
+
+    scoped_refptr<NavigationLock> nav_lock;
+    if (CEF_CURRENTLY_ON_UIT()) {
+      // Don't navigate while inside callbacks.
+      nav_lock = browser_info_->CreateNavigationLock();
+    }
+
+    // Empty the queue of pending actions. Any of these actions might result in
+    // the acquisition of a new NotificationStateLock.
+    while (!queue_.empty()) {
+      std::move(queue_.front()).Run(frame_handler_);
+      queue_.pop();
+    }
+  }
+}
--- a/libcef/browser/browser_info.h
+++ b/libcef/browser/browser_info.h
@@ -6,6 +6,7 @@
 #define CEF_LIBCEF_BROWSER_BROWSER_INFO_H_
 #pragma once

+#include <queue>
 #include <set>
 #include <unordered_map>

@@ -18,12 +19,10 @@
 #include "base/memory/weak_ptr.h"
 #include "base/synchronization/lock.h"
 #include "base/values.h"
-
-namespace content {
-class RenderFrameHost;
-}
+#include "content/public/browser/render_frame_host.h"

 class CefBrowserHostBase;
+class CefFrameHandler;
 class CefFrameHostImpl;

 // CefBrowserInfo is used to associate a browser ID and render view/process
@@ -60,6 +59,13 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
  // true).
  void MaybeCreateFrame(content::RenderFrameHost* host, bool is_guest_view);

+  // Used to track state changes such as entering/exiting the BackForwardCache.
+  // Called from CefBrowserContentsDelegate::RenderFrameHostStateChanged.
+  void FrameHostStateChanged(
+      content::RenderFrameHost* host,
+      content::RenderFrameHost::LifecycleState old_state,
+      content::RenderFrameHost::LifecycleState new_state);
+
  // Remove the frame record for |host|. Called for the main frame when the
  // RenderView is destroyed, or for a sub-frame when the associated RenderFrame
  // is destroyed in the renderer process.
@@ -88,7 +94,8 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
  // UI thread.
  CefRefPtr<CefFrameHostImpl> GetFrameForHost(
      const content::RenderFrameHost* host,
-      bool* is_guest_view = nullptr) const;
+      bool* is_guest_view = nullptr,
+      bool prefer_speculative = false) const;

  // Returns the frame object matching the specified IDs or nullptr if no match
  // is found. Nullptr will also be returned if a guest view match is found
@@ -98,7 +105,8 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
  CefRefPtr<CefFrameHostImpl> GetFrameForRoute(
      int32_t render_process_id,
      int32_t render_routing_id,
-      bool* is_guest_view = nullptr) const;
+      bool* is_guest_view = nullptr,
+      bool prefer_speculative = false) const;

  // Returns the frame object matching the specified ID or nullptr if no match
  // is found. Nullptr will also be returned if a guest view match is found
@@ -107,7 +115,8 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
  // thread.
  CefRefPtr<CefFrameHostImpl> GetFrameForId(
      int64_t frame_id,
-      bool* is_guest_view = nullptr) const;
+      bool* is_guest_view = nullptr,
+      bool prefer_speculative = false) const;

  // Returns the frame object matching the specified ID or nullptr if no match
  // is found. Nullptr will also be returned if a guest view match is found
@@ -146,6 +155,16 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
  // thread.
  bool IsNavigationLocked(base::OnceClosure pending_action);

+  using FrameNotifyOnceAction =
+      base::OnceCallback<void(CefRefPtr<CefFrameHandler>)>;
+
+  // Specifies a CefFrameHandler notification action whose execution may need
+  // to be blocked on release of a potentially held NotificationStateLock. If no
+  // CefFrameHandler exists then the action will be discarded without executing.
+  // If the NotificationStateLock is not currently held then the action will be
+  // executed immediately.
+  void MaybeExecuteFrameNotification(FrameNotifyOnceAction pending_action);
+
 private:
  friend class base::RefCountedThreadSafe<CefBrowserInfo>;

@@ -154,12 +173,17 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
  struct FrameInfo {
    ~FrameInfo();

+    inline bool IsCurrentMainFrame() const {
+      return frame_ && is_main_frame_ && !is_speculative_ && !is_in_bfcache_;
+    }
+
    content::RenderFrameHost* host_;
    int64_t frame_id_;  // Combination of render_process_id + render_routing_id.
    int frame_tree_node_id_;
    bool is_guest_view_;
    bool is_main_frame_;
    bool is_speculative_;
+    bool is_in_bfcache_ = false;
    CefRefPtr<CefFrameHostImpl> frame_;
  };

@@ -169,7 +193,17 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
      int frame_tree_node_id,
      bool* is_guest_view = nullptr) const;

-  void RemoveAllFrames();
+  void SetMainFrame(CefRefPtr<CefBrowserHostBase> browser,
+                    CefRefPtr<CefFrameHostImpl> frame);
+
+  void MaybeNotifyFrameCreated(CefRefPtr<CefFrameHostImpl> frame);
+  void MaybeNotifyFrameDetached(CefRefPtr<CefBrowserHostBase> browser,
+                                CefRefPtr<CefFrameHostImpl> frame);
+  void MaybeNotifyMainFrameChanged(CefRefPtr<CefBrowserHostBase> browser,
+                                   CefRefPtr<CefFrameHostImpl> old_frame,
+                                   CefRefPtr<CefFrameHostImpl> new_frame);
+
+  void RemoveAllFrames(CefRefPtr<CefBrowserHostBase> old_browser);

  int browser_id_;
  bool is_popup_;
@@ -180,6 +214,29 @@ class CefBrowserInfo : public base::RefCountedThreadSafe<CefBrowserInfo> {
  // Only accessed on the UI thread.
  base::WeakPtr<NavigationLock> navigation_lock_;

+  // Used instead of |base::AutoLock(lock_)| in situations that might generate
+  // CefFrameHandler notifications. Any notifications passed to
+  // MaybeExecuteFrameNotification() will be queued until the lock is released,
+  // and then executed in order.
+  class NotificationStateLock final {
+   public:
+    explicit NotificationStateLock(CefBrowserInfo* browser_info);
+    ~NotificationStateLock();
+
+   protected:
+    friend class CefBrowserInfo;
+    CefBrowserInfo* const browser_info_;
+    CefRefPtr<CefFrameHandler> frame_handler_;
+    std::unique_ptr<base::AutoLock> browser_info_lock_scope_;
+    std::queue<FrameNotifyOnceAction> queue_;
+  };
+
+  mutable base::Lock notification_lock_;
+
+  // These members must be protected by |notification_lock_|.
+  NotificationStateLock* notification_state_lock_ = nullptr;
+  CefRefPtr<CefFrameHandler> frame_handler_;
+
  mutable base::Lock lock_;

  // The below members must be protected by |lock_|.
--- a/libcef/browser/browser_info_manager.cc
+++ b/libcef/browser/browser_info_manager.cc
@@ -10,7 +10,6 @@
 #include "libcef/browser/browser_platform_delegate.h"
 #include "libcef/browser/extensions/browser_extensions_util.h"
 #include "libcef/browser/thread_util.h"
-#include "libcef/common/cef_messages.h"
 #include "libcef/common/cef_switches.h"
 #include "libcef/common/extensions/extensions_util.h"
 #include "libcef/common/values_impl.h"
@@ -18,6 +17,7 @@

 #include "base/command_line.h"
 #include "base/logging.h"
+#include "base/threading/sequenced_task_runner_handle.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
@@ -95,9 +95,9 @@ scoped_refptr<CefBrowserInfo> CefBrowserInfoManager::CreatePopupBrowserInfo(
  // Continue any pending NewBrowserInfo request.
  auto it = pending_new_browser_info_map_.find(frame_id);
  if (it != pending_new_browser_info_map_.end()) {
-    SendNewBrowserInfoResponse(render_process_id, browser_info,
-                               false /* is_guest_view */,
-                               it->second->reply_msg);
+    SendNewBrowserInfoResponse(
+        render_process_id, browser_info, /*is_guest_view=*/false,
+        std::move(it->second->callback), it->second->callback_runner);
    pending_new_browser_info_map_.erase(it);
  }

@@ -181,8 +181,11 @@ bool CefBrowserInfoManager::CanCreateWindow(
  if (allow) {
    CefBrowserCreateParams create_params;

-    if (!browser->HasView())
+    if (browser->HasView()) {
+      create_params.popup_with_views_hosted_opener = true;
+    } else {
      create_params.window_info = std::move(window_info);
+    }

    create_params.settings = pending_popup->settings;
    create_params.client = pending_popup->client;
@@ -259,12 +262,15 @@ void CefBrowserInfoManager::WebContentsCreated(
  extra_info = pending_popup->extra_info;
 }

-void CefBrowserInfoManager::OnGetNewBrowserInfo(int render_process_id,
-                                                int render_routing_id,
-                                                IPC::Message* reply_msg) {
+void CefBrowserInfoManager::OnGetNewBrowserInfo(
+    int render_process_id,
+    int render_routing_id,
+    cef::mojom::BrowserManager::GetNewBrowserInfoCallback callback) {
  DCHECK_NE(render_process_id, content::ChildProcessHost::kInvalidUniqueID);
  DCHECK_GT(render_routing_id, 0);
-  DCHECK(reply_msg);
+  DCHECK(callback);
+
+  auto callback_runner = base::SequencedTaskRunnerHandle::Get();

  base::AutoLock lock_scope(browser_info_lock_);

@@ -276,7 +282,7 @@ void CefBrowserInfoManager::OnGetNewBrowserInfo(int render_process_id,
  if (browser_info.get()) {
    // Send the response immediately.
    SendNewBrowserInfoResponse(render_process_id, browser_info, is_guest_view,
-                               reply_msg);
+                               std::move(callback), callback_runner);
    return;
  }

@@ -294,7 +300,8 @@ void CefBrowserInfoManager::OnGetNewBrowserInfo(int render_process_id,
  pending->render_process_id = render_process_id;
  pending->render_routing_id = render_routing_id;
  pending->timeout_id = timeout_id;
-  pending->reply_msg = reply_msg;
+  pending->callback = std::move(callback);
+  pending->callback_runner = callback_runner;
  pending_new_browser_info_map_.insert(
      std::make_pair(frame_id, std::move(pending)));

@@ -434,11 +441,13 @@ void CefBrowserInfoManager::RenderProcessHostDestroyed(
    PendingNewBrowserInfoMap::iterator it =
        pending_new_browser_info_map_.begin();
    while (it != pending_new_browser_info_map_.end()) {
-      auto info = it->second.get();
-      if (info->render_process_id == render_process_id)
+      const auto& info = it->second;
+      if (info->render_process_id == render_process_id) {
+        CancelNewBrowserInfoResponse(info.get());
        it = pending_new_browser_info_map_.erase(it);
-      else
+      } else {
        ++it;
+      }
    }
  }

@@ -519,44 +528,47 @@ void CefBrowserInfoManager::SendNewBrowserInfoResponse(
    int render_process_id,
    scoped_refptr<CefBrowserInfo> browser_info,
    bool is_guest_view,
-    IPC::Message* reply_msg) {
-  if (!CEF_CURRENTLY_ON_UIT()) {
-    CEF_POST_TASK(
-        CEF_UIT,
-        base::Bind(&CefBrowserInfoManager::SendNewBrowserInfoResponse,
-                   render_process_id, browser_info, is_guest_view, reply_msg));
+    cef::mojom::BrowserManager::GetNewBrowserInfoCallback callback,
+    scoped_refptr<base::SequencedTaskRunner> callback_runner) {
+  if (!callback_runner->RunsTasksInCurrentSequence()) {
+    callback_runner->PostTask(
+        FROM_HERE,
+        base::BindOnce(&CefBrowserInfoManager::SendNewBrowserInfoResponse,
+                       render_process_id, browser_info, is_guest_view,
+                       std::move(callback), callback_runner));
    return;
  }

-  content::RenderProcessHost* host =
-      content::RenderProcessHost::FromID(render_process_id);
-  if (!host) {
-    delete reply_msg;
-    return;
-  }
-
-  CefProcessHostMsg_GetNewBrowserInfo_Params params;
-  params.is_guest_view = is_guest_view;
+  auto params = cef::mojom::NewBrowserInfo::New();
+  params->is_guest_view = is_guest_view;

  if (browser_info) {
-    params.browser_id = browser_info->browser_id();
-    params.is_windowless = browser_info->is_windowless();
-    params.is_popup = browser_info->is_popup();
+    params->browser_id = browser_info->browser_id();
+    params->is_windowless = browser_info->is_windowless();
+    params->is_popup = browser_info->is_popup();

    auto extra_info = browser_info->extra_info();
    if (extra_info) {
      auto extra_info_impl =
          static_cast<CefDictionaryValueImpl*>(extra_info.get());
-      auto extra_info_value = extra_info_impl->CopyValue();
-      extra_info_value->Swap(&params.extra_info);
+      auto extra_info_value = base::WrapUnique(extra_info_impl->CopyValue());
+      params->extra_info = std::move(*extra_info_value);
    }
  } else {
    // The new browser info response has timed out.
-    params.browser_id = -1;
+    params->browser_id = -1;
  }

-  CefProcessHostMsg_GetNewBrowserInfo::WriteReplyParams(reply_msg, params);
-  host->Send(reply_msg);
+  std::move(callback).Run(std::move(params));
+}
+
+// static
+void CefBrowserInfoManager::CancelNewBrowserInfoResponse(
+    PendingNewBrowserInfo* pending_info) {
+  SendNewBrowserInfoResponse(pending_info->render_process_id,
+                             /*browser_info=*/nullptr, /*is_guest_view=*/false,
+                             std::move(pending_info->callback),
+                             pending_info->callback_runner);
 }

 // static
@@ -579,9 +591,7 @@ void CefBrowserInfoManager::TimeoutNewBrowserInfoResponse(int64_t frame_id,
               << pending_info->render_process_id << " and routing id "
               << pending_info->render_routing_id;

-    SendNewBrowserInfoResponse(pending_info->render_process_id, nullptr,
-                               false /* is_guest_view */,
-                               pending_info->reply_msg);
+    CancelNewBrowserInfoResponse(pending_info.get());
    g_info_manager->pending_new_browser_info_map_.erase(it);
  }
 }
--- a/libcef/browser/browser_info_manager.h
+++ b/libcef/browser/browser_info_manager.h
@@ -14,7 +14,9 @@

 #include "libcef/browser/browser_info.h"

+#include "base/sequenced_task_runner.h"
 #include "base/synchronization/lock.h"
+#include "cef/libcef/common/mojom/cef.mojom.h"
 #include "content/public/browser/render_process_host_observer.h"
 #include "third_party/blink/public/mojom/window_features/window_features.mojom.h"
 #include "ui/base/window_open_disposition.h"
@@ -33,10 +35,6 @@ class WebContents;
 class WebContentsView;
 }  // namespace content

-namespace IPC {
-class Message;
-}
-
 class CefBrowserHostBase;
 class CefBrowserPlatformDelegate;

@@ -97,16 +95,17 @@ class CefBrowserInfoManager : public content::RenderProcessHostObserver {
      std::unique_ptr<CefBrowserPlatformDelegate>& platform_delegate,
      CefRefPtr<CefDictionaryValue>& extra_info);

-  // Called from CefBrowserMessageFilter::OnGetNewBrowserInfo for delivering
+  // Called from CefBrowserManager::GetNewBrowserInfo for delivering
  // browser info to the renderer process. If the browser info already exists
  // the response will be sent immediately. Otherwise, the response will be sent
  // when CreatePopupBrowserInfo creates the browser info. The info will already
  // exist for explicitly created browsers and guest views. It may sometimes
  // already exist for traditional popup browsers depending on timing. See
  // comments on PendingPopup for more information.
-  void OnGetNewBrowserInfo(int render_process_id,
-                           int render_routing_id,
-                           IPC::Message* reply_msg);
+  void OnGetNewBrowserInfo(
+      int render_process_id,
+      int render_routing_id,
+      cef::mojom::BrowserManager::GetNewBrowserInfoCallback callback);

  // Called from CefBrowserHostBase::DestroyBrowser() when a browser is
  // destroyed.
@@ -163,7 +162,7 @@ class CefBrowserInfoManager : public content::RenderProcessHostObserver {
  //   Creates the OSR views for windowless popups.
  // - WebContentsCreated (UIT):
  //   Creates the CefBrowserHost representation for the popup.
-  // - CefBrowserMessageFilter::OnGetNewBrowserInfo (IOT)
+  // - CefBrowserManager::GetNewBrowserInfo (IOT)
  //   Passes information about the popup to the renderer process.
  struct PendingPopup {
    // Track the last method that modified this PendingPopup instance. There may
@@ -209,19 +208,24 @@ class CefBrowserInfoManager : public content::RenderProcessHostObserver {
      int render_process_id,
      scoped_refptr<CefBrowserInfo> browser_info,
      bool is_guest_view,
-      IPC::Message* reply_msg);
-
-  // Time out a response if it's still pending.
-  static void TimeoutNewBrowserInfoResponse(int64_t frame_id, int timeout_id);
+      cef::mojom::BrowserManager::GetNewBrowserInfoCallback callback,
+      scoped_refptr<base::SequencedTaskRunner> callback_runner);

  // Pending request for OnGetNewBrowserInfo.
  struct PendingNewBrowserInfo {
    int render_process_id;
    int render_routing_id;
    int timeout_id;
-    IPC::Message* reply_msg;
+    cef::mojom::BrowserManager::GetNewBrowserInfoCallback callback;
+    scoped_refptr<base::SequencedTaskRunner> callback_runner;
  };

+  // Cancel a response that is still pending.
+  static void CancelNewBrowserInfoResponse(PendingNewBrowserInfo* pending_info);
+
+  // Time out a response if it's still pending.
+  static void TimeoutNewBrowserInfoResponse(int64_t frame_id, int timeout_id);
+
  mutable base::Lock browser_info_lock_;

  // Access to the below members must be protected by |browser_info_lock_|.
--- a/libcef/browser/browser_manager.cc
+++ b/libcef/browser/browser_manager.cc
@@ -0,0 +1,56 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "libcef/browser/browser_manager.h"
+
+#include "libcef/browser/browser_info_manager.h"
+#include "libcef/browser/origin_whitelist_impl.h"
+
+#include "content/public/browser/render_process_host.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
+
+CefBrowserManager::CefBrowserManager(int render_process_id)
+    : render_process_id_(render_process_id) {}
+
+CefBrowserManager::~CefBrowserManager() = default;
+
+// static
+void CefBrowserManager::ExposeInterfacesToRenderer(
+    service_manager::BinderRegistry* registry,
+    blink::AssociatedInterfaceRegistry* associated_registry,
+    content::RenderProcessHost* host) {
+  registry->AddInterface(base::BindRepeating(
+      [](int render_process_id,
+         mojo::PendingReceiver<cef::mojom::BrowserManager> receiver) {
+        mojo::MakeSelfOwnedReceiver(
+            std::make_unique<CefBrowserManager>(render_process_id),
+            std::move(receiver));
+      },
+      host->GetID()));
+}
+
+// static
+mojo::Remote<cef::mojom::RenderManager>
+CefBrowserManager::GetRenderManagerForProcess(
+    content::RenderProcessHost* host) {
+  mojo::Remote<cef::mojom::RenderManager> client;
+  host->BindReceiver(client.BindNewPipeAndPassReceiver());
+  return client;
+}
+
+void CefBrowserManager::GetNewRenderThreadInfo(
+    cef::mojom::BrowserManager::GetNewRenderThreadInfoCallback callback) {
+  auto info = cef::mojom::NewRenderThreadInfo::New();
+  GetCrossOriginWhitelistEntries(&info->cross_origin_whitelist_entries);
+  std::move(callback).Run(std::move(info));
+}
+
+void CefBrowserManager::GetNewBrowserInfo(
+    int32_t render_frame_routing_id,
+    cef::mojom::BrowserManager::GetNewBrowserInfoCallback callback) {
+  CefBrowserInfoManager::GetInstance()->OnGetNewBrowserInfo(
+      render_process_id_, render_frame_routing_id, std::move(callback));
+}
--- a/libcef/browser/browser_manager.h
+++ b/libcef/browser/browser_manager.h
@@ -0,0 +1,54 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_BROWSER_MANAGER_H_
+#define CEF_LIBCEF_BROWSER_BROWSER_MANAGER_H_
+
+#include "cef/libcef/common/mojom/cef.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
+
+namespace blink {
+class AssociatedInterfaceRegistry;
+}
+
+namespace content {
+class RenderProcessHost;
+}
+
+class CefBrowserManager : public cef::mojom::BrowserManager {
+ public:
+  explicit CefBrowserManager(int render_process_id);
+  ~CefBrowserManager() override;
+
+  // Called from the ContentBrowserClient method of the same name.
+  // |associated_registry| is used for interfaces which must be associated with
+  // some IPC::ChannelProxy, meaning that messages on the interface retain FIFO
+  // with respect to legacy Chrome IPC messages sent or dispatched on the
+  // channel.
+  static void ExposeInterfacesToRenderer(
+      service_manager::BinderRegistry* registry,
+      blink::AssociatedInterfaceRegistry* associated_registry,
+      content::RenderProcessHost* host);
+
+  // Connects to CefRenderManager in the render process.
+  static mojo::Remote<cef::mojom::RenderManager> GetRenderManagerForProcess(
+      content::RenderProcessHost* host);
+
+ private:
+  // cef::mojom::BrowserManager methods:
+  void GetNewRenderThreadInfo(
+      cef::mojom::BrowserManager::GetNewRenderThreadInfoCallback callback)
+      override;
+  void GetNewBrowserInfo(
+      int32_t render_frame_routing_id,
+      cef::mojom::BrowserManager::GetNewBrowserInfoCallback callback) override;
+
+  // The process ID of the renderer.
+  const int render_process_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(CefBrowserManager);
+};
+
+#endif  // CEF_LIBCEF_BROWSER_BROWSER_MANAGER_H_
--- a/libcef/browser/browser_message_filter.cc
+++ b/libcef/browser/browser_message_filter.cc
@@ -1,55 +0,0 @@
-// Copyright (c) 2012 The Chromium Embedded Framework Authors.
-// Portions (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "libcef/browser/browser_message_filter.h"
-
-#include "libcef/browser/browser_info_manager.h"
-#include "libcef/browser/origin_whitelist_impl.h"
-#include "libcef/common/app_manager.h"
-#include "libcef/common/cef_messages.h"
-#include "libcef/common/values_impl.h"
-
-#include "base/bind.h"
-#include "base/compiler_specific.h"
-#include "content/public/common/child_process_host.h"
-
-CefBrowserMessageFilter::CefBrowserMessageFilter(int render_process_id)
-    : content::BrowserMessageFilter(ExtensionMsgStart),
-      render_process_id_(render_process_id) {}
-
-CefBrowserMessageFilter::~CefBrowserMessageFilter() {}
-
-void CefBrowserMessageFilter::OnFilterRemoved() {
-  render_process_id_ = content::ChildProcessHost::kInvalidUniqueID;
-  content::BrowserMessageFilter::OnFilterRemoved();
-}
-
-bool CefBrowserMessageFilter::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-
-  IPC_BEGIN_MESSAGE_MAP(CefBrowserMessageFilter, message)
-    IPC_MESSAGE_HANDLER(CefProcessHostMsg_GetNewRenderThreadInfo,
-                        OnGetNewRenderThreadInfo)
-    IPC_MESSAGE_HANDLER_DELAY_REPLY(CefProcessHostMsg_GetNewBrowserInfo,
-                                    OnGetNewBrowserInfo)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void CefBrowserMessageFilter::OnGetNewRenderThreadInfo(
-    CefProcessHostMsg_GetNewRenderThreadInfo_Params* params) {
-  GetCrossOriginWhitelistEntries(&params->cross_origin_whitelist_entries);
-}
-
-void CefBrowserMessageFilter::OnGetNewBrowserInfo(int render_frame_routing_id,
-                                                  IPC::Message* reply_msg) {
-  if (render_process_id_ != content::ChildProcessHost::kInvalidUniqueID) {
-    CefBrowserInfoManager::GetInstance()->OnGetNewBrowserInfo(
-        render_process_id_, render_frame_routing_id, reply_msg);
-  } else {
-    delete reply_msg;
-  }
-}
--- a/libcef/browser/browser_message_filter.h
+++ b/libcef/browser/browser_message_filter.h
@@ -1,40 +0,0 @@
-// Copyright (c) 2012 The Chromium Embedded Framework Authors.
-// Portions copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CEF_LIBCEF_BROWSER_BROWSER_MESSAGE_FILTER_H_
-#define CEF_LIBCEF_BROWSER_BROWSER_MESSAGE_FILTER_H_
-
-#include <stdint.h>
-
-#include <string>
-
-#include "content/public/browser/browser_message_filter.h"
-
-struct CefProcessHostMsg_GetNewBrowserInfo_Params;
-struct CefProcessHostMsg_GetNewRenderThreadInfo_Params;
-
-// This class sends and receives control messages on the browser process.
-class CefBrowserMessageFilter : public content::BrowserMessageFilter {
- public:
-  explicit CefBrowserMessageFilter(int render_process_id);
-  ~CefBrowserMessageFilter() override;
-
-  // IPC::ChannelProxy::MessageFilter implementation.
-  void OnFilterRemoved() override;
-  bool OnMessageReceived(const IPC::Message& message) override;
-
- private:
-  // Message handlers.
-  void OnGetNewRenderThreadInfo(
-      CefProcessHostMsg_GetNewRenderThreadInfo_Params* params);
-  void OnGetNewBrowserInfo(int render_frame_routing_id,
-                           IPC::Message* reply_msg);
-
-  int render_process_id_;
-
-  DISALLOW_COPY_AND_ASSIGN(CefBrowserMessageFilter);
-};
-
-#endif  // CEF_LIBCEF_BROWSER_BROWSER_MESSAGE_FILTER_H_
--- a/libcef/browser/browser_platform_delegate.cc
+++ b/libcef/browser/browser_platform_delegate.cc
@@ -76,7 +76,7 @@ void CefBrowserPlatformDelegate::BrowserCreated(CefBrowserHostBase* browser) {
 void CefBrowserPlatformDelegate::CreateExtensionHost(
    const extensions::Extension* extension,
    const GURL& url,
-    extensions::ViewType host_type) {
+    extensions::mojom::ViewType host_type) {
  NOTREACHED();
 }

--- a/libcef/browser/browser_platform_delegate.h
+++ b/libcef/browser/browser_platform_delegate.h
@@ -15,7 +15,7 @@
 #include "include/views/cef_browser_view.h"

 #include "base/callback_forward.h"
-#include "extensions/common/view_type.h"
+#include "extensions/common/mojom/view_type.mojom-forward.h"
 #include "third_party/blink/public/common/page/drag_operation.h"
 #include "third_party/blink/public/mojom/page/drag.mojom-forward.h"
 #include "third_party/skia/include/core/SkColor.h"
@@ -134,7 +134,7 @@ class CefBrowserPlatformDelegate {
  // Called from AlloyBrowserHostImpl::Create.
  virtual void CreateExtensionHost(const extensions::Extension* extension,
                                   const GURL& url,
-                                   extensions::ViewType host_type);
+                                   extensions::mojom::ViewType host_type);

  // Returns the current extension host.
  virtual extensions::ExtensionHost* GetExtensionHost() const;
--- a/libcef/browser/browser_platform_delegate_create.cc
+++ b/libcef/browser/browser_platform_delegate_create.cc
@@ -84,7 +84,8 @@ std::unique_ptr<CefBrowserPlatformDelegate> CefBrowserPlatformDelegate::Create(
    std::unique_ptr<CefBrowserPlatformDelegateNative> native_delegate =
        CreateNativeDelegate(CefWindowInfo(), background_color);
 #if defined(TOOLKIT_VIEWS)
-    if (create_params.browser_view) {
+    if (create_params.browser_view ||
+        create_params.popup_with_views_hosted_opener) {
      return std::make_unique<CefBrowserPlatformDelegateChromeViews>(
          std::move(native_delegate),
          static_cast<CefBrowserViewImpl*>(create_params.browser_view.get()));
@@ -114,7 +115,7 @@ std::unique_ptr<CefBrowserPlatformDelegate> CefBrowserPlatformDelegate::Create(
    }
    return std::move(native_delegate);
  } else if (create_params.extension_host_type ==
-             extensions::VIEW_TYPE_EXTENSION_BACKGROUND_PAGE) {
+             extensions::mojom::ViewType::kExtensionBackgroundPage) {
    // Creating a background extension host without a window.
    std::unique_ptr<CefBrowserPlatformDelegateNative> native_delegate =
        CreateNativeDelegate(CefWindowInfo(), background_color);
--- a/libcef/browser/chrome/chrome_browser_context.cc
+++ b/libcef/browser/chrome/chrome_browser_context.cc
@@ -4,37 +4,154 @@

 #include "libcef/browser/chrome/chrome_browser_context.h"

-#include "libcef/browser/prefs/browser_prefs.h"
+#include "libcef/browser/thread_util.h"

-#include "chrome/browser/profiles/profile_manager.h"
+#include "base/threading/thread_restrictions.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/profiles/off_the_record_profile_impl.h"
+#include "chrome/browser/profiles/profile_keep_alive_types.h"
+#include "chrome/browser/profiles/scoped_profile_keep_alive.h"

 ChromeBrowserContext::ChromeBrowserContext(
    const CefRequestContextSettings& settings)
-    : CefBrowserContext(settings) {}
+    : CefBrowserContext(settings), weak_ptr_factory_(this) {}

 ChromeBrowserContext::~ChromeBrowserContext() = default;

 content::BrowserContext* ChromeBrowserContext::AsBrowserContext() {
+  CHECK(!destroyed_);
  return profile_;
 }

 Profile* ChromeBrowserContext::AsProfile() {
+  CHECK(!destroyed_);
  return profile_;
 }

-void ChromeBrowserContext::Initialize() {
+bool ChromeBrowserContext::IsInitialized() const {
+  CEF_REQUIRE_UIT();
+  CHECK(!destroyed_);
+  return !!profile_;
+}
+
+void ChromeBrowserContext::StoreOrTriggerInitCallback(
+    base::OnceClosure callback) {
+  CEF_REQUIRE_UIT();
+  if (IsInitialized()) {
+    std::move(callback).Run();
+  } else {
+    init_callbacks_.emplace_back(std::move(callback));
+  }
+}
+
+void ChromeBrowserContext::InitializeAsync(base::OnceClosure initialized_cb) {
+  init_callbacks_.emplace_back(std::move(initialized_cb));
+
  CefBrowserContext::Initialize();

-  // TODO(chrome-runtime): ProfileManager can create new profiles relative to
-  // the user-data-dir, but it should be done asynchronously.
-  // The global ProfileManager instance can be retrieved via
-  // |g_browser_process->profile_manager()|.
-  profile_ = ProfileManager::GetLastUsedProfileAllowedByPolicy();
+  if (!cache_path_.empty()) {
+    auto* profile_manager = g_browser_process->profile_manager();
+    const auto& user_data_dir = profile_manager->user_data_dir();

-  browser_prefs::SetLanguagePrefs(profile_);
+    if (cache_path_ == user_data_dir) {
+      // Use the default disk-based profile.
+      auto profile = profile_manager->GetPrimaryUserProfile();
+      ProfileCreated(profile, Profile::CreateStatus::CREATE_STATUS_INITIALIZED);
+      return;
+    } else if (cache_path_.DirName() == user_data_dir) {
+      // Create or load a specific disk-based profile. May continue
+      // synchronously or asynchronously.
+      profile_manager->CreateProfileAsync(
+          cache_path_,
+          base::BindRepeating(&ChromeBrowserContext::ProfileCreated,
+                              weak_ptr_factory_.GetWeakPtr()));
+      return;
+    } else {
+      // All profile directories must be relative to |user_data_dir|.
+      LOG(ERROR) << "Cannot create profile at path "
+                 << cache_path_.AsUTF8Unsafe();
+    }
+  }
+
+  // Default to creating a new/unique OffTheRecord profile.
+  ProfileCreated(nullptr, Profile::CreateStatus::CREATE_STATUS_CANCELED);
 }

 void ChromeBrowserContext::Shutdown() {
  CefBrowserContext::Shutdown();
-  profile_ = nullptr;
+
+  // Allow potential deletion of the Profile at some future point (controlled
+  // by ProfileManager).
+  profile_keep_alive_.reset();
+
+  // |g_browser_process| may be nullptr during shutdown.
+  if (g_browser_process) {
+    if (should_destroy_) {
+      g_browser_process->profile_manager()
+          ->GetPrimaryUserProfile()
+          ->DestroyOffTheRecordProfile(profile_);
+    } else if (profile_) {
+      OnProfileWillBeDestroyed(profile_);
+    }
+  }
+}
+
+void ChromeBrowserContext::ProfileCreated(Profile* profile,
+                                          Profile::CreateStatus status) {
+  Profile* parent_profile = nullptr;
+  OffTheRecordProfileImpl* otr_profile = nullptr;
+
+  if (status != Profile::CreateStatus::CREATE_STATUS_CREATED &&
+      status != Profile::CreateStatus::CREATE_STATUS_INITIALIZED) {
+    CHECK(!profile);
+    CHECK(!profile_);
+
+    // Profile creation may access the filesystem.
+    base::ScopedAllowBlockingForTesting allow_blocking;
+
+    // Creation of a disk-based profile failed for some reason. Create a
+    // new/unique OffTheRecord profile instead.
+    const auto& profile_id = Profile::OTRProfileID::CreateUniqueForCEF();
+    parent_profile =
+        g_browser_process->profile_manager()->GetPrimaryUserProfile();
+    profile_ = parent_profile->GetOffTheRecordProfile(
+        profile_id, /*create_if_needed=*/true);
+    otr_profile = static_cast<OffTheRecordProfileImpl*>(profile_);
+    status = Profile::CreateStatus::CREATE_STATUS_INITIALIZED;
+    should_destroy_ = true;
+  } else if (profile && !profile_) {
+    // May be CREATE_STATUS_CREATED or CREATE_STATUS_INITIALIZED since
+    // *CREATED isn't always sent for a disk-based profile that already
+    // exists.
+    profile_ = profile;
+    profile_->AddObserver(this);
+    profile_keep_alive_.reset(new ScopedProfileKeepAlive(
+        profile_, ProfileKeepAliveOrigin::kAppWindow));
+  }
+
+  if (status == Profile::CreateStatus::CREATE_STATUS_INITIALIZED) {
+    CHECK(profile_);
+
+    // Must set |profile_| before Init() calls
+    // ChromeContentBrowserClientCef::ConfigureNetworkContextParams so that
+    // CefBrowserContext::FromBrowserContext can find us.
+    if (otr_profile) {
+      otr_profile->Init();
+      parent_profile->NotifyOffTheRecordProfileCreated(otr_profile);
+    }
+
+    if (!init_callbacks_.empty()) {
+      for (auto& callback : init_callbacks_) {
+        std::move(callback).Run();
+      }
+      init_callbacks_.clear();
+    }
+  }
+}
+
+void ChromeBrowserContext::OnProfileWillBeDestroyed(Profile* profile) {
+  CHECK_EQ(profile_, profile);
+  profile_->RemoveObserver(this);
+  profile_ = nullptr;
+  destroyed_ = true;
 }
--- a/libcef/browser/chrome/chrome_browser_context.h
+++ b/libcef/browser/chrome/chrome_browser_context.h
@@ -8,22 +8,45 @@

 #include "libcef/browser/browser_context.h"

+#include "base/memory/weak_ptr.h"
+#include "chrome/browser/profiles/profile_manager.h"
+#include "chrome/browser/profiles/profile_observer.h"
+
+class ScopedProfileKeepAlive;
+
 // See CefBrowserContext documentation for usage. Only accessed on the UI thread
 // unless otherwise indicated.
-class ChromeBrowserContext : public CefBrowserContext {
+class ChromeBrowserContext : public CefBrowserContext, public ProfileObserver {
 public:
  explicit ChromeBrowserContext(const CefRequestContextSettings& settings);

+  void InitializeAsync(base::OnceClosure initialized_cb);
+
  // CefBrowserContext overrides.
  content::BrowserContext* AsBrowserContext() override;
  Profile* AsProfile() override;
-  void Initialize() override;
+  bool IsInitialized() const override;
+  void StoreOrTriggerInitCallback(base::OnceClosure callback) override;
  void Shutdown() override;

+  // ProfileObserver overrides.
+  void OnProfileWillBeDestroyed(Profile* profile) override;
+
 private:
  ~ChromeBrowserContext() override;

+  void ProfileCreated(Profile* profile, Profile::CreateStatus status);
+
+  base::OnceClosure initialized_cb_;
  Profile* profile_ = nullptr;
+  bool should_destroy_ = false;
+
+  bool destroyed_ = false;
+  std::unique_ptr<ScopedProfileKeepAlive> profile_keep_alive_;
+
+  std::vector<base::OnceClosure> init_callbacks_;
+
+  base::WeakPtrFactory<ChromeBrowserContext> weak_ptr_factory_;

  DISALLOW_COPY_AND_ASSIGN(ChromeBrowserContext);
 };
--- a/libcef/browser/chrome/chrome_browser_delegate.cc
+++ b/libcef/browser/chrome/chrome_browser_delegate.cc
@@ -16,6 +16,7 @@

 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/browser_tabstrip.h"
 #include "content/public/browser/keyboard_event_processing_result.h"
 #include "content/public/browser/native_web_keyboard_event.h"

@@ -65,7 +66,7 @@ void ChromeBrowserDelegate::SetAsDelegate(content::WebContents* web_contents,
          create_params_.request_context);

  CreateBrowser(web_contents, create_params_.settings, create_params_.client,
-                std::move(platform_delegate), browser_info,
+                std::move(platform_delegate), browser_info, /*opener=*/nullptr,
                request_context_impl);
 }

@@ -103,7 +104,28 @@ void ChromeBrowserDelegate::WebContentsCreated(
  // We don't officially own |new_contents| until AddNewContents() is called.
  // However, we need to install observers/delegates here.
  CreateBrowser(new_contents, settings, client, std::move(platform_delegate),
-                browser_info, request_context_impl);
+                browser_info, opener, request_context_impl);
+}
+
+void ChromeBrowserDelegate::AddNewContents(
+    content::WebContents* source_contents,
+    std::unique_ptr<content::WebContents> new_contents,
+    const GURL& target_url,
+    WindowOpenDisposition disposition,
+    const gfx::Rect& initial_rect,
+    bool user_gesture,
+    bool* was_blocked) {
+  auto new_browser =
+      ChromeBrowserHostImpl::GetBrowserForContents(new_contents.get());
+  if (new_browser) {
+    // Create a new Browser and give it ownership of the WebContents.
+    new_browser->AddNewContents(std::move(new_contents));
+    return;
+  }
+
+  // Fall back to default behavior from Browser::AddNewContents.
+  chrome::AddWebContents(browser_, source_contents, std::move(new_contents),
+                         target_url, disposition, initial_rect);
 }

 content::WebContents* ChromeBrowserDelegate::OpenURLFromTab(
@@ -134,9 +156,9 @@ void ChromeBrowserDelegate::UpdateTargetURL(content::WebContents* source,
 bool ChromeBrowserDelegate::DidAddMessageToConsole(
    content::WebContents* source,
    blink::mojom::ConsoleMessageLevel log_level,
-    const base::string16& message,
+    const std::u16string& message,
    int32_t line_no,
-    const base::string16& source_id) {
+    const std::u16string& source_id) {
  if (auto delegate = GetDelegateForWebContents(source)) {
    return delegate->DidAddMessageToConsole(source, log_level, message, line_no,
                                            source_id);
@@ -195,6 +217,7 @@ void ChromeBrowserDelegate::CreateBrowser(
    CefRefPtr<CefClient> client,
    std::unique_ptr<CefBrowserPlatformDelegate> platform_delegate,
    scoped_refptr<CefBrowserInfo> browser_info,
+    CefRefPtr<ChromeBrowserHostImpl> opener,
    CefRefPtr<CefRequestContextImpl> request_context_impl) {
  CEF_REQUIRE_UIT();
  DCHECK(web_contents);
@@ -202,6 +225,9 @@ void ChromeBrowserDelegate::CreateBrowser(
  DCHECK(browser_info);
  DCHECK(request_context_impl);

+  // If |opener| is non-nullptr it must be a popup window.
+  DCHECK(!opener.get() || browser_info->is_popup());
+
  if (!client) {
    if (auto app = CefAppManager::Get()->GetApplication()) {
      if (auto bph = app->GetBrowserProcessHandler()) {
@@ -226,7 +252,12 @@ void ChromeBrowserDelegate::CreateBrowser(
  CefRefPtr<ChromeBrowserHostImpl> browser_host =
      new ChromeBrowserHostImpl(settings, client, std::move(platform_delegate),
                                browser_info, request_context_impl);
-  browser_host->Attach(browser_, web_contents);
+  browser_host->Attach(web_contents, opener);
+
+  // The Chrome browser for a popup won't be created until AddNewContents().
+  if (!opener) {
+    browser_host->SetBrowser(browser_);
+  }
 }

 CefBrowserContentsDelegate* ChromeBrowserDelegate::GetDelegateForWebContents(
--- a/libcef/browser/chrome/chrome_browser_delegate.h
+++ b/libcef/browser/chrome/chrome_browser_delegate.h
@@ -12,7 +12,7 @@
 #include "libcef/browser/browser_info.h"
 #include "libcef/browser/chrome/browser_delegate.h"

-#include "base/optional.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"

 class CefBrowserContentsDelegate;
 class CefRequestContextImpl;
@@ -55,6 +55,13 @@ class ChromeBrowserDelegate : public cef::BrowserDelegate {
                          const std::string& frame_name,
                          const GURL& target_url,
                          content::WebContents* new_contents) override;
+  void AddNewContents(content::WebContents* source_contents,
+                      std::unique_ptr<content::WebContents> new_contents,
+                      const GURL& target_url,
+                      WindowOpenDisposition disposition,
+                      const gfx::Rect& initial_rect,
+                      bool user_gesture,
+                      bool* was_blocked) override;
  content::WebContents* OpenURLFromTab(
      content::WebContents* source,
      const content::OpenURLParams& params) override;
@@ -63,9 +70,9 @@ class ChromeBrowserDelegate : public cef::BrowserDelegate {
  void UpdateTargetURL(content::WebContents* source, const GURL& url) override;
  bool DidAddMessageToConsole(content::WebContents* source,
                              blink::mojom::ConsoleMessageLevel log_level,
-                              const base::string16& message,
+                              const std::u16string& message,
                              int32_t line_no,
-                              const base::string16& source_id) override;
+                              const std::u16string& source_id) override;
  void DidNavigateMainFramePostCommit(
      content::WebContents* web_contents) override;
  void EnterFullscreenModeForTab(
@@ -88,6 +95,7 @@ class ChromeBrowserDelegate : public cef::BrowserDelegate {
      CefRefPtr<CefClient> client,
      std::unique_ptr<CefBrowserPlatformDelegate> platform_delegate,
      scoped_refptr<CefBrowserInfo> browser_info,
+      CefRefPtr<ChromeBrowserHostImpl> opener,
      CefRefPtr<CefRequestContextImpl> request_context_impl);

  CefBrowserContentsDelegate* GetDelegateForWebContents(
--- a/libcef/browser/chrome/chrome_browser_host_impl.cc
+++ b/libcef/browser/chrome/chrome_browser_host_impl.cc
@@ -8,6 +8,7 @@
 #include "libcef/browser/chrome/browser_platform_delegate_chrome.h"
 #include "libcef/browser/thread_util.h"
 #include "libcef/browser/views/browser_view_impl.h"
+#include "libcef/common/net/url_util.h"
 #include "libcef/features/runtime_checks.h"

 #include "base/logging.h"
@@ -21,8 +22,6 @@
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/pref_names.h"
-#include "components/url_formatter/url_fixer.h"
-#include "url/url_constants.h"

 #if defined(TOOLKIT_VIEWS)
 #include "libcef/browser/chrome/views/chrome_browser_frame.h"
@@ -32,62 +31,9 @@
 // static
 CefRefPtr<ChromeBrowserHostImpl> ChromeBrowserHostImpl::Create(
    const CefBrowserCreateParams& params) {
-  // Get or create the request context and profile.
-  CefRefPtr<CefRequestContextImpl> request_context_impl =
-      CefRequestContextImpl::GetOrCreateForRequestContext(
-          params.request_context);
-  CHECK(request_context_impl);
-  auto cef_browser_context = request_context_impl->GetBrowserContext();
-  CHECK(cef_browser_context);
-  auto profile = cef_browser_context->AsProfile();
+  auto browser = CreateBrowser(params);

-  Browser::CreateParams chrome_params =
-      Browser::CreateParams(profile, /*user_gesture=*/false);
-
-  // Pass |params| to cef::BrowserDelegate::Create from the Browser constructor.
-  chrome_params.cef_params = base::MakeRefCounted<DelegateCreateParams>(params);
-
-#if defined(TOOLKIT_VIEWS)
-  // Configure Browser creation to use the existing Views-based
-  // Widget/BrowserFrame (ChromeBrowserFrame) and BrowserView/BrowserWindow
-  // (ChromeBrowserView). See views/chrome_browser_frame.h for related
-  // documentation.
-  ChromeBrowserView* chrome_browser_view = nullptr;
-  if (params.browser_view) {
-    // Don't show most controls.
-    chrome_params.type = Browser::TYPE_POPUP;
-    // Don't show title bar or address.
-    chrome_params.trusted_source = true;
-
-    auto view_impl =
-        static_cast<CefBrowserViewImpl*>(params.browser_view.get());
-
-    chrome_browser_view =
-        static_cast<ChromeBrowserView*>(view_impl->root_view());
-    chrome_params.window = chrome_browser_view;
-
-    auto chrome_widget =
-        static_cast<ChromeBrowserFrame*>(chrome_browser_view->GetWidget());
-    chrome_browser_view->set_frame(chrome_widget);
-  }
-#endif  // defined(TOOLKIT_VIEWS)
-
-  // Create the Browser. This will indirectly create the ChomeBrowserDelegate.
-  // The same params will be used to create a new Browser if the tab is dragged
-  // out of the existing Browser. The returned Browser is owned by the
-  // associated BrowserView.
-  auto browser = Browser::Create(chrome_params);
-
-#if defined(TOOLKIT_VIEWS)
-  if (chrome_browser_view) {
-    // Initialize the BrowserFrame and BrowserView and create the controls that
-    // require access to the Browser.
-    chrome_browser_view->InitBrowser(base::WrapUnique(browser),
-                                     params.browser_view);
-  }
-#endif
-
-  GURL url = params.url;
+  GURL url = url_util::MakeGURL(params.url, /*fixup=*/true);
  if (url.is_empty()) {
    // Chrome will navigate to kChromeUINewTabURL by default. We want to keep
    // the current CEF behavior of not navigating at all. Use a special URL that
@@ -98,7 +44,8 @@ CefRefPtr<ChromeBrowserHostImpl> ChromeBrowserHostImpl::Create(
  // Add a new tab. This will indirectly create a new tab WebContents and
  // call ChromeBrowserDelegate::OnWebContentsCreated to create the associated
  // ChromeBrowserHostImpl.
-  chrome::AddTabAt(browser, url, /*idx=*/-1, /*foreground=*/true);
+  chrome::AddTabAt(browser, url, /*index=*/TabStripModel::kNoTab,
+                   /*foreground=*/true);

  // The new tab WebContents.
  auto web_contents = browser->tab_strip_model()->GetActiveWebContents();
@@ -159,6 +106,34 @@ CefRefPtr<ChromeBrowserHostImpl> ChromeBrowserHostImpl::GetBrowserForFrameRoute(

 ChromeBrowserHostImpl::~ChromeBrowserHostImpl() = default;

+void ChromeBrowserHostImpl::AddNewContents(
+    std::unique_ptr<content::WebContents> contents) {
+  DCHECK(contents);
+  DCHECK(!browser_);
+
+  // We should already be associated with the WebContents.
+  DCHECK_EQ(GetWebContents(), contents.get());
+
+  CefBrowserCreateParams params;
+  params.request_context = request_context();
+#if defined(TOOLKIT_VIEWS)
+  params.browser_view = GetBrowserView();
+#endif
+
+  // Create the new Browser representation.
+  auto browser = CreateBrowser(params);
+
+  // Add the WebContents to the Browser.
+  browser->tab_strip_model()->AddWebContents(
+      std::move(contents), /*index=*/TabStripModel::kNoTab,
+      ui::PageTransition::PAGE_TRANSITION_AUTO_TOPLEVEL,
+      TabStripModel::ADD_ACTIVE);
+
+  SetBrowser(browser);
+
+  browser->window()->Show();
+}
+
 void ChromeBrowserHostImpl::OnWebContentsDestroyed(
    content::WebContents* web_contents) {
  platform_delegate_->WebContentsDestroyed(web_contents);
@@ -416,16 +391,9 @@ bool ChromeBrowserHostImpl::Navigate(const content::OpenURLParams& params) {
  }

  if (browser_) {
-    // Fix common problems with user-typed text. Among other things, this:
-    // - Converts absolute file paths to "file://" URLs.
-    // - Normalizes "about:" and "chrome:" to "chrome://" URLs.
-    // - Adds the "http://" scheme if none was specified.
-    GURL gurl = url_formatter::FixupURL(params.url.possibly_invalid_spec(),
-                                        std::string());
-    if (!gurl.is_valid()) {
-      LOG(ERROR) << "Invalid URL: " << params.url.possibly_invalid_spec();
+    GURL gurl = params.url;
+    if (!url_util::FixupGURL(gurl))
      return false;
-    }

    // This is generally equivalent to calling Browser::OpenURL, except:
    // 1. It doesn't trigger a call to CefRequestHandler::OnOpenURLFromTab, and
@@ -461,17 +429,113 @@ ChromeBrowserHostImpl::ChromeBrowserHostImpl(
                         browser_info,
                         request_context) {}

-void ChromeBrowserHostImpl::Attach(Browser* browser,
-                                   content::WebContents* web_contents) {
-  DCHECK(browser);
+// static
+Browser* ChromeBrowserHostImpl::CreateBrowser(
+    const CefBrowserCreateParams& params) {
+  // Get or create the request context and profile.
+  CefRefPtr<CefRequestContextImpl> request_context_impl =
+      CefRequestContextImpl::GetOrCreateForRequestContext(
+          params.request_context);
+  CHECK(request_context_impl);
+  auto cef_browser_context = request_context_impl->GetBrowserContext();
+  CHECK(cef_browser_context);
+  auto profile = cef_browser_context->AsProfile();
+  CHECK(profile);
+
+  Browser::CreateParams chrome_params =
+      Browser::CreateParams(profile, /*user_gesture=*/false);
+
+  // Pass |params| to cef::BrowserDelegate::Create from the Browser constructor.
+  chrome_params.cef_params = base::MakeRefCounted<DelegateCreateParams>(params);
+
+#if defined(TOOLKIT_VIEWS)
+  // Configure Browser creation to use the existing Views-based
+  // Widget/BrowserFrame (ChromeBrowserFrame) and BrowserView/BrowserWindow
+  // (ChromeBrowserView). See views/chrome_browser_frame.h for related
+  // documentation.
+  ChromeBrowserView* chrome_browser_view = nullptr;
+  if (params.browser_view) {
+    // Don't show most controls.
+    chrome_params.type = Browser::TYPE_POPUP;
+    // Don't show title bar or address.
+    chrome_params.trusted_source = true;
+
+    auto view_impl =
+        static_cast<CefBrowserViewImpl*>(params.browser_view.get());
+
+    chrome_browser_view =
+        static_cast<ChromeBrowserView*>(view_impl->root_view());
+    chrome_params.window = chrome_browser_view;
+
+    auto chrome_widget =
+        static_cast<ChromeBrowserFrame*>(chrome_browser_view->GetWidget());
+    chrome_browser_view->set_frame(chrome_widget);
+  }
+#endif  // defined(TOOLKIT_VIEWS)
+
+  // Create the Browser. This will indirectly create the ChomeBrowserDelegate.
+  // The same params will be used to create a new Browser if the tab is dragged
+  // out of the existing Browser. The returned Browser is owned by the
+  // associated BrowserView.
+  auto browser = Browser::Create(chrome_params);
+
+#if defined(TOOLKIT_VIEWS)
+  if (chrome_browser_view) {
+    // Initialize the BrowserFrame and BrowserView and create the controls that
+    // require access to the Browser.
+    chrome_browser_view->InitBrowser(base::WrapUnique(browser),
+                                     params.browser_view);
+  }
+#endif
+
+  return browser;
+}
+
+void ChromeBrowserHostImpl::Attach(content::WebContents* web_contents,
+                                   CefRefPtr<ChromeBrowserHostImpl> opener) {
  DCHECK(web_contents);

-  SetBrowser(browser);
+  if (opener) {
+    // Give the opener browser's platform delegate an opportunity to modify the
+    // new browser's platform delegate.
+    opener->platform_delegate_->PopupWebContentsCreated(
+        settings_, client_, web_contents, platform_delegate_.get(),
+        /*is_devtools_popup=*/false);
+  }

  platform_delegate_->WebContentsCreated(web_contents,
                                         /*own_web_contents=*/false);
  contents_delegate_->ObserveWebContents(web_contents);
+
+  // Associate the platform delegate with this browser.
+  platform_delegate_->BrowserCreated(this);
+
+  // Associate the base class with the WebContents.
  InitializeBrowser();
+
+  // Notify that the browser has been created. These must be delivered in the
+  // expected order.
+
+  // 1. Notify the browser's LifeSpanHandler. This must always be the first
+  // notification for the browser.
+  {
+    // The WebContents won't be added to the Browser's TabStripModel until later
+    // in the current call stack. Block navigation until that time.
+    auto navigation_lock = browser_info_->CreateNavigationLock();
+    OnAfterCreated();
+  }
+
+  // 2. Notify the platform delegate. With Views this will result in a call to
+  // CefBrowserViewDelegate::OnBrowserCreated().
+  platform_delegate_->NotifyBrowserCreated();
+
+  if (opener && opener->platform_delegate_) {
+    // 3. Notify the opener browser's platform delegate. With Views this will
+    // result in a call to CefBrowserViewDelegate::OnPopupBrowserViewCreated().
+    opener->platform_delegate_->PopupBrowserCreated(
+        this,
+        /*is_devtools_popup=*/false);
+  }
 }

 void ChromeBrowserHostImpl::SetBrowser(Browser* browser) {
@@ -481,21 +545,6 @@ void ChromeBrowserHostImpl::SetBrowser(Browser* browser) {
      ->set_chrome_browser(browser);
 }

-void ChromeBrowserHostImpl::InitializeBrowser() {
-  CEF_REQUIRE_UIT();
-  DCHECK(browser_);
-
-  // Associate the platform delegate with this browser.
-  platform_delegate_->BrowserCreated(this);
-
-  CefBrowserHostBase::InitializeBrowser();
-
-  // The WebContents won't be added to the Browser's TabStripModel until later
-  // in the current call stack. Block navigation until that time.
-  auto navigation_lock = browser_info_->CreateNavigationLock();
-  OnAfterCreated();
-}
-
 void ChromeBrowserHostImpl::WindowDestroyed() {
  CEF_REQUIRE_UIT();
 #if defined(TOOLKIT_VIEWS)
--- a/libcef/browser/chrome/chrome_browser_host_impl.h
+++ b/libcef/browser/chrome/chrome_browser_host_impl.h
@@ -142,17 +142,24 @@ class ChromeBrowserHostImpl : public CefBrowserHostBase {
      scoped_refptr<CefBrowserInfo> browser_info,
      CefRefPtr<CefRequestContextImpl> request_context);

-  // Called from ChromeBrowserDelegate::SetAsDelegate when this object is first
-  // created. Must be called on the UI thread.
-  void Attach(Browser* browser, content::WebContents* web_contents);
+  // Create a new Browser without initializing the WebContents.
+  static Browser* CreateBrowser(const CefBrowserCreateParams& params);

-  // Called from ChromeBrowserDelegate::SetAsDelegate when this object changes
-  // Browser ownership (e.g. dragging between windows). The old Browser will be
-  // cleared before the new Browser is added. Must be called on the UI thread.
+  // Called from ChromeBrowserDelegate::CreateBrowser when this object is first
+  // created. Must be called on the UI thread.
+  void Attach(content::WebContents* web_contents,
+              CefRefPtr<ChromeBrowserHostImpl> opener);
+
+  // Called from ChromeBrowserDelegate::AddNewContents to take ownership of a
+  // popup WebContents.
+  void AddNewContents(std::unique_ptr<content::WebContents> contents);
+
+  // Called when this object changes Browser ownership (e.g. initially created,
+  // dragging between windows, etc). The old Browser, if any, will be cleared
+  // before the new Browser is added. Must be called on the UI thread.
  void SetBrowser(Browser* browser);

  // CefBrowserHostBase methods:
-  void InitializeBrowser() override;
  void WindowDestroyed() override;
  void DestroyBrowser() override;

--- a/libcef/browser/chrome/chrome_browser_main_extra_parts_cef.cc
+++ b/libcef/browser/chrome/chrome_browser_main_extra_parts_cef.cc
@@ -4,10 +4,12 @@

 #include "libcef/browser/chrome/chrome_browser_main_extra_parts_cef.h"

+#include "libcef/browser/chrome/chrome_context_menu_handler.h"
 #include "libcef/browser/context.h"
 #include "libcef/browser/net/chrome_scheme_handler.h"

 #include "base/task/post_task.h"
+#include "base/task/thread_pool.h"

 ChromeBrowserMainExtraPartsCef::ChromeBrowserMainExtraPartsCef() = default;

@@ -23,15 +25,16 @@ void ChromeBrowserMainExtraPartsCef::PostProfileInit() {
 }

 void ChromeBrowserMainExtraPartsCef::PreMainMessageLoopRun() {
-  background_task_runner_ = base::CreateSingleThreadTaskRunner(
-      {base::ThreadPool(), base::TaskPriority::BEST_EFFORT,
+  background_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+      {base::TaskPriority::BEST_EFFORT,
       base::TaskShutdownBehavior::BLOCK_SHUTDOWN, base::MayBlock()});
-  user_visible_task_runner_ = base::CreateSingleThreadTaskRunner(
-      {base::ThreadPool(), base::TaskPriority::USER_VISIBLE,
+  user_visible_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+      {base::TaskPriority::USER_VISIBLE,
       base::TaskShutdownBehavior::BLOCK_SHUTDOWN, base::MayBlock()});
-  user_blocking_task_runner_ = base::CreateSingleThreadTaskRunner(
-      {base::ThreadPool(), base::TaskPriority::USER_BLOCKING,
+  user_blocking_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+      {base::TaskPriority::USER_BLOCKING,
       base::TaskShutdownBehavior::BLOCK_SHUTDOWN, base::MayBlock()});

  scheme::RegisterWebUIControllerFactory();
+  context_menu::RegisterMenuCreatedCallback();
 }
--- a/libcef/browser/chrome/chrome_content_browser_client_cef.cc
+++ b/libcef/browser/chrome/chrome_content_browser_client_cef.cc
@@ -5,15 +5,20 @@

 #include "libcef/browser/chrome/chrome_content_browser_client_cef.h"

+#include "libcef/browser/browser_frame.h"
 #include "libcef/browser/browser_info_manager.h"
-#include "libcef/browser/browser_message_filter.h"
+#include "libcef/browser/browser_manager.h"
+#include "libcef/browser/chrome/chrome_browser_host_impl.h"
 #include "libcef/browser/chrome/chrome_browser_main_extra_parts_cef.h"
+#include "libcef/browser/context.h"
 #include "libcef/browser/net/chrome_scheme_handler.h"
 #include "libcef/browser/net/throttle_handler.h"
 #include "libcef/browser/net_service/cookie_manager_impl.h"
 #include "libcef/browser/net_service/login_delegate.h"
 #include "libcef/browser/net_service/proxy_url_loader_factory.h"
 #include "libcef/browser/net_service/resource_request_handler_wrapper.h"
+#include "libcef/browser/prefs/browser_prefs.h"
+#include "libcef/browser/prefs/renderer_prefs.h"
 #include "libcef/common/app_manager.h"
 #include "libcef/common/cef_switches.h"
 #include "libcef/common/command_line_impl.h"
@@ -25,7 +30,11 @@
 #include "chrome/common/chrome_switches.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/render_process_host.h"
+#include "content/public/browser/render_view_host.h"
+#include "content/public/browser/render_widget_host.h"
+#include "content/public/browser/render_widget_host_view.h"
 #include "content/public/common/content_switches.h"
+#include "third_party/blink/public/common/web_preferences/web_preferences.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"

 namespace {
@@ -33,13 +42,15 @@ namespace {
 void HandleExternalProtocolHelper(
    ChromeContentBrowserClientCef* self,
    content::WebContents::OnceGetter web_contents_getter,
+    int frame_tree_node_id,
    content::NavigationUIData* navigation_data,
    const network::ResourceRequest& resource_request) {
  // Match the logic of the original call in
  // NavigationURLLoaderImpl::PrepareForNonInterceptedRequest.
  self->HandleExternalProtocol(
      resource_request.url, std::move(web_contents_getter),
-      content::ChildProcessHost::kInvalidUniqueID, navigation_data,
+      content::ChildProcessHost::kInvalidUniqueID, frame_tree_node_id,
+      navigation_data,
      resource_request.resource_type ==
          static_cast<int>(blink::mojom::ResourceType::kMainFrame),
      static_cast<ui::PageTransition>(resource_request.transition_type),
@@ -82,6 +93,16 @@ void ChromeContentBrowserClientCef::AppendExtraCommandLineSwitches(

  const base::CommandLine* browser_cmd = base::CommandLine::ForCurrentProcess();

+  {
+    // Propagate the following switches to all command lines (along with any
+    // associated values) if present in the browser command line.
+    static const char* const kSwitchNames[] = {
+        switches::kUserAgentProductAndVersion,
+    };
+    command_line->CopySwitchesFrom(*browser_cmd, kSwitchNames,
+                                   base::size(kSwitchNames));
+  }
+
  const std::string& process_type =
      command_line->GetSwitchValueASCII(switches::kProcessType);
  if (process_type == switches::kRendererProcess) {
@@ -102,7 +123,7 @@ void ChromeContentBrowserClientCef::AppendExtraCommandLineSwitches(
      CefRefPtr<CefCommandLineImpl> commandLinePtr(
          new CefCommandLineImpl(command_line, false, false));
      handler->OnBeforeChildProcessLaunch(commandLinePtr.get());
-      commandLinePtr->Detach(nullptr);
+      ignore_result(commandLinePtr->Detach(nullptr));
    }
  }
 }
@@ -111,9 +132,6 @@ void ChromeContentBrowserClientCef::RenderProcessWillLaunch(
    content::RenderProcessHost* host) {
  ChromeContentBrowserClient::RenderProcessWillLaunch(host);

-  const int id = host->GetID();
-  host->AddFilter(new CefBrowserMessageFilter(id));
-
  // If the renderer process crashes then the host may already have
  // CefBrowserInfoManager as an observer. Try to remove it first before adding
  // to avoid DCHECKs.
@@ -148,13 +166,40 @@ bool ChromeContentBrowserClientCef::CanCreateWindow(
      user_gesture, opener_suppressed, no_javascript_access);
 }

+void ChromeContentBrowserClientCef::OverrideWebkitPrefs(
+    content::WebContents* web_contents,
+    blink::web_pref::WebPreferences* prefs) {
+  renderer_prefs::SetDefaultPrefs(*prefs);
+
+  ChromeContentBrowserClient::OverrideWebkitPrefs(web_contents, prefs);
+
+  auto browser = ChromeBrowserHostImpl::GetBrowserForContents(web_contents);
+  if (browser) {
+    renderer_prefs::SetCefPrefs(browser->settings(), *prefs);
+
+    // Set the background color for the WebView.
+    prefs->base_background_color = browser->GetBackgroundColor();
+  } else {
+    // We don't know for sure that the browser will be windowless but assume
+    // that the global windowless state is likely to be accurate.
+    prefs->base_background_color =
+        CefContext::Get()->GetBackgroundColor(nullptr, STATE_DEFAULT);
+  }
+
+  auto rvh = web_contents->GetRenderViewHost();
+  if (rvh->GetWidget()->GetView()) {
+    rvh->GetWidget()->GetView()->SetBackgroundColor(
+        prefs->base_background_color);
+  }
+}
+
 bool ChromeContentBrowserClientCef::WillCreateURLLoaderFactory(
    content::BrowserContext* browser_context,
    content::RenderFrameHost* frame,
    int render_process_id,
    URLLoaderFactoryType type,
    const url::Origin& request_initiator,
-    base::Optional<int64_t> navigation_id,
+    absl::optional<int64_t> navigation_id,
    ukm::SourceIdObj ukm_source_id,
    mojo::PendingReceiver<network::mojom::URLLoaderFactory>* factory_receiver,
    mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>*
@@ -175,7 +220,7 @@ bool ChromeContentBrowserClientCef::WillCreateURLLoaderFactory(
  // For example, the User Manager profile created via
  // profiles::CreateSystemProfileForUserManager.
  auto profile = Profile::FromBrowserContext(browser_context);
-  if (!CefBrowserContext::FromBrowserContext(profile->GetOriginalProfile()))
+  if (!CefBrowserContext::FromProfile(profile))
    return false;

  auto request_handler = net_service::CreateInterceptedRequestHandler(
@@ -193,11 +238,12 @@ bool ChromeContentBrowserClientCef::HandleExternalProtocol(
    const GURL& url,
    content::WebContents::OnceGetter web_contents_getter,
    int child_id,
+    int frame_tree_node_id,
    content::NavigationUIData* navigation_data,
    bool is_main_frame,
    ui::PageTransition page_transition,
    bool has_user_gesture,
-    const base::Optional<url::Origin>& initiating_origin,
+    const absl::optional<url::Origin>& initiating_origin,
    mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory) {
  // |out_factory| will be non-nullptr when this method is initially called
  // from NavigationURLLoaderImpl::PrepareForNonInterceptedRequest.
@@ -210,9 +256,9 @@ bool ChromeContentBrowserClientCef::HandleExternalProtocol(
  // HandleExternalProtocolHelper. Forward to the chrome layer for default
  // handling.
  return ChromeContentBrowserClient::HandleExternalProtocol(
-      url, std::move(web_contents_getter), child_id, navigation_data,
-      is_main_frame, page_transition, has_user_gesture, initiating_origin,
-      nullptr);
+      url, std::move(web_contents_getter), child_id, frame_tree_node_id,
+      navigation_data, is_main_frame, page_transition, has_user_gesture,
+      initiating_origin, nullptr);
 }

 bool ChromeContentBrowserClientCef::HandleExternalProtocol(
@@ -227,8 +273,9 @@ bool ChromeContentBrowserClientCef::HandleExternalProtocol(
  // HandleExternalProtocolHelper may be called if nothing handles the request.
  auto request_handler = net_service::CreateInterceptedRequestHandler(
      web_contents_getter, frame_tree_node_id, resource_request,
-      base::Bind(HandleExternalProtocolHelper, base::Unretained(this),
-                 web_contents_getter, navigation_data, resource_request));
+      base::BindRepeating(HandleExternalProtocolHelper, base::Unretained(this),
+                          web_contents_getter, frame_tree_node_id,
+                          navigation_data, resource_request));

  net_service::ProxyURLLoaderFactory::CreateProxy(
      web_contents_getter, std::move(receiver), std::move(request_handler));
@@ -258,7 +305,18 @@ void ChromeContentBrowserClientCef::ConfigureNetworkContextParams(
  auto cef_context = CefBrowserContext::FromBrowserContext(context);
  network_context_params->cookieable_schemes =
      cef_context ? cef_context->GetCookieableSchemes()
-                  : CefCookieManagerImpl::GetGlobalCookieableSchemes();
+                  : CefBrowserContext::GetGlobalCookieableSchemes();
+
+  // Prefer the CEF settings configuration, if specified, instead of the
+  // kAcceptLanguages preference which is controlled by the
+  // chrome://settings/languages configuration.
+  const std::string& accept_language_list =
+      browser_prefs::GetAcceptLanguageList(cef_context, /*browser=*/nullptr,
+                                           /*expand=*/true);
+  if (!accept_language_list.empty() &&
+      accept_language_list != network_context_params->accept_language) {
+    network_context_params->accept_language = accept_language_list;
+  }
 }

 std::unique_ptr<content::LoginDelegate>
@@ -297,6 +355,27 @@ bool ChromeContentBrowserClientCef::IsWebUIAllowedToMakeNetworkRequests(
  return scheme::IsWebUIAllowedToMakeNetworkRequests(origin);
 }

+void ChromeContentBrowserClientCef::ExposeInterfacesToRenderer(
+    service_manager::BinderRegistry* registry,
+    blink::AssociatedInterfaceRegistry* associated_registry,
+    content::RenderProcessHost* host) {
+  ChromeContentBrowserClient::ExposeInterfacesToRenderer(
+      registry, associated_registry, host);
+
+  CefBrowserManager::ExposeInterfacesToRenderer(registry, associated_registry,
+                                                host);
+}
+
+void ChromeContentBrowserClientCef::RegisterBrowserInterfaceBindersForFrame(
+    content::RenderFrameHost* render_frame_host,
+    mojo::BinderMapWithContext<content::RenderFrameHost*>* map) {
+  ChromeContentBrowserClient::RegisterBrowserInterfaceBindersForFrame(
+      render_frame_host, map);
+
+  CefBrowserFrame::RegisterBrowserInterfaceBindersForFrame(render_frame_host,
+                                                           map);
+}
+
 CefRefPtr<CefRequestContextImpl>
 ChromeContentBrowserClientCef::request_context() const {
  return browser_main_parts_->request_context();
--- a/libcef/browser/chrome/chrome_content_browser_client_cef.h
+++ b/libcef/browser/chrome/chrome_content_browser_client_cef.h
@@ -40,13 +40,15 @@ class ChromeContentBrowserClientCef : public ChromeContentBrowserClient {
                       bool user_gesture,
                       bool opener_suppressed,
                       bool* no_javascript_access) override;
+  void OverrideWebkitPrefs(content::WebContents* web_contents,
+                           blink::web_pref::WebPreferences* prefs) override;
  bool WillCreateURLLoaderFactory(
      content::BrowserContext* browser_context,
      content::RenderFrameHost* frame,
      int render_process_id,
      URLLoaderFactoryType type,
      const url::Origin& request_initiator,
-      base::Optional<int64_t> navigation_id,
+      absl::optional<int64_t> navigation_id,
      ukm::SourceIdObj ukm_source_id,
      mojo::PendingReceiver<network::mojom::URLLoaderFactory>* factory_receiver,
      mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>*
@@ -58,11 +60,12 @@ class ChromeContentBrowserClientCef : public ChromeContentBrowserClient {
      const GURL& url,
      content::WebContents::OnceGetter web_contents_getter,
      int child_id,
+      int frame_tree_node_id,
      content::NavigationUIData* navigation_data,
      bool is_main_frame,
      ui::PageTransition page_transition,
      bool has_user_gesture,
-      const base::Optional<url::Origin>& initiating_origin,
+      const absl::optional<url::Origin>& initiating_origin,
      mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory)
      override;
  bool HandleExternalProtocol(
@@ -93,6 +96,13 @@ class ChromeContentBrowserClientCef : public ChromeContentBrowserClient {
      LoginAuthRequiredCallback auth_required_callback) override;
  void BrowserURLHandlerCreated(content::BrowserURLHandler* handler) override;
  bool IsWebUIAllowedToMakeNetworkRequests(const url::Origin& origin) override;
+  void ExposeInterfacesToRenderer(
+      service_manager::BinderRegistry* registry,
+      blink::AssociatedInterfaceRegistry* associated_registry,
+      content::RenderProcessHost* render_process_host) override;
+  void RegisterBrowserInterfaceBindersForFrame(
+      content::RenderFrameHost* render_frame_host,
+      mojo::BinderMapWithContext<content::RenderFrameHost*>* map) override;

  CefRefPtr<CefRequestContextImpl> request_context() const;

--- a/libcef/browser/chrome/chrome_context_menu_handler.cc
+++ b/libcef/browser/chrome/chrome_context_menu_handler.cc
@@ -0,0 +1,207 @@
+// Copyright (c) 2021 The Chromium Embedded Framework Authors. All rights
+// reserved. Use of this source code is governed by a BSD-style license that can
+// be found in the LICENSE file.
+
+#include "libcef/browser/chrome/chrome_context_menu_handler.h"
+
+#include "libcef/browser/browser_host_base.h"
+#include "libcef/browser/context_menu_params_impl.h"
+#include "libcef/browser/simple_menu_model_impl.h"
+
+#include "chrome/browser/renderer_context_menu/render_view_context_menu.h"
+
+namespace context_menu {
+
+namespace {
+
+// Lifespan is controlled by RenderViewContextMenu.
+class CefContextMenuObserver : public RenderViewContextMenuObserver,
+                               public CefSimpleMenuModelImpl::StateDelegate {
+ public:
+  CefContextMenuObserver(RenderViewContextMenu* context_menu,
+                         CefRefPtr<CefBrowserHostBase> browser,
+                         CefRefPtr<CefContextMenuHandler> handler)
+      : context_menu_(context_menu), browser_(browser), handler_(handler) {}
+
+  // RenderViewContextMenuObserver methods:
+
+  void InitMenu(const content::ContextMenuParams& params) override {
+    params_ = new CefContextMenuParamsImpl(
+        const_cast<content::ContextMenuParams*>(&context_menu_->params()));
+    model_ = new CefSimpleMenuModelImpl(
+        const_cast<ui::SimpleMenuModel*>(&context_menu_->menu_model()),
+        context_menu_, this, /*is_owned=*/false, /*is_popup=*/false);
+
+    handler_->OnBeforeContextMenu(browser_, GetFrame(), params_, model_);
+  }
+
+  bool IsCommandIdSupported(int command_id) override {
+    // Always claim support for the reserved user ID range.
+    if (command_id >= MENU_ID_USER_FIRST && command_id <= MENU_ID_USER_LAST)
+      return true;
+
+    // Also claim support in specific cases where an ItemInfo exists.
+    return GetItemInfo(command_id) != nullptr;
+  }
+
+  // Only called if IsCommandIdSupported() returns true.
+  bool IsCommandIdEnabled(int command_id) override {
+    // Always return true to use the SimpleMenuModel state.
+    return true;
+  }
+
+  // Only called if IsCommandIdSupported() returns true.
+  bool IsCommandIdChecked(int command_id) override {
+    auto* info = GetItemInfo(command_id);
+    return info ? info->checked : false;
+  }
+
+  // Only called if IsCommandIdSupported() returns true.
+  bool GetAccelerator(int command_id, ui::Accelerator* accel) override {
+    auto* info = GetItemInfo(command_id);
+    if (info && info->accel) {
+      *accel = *info->accel;
+      return true;
+    }
+    return false;
+  }
+
+  void CommandWillBeExecuted(int command_id) override {
+    if (handler_->OnContextMenuCommand(browser_, GetFrame(), params_,
+                                       command_id, EVENTFLAG_NONE)) {
+      // Create an ItemInfo so that we get the ExecuteCommand() callback
+      // instead of the default handler.
+      GetOrCreateItemInfo(command_id);
+    }
+  }
+
+  // Only called if IsCommandIdSupported() returns true.
+  void ExecuteCommand(int command_id) override {
+    auto* info = GetItemInfo(command_id);
+    if (info) {
+      // In case it was added in CommandWillBeExecuted().
+      MaybeDeleteItemInfo(command_id, info);
+    }
+  }
+
+  void OnMenuClosed() override {
+    handler_->OnContextMenuDismissed(browser_, GetFrame());
+    model_->Detach();
+
+    // Clear stored state because this object won't be deleted until a new
+    // context menu is created or the associated browser is destroyed.
+    browser_ = nullptr;
+    handler_ = nullptr;
+    params_ = nullptr;
+    model_ = nullptr;
+    iteminfomap_.clear();
+  }
+
+  // CefSimpleMenuModelImpl::StateDelegate methods:
+
+  void SetChecked(int command_id, bool checked) override {
+    // No-op if already at the default state.
+    if (!checked && !GetItemInfo(command_id))
+      return;
+
+    auto* info = GetOrCreateItemInfo(command_id);
+    info->checked = checked;
+    if (!checked)
+      MaybeDeleteItemInfo(command_id, info);
+  }
+
+  void SetAccelerator(int command_id,
+                      absl::optional<ui::Accelerator> accel) override {
+    // No-op if already at the default state.
+    if (!accel && !GetItemInfo(command_id))
+      return;
+
+    auto* info = GetOrCreateItemInfo(command_id);
+    info->accel = accel;
+    if (!accel)
+      MaybeDeleteItemInfo(command_id, info);
+  }
+
+ private:
+  struct ItemInfo {
+    ItemInfo() {}
+
+    bool checked = false;
+    absl::optional<ui::Accelerator> accel;
+  };
+
+  ItemInfo* GetItemInfo(int command_id) {
+    auto it = iteminfomap_.find(command_id);
+    if (it != iteminfomap_.end()) {
+      return &it->second;
+    }
+    return nullptr;
+  }
+
+  ItemInfo* GetOrCreateItemInfo(int command_id) {
+    if (auto info = GetItemInfo(command_id))
+      return info;
+
+    auto result = iteminfomap_.insert(std::make_pair(command_id, ItemInfo()));
+    return &result.first->second;
+  }
+
+  void MaybeDeleteItemInfo(int command_id, ItemInfo* info) {
+    // Remove if all info has reverted to the default state.
+    if (!info->checked && !info->accel) {
+      auto it = iteminfomap_.find(command_id);
+      iteminfomap_.erase(it);
+    }
+  }
+
+  CefRefPtr<CefFrame> GetFrame() const {
+    CefRefPtr<CefFrame> frame;
+
+    // May return nullptr if the frame is destroyed while the menu is pending.
+    auto* rfh = context_menu_->GetRenderFrameHost();
+    if (rfh) {
+      frame = browser_->GetFrameForHost(rfh);
+    }
+    if (!frame) {
+      frame = browser_->GetMainFrame();
+    }
+    return frame;
+  }
+
+  RenderViewContextMenu* const context_menu_;
+  CefRefPtr<CefBrowserHostBase> browser_;
+  CefRefPtr<CefContextMenuHandler> handler_;
+  CefRefPtr<CefContextMenuParams> params_;
+  CefRefPtr<CefSimpleMenuModelImpl> model_;
+
+  // Map of command_id to ItemInfo.
+  using ItemInfoMap = std::map<int, ItemInfo>;
+  ItemInfoMap iteminfomap_;
+
+  DISALLOW_COPY_AND_ASSIGN(CefContextMenuObserver);
+};
+
+std::unique_ptr<RenderViewContextMenuObserver> MenuCreatedCallback(
+    RenderViewContextMenu* context_menu) {
+  auto browser = CefBrowserHostBase::GetBrowserForContents(
+      context_menu->source_web_contents());
+  if (browser) {
+    if (auto client = browser->GetClient()) {
+      if (auto handler = client->GetContextMenuHandler()) {
+        return std::make_unique<CefContextMenuObserver>(context_menu, browser,
+                                                        handler);
+      }
+    }
+  }
+
+  return nullptr;
+}
+
+}  // namespace
+
+void RegisterMenuCreatedCallback() {
+  RenderViewContextMenu::RegisterMenuCreatedCallback(
+      base::BindRepeating(&MenuCreatedCallback));
+}
+
+}  // namespace context_menu
--- a/libcef/browser/chrome/chrome_context_menu_handler.h
+++ b/libcef/browser/chrome/chrome_context_menu_handler.h
@@ -0,0 +1,16 @@
+// Copyright (c) 2021 The Chromium Embedded Framework Authors. All rights
+// reserved. Use of this source code is governed by a BSD-style license that can
+// be found in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_CHROME_CHROME_CONTEXT_MENU_HANDLER_H_
+#define CEF_LIBCEF_BROWSER_CHROME_CHROME_CONTEXT_MENU_HANDLER_H_
+#pragma once
+
+namespace context_menu {
+
+// Register the context menu created callback.
+void RegisterMenuCreatedCallback();
+
+}  // namespace context_menu
+
+#endif  // CEF_LIBCEF_BROWSER_CHROME_CHROME_CONTEXT_MENU_HANDLER_H_
--- a/libcef/browser/chrome/views/browser_platform_delegate_chrome_views.cc
+++ b/libcef/browser/chrome/views/browser_platform_delegate_chrome_views.cc
@@ -4,14 +4,59 @@

 #include "libcef/browser/chrome/views/browser_platform_delegate_chrome_views.h"

+#include "include/views/cef_window.h"
+
 #include "chrome/browser/ui/browser.h"
 #include "ui/views/widget/widget.h"

+namespace {
+
+// Default popup window delegate implementation.
+class PopupWindowDelegate : public CefWindowDelegate {
+ public:
+  explicit PopupWindowDelegate(CefRefPtr<CefBrowserView> browser_view)
+      : browser_view_(browser_view) {}
+
+  void OnWindowCreated(CefRefPtr<CefWindow> window) override {
+    window->AddChildView(browser_view_);
+    window->Show();
+    browser_view_->RequestFocus();
+  }
+
+  void OnWindowDestroyed(CefRefPtr<CefWindow> window) override {
+    browser_view_ = nullptr;
+  }
+
+  bool CanClose(CefRefPtr<CefWindow> window) override {
+    CefRefPtr<CefBrowser> browser = browser_view_->GetBrowser();
+    if (browser)
+      return browser->GetHost()->TryCloseBrowser();
+    return true;
+  }
+
+ private:
+  CefRefPtr<CefBrowserView> browser_view_;
+
+  IMPLEMENT_REFCOUNTING(PopupWindowDelegate);
+  DISALLOW_COPY_AND_ASSIGN(PopupWindowDelegate);
+};
+
+}  // namespace
+
 CefBrowserPlatformDelegateChromeViews::CefBrowserPlatformDelegateChromeViews(
    std::unique_ptr<CefBrowserPlatformDelegateNative> native_delegate,
    CefRefPtr<CefBrowserViewImpl> browser_view)
-    : CefBrowserPlatformDelegateChrome(std::move(native_delegate)),
-      browser_view_(browser_view) {}
+    : CefBrowserPlatformDelegateChrome(std::move(native_delegate)) {
+  if (browser_view)
+    SetBrowserView(browser_view);
+}
+
+void CefBrowserPlatformDelegateChromeViews::SetBrowserView(
+    CefRefPtr<CefBrowserViewImpl> browser_view) {
+  DCHECK(!browser_view_);
+  DCHECK(browser_view);
+  browser_view_ = browser_view;
+}

 void CefBrowserPlatformDelegateChromeViews::WebContentsCreated(
    content::WebContents* web_contents,
@@ -59,6 +104,50 @@ CefBrowserPlatformDelegateChromeViews::GetBrowserView() const {
  return browser_view_.get();
 }

+void CefBrowserPlatformDelegateChromeViews::PopupWebContentsCreated(
+    const CefBrowserSettings& settings,
+    CefRefPtr<CefClient> client,
+    content::WebContents* new_web_contents,
+    CefBrowserPlatformDelegate* new_platform_delegate,
+    bool is_devtools) {
+  DCHECK(new_platform_delegate->IsViewsHosted());
+  auto* new_platform_delegate_impl =
+      static_cast<CefBrowserPlatformDelegateChromeViews*>(
+          new_platform_delegate);
+
+  CefRefPtr<CefBrowserViewDelegate> new_delegate;
+  if (browser_view_->delegate()) {
+    new_delegate = browser_view_->delegate()->GetDelegateForPopupBrowserView(
+        browser_view_.get(), settings, client, is_devtools);
+  }
+
+  // Create a new BrowserView for the popup.
+  CefRefPtr<CefBrowserViewImpl> new_browser_view =
+      CefBrowserViewImpl::CreateForPopup(settings, new_delegate);
+
+  // Associate the PlatformDelegate with the new BrowserView.
+  new_platform_delegate_impl->SetBrowserView(new_browser_view);
+}
+
+void CefBrowserPlatformDelegateChromeViews::PopupBrowserCreated(
+    CefBrowserHostBase* new_browser,
+    bool is_devtools) {
+  CefRefPtr<CefBrowserView> new_browser_view =
+      CefBrowserView::GetForBrowser(new_browser);
+  DCHECK(new_browser_view);
+
+  bool popup_handled = false;
+  if (browser_view_->delegate()) {
+    popup_handled = browser_view_->delegate()->OnPopupBrowserViewCreated(
+        browser_view_.get(), new_browser_view.get(), is_devtools);
+  }
+
+  if (!popup_handled) {
+    CefWindow::CreateTopLevelWindow(
+        new PopupWindowDelegate(new_browser_view.get()));
+  }
+}
+
 bool CefBrowserPlatformDelegateChromeViews::IsViewsHosted() const {
  return true;
 }
--- a/libcef/browser/chrome/views/browser_platform_delegate_chrome_views.h
+++ b/libcef/browser/chrome/views/browser_platform_delegate_chrome_views.h
@@ -26,9 +26,19 @@ class CefBrowserPlatformDelegateChromeViews
  void CloseHostWindow() override;
  views::Widget* GetWindowWidget() const override;
  CefRefPtr<CefBrowserView> GetBrowserView() const override;
+  void PopupWebContentsCreated(
+      const CefBrowserSettings& settings,
+      CefRefPtr<CefClient> client,
+      content::WebContents* new_web_contents,
+      CefBrowserPlatformDelegate* new_platform_delegate,
+      bool is_devtools) override;
+  void PopupBrowserCreated(CefBrowserHostBase* new_browser,
+                           bool is_devtools) override;
  bool IsViewsHosted() const override;

 private:
+  void SetBrowserView(CefRefPtr<CefBrowserViewImpl> browser_view);
+
  CefRefPtr<CefBrowserViewImpl> browser_view_;
 };

--- a/libcef/browser/chrome/views/chrome_browser_view.cc
+++ b/libcef/browser/chrome/views/chrome_browser_view.cc
@@ -68,3 +68,31 @@ void ChromeBrowserView::OnBoundsChanged(const gfx::Rect& previous_bounds) {
  ParentClass::OnBoundsChanged(previous_bounds);
  browser_view_delegate_->OnBoundsChanged();
 }
+
+ToolbarView* ChromeBrowserView::OverrideCreateToolbar(
+    Browser* browser,
+    BrowserView* browser_view) {
+  if (cef_delegate()) {
+    auto toolbar_type = cef_delegate()->GetChromeToolbarType();
+    absl::optional<ToolbarView::DisplayMode> display_mode;
+    switch (toolbar_type) {
+      case CEF_CTT_NORMAL:
+        display_mode = ToolbarView::DisplayMode::NORMAL;
+        break;
+      case CEF_CTT_LOCATION:
+        display_mode = ToolbarView::DisplayMode::LOCATION;
+        break;
+      default:
+        break;
+    }
+    if (display_mode) {
+      cef_toolbar_ = CefToolbarViewImpl::Create(nullptr, browser, browser_view,
+                                                display_mode);
+      // Ownership will be taken by BrowserView.
+      view_util::PassOwnership(cef_toolbar_).release();
+      return cef_toolbar_->root_view();
+    }
+  }
+
+  return nullptr;
+}
--- a/libcef/browser/chrome/views/chrome_browser_view.h
+++ b/libcef/browser/chrome/views/chrome_browser_view.h
@@ -8,6 +8,7 @@

 #include "include/views/cef_browser_view.h"
 #include "include/views/cef_browser_view_delegate.h"
+#include "libcef/browser/chrome/views/toolbar_view_impl.h"
 #include "libcef/browser/views/browser_view_view.h"
 #include "libcef/browser/views/view_view.h"

@@ -42,6 +43,12 @@ class ChromeBrowserView
  void AddedToWidget() override;
  void OnBoundsChanged(const gfx::Rect& previous_bounds) override;

+  // BrowserView methods:
+  ToolbarView* OverrideCreateToolbar(Browser* browser,
+                                     BrowserView* browser_view) override;
+
+  CefRefPtr<CefToolbarViewImpl> cef_toolbar() const { return cef_toolbar_; }
+
 private:
  // Not owned by this object.
  Delegate* browser_view_delegate_;
@@ -51,6 +58,8 @@ class ChromeBrowserView

  bool destroyed_ = false;

+  CefRefPtr<CefToolbarViewImpl> cef_toolbar_;
+
  DISALLOW_COPY_AND_ASSIGN(ChromeBrowserView);
 };

--- a/libcef/browser/chrome/views/toolbar_view_impl.cc
+++ b/libcef/browser/chrome/views/toolbar_view_impl.cc
@@ -0,0 +1,40 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+#include "libcef/browser/chrome/views/toolbar_view_impl.h"
+
+// static
+CefRefPtr<CefToolbarViewImpl> CefToolbarViewImpl::Create(
+    CefRefPtr<CefViewDelegate> delegate,
+    Browser* browser,
+    BrowserView* browser_view,
+    absl::optional<ToolbarView::DisplayMode> display_mode) {
+  CEF_REQUIRE_UIT_RETURN(nullptr);
+  CefRefPtr<CefToolbarViewImpl> view =
+      new CefToolbarViewImpl(delegate, browser, browser_view, display_mode);
+  view->Initialize();
+  return view;
+}
+
+// static
+const char* const CefToolbarViewImpl::kTypeString = "ToolbarView";
+
+CefToolbarViewImpl::CefToolbarViewImpl(
+    CefRefPtr<CefViewDelegate> delegate,
+    Browser* browser,
+    BrowserView* browser_view,
+    absl::optional<ToolbarView::DisplayMode> display_mode)
+    : ParentClass(delegate),
+      browser_(browser),
+      browser_view_(browser_view),
+      display_mode_(display_mode) {}
+
+CefToolbarViewView* CefToolbarViewImpl::CreateRootView() {
+  return new CefToolbarViewView(delegate(), browser_, browser_view_,
+                                display_mode_);
+}
+
+void CefToolbarViewImpl::InitializeRootView() {
+  static_cast<CefToolbarViewView*>(root_view())->Initialize();
+}
--- a/libcef/browser/chrome/views/toolbar_view_impl.h
+++ b/libcef/browser/chrome/views/toolbar_view_impl.h
@@ -0,0 +1,55 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_CHROME_VIEWS_TOOLBAR_VIEW_IMPL_H_
+#define CEF_LIBCEF_BROWSER_CHROME_VIEWS_TOOLBAR_VIEW_IMPL_H_
+#pragma once
+
+#include "include/views/cef_view_delegate.h"
+
+#include "libcef/browser/chrome/views/toolbar_view_view.h"
+#include "libcef/browser/views/view_impl.h"
+
+class Browser;
+class BrowserView;
+
+class CefToolbarViewImpl
+    : public CefViewImpl<CefToolbarViewView, CefView, CefViewDelegate> {
+ public:
+  typedef CefViewImpl<CefToolbarViewView, CefView, CefViewDelegate> ParentClass;
+
+  // Create a new CefToolbarViewImpl instance. |delegate| may be nullptr.
+  static CefRefPtr<CefToolbarViewImpl> Create(
+      CefRefPtr<CefViewDelegate> delegate,
+      Browser* browser,
+      BrowserView* browser_view,
+      absl::optional<ToolbarView::DisplayMode> display_mode);
+
+  static const char* const kTypeString;
+
+  // CefViewAdapter methods:
+  std::string GetDebugType() override { return kTypeString; }
+
+ private:
+  // Create a new implementation object.
+  // Always call Initialize() after creation.
+  // |delegate| may be nullptr.
+  CefToolbarViewImpl(CefRefPtr<CefViewDelegate> delegate,
+                     Browser* browser,
+                     BrowserView* browser_view,
+                     absl::optional<ToolbarView::DisplayMode> display_mode);
+
+  // CefViewImpl methods:
+  CefToolbarViewView* CreateRootView() override;
+  void InitializeRootView() override;
+
+  Browser* const browser_;
+  BrowserView* const browser_view_;
+  absl::optional<ToolbarView::DisplayMode> const display_mode_;
+
+  IMPLEMENT_REFCOUNTING_DELETE_ON_UIT(CefToolbarViewImpl);
+  DISALLOW_COPY_AND_ASSIGN(CefToolbarViewImpl);
+};
+
+#endif  // CEF_LIBCEF_BROWSER_VIEWS_SCROLL_VIEW_IMPL_H_
--- a/libcef/browser/chrome/views/toolbar_view_view.cc
+++ b/libcef/browser/chrome/views/toolbar_view_view.cc
@@ -0,0 +1,11 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+#include "libcef/browser/chrome/views/toolbar_view_view.h"
+
+CefToolbarViewView::CefToolbarViewView(CefViewDelegate* cef_delegate,
+                                       Browser* browser,
+                                       BrowserView* browser_view,
+                                       absl::optional<DisplayMode> display_mode)
+    : ParentClass(cef_delegate, browser, browser_view, display_mode) {}
--- a/libcef/browser/chrome/views/toolbar_view_view.h
+++ b/libcef/browser/chrome/views/toolbar_view_view.h
@@ -0,0 +1,27 @@
+// Copyright 2021 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_CHROME_VIEWS_TOOLBAR_VIEW_VIEW_H_
+#define CEF_LIBCEF_BROWSER_CHROME_VIEWS_TOOLBAR_VIEW_VIEW_H_
+#pragma once
+
+#include "libcef/browser/views/view_view.h"
+
+#include "chrome/browser/ui/views/toolbar/toolbar_view.h"
+
+class CefToolbarViewView : public CefViewView<ToolbarView, CefViewDelegate> {
+ public:
+  typedef CefViewView<ToolbarView, CefViewDelegate> ParentClass;
+
+  // |cef_delegate| may be nullptr.
+  explicit CefToolbarViewView(CefViewDelegate* cef_delegate,
+                              Browser* browser,
+                              BrowserView* browser_view,
+                              absl::optional<DisplayMode> display_mode);
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(CefToolbarViewView);
+};
+
+#endif  // CEF_LIBCEF_BROWSER_CHROME_VIEWS_TOOLBAR_VIEW_VIEW_H_
--- a/libcef/browser/context.cc
+++ b/libcef/browser/context.cc
@@ -5,6 +5,7 @@
 #include "libcef/browser/context.h"

 #include "libcef/browser/browser_info_manager.h"
+#include "libcef/browser/request_context_impl.h"
 #include "libcef/browser/thread_util.h"
 #include "libcef/browser/trace_subscriber.h"
 #include "libcef/common/cef_switches.h"
@@ -293,10 +294,12 @@ void CefSetOSModalLoop(bool osModalLoop) {
    return;
  }

-  if (CEF_CURRENTLY_ON_UIT())
-    base::CurrentThread::Get()->set_os_modal_loop(osModalLoop);
-  else
-    CEF_POST_TASK(CEF_UIT, base::Bind(CefSetOSModalLoop, osModalLoop));
+  if (!CEF_CURRENTLY_ON_UIT()) {
+    CEF_POST_TASK(CEF_UIT, base::BindOnce(CefSetOSModalLoop, osModalLoop));
+    return;
+  }
+
+  base::CurrentThread::Get()->set_os_modal_loop(osModalLoop);
 #endif  // defined(OS_WIN)
 }

@@ -434,8 +437,11 @@ void CefContext::PopulateGlobalRequestContextSettings(
  settings->ignore_certificate_errors =
      settings_.ignore_certificate_errors ||
      command_line->HasSwitch(switches::kIgnoreCertificateErrors);
-  CefString(&settings->accept_language_list) =
-      CefString(&settings_.accept_language_list);
+
+  CefString(&settings->cookieable_schemes_list) =
+      CefString(&settings_.cookieable_schemes_list);
+  settings->cookieable_schemes_exclude_defaults =
+      settings_.cookieable_schemes_exclude_defaults;
 }

 void CefContext::NormalizeRequestContextSettings(
@@ -443,12 +449,6 @@ void CefContext::NormalizeRequestContextSettings(
  // The |root_cache_path| value was already normalized in Initialize.
  const base::FilePath& root_cache_path = CefString(&settings_.root_cache_path);
  NormalizeCachePathAndSet(settings->cache_path, root_cache_path);
-
-  if (settings->accept_language_list.length == 0) {
-    // Use the global language list setting.
-    CefString(&settings->accept_language_list) =
-        CefString(&settings_.accept_language_list);
-  }
 }

 void CefContext::AddObserver(Observer* observer) {
@@ -469,12 +469,19 @@ bool CefContext::HasObserver(Observer* observer) const {
 void CefContext::OnContextInitialized() {
  CEF_REQUIRE_UIT();

-  // Notify the handler.
  if (application_) {
-    CefRefPtr<CefBrowserProcessHandler> handler =
-        application_->GetBrowserProcessHandler();
-    if (handler)
-      handler->OnContextInitialized();
+    // Notify the handler after the global browser context has initialized.
+    CefRefPtr<CefRequestContext> request_context =
+        CefRequestContext::GetGlobalContext();
+    auto impl = static_cast<CefRequestContextImpl*>(request_context.get());
+    impl->ExecuteWhenBrowserContextInitialized(base::BindOnce(
+        [](CefRefPtr<CefApp> app) {
+          CefRefPtr<CefBrowserProcessHandler> handler =
+              app->GetBrowserProcessHandler();
+          if (handler)
+            handler->OnContextInitialized();
+        },
+        application_));
  }
 }

--- a/Show More
+++ b/Show More