Fix CVE-2020-15999 Heap overflow in the freetype library.

The coordinates passed to ScreenWin::GetDisplayMatching need to be converted
from DIP to screen coordinates.

BUILD.gn

@@ -1462,6 +1462,7 @@ repack("pak") {
     "$root_gen_dir/chrome/browser_resources.pak",
     "$root_gen_dir/chrome/dev_ui_browser_resources.pak",
     "$root_gen_dir/chrome/net_internals_resources.pak",
+    "$root_gen_dir/chrome/print_preview_pdf_resources.pak",
     "$root_gen_dir/chrome/print_preview_resources.pak",
     "$root_gen_dir/chrome/common_resources.pak",
     "$root_gen_dir/components/components_resources.pak",
@@ -1481,6 +1482,7 @@ repack("pak") {
     "//chrome/browser:dev_ui_browser_resources",
     "//chrome/browser:resources",
     "//chrome/browser/resources/net_internals:net_internals_resources",
+    "//chrome/browser/resources:print_preview_pdf_resources",
     "//chrome/browser/resources:print_preview_resources",
     "//chrome/common:resources",
     "//components/resources:components_resources",
@@ -1533,6 +1535,8 @@ make_pack_header("resources") {
     "$root_gen_dir/chrome/grit/component_extension_resources.h",
     "$root_gen_dir/chrome/grit/dev_ui_browser_resources.h",
     "$root_gen_dir/chrome/grit/net_internals_resources.h",
+    "$root_gen_dir/chrome/grit/print_preview_pdf_resources.h",
+    "$root_gen_dir/chrome/grit/print_preview_resources.h",
     "$root_gen_dir/chrome/grit/renderer_resources.h",
     "$root_gen_dir/components/grit/components_resources.h",
     "$root_gen_dir/components/grit/dev_ui_components_resources.h",

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,6 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/85.0.4183.0'
+  'chromium_checkout': 'refs/tags/85.0.4183.121',
+  'depot_tools_checkout': '233589f2e7'
 }

CMakeLists.txt.in

@@ -12,8 +12,8 @@
 # distribution include:
 #
 # Linux:      Ninja, Unix Makefiles
-# Mac OS X:   Ninja, Xcode 5+
+# MacOS:      Ninja, Xcode 8+
-# Windows:    Ninja, Visual Studio 2010+
+# Windows:    Ninja, Visual Studio 2015+
 #
 # Ninja is a cross-platform open-source tool for running fast builds using
 # pre-installed platform toolchains (GNU, clang, Xcode or MSVC). It can be
@@ -40,21 +40,21 @@
 #
 # - Linux requirements:
 #   Currently supported distributions include Debian Wheezy, Ubuntu Precise, and
-#   related. Ubuntu 14.04 64-bit is recommended. Newer versions will likely also
+#   related. Ubuntu 18.04 64-bit is recommended. Newer versions will likely also
 #   work but may not have been tested.
 #   Required packages include:
 #     build-essential
 #     libgtk2.0-dev     (required by the cefclient target only)
 #     libgtkglext1-dev  (required by the cefclient target only)
 #
-# - Mac OS X requirements:
+# - MacOS requirements:
-#   Xcode 5 or newer building on Mac OS X 10.9 (Mavericks) or newer. Xcode 8.3
+#   Xcode 8 or newer building on MacOS 10.10 (Yosemite) or newer. Xcode 11.2
-#   and OS X 10.12 are recommended. The Xcode command-line tools must also be
+#   and MacOS 10.14 are recommended. The Xcode command-line tools must also be
-#   installed. Only 64-bit builds are supported on OS X.
+#   installed. Only 64-bit builds are supported.
 #
 # - Windows requirements:
-#   Visual Studio 2010 or newer building on Windows 7 or newer. Visual Studio
+#   Visual Studio 2015 or newer building on Windows 7 or newer. Visual Studio
-#   2015 Update 3 and Windows 10 64-bit are recommended.
+#   2019 and Windows 10 64-bit are recommended.
 #
 # BUILD EXAMPLES
 #
@@ -75,7 +75,7 @@
 #     > cmake -G "Ninja" -DCMAKE_BUILD_TYPE=Debug ..
 #     > ninja cefclient cefsimple
 #
-# To perform a Mac OS X build using a 64-bit CEF binary distribution:
+# To perform a MacOS build using a 64-bit CEF binary distribution:
 #   Using the Xcode IDE:
 #     > cmake -G "Xcode" -DPROJECT_ARCH="x86_64" ..
 #     Open build\cef.xcodeproj in Xcode and select Product > Build.
@@ -85,24 +85,24 @@
 #     > ninja cefclient cefsimple
 #
 # To perform a Windows build using a 32-bit CEF binary distribution:
-#   Using the Visual Studio 2015 IDE:
+#   Using the Visual Studio 2019 IDE:
-#     > cmake -G "Visual Studio 14" ..
+#     > cmake -G "Visual Studio 16" -A Win32 ..
 #     Open build\cef.sln in Visual Studio and select Build > Build Solution.
 #
-#   Using Ninja with Visual Studio 2015 command-line tools:
+#   Using Ninja with Visual Studio 2019 command-line tools:
 #     (this path may be different depending on your Visual Studio installation)
-#     > "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\bin\vcvars32.bat"
+#     > "C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Auxiliary\Build\vcvars32.bat"
 #     > cmake -G "Ninja" -DCMAKE_BUILD_TYPE=Debug ..
 #     > ninja cefclient cefsimple
 #
 # To perform a Windows build using a 64-bit CEF binary distribution:
-#   Using the Visual Studio 2015 IDE:
+#   Using the Visual Studio 2019 IDE:
-#     > cmake -G "Visual Studio 14 Win64" ..
+#     > cmake -G "Visual Studio 16" -A x64 ..
 #     Open build\cef.sln in Visual Studio and select Build > Build Solution.
 #
-#   Using Ninja with Visual Studio 2015 command-line tools:
+#   Using Ninja with Visual Studio 2019 command-line tools:
 #     (this path may be different depending on your Visual Studio installation)
-#     > "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\bin\amd64\vcvars64.bat"
+#     > "C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Auxiliary\Build\vcvars64.bat"
 #     > cmake -G "Ninja" -DCMAKE_BUILD_TYPE=Debug ..
 #     > ninja cefclient cefsimple
 

cef_paths2.gypi

@@ -470,6 +470,7 @@
       'tests/ceftests/browser_info_map_unittest.cc',
       'tests/ceftests/command_line_unittest.cc',
       'tests/ceftests/cookie_unittest.cc',
+      'tests/ceftests/cors_unittest.cc',
       'tests/ceftests/devtools_message_unittest.cc',
       'tests/ceftests/dialog_unittest.cc',
       'tests/ceftests/display_unittest.cc',
@@ -520,6 +521,11 @@
       'tests/ceftests/task_unittest.cc',
       'tests/ceftests/test_handler.cc',
       'tests/ceftests/test_handler.h',
+      'tests/ceftests/test_request.cc',
+      'tests/ceftests/test_request.h',
+      'tests/ceftests/test_server.cc',
+      'tests/ceftests/test_server.h',
+      'tests/ceftests/test_server_unittest.cc',
       'tests/ceftests/test_suite.cc',
       'tests/ceftests/test_suite.h',
       'tests/ceftests/test_util.cc',
@@ -528,6 +534,7 @@
       'tests/ceftests/thread_helper.h',
       'tests/ceftests/thread_unittest.cc',
       'tests/ceftests/tracing_unittest.cc',
+      'tests/ceftests/track_callback.h',
       'tests/ceftests/translator_unittest.cc',
       'tests/ceftests/urlrequest_unittest.cc',
       'tests/ceftests/v8_unittest.cc',
@@ -587,10 +594,15 @@
       'tests/ceftests/urlrequest_unittest.cc',
       'tests/ceftests/test_handler.cc',
       'tests/ceftests/test_handler.h',
+      'tests/ceftests/test_request.cc',
+      'tests/ceftests/test_request.h',
+      'tests/ceftests/test_server.cc',
+      'tests/ceftests/test_server.h',
       'tests/ceftests/test_suite.cc',
       'tests/ceftests/test_suite.h',
       'tests/ceftests/test_util.cc',
       'tests/ceftests/test_util.h',
+      'tests/ceftests/track_callback.h',
       'tests/ceftests/thread_helper.cc',
       'tests/ceftests/thread_helper.h',
       'tests/ceftests/thread_unittest.cc',

cmake/cef_variables.cmake.in

@@ -310,7 +310,7 @@ if(OS_MACOSX)
 
   # Find the newest available base SDK.
   execute_process(COMMAND xcode-select --print-path OUTPUT_VARIABLE XCODE_PATH OUTPUT_STRIP_TRAILING_WHITESPACE)
-  foreach(OS_VERSION 10.11 10.10 10.9)
+  foreach(OS_VERSION 10.15 10.14 10.13 10.12 10.11 10.10)
     set(SDK "${XCODE_PATH}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX${OS_VERSION}.sdk")
     if(NOT "${CMAKE_OSX_SYSROOT}" AND EXISTS "${SDK}" AND IS_DIRECTORY "${SDK}")
       set(CMAKE_OSX_SYSROOT ${SDK})
@@ -318,7 +318,7 @@ if(OS_MACOSX)
   endforeach()
 
   # Target SDK.
-  set(CEF_TARGET_SDK               "10.9")
+  set(CEF_TARGET_SDK               "10.10")
   list(APPEND CEF_COMPILER_FLAGS
     -mmacosx-version-min=${CEF_TARGET_SDK}
   )
@@ -375,25 +375,8 @@ if(OS_WINDOWS)
 
   if(USE_SANDBOX)
     # Check if the current MSVC version is compatible with the cef_sandbox.lib
-    # static library. For a list of all version numbers see
+    # static library. We require VS2015 or newer.
-    # https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B#Internal_version_numbering
+    if(MSVC_VERSION LESS 1900)
-    list(APPEND supported_msvc_versions
-      1900  # VS2015 and updates 1, 2, & 3
-      1910  # VS2017 version 15.1 & 15.2
-      1911  # VS2017 version 15.3 & 15.4
-      1912  # VS2017 version 15.5
-      1913  # VS2017 version 15.6
-      1914  # VS2017 version 15.7
-      1915  # VS2017 version 15.8
-      1916  # VS2017 version 15.9
-      1920  # VS2019 version 16.0
-      1921  # VS2019 version 16.1
-      1922  # VS2019 version 16.2
-      1923  # VS2019 version 16.3
-      1924  # VS2019 version 16.4
-      )
-    list(FIND supported_msvc_versions ${MSVC_VERSION} _index)
-    if (${_index} EQUAL -1)
       message(WARNING "CEF sandbox is not compatible with the current MSVC version (${MSVC_VERSION})")
       set(USE_SANDBOX OFF)
     endif()

include/capi/cef_resource_bundle_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=b9577b495df3990284d4e4a3db2824196175dc91$
+// $hash=b0e2b63b467c6d4e990405d948908da3546ea1c7$
 //
 
 #ifndef CEF_INCLUDE_CAPI_CEF_RESOURCE_BUNDLE_CAPI_H_
@@ -41,6 +41,7 @@
 #pragma once
 
 #include "include/capi/cef_base_capi.h"
+#include "include/capi/cef_values_capi.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -70,34 +71,25 @@ typedef struct _cef_resource_bundle_t {
       int string_id);
 
   ///
-  // Retrieves the contents of the specified scale independent |resource_id|. If
+  // Returns a cef_binary_value_t containing the decompressed contents of the
-  // the value is found then |data| and |data_size| will be populated and this
+  // specified scale independent |resource_id| or NULL if not found. Include
-  // function will return true (1). If the value is not found then this function
+  // cef_pack_resources.h for a listing of valid resource ID values.
-  // will return false (0). The returned |data| pointer will remain resident in
-  // memory and should not be freed. Include cef_pack_resources.h for a listing
-  // of valid resource ID values.
   ///
-  int(CEF_CALLBACK* get_data_resource)(struct _cef_resource_bundle_t* self,
+  struct _cef_binary_value_t*(CEF_CALLBACK* get_data_resource)(
-                                       int resource_id,
+      struct _cef_resource_bundle_t* self,
-                                       void** data,
+      int resource_id);
-                                       size_t* data_size);
 
   ///
-  // Retrieves the contents of the specified |resource_id| nearest the scale
+  // Returns a cef_binary_value_t containing the decompressed contents of the
-  // factor |scale_factor|. Use a |scale_factor| value of SCALE_FACTOR_NONE for
+  // specified |resource_id| nearest the scale factor |scale_factor| or NULL if
-  // scale independent resources or call GetDataResource instead. If the value
+  // not found. Use a |scale_factor| value of SCALE_FACTOR_NONE for scale
-  // is found then |data| and |data_size| will be populated and this function
+  // independent resources or call GetDataResource instead.Include
-  // will return true (1). If the value is not found then this function will
+  // cef_pack_resources.h for a listing of valid resource ID values.
-  // return false (0). The returned |data| pointer will remain resident in
-  // memory and should not be freed. Include cef_pack_resources.h for a listing
-  // of valid resource ID values.
   ///
-  int(CEF_CALLBACK* get_data_resource_for_scale)(
+  struct _cef_binary_value_t*(CEF_CALLBACK* get_data_resource_for_scale)(
       struct _cef_resource_bundle_t* self,
       int resource_id,
-      cef_scale_factor_t scale_factor,
+      cef_scale_factor_t scale_factor);
-      void** data,
-      size_t* data_size);
 } cef_resource_bundle_t;
 
 ///

include/capi/views/cef_display_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=422243fda6e1404222aca7bdd4e7b84b961a9626$
+// $hash=652ac7a90c6cd10b1cbc6ae99a549c03f36c794e$
 //
 
 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_DISPLAY_CAPI_H_
@@ -50,9 +50,9 @@ extern "C" {
 // This structure typically, but not always, corresponds to a physical display
 // connected to the system. A fake Display may exist on a headless system, or a
 // Display may correspond to a remote, virtual display. All size and position
-// values are in density independent pixels (DIP) unless otherwise indicated.
+// values are in density independent pixel (DIP) coordinates unless otherwise
-// Methods must be called on the browser process UI thread unless otherwise
+// indicated. Methods must be called on the browser process UI thread unless
-// indicated.
+// otherwise indicated.
 ///
 typedef struct _cef_display_t {
   ///
@@ -74,27 +74,28 @@ typedef struct _cef_display_t {
   float(CEF_CALLBACK* get_device_scale_factor)(struct _cef_display_t* self);
 
   ///
-  // Convert |point| from density independent pixels (DIP) to pixel coordinates
+  // Convert |point| from DIP coordinates to pixel coordinates using this
-  // using this Display's device scale factor.
+  // Display's device scale factor.
   ///
   void(CEF_CALLBACK* convert_point_to_pixels)(struct _cef_display_t* self,
                                               cef_point_t* point);
 
   ///
-  // Convert |point| from pixel coordinates to density independent pixels (DIP)
+  // Convert |point| from pixel coordinates to DIP coordinates using this
-  // using this Display's device scale factor.
+  // Display's device scale factor.
   ///
   void(CEF_CALLBACK* convert_point_from_pixels)(struct _cef_display_t* self,
                                                 cef_point_t* point);
 
   ///
-  // Returns this Display's bounds. This is the full size of the display.
+  // Returns this Display's bounds in DIP screen coordinates. This is the full
+  // size of the display.
   ///
   cef_rect_t(CEF_CALLBACK* get_bounds)(struct _cef_display_t* self);
 
   ///
-  // Returns this Display's work area. This excludes areas of the display that
+  // Returns this Display's work area in DIP screen coordinates. This excludes
-  // are occupied for window manager toolbars, etc.
+  // areas of the display that are occupied with window manager toolbars, etc.
   ///
   cef_rect_t(CEF_CALLBACK* get_work_area)(struct _cef_display_t* self);
 
@@ -111,7 +112,7 @@ CEF_EXPORT cef_display_t* cef_display_get_primary();
 
 ///
 // Returns the Display nearest |point|. Set |input_pixel_coords| to true (1) if
-// |point| is in pixel coordinates instead of density independent pixels (DIP).
+// |point| is in pixel screen coordinates instead of DIP screen coordinates.
 ///
 CEF_EXPORT cef_display_t* cef_display_get_nearest_point(
     const cef_point_t* point,
@@ -119,8 +120,8 @@ CEF_EXPORT cef_display_t* cef_display_get_nearest_point(
 
 ///
 // Returns the Display that most closely intersects |bounds|.  Set
-// |input_pixel_coords| to true (1) if |bounds| is in pixel coordinates instead
+// |input_pixel_coords| to true (1) if |bounds| is in pixel screen coordinates
-// of density independent pixels (DIP).
+// instead of DIP screen coordinates.
 ///
 CEF_EXPORT cef_display_t* cef_display_get_matching_bounds(
     const cef_rect_t* bounds,

include/capi/views/cef_view_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=45b421dfcf8ee7cf61b1991a336bc65d33fbe10a$
+// $hash=55be3e44016d9861bb8e9270b52f2bf45c8a53f5$
 //
 
 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_VIEW_CAPI_H_
@@ -176,64 +176,72 @@ typedef struct _cef_view_t {
                                                      int id);
 
   ///
-  // Sets the bounds (size and position) of this View. Position is in parent
+  // Sets the bounds (size and position) of this View. |bounds| is in parent
-  // coordinates.
+  // coordinates, or DIP screen coordinates if there is no parent.
   ///
   void(CEF_CALLBACK* set_bounds)(struct _cef_view_t* self,
                                  const cef_rect_t* bounds);
 
   ///
-  // Returns the bounds (size and position) of this View. Position is in parent
+  // Returns the bounds (size and position) of this View in parent coordinates,
-  // coordinates.
+  // or DIP screen coordinates if there is no parent.
   ///
   cef_rect_t(CEF_CALLBACK* get_bounds)(struct _cef_view_t* self);
 
   ///
-  // Returns the bounds (size and position) of this View. Position is in screen
+  // Returns the bounds (size and position) of this View in DIP screen
   // coordinates.
   ///
   cef_rect_t(CEF_CALLBACK* get_bounds_in_screen)(struct _cef_view_t* self);
 
   ///
-  // Sets the size of this View without changing the position.
+  // Sets the size of this View without changing the position. |size| in parent
+  // coordinates, or DIP screen coordinates if there is no parent.
   ///
   void(CEF_CALLBACK* set_size)(struct _cef_view_t* self,
                                const cef_size_t* size);
 
   ///
-  // Returns the size of this View.
+  // Returns the size of this View in parent coordinates, or DIP screen
+  // coordinates if there is no parent.
   ///
   cef_size_t(CEF_CALLBACK* get_size)(struct _cef_view_t* self);
 
   ///
   // Sets the position of this View without changing the size. |position| is in
-  // parent coordinates.
+  // parent coordinates, or DIP screen coordinates if there is no parent.
   ///
   void(CEF_CALLBACK* set_position)(struct _cef_view_t* self,
                                    const cef_point_t* position);
 
   ///
-  // Returns the position of this View. Position is in parent coordinates.
+  // Returns the position of this View. Position is in parent coordinates, or
+  // DIP screen coordinates if there is no parent.
   ///
   cef_point_t(CEF_CALLBACK* get_position)(struct _cef_view_t* self);
 
   ///
   // Returns the size this View would like to be if enough space is available.
+  // Size is in parent coordinates, or DIP screen coordinates if there is no
+  // parent.
   ///
   cef_size_t(CEF_CALLBACK* get_preferred_size)(struct _cef_view_t* self);
 
   ///
-  // Size this View to its preferred size.
+  // Size this View to its preferred size. Size is in parent coordinates, or DIP
+  // screen coordinates if there is no parent.
   ///
   void(CEF_CALLBACK* size_to_preferred_size)(struct _cef_view_t* self);
 
   ///
-  // Returns the minimum size for this View.
+  // Returns the minimum size for this View. Size is in parent coordinates, or
+  // DIP screen coordinates if there is no parent.
   ///
   cef_size_t(CEF_CALLBACK* get_minimum_size)(struct _cef_view_t* self);
 
   ///
-  // Returns the maximum size for this View.
+  // Returns the maximum size for this View. Size is in parent coordinates, or
+  // DIP screen coordinates if there is no parent.
   ///
   cef_size_t(CEF_CALLBACK* get_maximum_size)(struct _cef_view_t* self);
 
@@ -327,21 +335,21 @@ typedef struct _cef_view_t {
   cef_color_t(CEF_CALLBACK* get_background_color)(struct _cef_view_t* self);
 
   ///
-  // Convert |point| from this View's coordinate system to that of the screen.
+  // Convert |point| from this View's coordinate system to DIP screen
-  // This View must belong to a Window when calling this function. Returns true
+  // coordinates. This View must belong to a Window when calling this function.
-  // (1) if the conversion is successful or false (0) otherwise. Use
+  // Returns true (1) if the conversion is successful or false (0) otherwise.
-  // cef_display_t::convert_point_to_pixels() after calling this function if
+  // Use cef_display_t::convert_point_to_pixels() after calling this function if
   // further conversion to display-specific pixel coordinates is desired.
   ///
   int(CEF_CALLBACK* convert_point_to_screen)(struct _cef_view_t* self,
                                              cef_point_t* point);
 
   ///
-  // Convert |point| to this View's coordinate system from that of the screen.
+  // Convert |point| to this View's coordinate system from DIP screen
-  // This View must belong to a Window when calling this function. Returns true
+  // coordinates. This View must belong to a Window when calling this function.
-  // (1) if the conversion is successful or false (0) otherwise. Use
+  // Returns true (1) if the conversion is successful or false (0) otherwise.
-  // cef_display_t::convert_point_from_pixels() before calling this function if
+  // Use cef_display_t::convert_point_from_pixels() before calling this function
-  // conversion from display-specific pixel coordinates is necessary.
+  // if conversion from display-specific pixel coordinates is necessary.
   ///
   int(CEF_CALLBACK* convert_point_from_screen)(struct _cef_view_t* self,
                                                cef_point_t* point);

include/capi/views/cef_window_delegate_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=a0cec778fbaf0b1f5c9b3ef75dc7bbeeba777a44$
+// $hash=fee25d300df47c6143b935d0f99d543ea888f55c$
 //
 
 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_WINDOW_DELEGATE_CAPI_H_
@@ -87,6 +87,18 @@ typedef struct _cef_window_delegate_t {
       int* is_menu,
       int* can_activate_menu);
 
+  ///
+  // Return the initial bounds for |window| in density independent pixel (DIP)
+  // coordinates. If this function returns an NULL CefRect then
+  // get_preferred_size() will be called to retrieve the size, and the window
+  // will be placed on the screen with origin (0,0). This function can be used
+  // in combination with cef_view_t::get_bounds_in_screen() to restore the
+  // previous window bounds.
+  ///
+  cef_rect_t(CEF_CALLBACK* get_initial_bounds)(
+      struct _cef_window_delegate_t* self,
+      struct _cef_window_t* window);
+
   ///
   // Return true (1) if |window| should be created without a frame or title bar.
   // The window will be resizable if can_resize() returns true (1). Use

include/cef_api_hash.h

@@ -42,13 +42,13 @@
 // way that may cause binary incompatibility with other builds. The universal
 // hash value will change if any platform is affected whereas the platform hash
 // values will change only if that particular platform is affected.
-#define CEF_API_HASH_UNIVERSAL "20d95f0b54da45b2ced365aa92c784e348862bd3"
+#define CEF_API_HASH_UNIVERSAL "09d3d4f08869644fe3baa7a751de537f3446525b"
 #if defined(OS_WIN)
-#define CEF_API_HASH_PLATFORM "fbe8ca0acbdc4b4050d5e44cbde930177be44edf"
+#define CEF_API_HASH_PLATFORM "3022db6736af26cc38158d38e22f74a51312a5c9"
 #elif defined(OS_MACOSX)
-#define CEF_API_HASH_PLATFORM "68ba2cd3b110e52ef2d6b07412155b845b105177"
+#define CEF_API_HASH_PLATFORM "13e2e2451c2320f0d16b35ba53b3295409888dd8"
 #elif defined(OS_LINUX)
-#define CEF_API_HASH_PLATFORM "40e1cf30d708463e32bf65f9d033f98f22a321e8"
+#define CEF_API_HASH_PLATFORM "d781b815150795b0bce95d72ce967b508c9a04d5"
 #endif
 
 #ifdef __cplusplus

include/cef_resource_bundle.h

@@ -39,6 +39,7 @@
 #pragma once
 
 #include "include/cef_base.h"
+#include "include/cef_values.h"
 
 ///
 // Class used for retrieving resources from the resource bundle (*.pak) files
@@ -67,33 +68,24 @@ class CefResourceBundle : public virtual CefBaseRefCounted {
   virtual CefString GetLocalizedString(int string_id) = 0;
 
   ///
-  // Retrieves the contents of the specified scale independent |resource_id|.
+  // Returns a CefBinaryValue containing the decompressed contents of the
-  // If the value is found then |data| and |data_size| will be populated and
+  // specified scale independent |resource_id| or NULL if not found. Include
-  // this method will return true. If the value is not found then this method
+  // cef_pack_resources.h for a listing of valid resource ID values.
-  // will return false. The returned |data| pointer will remain resident in
-  // memory and should not be freed. Include cef_pack_resources.h for a listing
-  // of valid resource ID values.
   ///
   /*--cef()--*/
-  virtual bool GetDataResource(int resource_id,
+  virtual CefRefPtr<CefBinaryValue> GetDataResource(int resource_id) = 0;
-                               void*& data,
-                               size_t& data_size) = 0;
 
   ///
-  // Retrieves the contents of the specified |resource_id| nearest the scale
+  // Returns a CefBinaryValue containing the decompressed contents of the
-  // factor |scale_factor|. Use a |scale_factor| value of SCALE_FACTOR_NONE for
+  // specified |resource_id| nearest the scale factor |scale_factor| or NULL if
-  // scale independent resources or call GetDataResource instead. If the value
+  // not found. Use a |scale_factor| value of SCALE_FACTOR_NONE for scale
-  // is found then |data| and |data_size| will be populated and this method will
+  // independent resources or call GetDataResource instead.Include
-  // return true. If the value is not found then this method will return false.
+  // cef_pack_resources.h for a listing of valid resource ID values.
-  // The returned |data| pointer will remain resident in memory and should not
-  // be freed. Include cef_pack_resources.h for a listing of valid resource ID
-  // values.
   ///
   /*--cef()--*/
-  virtual bool GetDataResourceForScale(int resource_id,
+  virtual CefRefPtr<CefBinaryValue> GetDataResourceForScale(
-                                       ScaleFactor scale_factor,
+      int resource_id,
-                                       void*& data,
+      ScaleFactor scale_factor) = 0;
-                                       size_t& data_size) = 0;
 };
 
 #endif  // CEF_INCLUDE_CEF_RESOURCE_BUNDLE_H_

include/views/cef_display.h

@@ -46,9 +46,9 @@
 // This class typically, but not always, corresponds to a physical display
 // connected to the system. A fake Display may exist on a headless system, or a
 // Display may correspond to a remote, virtual display. All size and position
-// values are in density independent pixels (DIP) unless otherwise indicated.
+// values are in density independent pixel (DIP) coordinates unless otherwise
-// Methods must be called on the browser process UI thread unless otherwise
+// indicated. Methods must be called on the browser process UI thread unless
-// indicated.
+// otherwise indicated.
 ///
 /*--cef(source=library)--*/
 class CefDisplay : public CefBaseRefCounted {
@@ -61,8 +61,7 @@ class CefDisplay : public CefBaseRefCounted {
 
   ///
   // Returns the Display nearest |point|. Set |input_pixel_coords| to true if
-  // |point| is in pixel coordinates instead of density independent pixels
+  // |point| is in pixel screen coordinates instead of DIP screen coordinates.
-  // (DIP).
   ///
   /*--cef()--*/
   static CefRefPtr<CefDisplay> GetDisplayNearestPoint(const CefPoint& point,
@@ -70,8 +69,8 @@ class CefDisplay : public CefBaseRefCounted {
 
   ///
   // Returns the Display that most closely intersects |bounds|.  Set
-  // |input_pixel_coords| to true if |bounds| is in pixel coordinates instead of
+  // |input_pixel_coords| to true if |bounds| is in pixel screen coordinates
-  // density independent pixels (DIP).
+  // instead of DIP screen coordinates.
   ///
   /*--cef()--*/
   static CefRefPtr<CefDisplay> GetDisplayMatchingBounds(
@@ -108,28 +107,29 @@ class CefDisplay : public CefBaseRefCounted {
   virtual float GetDeviceScaleFactor() = 0;
 
   ///
-  // Convert |point| from density independent pixels (DIP) to pixel coordinates
+  // Convert |point| from DIP coordinates to pixel coordinates using this
-  // using this Display's device scale factor.
+  // Display's device scale factor.
   ///
   /*--cef()--*/
   virtual void ConvertPointToPixels(CefPoint& point) = 0;
 
   ///
-  // Convert |point| from pixel coordinates to density independent pixels (DIP)
+  // Convert |point| from pixel coordinates to DIP coordinates using this
-  // using this Display's device scale factor.
+  // Display's device scale factor.
   ///
   /*--cef()--*/
   virtual void ConvertPointFromPixels(CefPoint& point) = 0;
 
   ///
-  // Returns this Display's bounds. This is the full size of the display.
+  // Returns this Display's bounds in DIP screen coordinates. This is the full
+  // size of the display.
   ///
   /*--cef()--*/
   virtual CefRect GetBounds() = 0;
 
   ///
-  // Returns this Display's work area. This excludes areas of the display that
+  // Returns this Display's work area in DIP screen coordinates. This excludes
-  // are occupied for window manager toolbars, etc.
+  // areas of the display that are occupied with window manager toolbars, etc.
   ///
   /*--cef()--*/
   virtual CefRect GetWorkArea() = 0;

include/views/cef_view.h

@@ -174,71 +174,79 @@ class CefView : public CefBaseRefCounted {
   virtual CefRefPtr<CefView> GetViewForID(int id) = 0;
 
   ///
-  // Sets the bounds (size and position) of this View. Position is in parent
+  // Sets the bounds (size and position) of this View. |bounds| is in parent
-  // coordinates.
+  // coordinates, or DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual void SetBounds(const CefRect& bounds) = 0;
 
   ///
-  // Returns the bounds (size and position) of this View. Position is in parent
+  // Returns the bounds (size and position) of this View in parent coordinates,
-  // coordinates.
+  // or DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual CefRect GetBounds() = 0;
 
   ///
-  // Returns the bounds (size and position) of this View. Position is in screen
+  // Returns the bounds (size and position) of this View in DIP screen
   // coordinates.
   ///
   /*--cef()--*/
   virtual CefRect GetBoundsInScreen() = 0;
 
   ///
-  // Sets the size of this View without changing the position.
+  // Sets the size of this View without changing the position. |size| in
+  // parent coordinates, or DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual void SetSize(const CefSize& size) = 0;
 
   ///
-  // Returns the size of this View.
+  // Returns the size of this View in parent coordinates, or DIP screen
+  // coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual CefSize GetSize() = 0;
 
   ///
   // Sets the position of this View without changing the size. |position| is in
-  // parent coordinates.
+  // parent coordinates, or DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual void SetPosition(const CefPoint& position) = 0;
 
   ///
-  // Returns the position of this View. Position is in parent coordinates.
+  // Returns the position of this View. Position is in parent coordinates, or
+  // DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual CefPoint GetPosition() = 0;
 
   ///
   // Returns the size this View would like to be if enough space is available.
+  // Size is in parent coordinates, or DIP screen coordinates if there is no
+  // parent.
   ///
   /*--cef()--*/
   virtual CefSize GetPreferredSize() = 0;
 
   ///
-  // Size this View to its preferred size.
+  // Size this View to its preferred size. Size is in parent coordinates, or
+  // DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual void SizeToPreferredSize() = 0;
 
   ///
-  // Returns the minimum size for this View.
+  // Returns the minimum size for this View. Size is in parent coordinates, or
+  // DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual CefSize GetMinimumSize() = 0;
 
   ///
-  // Returns the maximum size for this View.
+  // Returns the maximum size for this View. Size is in parent coordinates, or
+  // DIP screen coordinates if there is no parent.
   ///
   /*--cef()--*/
   virtual CefSize GetMaximumSize() = 0;
@@ -345,9 +353,9 @@ class CefView : public CefBaseRefCounted {
   virtual cef_color_t GetBackgroundColor() = 0;
 
   ///
-  // Convert |point| from this View's coordinate system to that of the screen.
+  // Convert |point| from this View's coordinate system to DIP screen
-  // This View must belong to a Window when calling this method. Returns true
+  // coordinates. This View must belong to a Window when calling this method.
-  // if the conversion is successful or false otherwise. Use
+  // Returns true if the conversion is successful or false otherwise. Use
   // CefDisplay::ConvertPointToPixels() after calling this method if further
   // conversion to display-specific pixel coordinates is desired.
   ///
@@ -355,9 +363,9 @@ class CefView : public CefBaseRefCounted {
   virtual bool ConvertPointToScreen(CefPoint& point) = 0;
 
   ///
-  // Convert |point| to this View's coordinate system from that of the screen.
+  // Convert |point| to this View's coordinate system from DIP screen
-  // This View must belong to a Window when calling this method. Returns true if
+  // coordinates. This View must belong to a Window when calling this method.
-  // the conversion is successful or false otherwise. Use
+  // Returns true if the conversion is successful or false otherwise. Use
   // CefDisplay::ConvertPointFromPixels() before calling this method if
   // conversion from display-specific pixel coordinates is necessary.
   ///

include/views/cef_window_delegate.h

@@ -78,6 +78,19 @@ class CefWindowDelegate : public CefPanelDelegate {
     return nullptr;
   }
 
+  ///
+  // Return the initial bounds for |window| in density independent pixel (DIP)
+  // coordinates. If this method returns an empty CefRect then
+  // GetPreferredSize() will be called to retrieve the size, and the window will
+  // be placed on the screen with origin (0,0). This method can be used in
+  // combination with CefView::GetBoundsInScreen() to restore the previous
+  // window bounds.
+  ///
+  /*--cef()--*/
+  virtual CefRect GetInitialBounds(CefRefPtr<CefWindow> window) {
+    return CefRect();
+  }
+
   ///
   // Return true if |window| should be created without a frame or title bar. The
   // window will be resizable if CanResize() returns true. Use

include/wrapper/cef_helpers.h

@@ -89,6 +89,32 @@ struct CefDeleteOnIOThread : public CefDeleteOnThread<TID_IO> {};
 struct CefDeleteOnFileThread : public CefDeleteOnThread<TID_FILE> {};
 struct CefDeleteOnRendererThread : public CefDeleteOnThread<TID_RENDERER> {};
 
+// Same as IMPLEMENT_REFCOUNTING() but using the specified Destructor.
+#define IMPLEMENT_REFCOUNTING_EX(ClassName, Destructor)              \
+ public:                                                             \
+  void AddRef() const OVERRIDE { ref_count_.AddRef(); }              \
+  bool Release() const OVERRIDE {                                    \
+    if (ref_count_.Release()) {                                      \
+      Destructor::Destruct(this);                                    \
+      return true;                                                   \
+    }                                                                \
+    return false;                                                    \
+  }                                                                  \
+  bool HasOneRef() const OVERRIDE { return ref_count_.HasOneRef(); } \
+  bool HasAtLeastOneRef() const OVERRIDE {                           \
+    return ref_count_.HasAtLeastOneRef();                            \
+  }                                                                  \
+                                                                     \
+ private:                                                            \
+  CefRefCount ref_count_
+
+#define IMPLEMENT_REFCOUNTING_DELETE_ON_UIT(ClassName) \
+  IMPLEMENT_REFCOUNTING_EX(ClassName, CefDeleteOnUIThread)
+
+#define IMPLEMENT_REFCOUNTING_DELETE_ON_IOT(ClassName) \
+  IMPLEMENT_REFCOUNTING_EX(ClassName, CefDeleteOnIOThread)
+
+
 ///
 // Helper class to manage a scoped copy of |argv|.
 ///

libcef/browser/alloy/alloy_browser_context.cc

@@ -21,6 +21,7 @@
 #include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "chrome/browser/font_family_cache.h"
+#include "chrome/browser/media/media_device_id_salt.h"
 #include "chrome/browser/plugins/chrome_plugin_service_filter.h"
 #include "chrome/browser/profiles/profile_key.h"
 #include "chrome/browser/ui/zoom/chrome_zoom_level_prefs.h"
@@ -168,6 +169,8 @@ void AlloyBrowserContext::Initialize() {
     extension_system_->Init();
 
   ChromePluginServiceFilter::GetInstance()->RegisterProfile(this);
+
+  media_device_id_salt_ = new MediaDeviceIDSalt(pref_service);
 }
 
 void AlloyBrowserContext::Shutdown() {
@@ -397,6 +400,10 @@ AlloyBrowserContext::GetBrowsingDataRemoverDelegate() {
   return nullptr;
 }
 
+std::string AlloyBrowserContext::GetMediaDeviceIDSalt() {
+  return media_device_id_salt_->GetSalt();
+}
+
 PrefService* AlloyBrowserContext::GetPrefs() {
   return pref_service_.get();
 }

libcef/browser/alloy/alloy_browser_context.h

@@ -18,6 +18,7 @@
 class CefDownloadManagerDelegate;
 class CefSSLHostStateDelegate;
 class CefVisitedLinkListener;
+class MediaDeviceIDSalt;
 class PrefService;
 
 namespace extensions {
@@ -80,6 +81,7 @@ class AlloyBrowserContext : public ChromeProfileAlloy,
   content::BackgroundSyncController* GetBackgroundSyncController() override;
   content::BrowsingDataRemoverDelegate* GetBrowsingDataRemoverDelegate()
       override;
+  std::string GetMediaDeviceIDSalt() override;
 
   // Profile overrides.
   ChromeZoomLevelPrefs* GetZoomLevelPrefs() override;
@@ -103,7 +105,7 @@ class AlloyBrowserContext : public ChromeProfileAlloy,
     return !!settings_.persist_session_cookies;
   }
   base::Optional<std::vector<std::string>> GetCookieableSchemes() override {
-    return cookieable_schemes_;
+    return cookieable_schemes();
   }
 
   // visitedlink::VisitedLinkDelegate methods.
@@ -140,6 +142,8 @@ class AlloyBrowserContext : public ChromeProfileAlloy,
 
   std::unique_ptr<content::ResourceContext> resource_context_;
 
+  scoped_refptr<MediaDeviceIDSalt> media_device_id_salt_;
+
   DISALLOW_COPY_AND_ASSIGN(AlloyBrowserContext);
 };
 

libcef/browser/alloy/alloy_content_browser_client.cc

@@ -52,6 +52,7 @@
 #include "cef/grit/cef_resources.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_content_browser_client.h"
+#include "chrome/browser/content_settings/cookie_settings_factory.h"
 #include "chrome/browser/net/system_network_context_manager.h"
 #include "chrome/browser/plugins/plugin_info_host_impl.h"
 #include "chrome/browser/plugins/plugin_response_interceptor_url_loader_throttle.h"
@@ -61,6 +62,7 @@
 #include "chrome/browser/profiles/renderer_updater_factory.h"
 #include "chrome/browser/renderer_host/pepper/chrome_browser_pepper_host_factory.h"
 #include "chrome/browser/spellchecker/spell_check_host_chrome_impl.h"
+#include "chrome/common/chrome_content_client.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/google_url_loader_throttle.h"
@@ -69,6 +71,7 @@
 #include "chrome/grit/browser_resources.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/services/printing/printing_service.h"
+#include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/navigation_interception/intercept_navigation_throttle.h"
 #include "components/navigation_interception/navigation_params.h"
 #include "components/spellcheck/common/spellcheck.mojom.h"
@@ -450,10 +453,21 @@ bool NavigationOnUIThread(
     const navigation_interception::NavigationParams& params) {
   CEF_REQUIRE_UIT();
 
+  content::OpenURLParams open_params(
+      params.url(), params.referrer(), WindowOpenDisposition::CURRENT_TAB,
+      params.transition_type(), params.is_renderer_initiated());
+  open_params.user_gesture = params.has_user_gesture();
+  open_params.initiator_origin = params.initiator_origin();
+
+  CefRefPtr<CefBrowserHostImpl> browser;
+  if (!CefBrowserInfoManager::GetInstance()->MaybeAllowNavigation(
+          source->GetMainFrame(), open_params, browser)) {
+    // Cancel the navigation.
+    return true;
+  }
+
   bool ignore_navigation = false;
 
-  CefRefPtr<CefBrowserHostImpl> browser =
-      CefBrowserHostImpl::GetBrowserForContents(source);
   if (browser.get()) {
     CefRefPtr<CefClient> client = browser->GetClient();
     if (client.get()) {
@@ -1243,6 +1257,7 @@ void AlloyContentBrowserClient::RegisterNonNetworkSubresourceURLLoaderFactories(
       extensions::Manifest::IsComponentLocation(extension->location())) {
     // Components of chrome that are implemented as extensions or platform apps
     // are allowed to use chrome://resources/ and chrome://theme/ URLs.
+    // See also HasCrossOriginWhitelistEntry.
     allowed_webui_hosts.emplace_back(content::kChromeUIResourcesHost);
     allowed_webui_hosts.emplace_back(chrome::kChromeUIThemeHost);
   }
@@ -1296,6 +1311,15 @@ void AlloyContentBrowserClient::ConfigureNetworkContextParams(
     const base::FilePath& relative_partition_path,
     network::mojom::NetworkContextParams* network_context_params,
     network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  // This method may be called during shutdown when using multi-threaded
+  // message loop mode. In that case exit early to avoid crashes.
+  if (!SystemNetworkContextManager::GetInstance()) {
+    // This must match the value expected in
+    // StoragePartitionImpl::InitNetworkContext.
+    network_context_params->context_name = "magic_shutting_down";
+    return;
+  }
+
   Profile* profile = Profile::FromBrowserContext(context);
   profile->ConfigureNetworkContextParams(in_memory, relative_partition_path,
                                          network_context_params,
@@ -1460,6 +1484,42 @@ AlloyContentBrowserClient::GetPluginMimeTypesWithExternalHandlers(
   return mime_types;
 }
 
+bool AlloyContentBrowserClient::ArePersistentMediaDeviceIDsAllowed(
+    content::BrowserContext* browser_context,
+    const GURL& url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin) {
+  // Persistent MediaDevice IDs are allowed if cookies are allowed.
+  return CookieSettingsFactory::GetForProfile(
+             Profile::FromBrowserContext(browser_context))
+      ->IsCookieAccessAllowed(url, site_for_cookies, top_frame_origin);
+}
+
+bool AlloyContentBrowserClient::ShouldAllowPluginCreation(
+    const url::Origin& embedder_origin,
+    const content::PepperPluginInfo& plugin_info) {
+  if (plugin_info.name == ChromeContentClient::kPDFInternalPluginName) {
+    // Allow embedding the internal PDF plugin in the built-in PDF extension.
+    if (embedder_origin.scheme() == extensions::kExtensionScheme &&
+        embedder_origin.host() == extension_misc::kPdfExtensionId) {
+      return true;
+    }
+
+    // Allow embedding the internal PDF plugin in chrome://print.
+    if (embedder_origin ==
+        url::Origin::Create(GURL(chrome::kChromeUIPrintURL))) {
+      return true;
+    }
+
+    // Only allow the PDF plugin in the known, trustworthy origins that are
+    // allowlisted above.  See also https://crbug.com/520422 and
+    // https://crbug.com/1027173.
+    return false;
+  }
+
+  return true;
+}
+
 CefRefPtr<CefRequestContextImpl> AlloyContentBrowserClient::request_context()
     const {
   return browser_main_parts_->request_context();

libcef/browser/alloy/alloy_content_browser_client.h

@@ -207,6 +207,14 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
   blink::UserAgentMetadata GetUserAgentMetadata() override;
   base::flat_set<std::string> GetPluginMimeTypesWithExternalHandlers(
       content::BrowserContext* browser_context) override;
+  bool ArePersistentMediaDeviceIDsAllowed(
+      content::BrowserContext* browser_context,
+      const GURL& scope,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) override;
+  bool ShouldAllowPluginCreation(
+      const url::Origin& embedder_origin,
+      const content::PepperPluginInfo& plugin_info) override;
 
   CefRefPtr<CefRequestContextImpl> request_context() const;
   CefDevToolsDelegate* devtools_delegate() const;

libcef/browser/browser_context.h

@@ -196,10 +196,11 @@ class CefBrowserContext {
 
   CefMediaRouterManager* GetMediaRouterManager();
 
-  void set_cookieable_schemes(
+  using CookieableSchemes = base::Optional<std::vector<std::string>>;
-      base::Optional<std::vector<std::string>> schemes) {
+  void set_cookieable_schemes(const CookieableSchemes& schemes) {
     cookieable_schemes_ = schemes;
   }
+  CookieableSchemes cookieable_schemes() const { return cookieable_schemes_; }
 
   // These accessors are safe to call from any thread because the values don't
   // change during this object's lifespan.
@@ -227,10 +228,9 @@ class CefBrowserContext {
   const CefRequestContextSettings settings_;
   base::FilePath cache_path_;
 
-  base::Optional<std::vector<std::string>> cookieable_schemes_;
-
  private:
   std::unique_ptr<CefIOThreadState> iothread_state_;
+  CookieableSchemes cookieable_schemes_;
   std::unique_ptr<CefMediaRouterManager> media_router_manager_;
 
   // CefRequestContextImpl objects referencing this object.

libcef/browser/browser_info_manager.cc

@@ -22,6 +22,8 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/child_process_host.h"
+#include "content/public/common/url_constants.h"
+#include "extensions/common/constants.h"
 
 namespace {
 
@@ -115,26 +117,13 @@ bool CefBrowserInfoManager::CanCreateWindow(
     bool* no_javascript_access) {
   CEF_REQUIRE_UIT();
 
-  bool is_guest_view = false;
+  content::OpenURLParams params(target_url, referrer, disposition,
-  CefRefPtr<CefBrowserHostImpl> browser =
+                                ui::PAGE_TRANSITION_LINK,
-      extensions::GetOwnerBrowserForHost(opener, &is_guest_view);
+                                /*is_renderer_initiated=*/true);
-  DCHECK(browser.get());
+  params.user_gesture = user_gesture;
-  if (!browser.get()) {
-    // Cancel the popup.
-    return false;
-  }
-
-  if (is_guest_view) {
-    content::OpenURLParams params(target_url, referrer, disposition,
-                                  ui::PAGE_TRANSITION_LINK, true);
-    params.user_gesture = user_gesture;
-
-    // Pass navigation to the owner browser.
-    CEF_POST_TASK(
-        CEF_UIT,
-        base::Bind(base::IgnoreResult(&CefBrowserHostImpl::OpenURLFromTab),
-                   browser.get(), nullptr, params));
 
+  CefRefPtr<CefBrowserHostImpl> browser;
+  if (!MaybeAllowNavigation(opener, params, browser) || !browser) {
     // Cancel the popup.
     return false;
   }
@@ -369,6 +358,38 @@ CefBrowserInfoManager::GetBrowserInfoForFrameRoute(int render_process_id,
   return GetBrowserInfo(render_process_id, render_routing_id, is_guest_view);
 }
 
+bool CefBrowserInfoManager::MaybeAllowNavigation(
+    content::RenderFrameHost* opener,
+    const content::OpenURLParams& params,
+    CefRefPtr<CefBrowserHostImpl>& browser_out) const {
+  CEF_REQUIRE_UIT();
+
+  bool is_guest_view = false;
+  CefRefPtr<CefBrowserHostImpl> browser =
+      extensions::GetOwnerBrowserForHost(opener, &is_guest_view);
+  if (!browser) {
+    // Print preview uses a modal dialog where we don't own the WebContents.
+    // Allow that navigation to proceed.
+    return true;
+  }
+
+  if (is_guest_view && !params.url.SchemeIs(extensions::kExtensionScheme) &&
+      !params.url.SchemeIs(content::kChromeUIScheme)) {
+    // The PDF viewer will load the PDF extension in the guest view, and print
+    // preview will load chrome://print in the guest view. All other navigations
+    // are passed to the owner browser.
+    CEF_POST_TASK(
+        CEF_UIT,
+        base::Bind(base::IgnoreResult(&CefBrowserHostImpl::OpenURLFromTab),
+                   browser.get(), nullptr, params));
+
+    return false;
+  }
+
+  browser_out = browser;
+  return true;
+}
+
 scoped_refptr<CefBrowserInfo>
 CefBrowserInfoManager::GetBrowserInfoForFrameTreeNode(int frame_tree_node_id,
                                                       bool* is_guest_view) {

libcef/browser/browser_info_manager.h

@@ -25,6 +25,7 @@ struct WebWindowFeatures;
 }
 
 namespace content {
+struct OpenURLParams;
 struct Referrer;
 class RenderFrameHost;
 class RenderViewHostDelegateView;
@@ -138,6 +139,13 @@ class CefBrowserInfoManager : public content::RenderProcessHostObserver {
   typedef std::list<scoped_refptr<CefBrowserInfo>> BrowserInfoList;
   BrowserInfoList GetBrowserInfoList();
 
+  // Returns true if the navigation should be allowed to proceed, or false if
+  // the navigation will instead be sent via OpenURLFromTab. If allowed,
+  // |browser| will be set to the target browser if any.
+  bool MaybeAllowNavigation(content::RenderFrameHost* opener,
+                            const content::OpenURLParams& params,
+                            CefRefPtr<CefBrowserHostImpl>& browser) const;
+
  private:
   // RenderProcessHostObserver methods:
   void RenderProcessHostDestroyed(content::RenderProcessHost* host) override;

libcef/browser/browser_message_loop.cc

@@ -70,19 +70,21 @@ class MessagePumpExternal : public base::MessagePumpForUI {
     // is_immediate() returns true if the next task is ready right away.
     more_immediate_work = next_work_info.is_immediate();
     if (!more_immediate_work) {
-      // DoIdleWork() returns true if idle work was all done.
-      more_idle_work = !delegate->DoIdleWork();
-
       // Check the next PendingTask's |delayed_run_time|.
       // is_max() returns true if there are no more immediate nor delayed tasks.
       more_delayed_work = !next_work_info.delayed_run_time.is_max();
-      if (more_delayed_work && !more_idle_work) {
+      if (more_delayed_work) {
         // The only remaining work that we know about is the PendingTask.
         // Consider the run time for that task in the time slice calculation.
         *next_run_time = next_work_info.delayed_run_time;
       }
     }
 
+    if (!more_immediate_work && !more_delayed_work) {
+      // DoIdleWork() returns true if idle work was all done.
+      more_idle_work = !delegate->DoIdleWork();
+    }
+
     return more_immediate_work || more_idle_work || more_delayed_work;
   }
 

libcef/browser/native/browser_platform_delegate_native.h

@@ -62,7 +62,6 @@ class CefBrowserPlatformDelegateNative
   void set_windowless_handler(WindowlessHandler* handler) {
     windowless_handler_ = handler;
   }
-  void set_browser(CefBrowserHostImpl* browser) { browser_ = browser; }
 
   CefWindowInfo window_info_;
   const SkColor background_color_;

libcef/browser/native/browser_platform_delegate_native_aura.cc

@@ -225,6 +225,8 @@ int CefBrowserPlatformDelegateNativeAura::TranslateUiChangedButtonFlags(
 
 content::RenderWidgetHostViewAura*
 CefBrowserPlatformDelegateNativeAura::GetHostView() const {
+  if (!web_contents_)
+    return nullptr;
   return static_cast<content::RenderWidgetHostViewAura*>(
       web_contents_->GetRenderWidgetHostView());
 }

libcef/browser/net_service/cookie_helper.cc

@@ -17,6 +17,7 @@
 #include "services/network/public/cpp/resource_request.h"
 
 namespace net_service {
+namespace cookie_helper {
 
 namespace {
 
@@ -137,6 +138,28 @@ void SaveCookiesOnUIThread(content::BrowserContext* browser_context,
 
 }  // namespace
 
+bool IsCookieableScheme(
+    const GURL& url,
+    const base::Optional<std::vector<std::string>>& cookieable_schemes) {
+  if (!url.has_scheme())
+    return false;
+
+  if (cookieable_schemes) {
+    // The client has explicitly registered the full set of schemes that should
+    // be supported.
+    const auto url_scheme = url.scheme_piece();
+    for (auto scheme : *cookieable_schemes) {
+      if (url_scheme == scheme)
+        return true;
+    }
+    return false;
+  }
+
+  // Schemes that support cookies by default.
+  // This should match CookieMonster::kDefaultCookieableSchemes.
+  return url.SchemeIsHTTPOrHTTPS() || url.SchemeIsWSOrWSS();
+}
+
 void LoadCookies(content::BrowserContext* browser_context,
                  const network::ResourceRequest& request,
                  const AllowCookieCallback& allow_cookie_callback,
@@ -228,4 +251,5 @@ void SaveCookies(content::BrowserContext* browser_context,
   }
 }
 
+}  // namespace cookie_helper
 }  // namespace net_service

libcef/browser/net_service/cookie_helper.h

@@ -21,6 +21,14 @@ struct ResourceRequest;
 }  // namespace network
 
 namespace net_service {
+namespace cookie_helper {
+
+// Returns true if the scheme for |url| supports cookies. |cookieable_schemes|
+// is the optional list of schemes that the client has explicitly registered as
+// cookieable, which may intentionally exclude standard schemes.
+bool IsCookieableScheme(
+    const GURL& url,
+    const base::Optional<std::vector<std::string>>& cookieable_schemes);
 
 using AllowCookieCallback =
     base::Callback<void(const net::CanonicalCookie&, bool* /* allow */)>;
@@ -52,6 +60,7 @@ void SaveCookies(content::BrowserContext* browser_context,
                  const AllowCookieCallback& allow_cookie_callback,
                  DoneCookieCallback done_callback);
 
+}  // namespace cookie_helper
 }  // namespace net_service
 
 #endif  // CEF_LIBCEF_BROWSER_NET_SERVICE_COOKIE_HELPER_H_

libcef/browser/net_service/proxy_url_loader_factory.cc

@@ -6,7 +6,9 @@
 #include "libcef/browser/net_service/proxy_url_loader_factory.h"
 
 #include "libcef/browser/context.h"
+#include "libcef/browser/origin_whitelist_impl.h"
 #include "libcef/browser/thread_util.h"
+#include "libcef/common/net/scheme_registration.h"
 #include "libcef/common/net_service/net_service_util.h"
 
 #include "base/barrier_closure.h"
@@ -18,7 +20,9 @@
 #include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/base/big_buffer.h"
 #include "net/http/http_status_code.h"
+#include "net/url_request/redirect_util.h"
 #include "services/network/public/cpp/cors/cors.h"
+#include "services/network/public/cpp/features.h"
 
 namespace net_service {
 
@@ -27,6 +31,26 @@ namespace {
 // User data key for ResourceContextData.
 const void* const kResourceContextUserDataKey = &kResourceContextUserDataKey;
 
+base::Optional<std::string> GetHeaderString(
+    const net::HttpResponseHeaders* headers,
+    const std::string& header_name) {
+  std::string header_value;
+  if (!headers || !headers->GetNormalizedHeader(header_name, &header_value)) {
+    return base::nullopt;
+  }
+  return header_value;
+}
+
+bool IsOutOfBlinkCorsEnabled() {
+  static int state = -1;
+  if (state == -1) {
+    state = base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors)
+                ? 1
+                : 0;
+  }
+  return !!state;
+}
+
 }  // namespace
 
 // Owns all of the ProxyURLLoaderFactorys for a given BrowserContext. Since
@@ -106,6 +130,43 @@ class ResourceContextData : public base::SupportsUserData::Data {
   DISALLOW_COPY_AND_ASSIGN(ResourceContextData);
 };
 
+// CORS preflight requests are handled in the network process, so we just need
+// to continue all of the callbacks and then delete ourself.
+class CorsPreflightRequest : public network::mojom::TrustedHeaderClient {
+ public:
+  explicit CorsPreflightRequest(
+      mojo::PendingReceiver<network::mojom::TrustedHeaderClient> receiver)
+      : weak_factory_(this) {
+    header_client_receiver_.Bind(std::move(receiver));
+
+    header_client_receiver_.set_disconnect_handler(base::BindOnce(
+        &CorsPreflightRequest::OnDestroy, weak_factory_.GetWeakPtr()));
+  }
+
+  // mojom::TrustedHeaderClient methods:
+  void OnBeforeSendHeaders(const net::HttpRequestHeaders& headers,
+                           OnBeforeSendHeadersCallback callback) override {
+    std::move(callback).Run(net::OK, base::nullopt);
+  }
+
+  void OnHeadersReceived(const std::string& headers,
+                         const net::IPEndPoint& remote_endpoint,
+                         OnHeadersReceivedCallback callback) override {
+    std::move(callback).Run(net::OK, base::nullopt, GURL());
+    OnDestroy();
+  }
+
+ private:
+  void OnDestroy() { delete this; }
+
+  mojo::Receiver<network::mojom::TrustedHeaderClient> header_client_receiver_{
+      this};
+
+  base::WeakPtrFactory<CorsPreflightRequest> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(CorsPreflightRequest);
+};
+
 //==============================
 // InterceptedRequest
 //=============================
@@ -219,6 +280,8 @@ class InterceptedRequest : public network::mojom::URLLoader,
                       bool wait_for_loader_error);
 
   void SendErrorAndCompleteImmediately(int error_code);
+  void SendErrorStatusAndCompleteImmediately(
+      const network::URLLoaderCompletionStatus& status);
 
   void SendErrorCallback(int error_code, bool safebrowsing_hit);
 
@@ -229,6 +292,7 @@ class InterceptedRequest : public network::mojom::URLLoader,
   const uint32_t options_;
   bool input_stream_previously_failed_ = false;
   bool request_was_redirected_ = false;
+  int redirect_limit_ = net::URLRequest::kMaxRedirects;
 
   // To avoid sending multiple OnReceivedError callbacks.
   bool sent_error_callback_ = false;
@@ -365,6 +429,27 @@ void InterceptedRequest::Restart() {
   current_request_uses_header_client_ =
       !!factory_->url_loader_header_client_receiver_;
 
+  if (IsOutOfBlinkCorsEnabled() && request_.request_initiator &&
+      network::cors::ShouldCheckCors(request_.url, request_.request_initiator,
+                                     request_.mode)) {
+    if (scheme::IsCorsEnabledScheme(request_.url.scheme())) {
+      // Add the Origin header for CORS-enabled scheme requests.
+      request_.headers.SetHeaderIfMissing(
+          net::HttpRequestHeaders::kOrigin,
+          request_.request_initiator->Serialize());
+    } else if (!HasCrossOriginWhitelistEntry(
+                   *request_.request_initiator,
+                   url::Origin::Create(request_.url))) {
+      // Fail requests if a CORS check is required and the scheme is not CORS
+      // enabled. This matches the error condition that would be generated by
+      // CorsURLLoader::StartRequest in the network process.
+      SendErrorStatusAndCompleteImmediately(
+          network::URLLoaderCompletionStatus(network::CorsErrorStatus(
+              network::mojom::CorsError::kCorsDisabledScheme)));
+      return;
+    }
+  }
+
   const GURL original_url = request_.url;
 
   factory_->request_handler_->OnBeforeRequest(
@@ -485,6 +570,11 @@ void InterceptedRequest::OnReceiveRedirect(
     needs_callback = true;
   }
 
+  if (--redirect_limit_ == 0) {
+    SendErrorAndCompleteImmediately(net::ERR_TOO_MANY_REDIRECTS);
+    return;
+  }
+
   net::RedirectInfo new_redirect_info;
 
   // When we redirect via ContinueToHandleOverrideHeaders the |redirect_info|
@@ -831,37 +921,46 @@ void InterceptedRequest::ContinueToBeforeRedirect(
   if (proxied_client_binding_)
     proxied_client_binding_.ResumeIncomingMethodCallProcessing();
 
+  const auto original_url = request_.url;
+  const auto original_method = request_.method;
+
+  net::RedirectInfo new_redirect_info = redirect_info;
   if (redirect_url.is_valid()) {
-    net::RedirectInfo new_redirect_info = redirect_info;
     new_redirect_info.new_url = redirect_url;
-    target_client_->OnReceiveRedirect(new_redirect_info,
+    new_redirect_info.new_site_for_cookies =
-                                      std::move(current_response_));
+        net::SiteForCookies::FromUrl(redirect_url);
-    request_.url = redirect_url;
-  } else {
-    target_client_->OnReceiveRedirect(redirect_info,
-                                      std::move(current_response_));
-    request_.url = redirect_info.new_url;
   }
 
-  // If request_ changes from POST to GET, strip POST headers.
+  target_client_->OnReceiveRedirect(new_redirect_info,
-  const bool post_to_get =
+                                    std::move(current_response_));
-      request_.method == "POST" &&
-      redirect_info.new_method == net::HttpRequestHeaders::kGetMethod;
 
-  request_.method = redirect_info.new_method;
+  request_.url = new_redirect_info.new_url;
-  request_.site_for_cookies = redirect_info.new_site_for_cookies;
+  request_.method = new_redirect_info.new_method;
-  request_.referrer = GURL(redirect_info.new_referrer);
+  request_.site_for_cookies = new_redirect_info.new_site_for_cookies;
-  request_.referrer_policy = redirect_info.new_referrer_policy;
+  request_.referrer = GURL(new_redirect_info.new_referrer);
+  request_.referrer_policy = new_redirect_info.new_referrer_policy;
 
-  // The request method can be changed to "GET". In this case we need to
+  if (request_.trusted_params) {
-  // reset the request body manually, and strip the POST headers.
+    request_.trusted_params->isolation_info =
-  if (request_.method == net::HttpRequestHeaders::kGetMethod) {
+        request_.trusted_params->isolation_info.CreateForRedirect(
+            url::Origin::Create(request_.url));
+  }
+
+  // Remove existing Cookie headers. They may be re-added after Restart().
+  const std::vector<std::string> remove_headers{
+      net::HttpRequestHeaders::kCookie};
+
+  // Use common logic for sanitizing request headers including Origin and
+  // Content-*.
+  bool should_clear_upload;
+  net::RedirectUtil::UpdateHttpRequest(original_url, original_method,
+                                       new_redirect_info,
+                                       base::make_optional(remove_headers),
+                                       /*modified_headers=*/base::nullopt,
+                                       &request_.headers, &should_clear_upload);
+
+  if (should_clear_upload) {
     request_.request_body = nullptr;
-
-    if (post_to_get) {
-      request_.headers.RemoveHeader(net::HttpRequestHeaders::kContentLength);
-      request_.headers.RemoveHeader(net::HttpRequestHeaders::kContentType);
-    }
   }
 }
 
@@ -875,10 +974,12 @@ void InterceptedRequest::ContinueToResponseStarted(int error_code) {
   override_headers_ = nullptr;
   redirect_url_ = GURL();
 
+  scoped_refptr<net::HttpResponseHeaders> headers =
+      current_response_ ? current_response_->headers : nullptr;
+
   std::string location;
-  const bool is_redirect = redirect_url.is_valid() ||
+  const bool is_redirect =
-                           (current_response_->headers &&
+      redirect_url.is_valid() || (headers && headers->IsRedirect(&location));
-                            current_response_->headers->IsRedirect(&location));
   if (stream_loader_ && is_redirect) {
     // Redirecting from OnReceiveResponse generally isn't supported by the
     // NetworkService, so we can only support it when using a custom loader.
@@ -897,6 +998,30 @@ void InterceptedRequest::ContinueToResponseStarted(int error_code) {
     LOG_IF(WARNING, is_redirect) << "Redirect at this time is not supported by "
                                     "the default network loader.";
 
+    // CORS check for requests that are handled by the client. Requests handled
+    // by the network process will be checked there.
+    if (IsOutOfBlinkCorsEnabled() && stream_loader_ && !is_redirect &&
+        request_.request_initiator &&
+        network::cors::ShouldCheckCors(request_.url, request_.request_initiator,
+                                       request_.mode)) {
+      const auto error_status = network::cors::CheckAccess(
+          request_.url,
+          GetHeaderString(
+              headers.get(),
+              network::cors::header_names::kAccessControlAllowOrigin),
+          GetHeaderString(
+              headers.get(),
+              network::cors::header_names::kAccessControlAllowCredentials),
+          request_.credentials_mode, *request_.request_initiator);
+      if (error_status &&
+          !HasCrossOriginWhitelistEntry(*request_.request_initiator,
+                                        url::Origin::Create(request_.url))) {
+        SendErrorStatusAndCompleteImmediately(
+            network::URLLoaderCompletionStatus(*error_status));
+        return;
+      }
+    }
+
     // Resume handling of client messages after continuing from an async
     // callback.
     if (proxied_client_binding_)
@@ -986,7 +1111,13 @@ void InterceptedRequest::CallOnComplete(
 }
 
 void InterceptedRequest::SendErrorAndCompleteImmediately(int error_code) {
-  status_ = network::URLLoaderCompletionStatus(error_code);
+  SendErrorStatusAndCompleteImmediately(
+      network::URLLoaderCompletionStatus(error_code));
+}
+
+void InterceptedRequest::SendErrorStatusAndCompleteImmediately(
+    const network::URLLoaderCompletionStatus& status) {
+  status_ = status;
   SendErrorCallback(status_.error_code, false);
   target_client_->OnComplete(status_);
   OnDestroy();
@@ -1207,10 +1338,10 @@ void ProxyURLLoaderFactory::OnLoaderCreated(
 }
 
 void ProxyURLLoaderFactory::OnLoaderForCorsPreflightCreated(
-    const ::network::ResourceRequest& request,
+    const network::ResourceRequest& request,
-    mojo::PendingReceiver<network::mojom::TrustedHeaderClient> header_client) {
+    mojo::PendingReceiver<network::mojom::TrustedHeaderClient> receiver) {
   CEF_REQUIRE_IOT();
-  // TODO(cef): Should we do something here?
+  new CorsPreflightRequest(std::move(receiver));
 }
 
 void ProxyURLLoaderFactory::OnTargetFactoryError() {

libcef/browser/net_service/proxy_url_loader_factory.h

@@ -168,8 +168,8 @@ class ProxyURLLoaderFactory
       mojo::PendingReceiver<network::mojom::TrustedHeaderClient> receiver)
       override;
   void OnLoaderForCorsPreflightCreated(
-      const ::network::ResourceRequest& request,
+      const network::ResourceRequest& request,
-      mojo::PendingReceiver<network::mojom::TrustedHeaderClient> header_client)
+      mojo::PendingReceiver<network::mojom::TrustedHeaderClient> receiver)
       override;
 
  private:

libcef/browser/net_service/resource_request_handler_wrapper.cc

@@ -264,6 +264,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
           CefBrowserContext::FromBrowserContext(browser_context);
       iothread_state_ = cef_browser_context->iothread_state();
       DCHECK(iothread_state_);
+      cookieable_schemes_ = cef_browser_context->cookieable_schemes();
 
       // We register to be notified of CEF context or browser destruction so
       // that we can stop accepting new requests and cancel pending/in-progress
@@ -312,6 +313,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     CefRefPtr<CefBrowserHostImpl> browser_;
     CefRefPtr<CefFrame> frame_;
     CefIOThreadState* iothread_state_ = nullptr;
+    CefBrowserContext::CookieableSchemes cookieable_schemes_;
     int render_process_id_ = 0;
     int render_frame_id_ = -1;
     int frame_tree_node_id_ = -1;
@@ -487,6 +489,13 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
                         base::OnceClosure callback) {
     CEF_REQUIRE_IOT();
 
+    if (!cookie_helper::IsCookieableScheme(request->url,
+                                           init_state_->cookieable_schemes_)) {
+      // The scheme does not support cookies.
+      std::move(callback).Run();
+      return;
+    }
+
     // We need to load/save cookies ourselves for custom-handled requests, or
     // if we're using a cookie filter.
     auto allow_cookie_callback =
@@ -499,9 +508,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     auto done_cookie_callback = base::BindOnce(
         &InterceptedRequestHandlerWrapper::ContinueWithLoadedCookies,
         weak_ptr_factory_.GetWeakPtr(), id, request, std::move(callback));
-    net_service::LoadCookies(init_state_->browser_context_, *request,
+    cookie_helper::LoadCookies(init_state_->browser_context_, *request,
-                             allow_cookie_callback,
+                               allow_cookie_callback,
-                             std::move(done_cookie_callback));
+                               std::move(done_cookie_callback));
   }
 
   static void AllowCookieAlways(const net::CanonicalCookie& cookie,
@@ -850,6 +859,13 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       return;
     }
 
+    if (!cookie_helper::IsCookieableScheme(request->url,
+                                           init_state_->cookieable_schemes_)) {
+      // The scheme does not support cookies.
+      std::move(callback).Run();
+      return;
+    }
+
     // We need to load/save cookies ourselves for custom-handled requests, or
     // if we're using a cookie filter.
     auto allow_cookie_callback =
@@ -862,9 +878,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     auto done_cookie_callback = base::BindOnce(
         &InterceptedRequestHandlerWrapper::ContinueWithSavedCookies,
         weak_ptr_factory_.GetWeakPtr(), id, std::move(callback));
-    net_service::SaveCookies(init_state_->browser_context_, *request, headers,
+    cookie_helper::SaveCookies(init_state_->browser_context_, *request, headers,
-                             allow_cookie_callback,
+                               allow_cookie_callback,
-                             std::move(done_cookie_callback));
+                               std::move(done_cookie_callback));
   }
 
   void AllowCookieSave(const RequestId& id,

libcef/browser/origin_whitelist_impl.cc

@@ -15,8 +15,12 @@
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "base/synchronization/lock.h"
+#include "chrome/common/webui_url_constants.h"
 #include "content/public/browser/render_process_host.h"
+#include "content/public/common/url_constants.h"
+#include "extensions/common/constants.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace {
 
@@ -157,10 +161,11 @@ CefOriginWhitelistManager* CefOriginWhitelistManager::GetInstance() {
   return g_manager.Pointer();
 }
 
-bool IsMatch(const GURL& source_origin,
+bool IsMatch(const url::Origin& source_origin,
-             const GURL& target_origin,
+             const url::Origin& target_origin,
              const Cef_CrossOriginWhiteListEntry_Params& param) {
-  if (source_origin.GetOrigin() != GURL(param.source_origin)) {
+  if (!source_origin.IsSameOriginWith(
+          url::Origin::Create(GURL(param.source_origin)))) {
     // Source origin does not match.
     return false;
   }
@@ -271,7 +276,18 @@ void GetCrossOriginWhitelistEntries(
       entries);
 }
 
-bool HasCrossOriginWhitelistEntry(const GURL& source, const GURL& target) {
+bool HasCrossOriginWhitelistEntry(const url::Origin& source,
+                                  const url::Origin& target) {
+  // Components of chrome that are implemented as extensions or platform apps
+  // are allowed to use chrome://resources/ and chrome://theme/ URLs.
+  // See also RegisterNonNetworkSubresourceURLLoaderFactories.
+  if (source.scheme() == extensions::kExtensionScheme &&
+      target.scheme() == content::kChromeUIScheme &&
+      (target.host() == chrome::kChromeUIThemeHost ||
+       target.host() == content::kChromeUIResourcesHost)) {
+    return true;
+  }
+
   std::vector<Cef_CrossOriginWhiteListEntry_Params> params;
   CefOriginWhitelistManager::GetInstance()->GetCrossOriginWhitelistEntries(
       &params);

libcef/browser/origin_whitelist_impl.h

@@ -12,7 +12,9 @@ namespace content {
 class RenderProcessHost;
 }
 
-class GURL;
+namespace url {
+class Origin;
+}
 
 struct Cef_CrossOriginWhiteListEntry_Params;
 
@@ -23,6 +25,7 @@ void GetCrossOriginWhitelistEntries(
 
 // Returns true if |source| can access |target| based on the cross-origin white
 // list settings.
-bool HasCrossOriginWhitelistEntry(const GURL& source, const GURL& target);
+bool HasCrossOriginWhitelistEntry(const url::Origin& source,
+                                  const url::Origin& target);
 
 #endif  // CEF_LIBCEF_BROWSER_ORIGIN_WHITELIST_IMPL_H_

libcef/browser/osr/browser_platform_delegate_osr.cc

@@ -53,6 +53,12 @@ void CefBrowserPlatformDelegateOsr::WebContentsCreated(
   view_osr_->WebContentsCreated(web_contents);
 }
 
+void CefBrowserPlatformDelegateOsr::RenderViewCreated(
+    content::RenderViewHost* render_view_host) {
+  if (view_osr_)
+    view_osr_->RenderViewCreated();
+}
+
 void CefBrowserPlatformDelegateOsr::BrowserCreated(
     CefBrowserHostImpl* browser) {
   CefBrowserPlatformDelegateAlloy::BrowserCreated(browser);
@@ -71,6 +77,20 @@ void CefBrowserPlatformDelegateOsr::BrowserCreated(
   }
 }
 
+void CefBrowserPlatformDelegateOsr::NotifyBrowserDestroyed() {
+  content::WebContents* web_contents = browser_->web_contents();
+  content::RenderViewHost* host = web_contents->GetRenderViewHost();
+  if (host) {
+    CefRenderWidgetHostViewOSR* view =
+        static_cast<CefRenderWidgetHostViewOSR*>(host->GetWidget()->GetView());
+    if (view) {
+      view->ReleaseCompositor();
+    }
+  }
+
+  CefBrowserPlatformDelegateAlloy::NotifyBrowserDestroyed();
+}
+
 void CefBrowserPlatformDelegateOsr::BrowserDestroyed(
     CefBrowserHostImpl* browser) {
   CefBrowserPlatformDelegateAlloy::BrowserDestroyed(browser);

libcef/browser/osr/browser_platform_delegate_osr.h

@@ -26,7 +26,9 @@ class CefBrowserPlatformDelegateOsr
       content::RenderViewHostDelegateView** delegate_view) override;
   void WebContentsCreated(content::WebContents* web_contents,
                           bool owned) override;
+  void RenderViewCreated(content::RenderViewHost* render_view_host) override;
   void BrowserCreated(CefBrowserHostImpl* browser) override;
+  void NotifyBrowserDestroyed() override;
   void BrowserDestroyed(CefBrowserHostImpl* browser) override;
   SkColor GetBackgroundColor() const override;
   void WasResized() override;

libcef/browser/osr/render_widget_host_view_osr.cc

@@ -25,6 +25,7 @@
 #include "components/viz/common/frame_sinks/begin_frame_args.h"
 #include "components/viz/common/frame_sinks/copy_output_request.h"
 #include "components/viz/common/frame_sinks/delay_based_time_source.h"
+#include "components/viz/common/surfaces/frame_sink_id_allocator.h"
 #include "components/viz/common/switches.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/gpu/gpu_data_manager_impl.h"
@@ -291,6 +292,23 @@ CefRenderWidgetHostViewOSR::CefRenderWidgetHostViewOSR(
 }
 
 CefRenderWidgetHostViewOSR::~CefRenderWidgetHostViewOSR() {
+  ReleaseCompositor();
+  root_layer_.reset(nullptr);
+
+  DCHECK(!parent_host_view_);
+  DCHECK(!popup_host_view_);
+  DCHECK(!child_host_view_);
+  DCHECK(guest_host_views_.empty());
+
+  if (text_input_manager_)
+    text_input_manager_->RemoveObserver(this);
+}
+
+void CefRenderWidgetHostViewOSR::ReleaseCompositor() {
+  if (!compositor_) {
+    return;  // already released
+  }
+
   // Marking the DelegatedFrameHost as removed from the window hierarchy is
   // necessary to remove all connections to its old ui::Compositor.
   if (is_showing_) {
@@ -301,15 +319,6 @@ CefRenderWidgetHostViewOSR::~CefRenderWidgetHostViewOSR() {
 
   delegated_frame_host_.reset(nullptr);
   compositor_.reset(nullptr);
-  root_layer_.reset(nullptr);
-
-  DCHECK(!parent_host_view_);
-  DCHECK(!popup_host_view_);
-  DCHECK(!child_host_view_);
-  DCHECK(guest_host_views_.empty());
-
-  if (text_input_manager_)
-    text_input_manager_->RemoveObserver(this);
 }
 
 // Called for full-screen widgets.
@@ -351,7 +360,9 @@ bool CefRenderWidgetHostViewOSR::HasFocus() {
 }
 
 bool CefRenderWidgetHostViewOSR::IsSurfaceAvailableForCopy() {
-  return delegated_frame_host_->CanCopyFromCompositingSurface();
+  return delegated_frame_host_
+             ? delegated_frame_host_->CanCopyFromCompositingSurface()
+             : false;
 }
 
 void CefRenderWidgetHostViewOSR::Show() {
@@ -380,26 +391,30 @@ void CefRenderWidgetHostViewOSR::Show() {
         base::nullopt /* record_tab_switch_time_request */);
   }
 
-  delegated_frame_host_->AttachToCompositor(compositor_.get());
+  if (delegated_frame_host_) {
-  delegated_frame_host_->WasShown(
+    delegated_frame_host_->AttachToCompositor(compositor_.get());
-      GetLocalSurfaceIdAllocation().local_surface_id(), GetViewBounds().size(),
+    delegated_frame_host_->WasShown(
-      base::nullopt);
+        GetLocalSurfaceIdAllocation().local_surface_id(),
+        GetViewBounds().size(), base::nullopt);
+  }
 
   if (!content::GpuDataManagerImpl::GetInstance()->IsGpuCompositingDisabled()) {
     // Start generating frames when we're visible and at the correct size.
     if (!video_consumer_) {
       video_consumer_.reset(new CefVideoConsumerOSR(this));
       UpdateFrameRate();
-
-      // Call OnRenderFrameMetadataChangedAfterActivation for every frame.
-      content::RenderFrameMetadataProviderImpl* provider =
-          content::RenderWidgetHostImpl::From(render_widget_host_)
-              ->render_frame_metadata_provider();
-      provider->ReportAllFrameSubmissionsForTesting(true);
     } else {
       video_consumer_->SetActive(true);
     }
   }
+
+  if (render_widget_host_) {
+    // Call OnRenderFrameMetadataChangedAfterActivation for every frame.
+    content::RenderFrameMetadataProviderImpl* provider =
+        content::RenderWidgetHostImpl::From(render_widget_host_)
+            ->render_frame_metadata_provider();
+    provider->ReportAllFrameSubmissionsForTesting(true);
+  }
 }
 
 void CefRenderWidgetHostViewOSR::Hide() {
@@ -418,9 +433,11 @@ void CefRenderWidgetHostViewOSR::Hide() {
   if (render_widget_host_)
     render_widget_host_->WasHidden();
 
-  delegated_frame_host_->WasHidden(
+  if (delegated_frame_host_) {
-      content::DelegatedFrameHost::HiddenCause::kOther);
+    delegated_frame_host_->WasHidden(
-  delegated_frame_host_->DetachFromCompositor();
+        content::DelegatedFrameHost::HiddenCause::kOther);
+    delegated_frame_host_->DetachFromCompositor();
+  }
 }
 
 bool CefRenderWidgetHostViewOSR::IsShowing() {
@@ -554,7 +571,9 @@ void CefRenderWidgetHostViewOSR::AddDamageRect(uint32_t sequence,
 }
 
 void CefRenderWidgetHostViewOSR::ResetFallbackToFirstNavigationSurface() {
-  delegated_frame_host_->ResetFallbackToFirstNavigationSurface();
+  if (delegated_frame_host_) {
+    delegated_frame_host_->ResetFallbackToFirstNavigationSurface();
+  }
 }
 
 void CefRenderWidgetHostViewOSR::InitAsPopup(
@@ -718,8 +737,10 @@ void CefRenderWidgetHostViewOSR::CopyFromSurface(
     const gfx::Rect& src_rect,
     const gfx::Size& output_size,
     base::OnceCallback<void(const SkBitmap&)> callback) {
-  delegated_frame_host_->CopyFromCompositingSurface(src_rect, output_size,
+  if (delegated_frame_host_) {
-                                                    std::move(callback));
+    delegated_frame_host_->CopyFromCompositingSurface(src_rect, output_size,
+                                                      std::move(callback));
+  }
 }
 
 void CefRenderWidgetHostViewOSR::GetScreenInfo(content::ScreenInfo* results) {
@@ -894,21 +915,45 @@ CefRenderWidgetHostViewOSR::GetLocalSurfaceIdAllocation() const {
 }
 
 const viz::FrameSinkId& CefRenderWidgetHostViewOSR::GetFrameSinkId() const {
-  return delegated_frame_host_->frame_sink_id();
+  return delegated_frame_host_
+             ? delegated_frame_host_->frame_sink_id()
+             : viz::FrameSinkIdAllocator::InvalidFrameSinkId();
 }
 
 viz::FrameSinkId CefRenderWidgetHostViewOSR::GetRootFrameSinkId() {
-  return compositor_->frame_sink_id();
+  return compositor_ ? compositor_->frame_sink_id() : viz::FrameSinkId();
 }
 
 void CefRenderWidgetHostViewOSR::OnRenderFrameMetadataChangedAfterActivation() {
+  auto metadata =
+      host_->render_frame_metadata_provider()->LastRenderFrameMetadata();
+
   if (video_consumer_) {
     // Need to wait for the first frame of the new size before calling
     // SizeChanged. Otherwise, the video frame will be letterboxed.
-    auto metadata =
-        host_->render_frame_metadata_provider()->LastRenderFrameMetadata();
     video_consumer_->SizeChanged(metadata.viewport_size_in_pixels);
   }
+
+  gfx::Vector2dF root_scroll_offset;
+  if (metadata.root_scroll_offset) {
+    root_scroll_offset = *metadata.root_scroll_offset;
+  }
+  if (root_scroll_offset != last_scroll_offset_) {
+    last_scroll_offset_ = root_scroll_offset;
+
+    if (!is_scroll_offset_changed_pending_) {
+      is_scroll_offset_changed_pending_ = true;
+
+      // Send the notification asynchronously.
+      CEF_POST_TASK(
+          CEF_UIT,
+          base::Bind(&CefRenderWidgetHostViewOSR::OnScrollOffsetChanged,
+                     weak_ptr_factory_.GetWeakPtr()));
+    }
+  }
+
+  content::RenderWidgetHostViewBase::
+      OnRenderFrameMetadataChangedAfterActivation();
 }
 
 std::unique_ptr<content::SyntheticGestureTarget>
@@ -1077,10 +1122,12 @@ void CefRenderWidgetHostViewOSR::SendExternalBeginFrame() {
   if (render_widget_host_)
     render_widget_host_->ProgressFlingIfNeeded(frame_time);
 
-  compositor_->IssueExternalBeginFrame(
+  if (compositor_) {
-      begin_frame_args, /* force= */ true,
+    compositor_->IssueExternalBeginFrame(
-      base::BindOnce(&CefRenderWidgetHostViewOSR::OnFrameComplete,
+        begin_frame_args, /* force= */ true,
-                     weak_ptr_factory_.GetWeakPtr()));
+        base::BindOnce(&CefRenderWidgetHostViewOSR::OnFrameComplete,
+                       weak_ptr_factory_.GetWeakPtr()));
+  }
 
   if (!IsPopupWidget() && popup_host_view_) {
     popup_host_view_->SendExternalBeginFrame();

libcef/browser/osr/render_widget_host_view_osr.h

@@ -264,6 +264,8 @@ class CefRenderWidgetHostViewOSR : public content::RenderWidgetHostViewBase,
   void OnDidUpdateVisualPropertiesComplete(
       const cc::RenderFrameMetadata& metadata);
 
+  void ReleaseCompositor();
+
  private:
   void SetFrameRate();
   bool SetDeviceScaleFactor();

libcef/browser/osr/web_contents_view_osr.cc

@@ -29,11 +29,17 @@ void CefWebContentsViewOSR::WebContentsCreated(
   DCHECK(!web_contents_);
   web_contents_ = web_contents;
 
-  auto host = web_contents_->GetRenderViewHost();
+  RenderViewCreated();
-  CefRenderWidgetHostViewOSR* view =
+}
-      static_cast<CefRenderWidgetHostViewOSR*>(host->GetWidget()->GetView());
+
-  if (view)
+void CefWebContentsViewOSR::RenderViewCreated() {
-    view->InstallTransparency();
+  if (web_contents_) {
+    auto host = web_contents_->GetRenderViewHost();
+    CefRenderWidgetHostViewOSR* view =
+        static_cast<CefRenderWidgetHostViewOSR*>(host->GetWidget()->GetView());
+    if (view)
+      view->InstallTransparency();
+  }
 }
 
 gfx::NativeView CefWebContentsViewOSR::GetNativeView() const {

libcef/browser/osr/web_contents_view_osr.h

@@ -31,6 +31,8 @@ class CefWebContentsViewOSR : public content::WebContentsView,
   void WebContentsCreated(content::WebContents* web_contents);
   content::WebContents* web_contents() const { return web_contents_; }
 
+  void RenderViewCreated();
+
   // WebContentsView methods.
   gfx::NativeView GetNativeView() const override;
   gfx::NativeView GetContentNativeView() const override;

libcef/browser/prefs/browser_prefs.cc

@@ -18,6 +18,7 @@
 #include "base/values.h"
 #include "chrome/browser/accessibility/accessibility_ui.h"
 #include "chrome/browser/download/download_prefs.h"
+#include "chrome/browser/media/media_device_id_salt.h"
 #include "chrome/browser/media/router/media_router_feature.h"
 #include "chrome/browser/net/prediction_options.h"
 #include "chrome/browser/net/profile_network_context_service.h"
@@ -230,6 +231,7 @@ std::unique_ptr<PrefService> CreatePrefService(Profile* profile,
     HostContentSettingsMap::RegisterProfilePrefs(registry.get());
     language::LanguagePrefs::RegisterProfilePrefs(registry.get());
     media_router::RegisterProfilePrefs(registry.get());
+    MediaDeviceIDSalt::RegisterProfilePrefs(registry.get());
     ProfileNetworkContextService::RegisterProfilePrefs(registry.get());
 
     const std::string& locale =

libcef/browser/views/browser_platform_delegate_views.cc

@@ -69,15 +69,21 @@ void CefBrowserPlatformDelegateViews::WebContentsCreated(
     content::WebContents* web_contents,
     bool owned) {
   CefBrowserPlatformDelegateAlloy::WebContentsCreated(web_contents, owned);
-
+  native_delegate_->WebContentsCreated(web_contents, /*owned=*/false);
   browser_view_->WebContentsCreated(web_contents);
 }
 
+void CefBrowserPlatformDelegateViews::WebContentsDestroyed(
+    content::WebContents* web_contents) {
+  CefBrowserPlatformDelegateAlloy::WebContentsDestroyed(web_contents);
+  native_delegate_->WebContentsDestroyed(web_contents);
+}
+
 void CefBrowserPlatformDelegateViews::BrowserCreated(
     CefBrowserHostImpl* browser) {
   CefBrowserPlatformDelegateAlloy::BrowserCreated(browser);
 
-  native_delegate_->set_browser(browser);
+  native_delegate_->BrowserCreated(browser);
   browser_view_->BrowserCreated(browser, GetBoundsChangedCallback());
 }
 
@@ -99,9 +105,9 @@ void CefBrowserPlatformDelegateViews::BrowserDestroyed(
     CefBrowserHostImpl* browser) {
   CefBrowserPlatformDelegateAlloy::BrowserDestroyed(browser);
 
-  native_delegate_->set_browser(nullptr);
   browser_view_->BrowserDestroyed(browser);
   browser_view_ = nullptr;
+  native_delegate_->BrowserDestroyed(browser);
 }
 
 bool CefBrowserPlatformDelegateViews::CreateHostWindow() {

libcef/browser/views/browser_platform_delegate_views.h

@@ -23,6 +23,7 @@ class CefBrowserPlatformDelegateViews
   // CefBrowserPlatformDelegate methods:
   void WebContentsCreated(content::WebContents* web_contents,
                           bool owned) override;
+  void WebContentsDestroyed(content::WebContents* web_contents) override;
   void BrowserCreated(CefBrowserHostImpl* browser) override;
   void NotifyBrowserCreated() override;
   void NotifyBrowserDestroyed() override;

libcef/browser/views/window_view.cc

@@ -250,13 +250,15 @@ void CefWindowView::CreateWidget() {
   views::Widget::InitParams params;
   params.delegate = this;
   params.type = views::Widget::InitParams::TYPE_WINDOW;
-  params.bounds = gfx::Rect(CalculatePreferredSize());
   bool can_activate = true;
 
   if (cef_delegate()) {
     CefRefPtr<CefWindow> cef_window = GetCefWindow();
     is_frameless_ = cef_delegate()->IsFrameless(cef_window);
 
+    auto bounds = cef_delegate()->GetInitialBounds(cef_window);
+    params.bounds = gfx::Rect(bounds.x, bounds.y, bounds.width, bounds.height);
+
     bool is_menu = false;
     bool can_activate_menu = true;
     CefRefPtr<CefWindow> parent_window = cef_delegate()->GetParentWindow(
@@ -279,6 +281,11 @@ void CefWindowView::CreateWidget() {
     }
   }
 
+  if (params.bounds.IsEmpty()) {
+    // The window will be placed on the default screen with origin (0,0).
+    params.bounds = gfx::Rect(CalculatePreferredSize());
+  }
+
 #if defined(OS_WIN)
   if (is_frameless_) {
     // Don't show the native window caption. Setting this value on Linux will

libcef/common/alloy/alloy_main_delegate.cc

@@ -244,12 +244,6 @@ bool AlloyMainDelegate::BasicStartupComplete(int* exit_code) {
 
     std::vector<std::string> disable_features;
 
-    if (network::features::kOutOfBlinkCors.default_state ==
-        base::FEATURE_ENABLED_BY_DEFAULT) {
-      // TODO: Add support for out-of-Blink CORS (see issue #2716)
-      disable_features.push_back(network::features::kOutOfBlinkCors.name);
-    }
-
 #if defined(OS_WIN)
     if (features::kCalculateNativeWinOcclusion.default_state ==
         base::FEATURE_ENABLED_BY_DEFAULT) {

libcef/common/net/scheme_registration.cc

@@ -8,6 +8,7 @@
 #include "libcef/common/net/scheme_info.h"
 #include "libcef/features/runtime.h"
 
+#include "base/stl_util.h"
 #include "content/public/common/url_constants.h"
 #include "extensions/common/constants.h"
 #include "net/net_buildflags.h"
@@ -86,4 +87,10 @@ bool IsStandardScheme(const std::string& scheme) {
   return url::IsStandard(scheme.c_str(), scheme_comp);
 }
 
+// Should return the same value as SecurityOrigin::isLocal and
+// SchemeRegistry::shouldTreatURLSchemeAsCorsEnabled.
+bool IsCorsEnabledScheme(const std::string& scheme) {
+  return base::Contains(url::GetCorsEnabledSchemes(), scheme);
+}
+
 }  // namespace scheme

libcef/common/net/scheme_registration.h

@@ -22,6 +22,9 @@ bool IsInternalHandledScheme(const std::string& scheme);
 // Returns true if the specified |scheme| is a registered standard scheme.
 bool IsStandardScheme(const std::string& scheme);
 
+// Returns true if the specified |scheme| is a registered CORS enabled scheme.
+bool IsCorsEnabledScheme(const std::string& scheme);
+
 }  // namespace scheme
 
 #endif  // CEF_LIBCEF_COMMON_NET_SCHEME_REGISTRATION_H_

libcef/common/resource_bundle_impl.cc

@@ -4,6 +4,7 @@
 
 #include "libcef/common/resource_bundle_impl.h"
 
+#include "base/memory/ref_counted_memory.h"
 #include "ui/base/resource/resource_bundle.h"
 
 CefResourceBundleImpl::CefResourceBundleImpl() {}
@@ -15,29 +16,24 @@ CefString CefResourceBundleImpl::GetLocalizedString(int string_id) {
   return ui::ResourceBundle::GetSharedInstance().GetLocalizedString(string_id);
 }
 
-bool CefResourceBundleImpl::GetDataResource(int resource_id,
+CefRefPtr<CefBinaryValue> CefResourceBundleImpl::GetDataResource(
-                                            void*& data,
+    int resource_id) {
-                                            size_t& data_size) {
+  return GetDataResourceForScale(resource_id, SCALE_FACTOR_NONE);
-  return GetDataResourceForScale(resource_id, SCALE_FACTOR_NONE, data,
-                                 data_size);
 }
 
-bool CefResourceBundleImpl::GetDataResourceForScale(int resource_id,
+CefRefPtr<CefBinaryValue> CefResourceBundleImpl::GetDataResourceForScale(
-                                                    ScaleFactor scale_factor,
+    int resource_id,
-                                                    void*& data,
+    ScaleFactor scale_factor) {
-                                                    size_t& data_size) {
   if (!ui::ResourceBundle::HasSharedInstance())
-    return false;
+    return nullptr;
 
-  const base::StringPiece& result =
+  base::RefCountedMemory* result =
-      ui::ResourceBundle::GetSharedInstance().GetRawDataResourceForScale(
+      ui::ResourceBundle::GetSharedInstance().LoadDataResourceBytesForScale(
           resource_id, static_cast<ui::ScaleFactor>(scale_factor));
-  if (result.empty())
+  if (!result)
-    return false;
+    return nullptr;
 
-  data = const_cast<char*>(result.data());
+  return CefBinaryValue::Create(result->data(), result->size());
-  data_size = result.size();
-  return true;
 }
 
 // static

libcef/common/resource_bundle_impl.h

@@ -14,13 +14,10 @@ class CefResourceBundleImpl : public CefResourceBundle {
 
   // CefResourceBundle methods.
   CefString GetLocalizedString(int string_id) override;
-  bool GetDataResource(int resource_id,
+  CefRefPtr<CefBinaryValue> GetDataResource(int resource_id) override;
-                       void*& data,
+  CefRefPtr<CefBinaryValue> GetDataResourceForScale(
-                       size_t& data_size) override;
+      int resource_id,
-  bool GetDataResourceForScale(int resource_id,
+      ScaleFactor scale_factor) override;
-                               ScaleFactor scale_factor,
-                               void*& data,
-                               size_t& data_size) override;
 
  private:
   IMPLEMENT_REFCOUNTING(CefResourceBundleImpl);

libcef/renderer/alloy/alloy_content_renderer_client.cc

@@ -107,6 +107,7 @@
 #include "third_party/blink/public/web/web_prerenderer_client.h"
 #include "third_party/blink/public/web/web_security_policy.h"
 #include "third_party/blink/public/web/web_view.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "ui/base/l10n/l10n_util.h"
 
 #if defined(OS_MACOSX)
@@ -256,9 +257,6 @@ void AlloyContentRendererClient::WebKitInitialized() {
   // Create global objects associated with the default Isolate.
   CefV8IsolateCreated();
 
-  // TODO(cef): Enable these once the implementation supports it.
-  blink::WebRuntimeFeatures::EnableNotifications(false);
-
   const CefAppManager::SchemeInfoList* schemes =
       CefAppManager::Get()->GetCustomSchemes();
   if (!schemes->empty()) {
@@ -361,6 +359,14 @@ void AlloyContentRendererClient::RunSingleProcessCleanup() {
   } while (!complete);
 }
 
+void AlloyContentRendererClient::PostIOThreadCreated(
+    base::SingleThreadTaskRunner*) {
+  // TODO(cef): Enable these once the implementation supports it.
+  blink::WebRuntimeFeatures::EnableNotifications(false);
+  blink::WebRuntimeFeatures::EnablePushMessaging(false);
+  blink::RuntimeEnabledFeatures::SetBadgingEnabled(false);
+}
+
 void AlloyContentRendererClient::RenderThreadStarted() {
   const base::CommandLine* command_line =
       base::CommandLine::ForCurrentProcess();

libcef/renderer/alloy/alloy_content_renderer_client.h

@@ -96,6 +96,8 @@ class AlloyContentRendererClient
   void RunSingleProcessCleanup();
 
   // ContentRendererClient implementation.
+  void PostIOThreadCreated(
+      base::SingleThreadTaskRunner* io_thread_task_runner) override;
   void RenderThreadStarted() override;
   void ExposeInterfacesToBrowser(mojo::BinderMap* binders) override;
   void RenderThreadConnected() override;

libcef_dll/cpptoc/resource_bundle_cpptoc.cc

@@ -9,10 +9,11 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=ba0a12367019906d32dae965d7d1b5245d02b442$
+// $hash=0dc6766f75f9b051daf582009455efb08c969e9f$
 //
 
 #include "libcef_dll/cpptoc/resource_bundle_cpptoc.h"
+#include "libcef_dll/cpptoc/binary_value_cpptoc.h"
 
 // GLOBAL FUNCTIONS - Body may be edited by hand.
 
@@ -47,83 +48,40 @@ resource_bundle_get_localized_string(struct _cef_resource_bundle_t* self,
   return _retval.DetachToUserFree();
 }
 
-int CEF_CALLBACK
+struct _cef_binary_value_t* CEF_CALLBACK
 resource_bundle_get_data_resource(struct _cef_resource_bundle_t* self,
-                                  int resource_id,
+                                  int resource_id) {
-                                  void** data,
-                                  size_t* data_size) {
   // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
 
   DCHECK(self);
   if (!self)
-    return 0;
+    return NULL;
-  // Verify param: data; type: simple_byref
-  DCHECK(data);
-  if (!data)
-    return 0;
-  // Verify param: data_size; type: simple_byref
-  DCHECK(data_size);
-  if (!data_size)
-    return 0;
-
-  // Translate param: data; type: simple_byref
-  void* dataVal = data ? *data : NULL;
-  // Translate param: data_size; type: simple_byref
-  size_t data_sizeVal = data_size ? *data_size : 0;
 
   // Execute
-  bool _retval = CefResourceBundleCppToC::Get(self)->GetDataResource(
+  CefRefPtr<CefBinaryValue> _retval =
-      resource_id, dataVal, data_sizeVal);
+      CefResourceBundleCppToC::Get(self)->GetDataResource(resource_id);
 
-  // Restore param: data; type: simple_byref
+  // Return type: refptr_same
-  if (data)
+  return CefBinaryValueCppToC::Wrap(_retval);
-    *data = dataVal;
-  // Restore param: data_size; type: simple_byref
-  if (data_size)
-    *data_size = data_sizeVal;
-
-  // Return type: bool
-  return _retval;
 }
 
-int CEF_CALLBACK
+struct _cef_binary_value_t* CEF_CALLBACK
 resource_bundle_get_data_resource_for_scale(struct _cef_resource_bundle_t* self,
                                             int resource_id,
-                                            cef_scale_factor_t scale_factor,
+                                            cef_scale_factor_t scale_factor) {
-                                            void** data,
-                                            size_t* data_size) {
   // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
 
   DCHECK(self);
   if (!self)
-    return 0;
+    return NULL;
-  // Verify param: data; type: simple_byref
-  DCHECK(data);
-  if (!data)
-    return 0;
-  // Verify param: data_size; type: simple_byref
-  DCHECK(data_size);
-  if (!data_size)
-    return 0;
-
-  // Translate param: data; type: simple_byref
-  void* dataVal = data ? *data : NULL;
-  // Translate param: data_size; type: simple_byref
-  size_t data_sizeVal = data_size ? *data_size : 0;
 
   // Execute
-  bool _retval = CefResourceBundleCppToC::Get(self)->GetDataResourceForScale(
+  CefRefPtr<CefBinaryValue> _retval =
-      resource_id, scale_factor, dataVal, data_sizeVal);
+      CefResourceBundleCppToC::Get(self)->GetDataResourceForScale(resource_id,
+                                                                  scale_factor);
 
-  // Restore param: data; type: simple_byref
+  // Return type: refptr_same
-  if (data)
+  return CefBinaryValueCppToC::Wrap(_retval);
-    *data = dataVal;
-  // Restore param: data_size; type: simple_byref
-  if (data_size)
-    *data_size = data_sizeVal;
-
-  // Return type: bool
-  return _retval;
 }
 
 }  // namespace

libcef_dll/cpptoc/views/window_delegate_cpptoc.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=52b31a63bbe83937a9f5dc557accfc1e84af6d84$
+// $hash=fc5a46d1a73e61c08ec1266ac1c481dc65aedf6b$
 //
 
 #include "libcef_dll/cpptoc/views/window_delegate_cpptoc.h"
@@ -108,6 +108,29 @@ window_delegate_get_parent_window(struct _cef_window_delegate_t* self,
   return CefWindowCToCpp::Unwrap(_retval);
 }
 
+cef_rect_t CEF_CALLBACK
+window_delegate_get_initial_bounds(struct _cef_window_delegate_t* self,
+                                   cef_window_t* window) {
+  shutdown_checker::AssertNotShutdown();
+
+  // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
+
+  DCHECK(self);
+  if (!self)
+    return CefRect();
+  // Verify param: window; type: refptr_diff
+  DCHECK(window);
+  if (!window)
+    return CefRect();
+
+  // Execute
+  cef_rect_t _retval = CefWindowDelegateCppToC::Get(self)->GetInitialBounds(
+      CefWindowCToCpp::Wrap(window));
+
+  // Return type: simple
+  return _retval;
+}
+
 int CEF_CALLBACK
 window_delegate_is_frameless(struct _cef_window_delegate_t* self,
                              cef_window_t* window) {
@@ -475,6 +498,7 @@ CefWindowDelegateCppToC::CefWindowDelegateCppToC() {
   GetStruct()->on_window_created = window_delegate_on_window_created;
   GetStruct()->on_window_destroyed = window_delegate_on_window_destroyed;
   GetStruct()->get_parent_window = window_delegate_get_parent_window;
+  GetStruct()->get_initial_bounds = window_delegate_get_initial_bounds;
   GetStruct()->is_frameless = window_delegate_is_frameless;
   GetStruct()->can_resize = window_delegate_can_resize;
   GetStruct()->can_maximize = window_delegate_can_maximize;

libcef_dll/ctocpp/resource_bundle_ctocpp.cc

@@ -9,10 +9,11 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=026dabca1d46cfbe911d71ede9d5bb79cb7c553d$
+// $hash=12bfdabd19a9a90eb4c7b88cb0d8d225c8142115$
 //
 
 #include "libcef_dll/ctocpp/resource_bundle_ctocpp.h"
+#include "libcef_dll/ctocpp/binary_value_ctocpp.h"
 
 // STATIC METHODS - Body may be edited by hand.
 
@@ -48,40 +49,38 @@ CefString CefResourceBundleCToCpp::GetLocalizedString(int string_id) {
 }
 
 NO_SANITIZE("cfi-icall")
-bool CefResourceBundleCToCpp::GetDataResource(int resource_id,
+CefRefPtr<CefBinaryValue> CefResourceBundleCToCpp::GetDataResource(
-                                              void*& data,
+    int resource_id) {
-                                              size_t& data_size) {
   cef_resource_bundle_t* _struct = GetStruct();
   if (CEF_MEMBER_MISSING(_struct, get_data_resource))
-    return false;
+    return nullptr;
 
   // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
 
   // Execute
-  int _retval =
+  cef_binary_value_t* _retval =
-      _struct->get_data_resource(_struct, resource_id, &data, &data_size);
+      _struct->get_data_resource(_struct, resource_id);
 
-  // Return type: bool
+  // Return type: refptr_same
-  return _retval ? true : false;
+  return CefBinaryValueCToCpp::Wrap(_retval);
 }
 
 NO_SANITIZE("cfi-icall")
-bool CefResourceBundleCToCpp::GetDataResourceForScale(int resource_id,
+CefRefPtr<CefBinaryValue> CefResourceBundleCToCpp::GetDataResourceForScale(
-                                                      ScaleFactor scale_factor,
+    int resource_id,
-                                                      void*& data,
+    ScaleFactor scale_factor) {
-                                                      size_t& data_size) {
   cef_resource_bundle_t* _struct = GetStruct();
   if (CEF_MEMBER_MISSING(_struct, get_data_resource_for_scale))
-    return false;
+    return nullptr;
 
   // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
 
   // Execute
-  int _retval = _struct->get_data_resource_for_scale(
+  cef_binary_value_t* _retval =
-      _struct, resource_id, scale_factor, &data, &data_size);
+      _struct->get_data_resource_for_scale(_struct, resource_id, scale_factor);
 
-  // Return type: bool
+  // Return type: refptr_same
-  return _retval ? true : false;
+  return CefBinaryValueCToCpp::Wrap(_retval);
 }
 
 // CONSTRUCTOR - Do not edit by hand.

libcef_dll/ctocpp/resource_bundle_ctocpp.h

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=c0d4e71c707c9d63a00ca1a497aaede3e429e970$
+// $hash=7668efc00e13bb790df91f26c2a5683bd74ff677$
 //
 
 #ifndef CEF_LIBCEF_DLL_CTOCPP_RESOURCE_BUNDLE_CTOCPP_H_
@@ -36,13 +36,10 @@ class CefResourceBundleCToCpp
 
   // CefResourceBundle methods.
   CefString GetLocalizedString(int string_id) OVERRIDE;
-  bool GetDataResource(int resource_id,
+  CefRefPtr<CefBinaryValue> GetDataResource(int resource_id) OVERRIDE;
-                       void*& data,
+  CefRefPtr<CefBinaryValue> GetDataResourceForScale(
-                       size_t& data_size) OVERRIDE;
+      int resource_id,
-  bool GetDataResourceForScale(int resource_id,
+      ScaleFactor scale_factor) OVERRIDE;
-                               ScaleFactor scale_factor,
-                               void*& data,
-                               size_t& data_size) OVERRIDE;
 };
 
 #endif  // CEF_LIBCEF_DLL_CTOCPP_RESOURCE_BUNDLE_CTOCPP_H_

libcef_dll/ctocpp/views/window_delegate_ctocpp.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=42f9fdcc49577f6d052e4f357138efe4443a72d9$
+// $hash=c2193e3a76df58538caf73c332d4148d00e235d4$
 //
 
 #include "libcef_dll/ctocpp/views/window_delegate_ctocpp.h"
@@ -104,6 +104,29 @@ CefRefPtr<CefWindow> CefWindowDelegateCToCpp::GetParentWindow(
   return CefWindowCppToC::Unwrap(_retval);
 }
 
+NO_SANITIZE("cfi-icall")
+CefRect CefWindowDelegateCToCpp::GetInitialBounds(CefRefPtr<CefWindow> window) {
+  shutdown_checker::AssertNotShutdown();
+
+  cef_window_delegate_t* _struct = GetStruct();
+  if (CEF_MEMBER_MISSING(_struct, get_initial_bounds))
+    return CefRect();
+
+  // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
+
+  // Verify param: window; type: refptr_diff
+  DCHECK(window.get());
+  if (!window.get())
+    return CefRect();
+
+  // Execute
+  cef_rect_t _retval =
+      _struct->get_initial_bounds(_struct, CefWindowCppToC::Wrap(window));
+
+  // Return type: simple
+  return _retval;
+}
+
 NO_SANITIZE("cfi-icall")
 bool CefWindowDelegateCToCpp::IsFrameless(CefRefPtr<CefWindow> window) {
   shutdown_checker::AssertNotShutdown();

libcef_dll/ctocpp/views/window_delegate_ctocpp.h

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=e1c4def5dc9c50b90a1a57bb7769f18763827b25$
+// $hash=2e94fea293b3a9e82cdb57d9e3cb630c13ce0ede$
 //
 
 #ifndef CEF_LIBCEF_DLL_CTOCPP_VIEWS_WINDOW_DELEGATE_CTOCPP_H_
@@ -42,6 +42,7 @@ class CefWindowDelegateCToCpp
   CefRefPtr<CefWindow> GetParentWindow(CefRefPtr<CefWindow> window,
                                        bool* is_menu,
                                        bool* can_activate_menu) override;
+  CefRect GetInitialBounds(CefRefPtr<CefWindow> window) override;
   bool IsFrameless(CefRefPtr<CefWindow> window) override;
   bool CanResize(CefRefPtr<CefWindow> window) override;
   bool CanMaximize(CefRefPtr<CefWindow> window) override;

libcef_dll/wrapper/cef_stream_resource_handler.cc

@@ -18,7 +18,6 @@ CefStreamResourceHandler::CefStreamResourceHandler(
       mime_type_(mime_type),
       stream_(stream) {
   DCHECK(!mime_type_.empty());
-  DCHECK(stream_.get());
 }
 
 CefStreamResourceHandler::CefStreamResourceHandler(
@@ -33,7 +32,6 @@ CefStreamResourceHandler::CefStreamResourceHandler(
       header_map_(header_map),
       stream_(stream) {
   DCHECK(!mime_type_.empty());
-  DCHECK(stream_.get());
 }
 
 bool CefStreamResourceHandler::Open(CefRefPtr<CefRequest> request,
@@ -59,7 +57,7 @@ void CefStreamResourceHandler::GetResponseHeaders(
   if (!header_map_.empty())
     response->SetHeaderMap(header_map_);
 
-  response_length = -1;
+  response_length = stream_ ? -1 : 0;
 }
 
 bool CefStreamResourceHandler::Read(
@@ -69,6 +67,7 @@ bool CefStreamResourceHandler::Read(
     CefRefPtr<CefResourceReadCallback> callback) {
   DCHECK(!CefCurrentlyOn(TID_UI) && !CefCurrentlyOn(TID_IO));
   DCHECK_GT(bytes_to_read, 0);
+  DCHECK(stream_);
 
   // Read until the buffer is full or until Read() returns 0 to indicate no
   // more data.

patch/patch.cfg

@@ -401,7 +401,7 @@ patches = [
     # https://bitbucket.org/chromiumembedded/cef/issues/2718
     #
     # Fix shutdown crash in InitNetworkContext with multi-threaded message loop.
-    # https://bitbucket.org/chromiumembedded/cef/issues/2703
+    # https://bitbucket.org/chromiumembedded/cef/issues/2985
     #
     # Compute correct default quota when cache_path is unspecified.
     'name': 'services_network_2718',
@@ -511,5 +511,17 @@ patches = [
     # Fix build errors with enable_background_mode=false.
     # https://bugs.chromium.org/p/chromium/issues/detail?id=1100085
     'name': 'chrome_browser_background_mode_1100085',
+  },
+  {
+    # Windows: Fix incorrect coordinates in ScreenWin::GetDisplayMatching.
+    # https://crrev.com/6fc3c027c3
+    # https://bitbucket.org/chromiumembedded/cef/issues/2980
+    'name': 'win_screen_2980',
+  },
+  {
+    # Fix CVE-2020-15999 Heap overflow in the freetype library.
+    # https://chromium.googlesource.com/chromium/src/third_party/freetype2.git/+/refs/heads/chromium/branch-heads/4240%5E%21/
+    'name': 'freetype_1139963',
+    'path': 'third_party/freetype/src',
   }
 ]

patch/patches/base_sandbox_2743.patch

@@ -1,5 +1,5 @@
 diff --git base/BUILD.gn base/BUILD.gn
-index fb85807363f1..bdef6c7f64c7 100644
+index 31b9d9258353..ca1d82201b53 100644
 --- base/BUILD.gn
 +++ base/BUILD.gn
 @@ -34,6 +34,7 @@ import("//build/config/ui.gni")

patch/patches/chrome_browser.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index 9fe789540c05..a2646c13e5d5 100644
+index 995b99c5ba9d..ba71d4093417 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
 @@ -12,6 +12,7 @@ import("//build/config/crypto.gni")
@@ -10,7 +10,7 @@ index 9fe789540c05..a2646c13e5d5 100644
  import("//chrome/browser/buildflags.gni")
  import("//chrome/browser/downgrade/buildflags.gni")
  import("//chrome/common/features.gni")
-@@ -1824,6 +1825,7 @@ static_library("browser") {
+@@ -1840,6 +1841,7 @@ static_library("browser") {
      "//base/util/values:values_util",
      "//build:branding_buildflags",
      "//cc",
@@ -18,7 +18,7 @@ index 9fe789540c05..a2646c13e5d5 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -2156,6 +2158,10 @@ static_library("browser") {
+@@ -2172,6 +2174,10 @@ static_library("browser") {
      ]
    }
  

patch/patches/chrome_browser_net_export.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index 7f8d13d8c4c2..ab5688900991 100644
+index a429fd975116..7f6c4e7622fb 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -9,6 +9,7 @@ import("//build/config/crypto.gni")
@@ -10,7 +10,7 @@ index 7f8d13d8c4c2..ab5688900991 100644
  import("//chrome/browser/buildflags.gni")
  import("//chrome/common/features.gni")
  import("//chromeos/assistant/assistant.gni")
-@@ -335,6 +336,10 @@ static_library("ui") {
+@@ -337,6 +338,10 @@ static_library("ui") {
      "//build/config/compiler:wexit_time_destructors",
    ]
  
@@ -21,7 +21,7 @@ index 7f8d13d8c4c2..ab5688900991 100644
    # Since browser and browser_ui actually depend on each other,
    # we must omit the dependency from browser_ui to browser.
    # However, this means browser_ui and browser should more or less
-@@ -356,6 +361,7 @@ static_library("ui") {
+@@ -357,6 +362,7 @@ static_library("ui") {
      "//base/allocator:buildflags",
      "//build:branding_buildflags",
      "//cc/paint",
@@ -29,7 +29,7 @@ index 7f8d13d8c4c2..ab5688900991 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -1473,6 +1479,7 @@ static_library("ui") {
+@@ -1475,6 +1481,7 @@ static_library("ui") {
        "//components/keep_alive_registry",
        "//components/network_session_configurator/common",
        "//components/page_load_metrics/browser",

patch/patches/chrome_browser_product_override.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
-index d27f4eb65fa9..9bf1bde37e63 100644
+index c72f20b6cda0..83c725c64350 100644
 --- chrome/browser/chrome_content_browser_client.cc
 +++ chrome/browser/chrome_content_browser_client.cc
 @@ -1021,10 +1021,6 @@ void LaunchURL(const GURL& url,

patch/patches/chrome_browser_profiles.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/profiles/profile_manager.cc chrome/browser/profiles/profile_manager.cc
-index f81028b5cda7..9b934d020ce6 100644
+index b6d1198fbf0f..2ef9e7835b3d 100644
 --- chrome/browser/profiles/profile_manager.cc
 +++ chrome/browser/profiles/profile_manager.cc
-@@ -377,7 +377,7 @@ ProfileManager::ProfileManager(const base::FilePath& user_data_dir)
+@@ -379,7 +379,7 @@ ProfileManager::ProfileManager(const base::FilePath& user_data_dir)
    registrar_.Add(this, chrome::NOTIFICATION_BROWSER_CLOSE_CANCELLED,
                   content::NotificationService::AllSources());
  

patch/patches/chrome_browser_themes.patch

@@ -1,37 +1,82 @@
+diff --git chrome/browser/themes/theme_service.cc chrome/browser/themes/theme_service.cc
+index 2a6df8119a44..dffe87df9c54 100644
+--- chrome/browser/themes/theme_service.cc
++++ chrome/browser/themes/theme_service.cc
+@@ -25,6 +25,7 @@
+ #include "base/task/thread_pool.h"
+ #include "base/threading/thread_task_runner_handle.h"
+ #include "build/build_config.h"
++#include "cef/libcef/features/runtime.h"
+ #include "chrome/browser/chrome_notification_types.h"
+ #include "chrome/browser/extensions/extension_service.h"
+ #include "chrome/browser/extensions/theme_installed_infobar_delegate.h"
+@@ -54,6 +55,10 @@
+ #include "extensions/common/extension_set.h"
+ #include "ui/base/layout.h"
+ 
++#if BUILDFLAG(ENABLE_CEF)
++#include "cef/libcef/common/extensions/extensions_util.h"
++#endif
++
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
+ #include "base/scoped_observer.h"
+ #include "extensions/browser/extension_registry_observer.h"
+@@ -270,11 +275,19 @@ void ThemeService::Init() {
+   // OnExtensionServiceReady. Otherwise, the ThemeObserver won't be
+   // constructed in time to observe the corresponding events.
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
++#if BUILDFLAG(ENABLE_CEF)
++  const bool extensions_disabled = cef::IsAlloyRuntimeEnabled() &&
++                                   !extensions::ExtensionsEnabled();
++#else
++  const bool extensions_disabled = false;
++#endif
++  if (!extensions_disabled) {
+   theme_observer_ = std::make_unique<ThemeObserver>(this);
+ 
+   extensions::ExtensionSystem::Get(profile_)->ready().Post(
+       FROM_HERE, base::Bind(&ThemeService::OnExtensionServiceReady,
+                             weak_ptr_factory_.GetWeakPtr()));
++  }
+ #endif
+   theme_syncable_service_.reset(new ThemeSyncableService(profile_, this));
+ 
 diff --git chrome/browser/themes/theme_service_factory.cc chrome/browser/themes/theme_service_factory.cc
-index caec77bbe3ba..1640307eef65 100644
+index caec77bbe3ba..92a813acc008 100644
 --- chrome/browser/themes/theme_service_factory.cc
 +++ chrome/browser/themes/theme_service_factory.cc
 @@ -6,6 +6,7 @@
  
  #include "base/no_destructor.h"
  #include "build/build_config.h"
-+#include "cef/libcef/features/features.h"
++#include "cef/libcef/features/runtime.h"
  #include "chrome/browser/extensions/extension_system_factory.h"
  #include "chrome/browser/profiles/incognito_helpers.h"
  #include "chrome/browser/profiles/profile.h"
-@@ -41,6 +42,10 @@ const ThemeHelper& GetThemeHelper() {
+@@ -27,6 +28,10 @@
- 
+ #include "ui/views/linux_ui/linux_ui.h"
- }  // namespace
+ #endif
  
 +#if BUILDFLAG(ENABLE_CEF)
 +#include "cef/libcef/common/extensions/extensions_util.h"
 +#endif
 +
- // static
+ namespace {
- ThemeService* ThemeServiceFactory::GetForProfile(Profile* profile) {
+ 
-   return static_cast<ThemeService*>(
+ const ThemeHelper& GetThemeHelper() {
-@@ -70,7 +75,13 @@ ThemeServiceFactory::ThemeServiceFactory()
+@@ -70,7 +75,15 @@ ThemeServiceFactory::ThemeServiceFactory()
            BrowserContextDependencyManager::GetInstance()) {
    DependsOn(extensions::ExtensionRegistryFactory::GetInstance());
    DependsOn(extensions::ExtensionPrefsFactory::GetInstance());
 +#if BUILDFLAG(ENABLE_CEF)
-+  if (extensions::ExtensionsEnabled()) {
++  const bool extensions_disabled = cef::IsAlloyRuntimeEnabled() &&
++                                   !extensions::ExtensionsEnabled();
++#else
++  const bool extensions_disabled = false;
 +#endif
++  if (!extensions_disabled) {
    DependsOn(extensions::ExtensionSystemFactory::GetInstance());
-+#if BUILDFLAG(ENABLE_CEF)
 +  }
-+#endif
  }
  
  ThemeServiceFactory::~ThemeServiceFactory() {}

patch/patches/chrome_plugins.patch

@@ -198,7 +198,7 @@ index c1870b0f56ef..d32b8d54fb3f 100644
    GURL webstore_url(extension_urls::GetWebstoreLaunchURL());
    if (response_url.SchemeIsHTTPOrHTTPS() &&
 diff --git chrome/renderer/chrome_content_renderer_client.cc chrome/renderer/chrome_content_renderer_client.cc
-index 03d1e6a07843..2fd040ed87b5 100644
+index 35542225d869..b30cd9d24b0d 100644
 --- chrome/renderer/chrome_content_renderer_client.cc
 +++ chrome/renderer/chrome_content_renderer_client.cc
 @@ -842,6 +842,7 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(

patch/patches/chrome_runtime.patch

@@ -78,7 +78,7 @@ index 945cee14368b..38c180a6e7e6 100644
  
  #endif  // defined(OS_LINUX)
 diff --git chrome/browser/chrome_browser_main.cc chrome/browser/chrome_browser_main.cc
-index 5117fe3b5ee3..e8f37fa7066f 100644
+index 5448284d476e..3197f24b5004 100644
 --- chrome/browser/chrome_browser_main.cc
 +++ chrome/browser/chrome_browser_main.cc
 @@ -48,6 +48,7 @@
@@ -89,7 +89,7 @@ index 5117fe3b5ee3..e8f37fa7066f 100644
  #include "chrome/browser/about_flags.h"
  #include "chrome/browser/active_use_util.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -889,8 +890,10 @@ int ChromeBrowserMainParts::PreCreateThreadsImpl() {
+@@ -891,8 +892,10 @@ int ChromeBrowserMainParts::PreCreateThreadsImpl() {
  #if !defined(OS_ANDROID)
    // Create the RunLoop for MainMessageLoopRun() to use, and pass a copy of
    // its QuitClosure to the BrowserProcessImpl to call when it is time to exit.
@@ -101,7 +101,7 @@ index 5117fe3b5ee3..e8f37fa7066f 100644
  
    // These members must be initialized before returning from this function.
    // Android doesn't use StartupBrowserCreator.
-@@ -1592,11 +1595,13 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1597,11 +1600,13 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
    // This step is costly and is already measured in
    // Startup.StartupBrowserCreator_Start.
    // See the comment above for an explanation of |process_command_line|.

patch/patches/content_2015.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/download/download_target_determiner.cc chrome/browser/download/download_target_determiner.cc
-index b5bb5e01d7db..f2e23f9fffef 100644
+index cdeecb35a998..1615185f2a65 100644
 --- chrome/browser/download/download_target_determiner.cc
 +++ chrome/browser/download/download_target_determiner.cc
 @@ -660,7 +660,7 @@ void IsHandledBySafePlugin(int render_process_id,

patch/patches/freetype_1139963.patch

@@ -0,0 +1,32 @@
+diff --git src/sfnt/pngshim.c src/sfnt/pngshim.c
+index 2e64e5846..3cfedd8f5 100644
+--- src/sfnt/pngshim.c
++++ src/sfnt/pngshim.c
+@@ -332,6 +332,13 @@
+ 
+     if ( populate_map_and_metrics )
+     {
++      /* reject too large bitmaps similarly to the rasterizer */
++      if ( imgWidth > 0x7FFF || imgHeight > 0x7FFF )
++      {
++        error = FT_THROW( Array_Too_Large );
++        goto DestroyExit;
++      }
++
+       metrics->width  = (FT_UShort)imgWidth;
+       metrics->height = (FT_UShort)imgHeight;
+ 
+@@ -340,13 +347,6 @@
+       map->pixel_mode = FT_PIXEL_MODE_BGRA;
+       map->pitch      = (int)( map->width * 4 );
+       map->num_grays  = 256;
+-
+-      /* reject too large bitmaps similarly to the rasterizer */
+-      if ( map->rows > 0x7FFF || map->width > 0x7FFF )
+-      {
+-        error = FT_THROW( Array_Too_Large );
+-        goto DestroyExit;
+-      }
+     }
+ 
+     /* convert palette/gray image to rgb */

patch/patches/prefs_content_1161.patch

@@ -35,7 +35,7 @@ index bf98747b7b38..fa046af3e0ee 100644
    bool record_whole_document;
  
 diff --git content/renderer/render_view_impl.cc content/renderer/render_view_impl.cc
-index c6a990f87306..1b9759f2b603 100644
+index efab61352658..f65cdba5b96c 100644
 --- content/renderer/render_view_impl.cc
 +++ content/renderer/render_view_impl.cc
 @@ -963,6 +963,8 @@ void RenderView::ApplyWebPreferences(const WebPreferences& prefs,

patch/patches/print_preview_123.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/download/download_prefs.cc chrome/browser/download/download_prefs.cc
-index b4c6ef8fec23..1e2586810d7c 100644
+index 6c30afbd726b..4e66f64e9ad0 100644
 --- chrome/browser/download/download_prefs.cc
 +++ chrome/browser/download/download_prefs.cc
 @@ -23,6 +23,7 @@
@@ -21,7 +21,7 @@ index b4c6ef8fec23..1e2586810d7c 100644
  using content::BrowserContext;
  using content::BrowserThread;
  using content::DownloadManager;
-@@ -349,6 +354,11 @@ DownloadPrefs* DownloadPrefs::FromDownloadManager(
+@@ -355,6 +360,11 @@ DownloadPrefs* DownloadPrefs::FromDownloadManager(
  // static
  DownloadPrefs* DownloadPrefs::FromBrowserContext(
      content::BrowserContext* context) {

patch/patches/renderer_host_1070713.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/renderer_host/render_view_host_impl.cc content/browser/renderer_host/render_view_host_impl.cc
-index f2c4cbf78618..2a2f4d475538 100644
+index c5140471ec2a..638d8259e801 100644
 --- content/browser/renderer_host/render_view_host_impl.cc
 +++ content/browser/renderer_host/render_view_host_impl.cc
 @@ -509,6 +509,8 @@ bool RenderViewHostImpl::IsRenderViewLive() {

patch/patches/rwh_background_color_1984.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/renderer_host/render_widget_host_view_aura.cc content/browser/renderer_host/render_widget_host_view_aura.cc
-index 3ff69bf8cd7d..fe5fbf5f79fb 100644
+index 338fd87a55cb..b79423eb0e24 100644
 --- content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ content/browser/renderer_host/render_widget_host_view_aura.cc
 @@ -676,10 +676,12 @@ gfx::Rect RenderWidgetHostViewAura::GetViewBounds() {

patch/patches/services_network_2718.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/storage_partition_impl.cc content/browser/storage_partition_impl.cc
-index a0034ad3a21d..80fa8da263ac 100644
+index a0034ad3a21d..bf694fdf18d0 100644
 --- content/browser/storage_partition_impl.cc
 +++ content/browser/storage_partition_impl.cc
 @@ -490,10 +490,6 @@ class LoginHandlerDelegate {
@@ -40,15 +40,15 @@ index a0034ad3a21d..80fa8da263ac 100644
        storage::GetDefaultDeviceInfoHelper(), std::move(callback));
  }
  
-@@ -2396,7 +2390,10 @@ void StoragePartitionImpl::InitNetworkContext() {
+@@ -2371,6 +2365,11 @@ void StoragePartitionImpl::InitNetworkContext() {
-   network_context_.reset();
+   GetContentClient()->browser()->ConfigureNetworkContextParams(
-   GetNetworkService()->CreateNetworkContext(
+       browser_context_, is_in_memory_, relative_partition_path_,
-       network_context_.BindNewPipeAndPassReceiver(), std::move(context_params));
+       context_params.get(), cert_verifier_creation_params.get());
--  DCHECK(network_context_);
++  if (context_params->context_name &&
-+  if (!network_context_) {
++      *context_params->context_name == "magic_shutting_down") {
-+    // May happen during shutdown.
++    // Don't re-initialize the network context during shutdown.
 +    return;
 +  }
- 
+   devtools_instrumentation::ApplyNetworkContextParamsOverrides(
-   network_context_client_receiver_.reset();
+       browser_context_, context_params.get());
-   network_context_->SetClient(
+   DCHECK(!context_params->cert_verifier_params)

patch/patches/views_1749_2102.patch

@@ -1,5 +1,5 @@
 diff --git ui/base/models/menu_model.h ui/base/models/menu_model.h
-index 4c08fbf43c16..e319f8b6782f 100644
+index c746b37d6278..b6cebc24b73e 100644
 --- ui/base/models/menu_model.h
 +++ ui/base/models/menu_model.h
 @@ -12,8 +12,11 @@
@@ -14,7 +14,7 @@ index 4c08fbf43c16..e319f8b6782f 100644
  }
  
  namespace ui {
-@@ -129,6 +132,27 @@ class COMPONENT_EXPORT(UI_BASE) MenuModel
+@@ -133,6 +136,27 @@ class COMPONENT_EXPORT(UI_BASE) MenuModel
    // |event_flags| is a bit mask of ui::EventFlags.
    virtual void ActivatedAt(int index, int event_flags);
  
@@ -234,10 +234,10 @@ index 5a45ef3cbf00..597d5f1e8767 100644
    std::unique_ptr<SelectionController> selection_controller_;
  
 diff --git ui/views/controls/menu/menu_controller.cc ui/views/controls/menu/menu_controller.cc
-index a039303e8b9a..60d429d88aa5 100644
+index 87f9291b67d1..860c0a2e147b 100644
 --- ui/views/controls/menu/menu_controller.cc
 +++ ui/views/controls/menu/menu_controller.cc
-@@ -2652,8 +2652,13 @@ MenuItemView* MenuController::FindNextSelectableMenuItem(
+@@ -2662,8 +2662,13 @@ MenuItemView* MenuController::FindNextSelectableMenuItem(
  
  void MenuController::OpenSubmenuChangeSelectionIfCan() {
    MenuItemView* item = pending_state_.item;
@@ -252,7 +252,7 @@ index a039303e8b9a..60d429d88aa5 100644
    MenuItemView* to_select = nullptr;
    if (!item->GetSubmenu()->GetMenuItems().empty())
      to_select = FindInitialSelectableMenuItem(item, INCREMENT_SELECTION_DOWN);
-@@ -2672,8 +2677,10 @@ void MenuController::OpenSubmenuChangeSelectionIfCan() {
+@@ -2682,8 +2687,10 @@ void MenuController::OpenSubmenuChangeSelectionIfCan() {
  void MenuController::CloseSubmenu() {
    MenuItemView* item = state_.item;
    DCHECK(item);
@@ -304,10 +304,10 @@ index 158724b4752c..c82192848584 100644
    virtual int GetMaxWidthForMenu(MenuItemView* menu);
  
 diff --git ui/views/controls/menu/menu_item_view.cc ui/views/controls/menu/menu_item_view.cc
-index 6d06d6fc20ea..28722992c551 100644
+index 262ea70539ab..f91f6c9b668c 100644
 --- ui/views/controls/menu/menu_item_view.cc
 +++ ui/views/controls/menu/menu_item_view.cc
-@@ -1030,6 +1030,15 @@ void MenuItemView::PaintBackground(gfx::Canvas* canvas,
+@@ -1055,6 +1055,15 @@ void MenuItemView::PaintBackground(gfx::Canvas* canvas,
      spilling_rect.set_y(spilling_rect.y() - corner_radius_);
      spilling_rect.set_height(spilling_rect.height() + corner_radius_);
      canvas->DrawRoundRect(spilling_rect, corner_radius_, flags);
@@ -323,7 +323,7 @@ index 6d06d6fc20ea..28722992c551 100644
    } else if (render_selection) {
      gfx::Rect item_bounds = GetLocalBounds();
      if (type_ == Type::kActionableSubMenu) {
-@@ -1097,6 +1106,13 @@ void MenuItemView::PaintMinorIconAndText(
+@@ -1122,6 +1131,13 @@ void MenuItemView::PaintMinorIconAndText(
  }
  
  SkColor MenuItemView::GetTextColor(bool minor, bool render_selection) const {
@@ -338,10 +338,10 @@ index 6d06d6fc20ea..28722992c551 100644
        GetMenuController() && GetMenuController()->use_touchable_layout()
            ? style::CONTEXT_TOUCH_MENU
 diff --git ui/views/controls/menu/menu_model_adapter.cc ui/views/controls/menu/menu_model_adapter.cc
-index 7d0d04e10a19..a2fbe6b62328 100644
+index b0b1cf9a7a79..17b37e84e933 100644
 --- ui/views/controls/menu/menu_model_adapter.cc
 +++ ui/views/controls/menu/menu_model_adapter.cc
-@@ -236,6 +236,77 @@ bool MenuModelAdapter::IsItemChecked(int id) const {
+@@ -240,6 +240,77 @@ bool MenuModelAdapter::IsItemChecked(int id) const {
    return false;
  }
  

patch/patches/views_widget_180_1481_1565_1677_1749.patch

@@ -18,10 +18,10 @@ index 85b265f70047..691e04ddcf97 100644
    return renderer_frame_number_;
  }
 diff --git content/browser/renderer_host/render_widget_host_view_base.h content/browser/renderer_host/render_widget_host_view_base.h
-index d6363c75664b..45288fdafdee 100644
+index 73078c6123c3..b30d9e058935 100644
 --- content/browser/renderer_host/render_widget_host_view_base.h
 +++ content/browser/renderer_host/render_widget_host_view_base.h
-@@ -66,6 +66,7 @@ class CursorManager;
+@@ -67,6 +67,7 @@ class CursorManager;
  class MouseWheelPhaseHandler;
  class RenderWidgetHostImpl;
  class RenderWidgetHostViewBaseObserver;
@@ -29,7 +29,7 @@ index d6363c75664b..45288fdafdee 100644
  class SyntheticGestureTarget;
  class TextInputManager;
  class TouchSelectionControllerClientManager;
-@@ -83,6 +84,9 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -84,6 +85,9 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    float current_device_scale_factor() const {
      return current_device_scale_factor_;
    }
@@ -39,7 +39,7 @@ index d6363c75664b..45288fdafdee 100644
  
    // Returns the focused RenderWidgetHost inside this |view|'s RWH.
    RenderWidgetHostImpl* GetFocusedWidget() const;
-@@ -117,6 +121,8 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -118,6 +122,8 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    void DisableAutoResize(const gfx::Size& new_size) override;
    bool IsScrollOffsetAtTop() override;
    float GetDeviceScaleFactor() final;
@@ -48,7 +48,7 @@ index d6363c75664b..45288fdafdee 100644
    TouchSelectionControllerClientManager*
    GetTouchSelectionControllerClientManager() override;
    void SetRecordContentToVisibleTimeRequest(
-@@ -439,6 +445,12 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -442,6 +448,12 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    // helps to position the full screen widget on the correct monitor.
    virtual void InitAsFullscreen(RenderWidgetHostView* reference_host_view) = 0;
  
@@ -61,7 +61,7 @@ index d6363c75664b..45288fdafdee 100644
    // Sets the cursor for this view to the one associated with the specified
    // cursor_type.
    virtual void UpdateCursor(const WebCursor& cursor) = 0;
-@@ -616,6 +628,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -619,6 +631,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    // specific RenderWidgetHostView.
    base::Optional<DisplayFeature> display_feature_;
  

patch/patches/viz_osr_2575.patch

@@ -80,7 +80,7 @@ index 1026b739d283..fe562ab60ce9 100644
   private:
    const HWND hwnd_;
 diff --git components/viz/service/BUILD.gn components/viz/service/BUILD.gn
-index 7b6f69e3dcce..b04d7984d855 100644
+index 097977040913..34412823b09b 100644
 --- components/viz/service/BUILD.gn
 +++ components/viz/service/BUILD.gn
 @@ -13,7 +13,10 @@ config("viz_service_implementation") {

patch/patches/web_contents_1257_1565.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index 1afd8ac2c2cf..34d1ec7938b2 100644
+index 1db46cd9bee4..a0c84db7caf4 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
-@@ -2225,15 +2225,22 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
+@@ -2229,15 +2229,22 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
    std::string unique_name;
    frame_tree_.root()->SetFrameName(params.main_frame_name, unique_name);
  
@@ -33,7 +33,7 @@ index 1afd8ac2c2cf..34d1ec7938b2 100644
    }
    CHECK(render_view_host_delegate_view_);
    CHECK(view_.get());
-@@ -3035,6 +3042,15 @@ RenderFrameHostDelegate* WebContentsImpl::CreateNewWindow(
+@@ -3039,6 +3046,15 @@ RenderFrameHostDelegate* WebContentsImpl::CreateNewWindow(
    // objects.
    create_params.renderer_initiated_creation = !is_new_browsing_instance;
  
@@ -49,7 +49,7 @@ index 1afd8ac2c2cf..34d1ec7938b2 100644
    std::unique_ptr<WebContentsImpl> new_contents;
    if (!is_guest) {
      create_params.context = view_->GetNativeView();
-@@ -6405,6 +6421,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
+@@ -6409,6 +6425,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
      // This is an outermost WebContents.
      SetAsFocusedWebContentsIfNecessary();
    }
@@ -72,7 +72,7 @@ index f1dcf53ea481..192f7c0ddd04 100644
  
  WebContents::CreateParams::CreateParams(const CreateParams& other) = default;
 diff --git content/public/browser/web_contents.h content/public/browser/web_contents.h
-index 40b5d17d9c73..662068b57f36 100644
+index c5d3d6a2004f..573dd337ad72 100644
 --- content/public/browser/web_contents.h
 +++ content/public/browser/web_contents.h
 @@ -82,8 +82,10 @@ class BrowserContext;
@@ -130,10 +130,10 @@ index e545ff70c612..41cd5299898f 100644
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git content/public/browser/web_contents_observer.h content/public/browser/web_contents_observer.h
-index 0cab1ba9e1ef..1f74ccca4ff2 100644
+index 231047ad1fe1..ed2cfad7fdf7 100644
 --- content/public/browser/web_contents_observer.h
 +++ content/public/browser/web_contents_observer.h
-@@ -599,6 +599,10 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
+@@ -600,6 +600,10 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
    // WebContents has gained/lost focus.
    virtual void OnFocusChangedInPage(FocusedNodeDetails* details) {}
  

patch/patches/webkit_plugin_info_2015.patch

@@ -44,10 +44,10 @@ index bab98605009b..92709eee4924 100644
  
  DocumentInit& DocumentInit::WithTypeFrom(const String& mime_type) {
 diff --git third_party/blink/renderer/core/frame/local_frame.cc third_party/blink/renderer/core/frame/local_frame.cc
-index 81585d785de9..726ee5466d21 100644
+index 6032e38bfd64..7f2bd154e417 100644
 --- third_party/blink/renderer/core/frame/local_frame.cc
 +++ third_party/blink/renderer/core/frame/local_frame.cc
-@@ -1483,7 +1483,7 @@ WebContentSettingsClient* LocalFrame::GetContentSettingsClient() {
+@@ -1484,7 +1484,7 @@ WebContentSettingsClient* LocalFrame::GetContentSettingsClient() {
  PluginData* LocalFrame::GetPluginData() const {
    if (!Loader().AllowPlugins(kNotAboutToInstantiatePlugin))
      return nullptr;

patch/patches/webui_2037.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
-index 29953fdc7c55..89dd4e61f66f 100644
+index 0a144a99349f..1c277b590814 100644
 --- chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
 +++ chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
 @@ -21,6 +21,7 @@
@@ -18,7 +18,7 @@ index 29953fdc7c55..89dd4e61f66f 100644
  #include "components/prefs/pref_service.h"
  #include "components/sync/driver/about_sync_util.h"
  #include "components/sync/driver/sync_service.h"
-@@ -274,7 +276,11 @@ void ChromeInternalLogSource::Fetch(SysLogsSourceCallback callback) {
+@@ -277,7 +279,11 @@ void ChromeInternalLogSource::Fetch(SysLogsSourceCallback callback) {
    response->emplace(kOsVersionTag, os_version);
  #endif
  
@@ -30,7 +30,7 @@ index 29953fdc7c55..89dd4e61f66f 100644
    PopulateExtensionInfoLogs(response.get());
    PopulatePowerApiLogs(response.get());
    PopulateDataReductionProxyLogs(response.get());
-@@ -364,6 +370,12 @@ void ChromeInternalLogSource::PopulateExtensionInfoLogs(
+@@ -368,6 +374,12 @@ void ChromeInternalLogSource::PopulateExtensionInfoLogs(
    if (!profile)
      return;
  
@@ -43,7 +43,7 @@ index 29953fdc7c55..89dd4e61f66f 100644
    extensions::ExtensionRegistry* extension_registry =
        extensions::ExtensionRegistry::Get(profile);
    std::string extensions_list;
-@@ -453,6 +465,8 @@ void ChromeInternalLogSource::PopulateArcPolicyStatus(
+@@ -474,6 +486,8 @@ void ChromeInternalLogSource::PopulateOnboardingTime(
  #if defined(OS_WIN)
  void ChromeInternalLogSource::PopulateUsbKeyboardDetected(
      SystemLogsResponse* response) {

patch/patches/webview_plugin_2020.patch

@@ -1,5 +1,5 @@
 diff --git chrome/app/generated_resources.grd chrome/app/generated_resources.grd
-index 39f6ac6a3f52..a9540fd77690 100644
+index 15e301fc0521..402d4c986057 100644
 --- chrome/app/generated_resources.grd
 +++ chrome/app/generated_resources.grd
 @@ -5051,7 +5051,7 @@ Keep your key file in a safe place. You will need it to create new versions of y

patch/patches/win_screen_2980.patch

@@ -0,0 +1,15 @@
+diff --git ui/display/win/screen_win.cc ui/display/win/screen_win.cc
+index d4fc53fd60d7..53c814534d44 100644
+--- ui/display/win/screen_win.cc
++++ ui/display/win/screen_win.cc
+@@ -728,7 +728,9 @@ Display ScreenWin::GetDisplayNearestPoint(const gfx::Point& point) const {
+ }
+ 
+ Display ScreenWin::GetDisplayMatching(const gfx::Rect& match_rect) const {
+-  return GetScreenWinDisplayNearestScreenRect(match_rect).display();
++  const gfx::Rect screen_rect = DIPToScreenRect(nullptr, match_rect);
++  return GetScreenWinDisplayNearestScreenRect(screen_rect).display();
++
+ }
+ 
+ Display ScreenWin::GetPrimaryDisplay() const {

tests/cefclient/CMakeLists.txt.in

@@ -135,6 +135,9 @@ if(OS_LINUX)
   set_target_properties(${CEF_TARGET} PROPERTIES BUILD_WITH_INSTALL_RPATH TRUE)
   set_target_properties(${CEF_TARGET} PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CEF_TARGET_OUT_DIR})
 
+  # We don't call deprecated GTK functions, and they can cause build failures, so disable them.
+  add_definitions("-DGTK_DISABLE_DEPRECATED")
+
   # Copy CEF binary and resource files to the target output directory.
   COPY_FILES("${CEF_TARGET}" "${CEF_BINARY_FILES}" "${CEF_BINARY_DIR}" "${CEF_TARGET_OUT_DIR}")
   COPY_FILES("${CEF_TARGET}" "${CEF_RESOURCE_FILES}" "${CEF_RESOURCE_DIR}" "${CEF_TARGET_OUT_DIR}")

tests/cefclient/browser/osr_renderer_settings.h

@@ -13,7 +13,7 @@ namespace client {
 struct OsrRendererSettings {
   OsrRendererSettings()
       : show_update_rect(false),
-        background_color(CefColorSetARGB(255, 255, 255, 255)),
+        background_color(0),
         shared_texture_enabled(false),
         external_begin_frame_enabled(false),
         begin_frame_rate(0) {}

tests/cefclient/resources/mac/Info.plist

@@ -28,7 +28,7 @@
 		<string>0</string>
 	</dict>
 	<key>LSMinimumSystemVersion</key>
-	<string>10.9.0</string>
+	<string>10.10.0</string>
 	<key>NSMainNibFile</key>
 	<string>MainMenu</string>
 	<key>NSPrincipalClass</key>

tests/cefclient/resources/mac/helper-Info.plist

@@ -28,7 +28,7 @@
 	<key>LSFileQuarantineEnabled</key>
 	<true/>
 	<key>LSMinimumSystemVersion</key>
-	<string>10.9.0</string>
+	<string>10.10.0</string>
 	<key>LSUIElement</key>
 	<string>1</string>
 	<key>NSSupportsAutomaticGraphicsSwitching</key>

tests/cefsimple/mac/Info.plist

@@ -26,7 +26,7 @@
 		<string>0</string>
 	</dict>
 	<key>LSMinimumSystemVersion</key>
-	<string>10.9.0</string>
+	<string>10.10.0</string>
 	<key>NSMainNibFile</key>
 	<string>MainMenu</string>
 	<key>NSPrincipalClass</key>

tests/cefsimple/mac/helper-Info.plist

@@ -26,7 +26,7 @@
 	<key>LSFileQuarantineEnabled</key>
 	<true/>
 	<key>LSMinimumSystemVersion</key>
-	<string>10.9.0</string>
+	<string>10.10.0</string>
 	<key>LSUIElement</key>
 	<string>1</string>
 	<key>NSSupportsAutomaticGraphicsSwitching</key>

tests/ceftests/cookie_unittest.cc

@@ -15,6 +15,7 @@
 #include "include/wrapper/cef_closure_task.h"
 #include "tests/ceftests/routing_test_handler.h"
 #include "tests/ceftests/test_handler.h"
+#include "tests/ceftests/test_server.h"
 #include "tests/ceftests/test_suite.h"
 #include "tests/ceftests/test_util.h"
 #include "tests/gtest/include/gtest/gtest.h"
@@ -1050,30 +1051,29 @@ namespace {
 
 const char kCookieAccessScheme[] = "http";
 const char kCookieAccessDomain[] = "test-cookies.com";
-const char kCookieAccessServerIP[] = "127.0.0.1";
+const char* kCookieAccessServerAddress = test_server::kServerAddress;
-const uint16 kCookieAccessServerPort = 8099;
+const uint16 kCookieAccessServerPort = test_server::kServerPort;
 
 std::string GetCookieAccessOrigin(const std::string& scheme,
                                   bool server_backend) {
   std::stringstream ss;
   if (server_backend) {
-    ss << scheme << "://" << kCookieAccessServerIP << ":"
+    ss << scheme << "://" << kCookieAccessServerAddress << ":"
        << kCookieAccessServerPort;
   } else {
     ss << scheme << "://" << kCookieAccessDomain;
   }
-  ss << "/";
   return ss.str();
 }
 
 std::string GetCookieAccessUrl1(const std::string& scheme,
                                 bool server_backend) {
-  return GetCookieAccessOrigin(scheme, server_backend) + "cookie1.html";
+  return GetCookieAccessOrigin(scheme, server_backend) + "/cookie1.html";
 }
 
 std::string GetCookieAccessUrl2(const std::string& scheme,
                                 bool server_backend) {
-  return GetCookieAccessOrigin(scheme, server_backend) + "cookie2.html";
+  return GetCookieAccessOrigin(scheme, server_backend) + "/cookie2.html";
 }
 
 void TestCookieString(const std::string& cookie_str,
@@ -1248,7 +1248,7 @@ class CookieAccessSchemeHandlerFactory : public CefSchemeHandlerFactory,
 };
 
 // HTTP server handler.
-class CookieAccessServerHandler : public CefServerHandler,
+class CookieAccessServerHandler : public test_server::ObserverHelper,
                                   public CookieAccessResponseHandler {
  public:
   CookieAccessServerHandler()
@@ -1288,8 +1288,7 @@ class CookieAccessServerHandler : public CefServerHandler,
     EXPECT_TRUE(complete_callback_.is_null());
     complete_callback_ = complete_callback;
 
-    CefServer::CreateServer(kCookieAccessServerIP, kCookieAccessServerPort, 10,
+    Initialize();
-                            this);
   }
 
   // Results in a call to VerifyResults() and eventual execution of the
@@ -1301,73 +1300,60 @@ class CookieAccessServerHandler : public CefServerHandler,
     EXPECT_TRUE(complete_callback_.is_null());
     complete_callback_ = complete_callback;
 
-    EXPECT_TRUE(server_);
+    Shutdown();
-    if (server_)
-      server_->Shutdown();
   }
 
-  void OnServerCreated(CefRefPtr<CefServer> server) override {
+  void OnInitialized(const std::string& server_origin) override {
-    EXPECT_TRUE(server);
+    EXPECT_UI_THREAD();
-    EXPECT_TRUE(server->IsRunning());
+    EXPECT_STREQ(server_origin.c_str(),
-    EXPECT_FALSE(server->HasConnection());
+                 GetCookieAccessOrigin(kCookieAccessScheme, true).c_str());
 
     EXPECT_FALSE(got_server_created_);
     got_server_created_.yes();
 
-    EXPECT_FALSE(server_);
+    RunCompleteCallback();
-    server_ = server;
-
-    EXPECT_FALSE(server_runner_);
-    server_runner_ = server_->GetTaskRunner();
-    EXPECT_TRUE(server_runner_);
-    EXPECT_TRUE(server_runner_->BelongsToCurrentThread());
-
-    CefPostTask(
-        TID_UI,
-        base::Bind(&CookieAccessServerHandler::RunCompleteCallback, this));
   }
 
-  void OnServerDestroyed(CefRefPtr<CefServer> server) override {
+  void OnShutdown() override {
-    EXPECT_TRUE(VerifyServer(server));
+    EXPECT_UI_THREAD();
-    EXPECT_FALSE(server->IsRunning());
-    EXPECT_FALSE(server->HasConnection());
 
     EXPECT_FALSE(got_server_destroyed_);
     got_server_destroyed_.yes();
 
-    server_ = nullptr;
-
     VerifyResults();
+
+    delete this;
   }
 
-  void OnClientConnected(CefRefPtr<CefServer> server,
+  bool OnClientConnected(CefRefPtr<CefServer> server,
                          int connection_id) override {
-    EXPECT_TRUE(VerifyServer(server));
+    EXPECT_UI_THREAD();
-    EXPECT_TRUE(server->HasConnection());
-    EXPECT_TRUE(server->IsValidConnection(connection_id));
 
     EXPECT_TRUE(connection_id_set_.find(connection_id) ==
                 connection_id_set_.end());
     connection_id_set_.insert(connection_id);
 
     actual_connection_ct_++;
+
+    return true;
   }
 
-  void OnClientDisconnected(CefRefPtr<CefServer> server,
+  bool OnClientDisconnected(CefRefPtr<CefServer> server,
                             int connection_id) override {
-    EXPECT_TRUE(VerifyServer(server));
+    EXPECT_UI_THREAD();
-    EXPECT_FALSE(server->IsValidConnection(connection_id));
 
     ConnectionIdSet::iterator it = connection_id_set_.find(connection_id);
     EXPECT_TRUE(it != connection_id_set_.end());
     connection_id_set_.erase(it);
+
+    return true;
   }
 
-  void OnHttpRequest(CefRefPtr<CefServer> server,
+  bool OnHttpRequest(CefRefPtr<CefServer> server,
                      int connection_id,
                      const CefString& client_address,
                      CefRefPtr<CefRequest> request) override {
-    EXPECT_TRUE(VerifyServer(server));
+    EXPECT_UI_THREAD();
     EXPECT_TRUE(VerifyConnection(connection_id));
     EXPECT_FALSE(client_address.empty());
 
@@ -1378,50 +1364,16 @@ class CookieAccessServerHandler : public CefServerHandler,
     HandleRequest(server, connection_id, request);
 
     actual_http_request_ct_++;
-  }
 
-  void OnWebSocketRequest(CefRefPtr<CefServer> server,
+    return true;
-                          int connection_id,
-                          const CefString& client_address,
-                          CefRefPtr<CefRequest> request,
-                          CefRefPtr<CefCallback> callback) override {
-    NOTREACHED();
-  }
-
-  void OnWebSocketConnected(CefRefPtr<CefServer> server,
-                            int connection_id) override {
-    NOTREACHED();
-  }
-
-  void OnWebSocketMessage(CefRefPtr<CefServer> server,
-                          int connection_id,
-                          const void* data,
-                          size_t data_size) override {
-    NOTREACHED();
   }
 
  private:
-  bool RunningOnServerThread() {
-    return server_runner_ && server_runner_->BelongsToCurrentThread();
-  }
-
-  bool VerifyServer(CefRefPtr<CefServer> server) {
-    V_DECLARE();
-    V_EXPECT_TRUE(RunningOnServerThread());
-    V_EXPECT_TRUE(server);
-    V_EXPECT_TRUE(server_);
-    V_EXPECT_TRUE(server->GetAddress().ToString() ==
-                  server_->GetAddress().ToString());
-    V_RETURN();
-  }
-
   bool VerifyConnection(int connection_id) {
     return connection_id_set_.find(connection_id) != connection_id_set_.end();
   }
 
   void VerifyResults() {
-    EXPECT_TRUE(RunningOnServerThread());
-
     EXPECT_TRUE(got_server_created_);
     EXPECT_TRUE(got_server_destroyed_);
     EXPECT_TRUE(connection_id_set_.empty());
@@ -1453,10 +1405,19 @@ class CookieAccessServerHandler : public CefServerHandler,
     }
   }
 
-  void SendResponse(CefRefPtr<CefServer> server,
+  static void SendResponse(CefRefPtr<CefServer> server,
-                    int connection_id,
+                           int connection_id,
-                    CefRefPtr<CefResponse> response,
+                           CefRefPtr<CefResponse> response,
-                    const std::string& response_data) {
+                           const std::string& response_data) {
+    // Execute on the server thread because some methods require it.
+    CefRefPtr<CefTaskRunner> task_runner = server->GetTaskRunner();
+    if (!task_runner->BelongsToCurrentThread()) {
+      task_runner->PostTask(CefCreateClosureTask(
+          base::Bind(CookieAccessServerHandler::SendResponse, server,
+                     connection_id, response, response_data)));
+      return;
+    }
+
     int response_code = response->GetStatus();
     const CefString& content_type = response->GetMimeType();
     int64 content_length = static_cast<int64>(response_data.size());
@@ -1489,8 +1450,6 @@ class CookieAccessServerHandler : public CefServerHandler,
   typedef std::map<std::string, CookieAccessData*> ResponseDataMap;
   ResponseDataMap data_map_;
 
-  CefRefPtr<CefServer> server_;
-  CefRefPtr<CefTaskRunner> server_runner_;
   bool initialized_;
 
   // Only accessed on the UI thread.
@@ -1512,7 +1471,6 @@ class CookieAccessServerHandler : public CefServerHandler,
 
   std::string request_log_;
 
-  IMPLEMENT_REFCOUNTING(CookieAccessServerHandler);
   DISALLOW_COPY_AND_ASSIGN(CookieAccessServerHandler);
 };
 
@@ -1611,20 +1569,24 @@ class CookieAccessTestHandler : public RoutingTestHandler,
       EXPECT_EQ(0, can_save_cookie1_ct_);
       EXPECT_EQ(0, can_send_cookie2_ct_);
     } else {
-      // Get 1 call to CanSaveCookie for the 1st network request due to the
-      // network cookie.
-      EXPECT_EQ(1, can_save_cookie1_ct_);
       if (test_mode_ == BLOCK_ALL_COOKIES) {
         // Never send any cookies.
         EXPECT_EQ(0, can_send_cookie2_ct_);
+        EXPECT_EQ(0, can_save_cookie1_ct_);
       } else if (test_mode_ & BLOCK_WRITE) {
         // Get 1 calls to CanSendCookie for the 2nd network request due to the
         // JS cookie (network cookie is blocked).
         EXPECT_EQ(1, can_send_cookie2_ct_);
+        // Get 1 call to CanSaveCookie for the 1st network request due to the
+        // network cookie.
+        EXPECT_EQ(1, can_save_cookie1_ct_);
       } else {
         // Get 2 calls to CanSendCookie for the 2nd network request due to the
         // network cookie + JS cookie.
         EXPECT_EQ(2, can_send_cookie2_ct_);
+        // Get 1 call to CanSaveCookie for the 1st network request due to the
+        // network cookie.
+        EXPECT_EQ(1, can_save_cookie1_ct_);
       }
     }
 
@@ -1833,7 +1795,7 @@ class CookieAccessTestHandler : public RoutingTestHandler,
     EXPECT_FALSE(server_handler_);
 
     server_handler_ = new CookieAccessServerHandler();
-    AddResponses(server_handler_.get());
+    AddResponses(server_handler_);
     server_handler_->CreateServer(complete_callback);
   }
 
@@ -1911,6 +1873,7 @@ class CookieAccessTestHandler : public RoutingTestHandler,
   void ShutdownServer(const base::Closure& complete_callback) {
     EXPECT_TRUE(server_handler_);
 
+    // |server_handler_| will delete itself after shutdown.
     server_handler_->ShutdownServer(complete_callback);
     server_handler_ = nullptr;
   }
@@ -1933,7 +1896,7 @@ class CookieAccessTestHandler : public RoutingTestHandler,
   CefRefPtr<CefRequestContext> context_;
   CefRefPtr<CefCookieManager> cookie_manager_;
 
-  CefRefPtr<CookieAccessServerHandler> server_handler_;
+  CookieAccessServerHandler* server_handler_ = nullptr;
   CefRefPtr<CookieAccessSchemeHandlerFactory> scheme_factory_;
 
   CookieAccessData data1_;
@@ -2292,7 +2255,7 @@ class CookieRestartTestHandler : public RoutingTestHandler,
     EXPECT_FALSE(server_handler_);
 
     server_handler_ = new CookieAccessServerHandler();
-    AddResponses(server_handler_.get());
+    AddResponses(server_handler_);
     // 2 requests for each URL.
     server_handler_->SetExpectedRequestCount(4);
     server_handler_->CreateServer(complete_callback);
@@ -2351,6 +2314,7 @@ class CookieRestartTestHandler : public RoutingTestHandler,
   void ShutdownServer(const base::Closure& complete_callback) {
     EXPECT_TRUE(server_handler_);
 
+    // |server_handler_| will delete itself after shutdown.
     server_handler_->ShutdownServer(complete_callback);
     server_handler_ = nullptr;
   }
@@ -2360,7 +2324,7 @@ class CookieRestartTestHandler : public RoutingTestHandler,
   CefRefPtr<CefRequestContext> context_;
   CefRefPtr<CefCookieManager> cookie_manager_;
 
-  CefRefPtr<CookieAccessServerHandler> server_handler_;
+  CookieAccessServerHandler* server_handler_ = nullptr;
 
   CookieAccessData data1_;
   CookieAccessData data2_;

tests/ceftests/extensions/extension_test_handler.h

@@ -2,8 +2,8 @@
 // reserved. Use of this source code is governed by a BSD-style license that
 // can be found in the LICENSE file.
 
-#ifndef CEF_TESTS_UNITTESTS_EXTENSIONS_EXTENSION_TEST_HANDLER_H_
+#ifndef CEF_TESTS_CEFTESTS_EXTENSIONS_EXTENSION_TEST_HANDLER_H_
-#define CEF_TESTS_UNITTESTS_EXTENSIONS_EXTENSION_TEST_HANDLER_H_
+#define CEF_TESTS_CEFTESTS_EXTENSIONS_EXTENSION_TEST_HANDLER_H_
 #pragma once
 
 #include <vector>
@@ -235,4 +235,4 @@ class ExtensionTestHandler : public RoutingTestHandler,
   EXTENSION_TEST_GROUP_MINIMAL_GLOBAL(name, test_class) \
   EXTENSION_TEST_GROUP_MINIMAL_CUSTOM(name, test_class)
 
-#endif  // CEF_TESTS_UNITTESTS_EXTENSIONS_EXTENSION_TEST_HANDLER_H_
+#endif  // CEF_TESTS_CEFTESTS_EXTENSIONS_EXTENSION_TEST_HANDLER_H_

tests/ceftests/image_util.h

@@ -2,8 +2,8 @@
 // reserved. Use of this source code is governed by a BSD-style license that
 // can be found in the LICENSE file.
 
-#ifndef CEF_TESTS_UNITTESTS_IMAGE_UTIL_H_
+#ifndef CEF_TESTS_CEFTESTS_IMAGE_UTIL_H_
-#define CEF_TESTS_UNITTESTS_IMAGE_UTIL_H_
+#define CEF_TESTS_CEFTESTS_IMAGE_UTIL_H_
 #pragma once
 
 #include "include/cef_image.h"
@@ -24,4 +24,4 @@ void LoadIconImage(CefRefPtr<CefImage> image,
 
 }  // namespace image_util
 
-#endif  // CEF_TESTS_UNITTESTS_IMAGE_UTIL_H_
+#endif  // CEF_TESTS_CEFTESTS_IMAGE_UTIL_H_

tests/ceftests/os_rendering_unittest_mac.h

@@ -2,8 +2,8 @@
 // reserved. Use of this source code is governed by a BSD-style license
 // that can be found in the LICENSE file.
 
-#ifndef CEF_TESTS_UNITTESTS_OS_RENDERING_UNITTEST_MAC_H_
+#ifndef CEF_TESTS_CEFTESTS_OS_RENDERING_UNITTEST_MAC_H_
-#define CEF_TESTS_UNITTESTS_OS_RENDERING_UNITTEST_MAC_H_
+#define CEF_TESTS_CEFTESTS_OS_RENDERING_UNITTEST_MAC_H_
 
 #include "include/cef_base.h"
 
@@ -13,4 +13,4 @@ CefWindowHandle GetFakeView();
 
 }  // namespace osr_unittests
 
-#endif
+#endif  // CEF_TESTS_CEFTESTS_OS_RENDERING_UNITTEST_MAC_H_

tests/ceftests/resources/mac/Info.plist

@@ -25,9 +25,13 @@
 		<key>MallocNanoZone</key>
 		<string>0</string>
 	</dict>
+	<key>LSMinimumSystemVersion</key>
+	<string>10.10.0</string>
 	<key>NSMainNibFile</key>
 	<string>MainMenu</string>
 	<key>NSPrincipalClass</key>
 	<string>NSApplication</string>
+	<key>NSSupportsAutomaticGraphicsSwitching</key>
+	<true/>
 </dict>
 </plist>

tests/ceftests/resources/mac/helper-Info.plist

@@ -26,7 +26,7 @@
 	<key>LSFileQuarantineEnabled</key>
 	<true/>
 	<key>LSMinimumSystemVersion</key>
-	<string>10.9.0</string>
+	<string>10.10.0</string>
 	<key>LSUIElement</key>
 	<string>1</string>
 	<key>NSSupportsAutomaticGraphicsSwitching</key>

tests/ceftests/routing_test_handler.h

@@ -2,8 +2,8 @@
 // reserved. Use of this source code is governed by a BSD-style license that
 // can be found in the LICENSE file.
 
-#ifndef CEF_TESTS_UNITTESTS_ROUTING_TEST_HANDLER_H_
+#ifndef CEF_TESTS_CEFTESTS_ROUTING_TEST_HANDLER_H_
-#define CEF_TESTS_UNITTESTS_ROUTING_TEST_HANDLER_H_
+#define CEF_TESTS_CEFTESTS_ROUTING_TEST_HANDLER_H_
 #pragma once
 
 #include "include/wrapper/cef_message_router.h"
@@ -39,4 +39,4 @@ class RoutingTestHandler : public TestHandler,
   CefRefPtr<CefMessageRouterBrowserSide> message_router_;
 };
 
-#endif  // CEF_TESTS_UNITTESTS_ROUTING_TEST_HANDLER_H_
+#endif  // CEF_TESTS_CEFTESTS_ROUTING_TEST_HANDLER_H_

tests/ceftests/run_all_unittests.cc

@@ -20,9 +20,11 @@
 #include "include/cef_app.h"
 #include "include/cef_task.h"
 #include "include/cef_thread.h"
+#include "include/cef_waitable_event.h"
 #include "include/wrapper/cef_closure_task.h"
 #include "include/wrapper/cef_helpers.h"
 #include "tests/ceftests/test_handler.h"
+#include "tests/ceftests/test_server.h"
 #include "tests/ceftests/test_suite.h"
 #include "tests/shared/browser/client_app_browser.h"
 #include "tests/shared/browser/main_message_loop_external_pump.h"
@@ -48,6 +50,7 @@
 namespace {
 
 void QuitMessageLoop() {
+  CEF_REQUIRE_UI_THREAD();
   client::MainMessageLoop* message_loop = client::MainMessageLoop::Get();
   if (message_loop)
     message_loop->Quit();
@@ -74,8 +77,8 @@ void RunTestsOnTestThread() {
   while (TestHandler::HasBrowser())
     sleep(100);
 
-  // Quit the CEF message loop.
+  // Wait for the test server to stop, and then quit the CEF message loop.
-  CefPostTask(TID_UI, base::Bind(&QuitMessageLoop));
+  test_server::Stop(base::Bind(QuitMessageLoop));
 }
 
 // Called on the UI thread.
@@ -201,6 +204,12 @@ int main(int argc, char* argv[]) {
   if (settings.multi_threaded_message_loop) {
     // Run the test suite on the main thread.
     retval = test_suite.Run();
+
+    // Wait for the test server to stop.
+    CefRefPtr<CefWaitableEvent> event =
+        CefWaitableEvent::CreateWaitableEvent(true, false);
+    test_server::Stop(base::Bind(&CefWaitableEvent::Signal, event));
+    event->Wait();
   } else {
     // Create and start the test thread.
     CefRefPtr<CefThread> thread = CefThread::CreateThread("test_thread");

tests/ceftests/scheme_handler_unittest.cc

@@ -3,6 +3,7 @@
 // can be found in the LICENSE file.
 
 #include <algorithm>
+#include <vector>
 
 #include "include/base/cef_bind.h"
 #include "include/cef_callback.h"
@@ -32,6 +33,7 @@ class TestResults {
     sub_allow_origin.clear();
     exit_url.clear();
     accept_language.clear();
+    console_messages.clear();
     delay = 0;
     got_request.reset();
     got_read.reset();
@@ -69,6 +71,9 @@ class TestResults {
   // Used for testing per-browser Accept-Language.
   std::string accept_language;
 
+  // Used for testing received console messages.
+  std::vector<std::string> console_messages;
+
   // Delay for returning scheme handler results.
   int delay;
 
@@ -104,7 +109,13 @@ class TestSchemeHandler : public TestHandler {
 
   // Necessary to make the method public in order to destroy the test from
   // ClientSchemeHandler::ProcessRequest().
-  void DestroyTest() override { TestHandler::DestroyTest(); }
+  void DestroyTest() override {
+    EXPECT_TRUE(test_results_->console_messages.empty())
+        << "Did not receive expected console message: "
+        << test_results_->console_messages.front();
+
+    TestHandler::DestroyTest();
+  }
 
   void DestroyTestIfDone() {
     if (!test_results_->exit_url.empty() && !test_results_->got_exit_request) {
@@ -206,6 +217,31 @@ class TestSchemeHandler : public TestHandler {
     DestroyTestIfDone();
   }
 
+  bool OnConsoleMessage(CefRefPtr<CefBrowser> browser,
+                        cef_log_severity_t level,
+                        const CefString& message,
+                        const CefString& source,
+                        int line) override {
+    bool expected = false;
+    if (!test_results_->console_messages.empty()) {
+      std::vector<std::string>::iterator it =
+          test_results_->console_messages.begin();
+      for (; it != test_results_->console_messages.end(); ++it) {
+        const std::string& possible = *it;
+        const std::string& actual = message.ToString();
+        if (actual.find(possible) == 0U) {
+          expected = true;
+          test_results_->console_messages.erase(it);
+          break;
+        }
+      }
+    }
+
+    EXPECT_TRUE(expected) << "Unexpected console message: "
+                          << message.ToString();
+    return false;
+  }
+
  protected:
   TestResults* test_results_;
 
@@ -635,6 +671,11 @@ void SetUpXHR(const XHRTestSettings& settings) {
   g_TestResults.sub_allow_origin = settings.sub_allow_origin;
   g_TestResults.sub_redirect_url = settings.sub_redirect_url;
 
+  if (settings.synchronous) {
+    g_TestResults.console_messages.push_back(
+        "Synchronous XMLHttpRequest on the main thread is deprecated");
+  }
+
   std::string request_url;
   if (!settings.sub_redirect_url.empty())
     request_url = settings.sub_redirect_url;
@@ -677,7 +718,6 @@ void SetUpXHR(const XHRTestSettings& settings) {
           "  }"
           "};"
           "xhr.onerror = function(e) {"
-          "  console.log('XMLHttpRequest failed with error ' + e);"
           "  onResult('FAILURE');"
           "};"
           "xhr.send()";
@@ -728,16 +768,12 @@ void SetUpFetch(const FetchTestSettings& settings) {
         "      response.text().then(function(text) {"
         "          onResult(text);"
         "      }).catch(function(e) {"
-        "          console.log('FetchHttpRequest failed with error ' + e);"
         "          onResult('FAILURE');        "
         "      });"
         "  } else {"
-        "      console.log('XMLHttpRequest failed with status ' + "
-        "      response.status);"
         "      onResult('FAILURE');"
         "  }"
         "}).catch(function(e) {"
-        "  console.log('FetchHttpRequest failed with error ' + e);"
         "  onResult('FAILURE');"
         "});"
      << "}"
@@ -1154,6 +1190,11 @@ TEST(SchemeHandlerTest, CustomNonStandardXHRSameOriginSync) {
   settings.sub_url = "customnonstd:xhr%20value";
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'customnonstd:xhr%20value' from origin "
+      "'null' has been blocked by CORS policy: Cross origin requests are only "
+      "supported for protocol schemes:");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1179,6 +1220,11 @@ TEST(SchemeHandlerTest, CustomNonStandardXHRSameOriginAsync) {
   settings.synchronous = false;
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'customnonstd:xhr%20value' from origin "
+      "'null' has been blocked by CORS policy: Cross origin requests are only "
+      "supported for protocol schemes:");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1203,6 +1249,10 @@ TEST(SchemeHandlerTest, CustomStandardFetchSameOrigin) {
   settings.sub_url = "customstd://test/fetch.html";
   SetUpFetch(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Fetch API cannot load customstd://test/fetch.html. URL scheme "
+      "\"customstd\" is not supported.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1251,6 +1301,10 @@ TEST(SchemeHandlerTest, CustomNonStandardFetchSameOrigin) {
   settings.sub_url = "customnonstd:xhr%20value";
   SetUpFetch(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Fetch API cannot load customnonstd:xhr%20value. URL scheme must be "
+      "\"http\" or \"https\" for CORS request.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1290,6 +1344,10 @@ TEST(SchemeHandlerTest, CustomNonStandardXSSSameOrigin) {
   RegisterTestScheme("customnonstd", std::string());
   SetUpXSS("customnonstd:some%20value", "customnonstd:xhr%20value");
 
+  g_TestResults.console_messages.push_back(
+      "Error: Blocked a frame with origin \"null\" from accessing a "
+      "cross-origin frame.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1315,6 +1373,12 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginSync) {
   settings.sub_url = "customstd://test2/xhr.html";
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'customstd://test2/xhr.html' from origin "
+      "'customstd://test1' has been blocked by CORS policy: No "
+      "'Access-Control-Allow-Origin' header is present on the requested "
+      "resource.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1323,7 +1387,11 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginSync) {
   EXPECT_TRUE(g_TestResults.got_read);
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -1341,6 +1409,12 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginAsync) {
   settings.synchronous = false;
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'customstd://test2/xhr.html' from origin "
+      "'customstd://test1' has been blocked by CORS policy: No "
+      "'Access-Control-Allow-Origin' header is present on the requested "
+      "resource.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1349,7 +1423,11 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginAsync) {
   EXPECT_TRUE(g_TestResults.got_read);
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -1366,6 +1444,13 @@ TEST(SchemeHandlerTest, CustomStandardFetchDifferentOrigin) {
   settings.sub_url = "customstdfetch://test2/fetch.html";
   SetUpFetch(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to fetch at 'customstdfetch://test2/fetch.html' from origin "
+      "'customstdfetch://test1' has been blocked by CORS policy: No "
+      "'Access-Control-Allow-Origin' header is present on the requested "
+      "resource. If an opaque response serves your needs, set the request's "
+      "mode to 'no-cors' to fetch the resource with CORS disabled.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1374,7 +1459,11 @@ TEST(SchemeHandlerTest, CustomStandardFetchDifferentOrigin) {
   EXPECT_TRUE(g_TestResults.got_read);
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -1387,6 +1476,10 @@ TEST(SchemeHandlerTest, CustomStandardXSSDifferentOrigin) {
   RegisterTestScheme("customstd", "test2");
   SetUpXSS("customstd://test1/run.html", "customstd://test2/iframe.html");
 
+  g_TestResults.console_messages.push_back(
+      "Error: Blocked a frame with origin \"customstd://test2\" from accessing "
+      "a cross-origin frame.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1408,6 +1501,10 @@ TEST(SchemeHandlerTest, CustomStandardXSSDifferentProtocolHttp) {
   RegisterTestScheme("http", "test2");
   SetUpXSS("customstd://test1/run.html", "http://test2/iframe.html");
 
+  g_TestResults.console_messages.push_back(
+      "Error: Blocked a frame with origin \"http://test2\" from accessing a "
+      "cross-origin frame.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1430,6 +1527,10 @@ TEST(SchemeHandlerTest, CustomStandardXSSDifferentProtocolCustomNonStandard) {
   RegisterTestScheme("customnonstd", std::string());
   SetUpXSS("customstd://test1/run.html", "customnonstd:some%20value");
 
+  g_TestResults.console_messages.push_back(
+      "Error: Blocked a frame with origin \"null\" from accessing a "
+      "cross-origin frame.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1451,6 +1552,10 @@ TEST(SchemeHandlerTest, HttpXSSDifferentProtocolCustomStandard) {
   RegisterTestScheme("customstd", "test2");
   SetUpXSS("http://test1/run.html", "customstd://test2/iframe.html");
 
+  g_TestResults.console_messages.push_back(
+      "Error: Blocked a frame with origin \"customstd://test2\" from accessing "
+      "a cross-origin frame.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1472,6 +1577,10 @@ TEST(SchemeHandlerTest, HttpXSSDifferentProtocolCustomNonStandard) {
   RegisterTestScheme("customnonstd", std::string());
   SetUpXSS("http://test1/run.html", "customnonstd:some%20value");
 
+  g_TestResults.console_messages.push_back(
+      "Error: Blocked a frame with origin \"null\" from accessing a "
+      "cross-origin frame.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1497,6 +1606,12 @@ TEST(SchemeHandlerTest, HttpXHRDifferentOriginSync) {
   settings.sub_url = "http://test2/xhr.html";
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'http://test2/xhr.html' from origin "
+      "'http://test1' has been blocked by CORS policy: No "
+      "'Access-Control-Allow-Origin' header is present on the requested "
+      "resource.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1505,7 +1620,11 @@ TEST(SchemeHandlerTest, HttpXHRDifferentOriginSync) {
   EXPECT_TRUE(g_TestResults.got_read);
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -1523,6 +1642,12 @@ TEST(SchemeHandlerTest, HttpXHRDifferentOriginAsync) {
   settings.synchronous = false;
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'http://test2/xhr.html' from origin "
+      "'http://test1' has been blocked by CORS policy: No "
+      "'Access-Control-Allow-Origin' header is present on the requested "
+      "resource.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1531,7 +1656,11 @@ TEST(SchemeHandlerTest, HttpXHRDifferentOriginAsync) {
   EXPECT_TRUE(g_TestResults.got_read);
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -1548,6 +1677,13 @@ TEST(SchemeHandlerTest, HttpFetchDifferentOriginAsync) {
   settings.sub_url = "http://test2/fetch.html";
   SetUpFetch(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to fetch at 'http://test2/fetch.html' from origin 'http://test1' "
+      "has been blocked by CORS policy: No 'Access-Control-Allow-Origin' "
+      "header is present on the requested resource. If an opaque response "
+      "serves your needs, set the request's mode to 'no-cors' to fetch the "
+      "resource with CORS disabled.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -1556,7 +1692,11 @@ TEST(SchemeHandlerTest, HttpFetchDifferentOriginAsync) {
   EXPECT_TRUE(g_TestResults.got_read);
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -1569,6 +1709,10 @@ TEST(SchemeHandlerTest, HttpXSSDifferentOrigin) {
   RegisterTestScheme("http", "test2");
   SetUpXSS("http://test1/run.html", "http://test2/xss.html");
 
+  g_TestResults.console_messages.push_back(
+      "Error: Blocked a frame with origin \"http://test2\" from accessing a "
+      "cross-origin frame.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -2085,6 +2229,12 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginRedirectSync) {
   settings.sub_redirect_url = "customstd://test1/xhr.html";
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'customstd://test2/xhr.html' (redirected "
+      "from 'customstd://test1/xhr.html') from origin 'customstd://test1' has "
+      "been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is "
+      "present on the requested resource.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -2094,7 +2244,11 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginRedirectSync) {
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_redirect);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -2113,6 +2267,12 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginRedirectAsync) {
   settings.synchronous = false;
   SetUpXHR(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to XMLHttpRequest at 'customstd://test2/xhr.html' (redirected "
+      "from 'customstd://test1/xhr.html') from origin 'customstd://test1' has "
+      "been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is "
+      "present on the requested resource.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -2122,7 +2282,11 @@ TEST(SchemeHandlerTest, CustomStandardXHRDifferentOriginRedirectAsync) {
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_redirect);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -2140,6 +2304,14 @@ TEST(SchemeHandlerTest, CustomStandardFetchDifferentOriginRedirect) {
   settings.sub_redirect_url = "customstdfetch://test1/fetch.html";
   SetUpFetch(settings);
 
+  g_TestResults.console_messages.push_back(
+      "Access to fetch at 'customstdfetch://test2/fetch.html' (redirected from "
+      "'customstdfetch://test1/fetch.html') from origin "
+      "'customstdfetch://test1' has been blocked by CORS policy: No "
+      "'Access-Control-Allow-Origin' header is present on the requested "
+      "resource. If an opaque response serves your needs, set the request's "
+      "mode to 'no-cors' to fetch the resource with CORS disabled.");
+
   CefRefPtr<TestSchemeHandler> handler = new TestSchemeHandler(&g_TestResults);
   handler->ExecuteTest();
   ReleaseAndWaitForDestructor(handler);
@@ -2149,7 +2321,11 @@ TEST(SchemeHandlerTest, CustomStandardFetchDifferentOriginRedirect) {
   EXPECT_TRUE(g_TestResults.got_output);
   EXPECT_TRUE(g_TestResults.got_sub_redirect);
   EXPECT_TRUE(g_TestResults.got_sub_request);
-  EXPECT_TRUE(g_TestResults.got_sub_read);
+  if (!IsOutOfBlinkCorsEnabled()) {
+    EXPECT_TRUE(g_TestResults.got_sub_read);
+  } else {
+    EXPECT_FALSE(g_TestResults.got_sub_read);
+  }
   EXPECT_FALSE(g_TestResults.got_sub_success);
 
   ClearTestSchemes();
@@ -2429,10 +2605,13 @@ void RegisterSchemeHandlerCustomSchemes(
   // Add a custom standard scheme.
   registrar->AddCustomScheme(
       "customstd", CEF_SCHEME_OPTION_STANDARD | CEF_SCHEME_OPTION_CORS_ENABLED);
+  cookiable_schemes.push_back("customstd");
+  // Also used in cors_unittest.cc.
   registrar->AddCustomScheme("customstdfetch",
                              CEF_SCHEME_OPTION_STANDARD |
                                  CEF_SCHEME_OPTION_CORS_ENABLED |
                                  CEF_SCHEME_OPTION_FETCH_ENABLED);
+  cookiable_schemes.push_back("customstdfetch");
   // Add a custom non-standard scheme.
   registrar->AddCustomScheme("customnonstd", CEF_SCHEME_OPTION_NONE);
   registrar->AddCustomScheme("customnonstdfetch",

tests/ceftests/server_unittest.cc

@@ -20,6 +20,7 @@
 
 namespace {
 
+// Must use a different port than test_server.cc.
 const char kTestServerAddress[] = "127.0.0.1";
 const uint16 kTestServerPort = 8099;
 const int kTestTimeout = 5000;
@@ -27,7 +28,7 @@ const int kTestTimeout = 5000;
 std::string GetTestServerOrigin(bool is_websocket) {
   std::stringstream ss;
   ss << (is_websocket ? "ws://" : "http://") << kTestServerAddress << ":"
-     << kTestServerPort << "/";
+     << kTestServerPort;
   return ss.str();
 }
 
@@ -793,7 +794,7 @@ CefRefPtr<CefRequest> CreateTestServerRequest(
     const std::string& content_type = std::string(),
     const CefRequest::HeaderMap& extra_headers = CefRequest::HeaderMap()) {
   CefRefPtr<CefRequest> request = CefRequest::Create();
-  request->SetURL(GetTestServerOrigin(false) + path);
+  request->SetURL(GetTestServerOrigin(false) + "/" + path);
   request->SetMethod(method);
 
   CefRequest::HeaderMap header_map;
@@ -1277,7 +1278,7 @@ class EchoWebSocketRequestHandler : public TestServerHandler::WsRequestHandler {
   explicit EchoWebSocketRequestHandler(int expected_message_ct)
       : expected_message_ct_(expected_message_ct), actual_message_ct_(0) {}
 
-  std::string GetWebSocketUrl() { return GetTestServerOrigin(true) + "echo"; }
+  std::string GetWebSocketUrl() { return GetTestServerOrigin(true) + "/echo"; }
 
   bool HandleRequest(CefRefPtr<CefServer> server,
                      int connection_id,

tests/ceftests/test_handler.cc

@@ -10,6 +10,7 @@
 #include "include/cef_stream.h"
 #include "include/wrapper/cef_closure_task.h"
 #include "include/wrapper/cef_stream_resource_handler.h"
+#include "tests/ceftests/test_request.h"
 #include "tests/shared/common/client_switches.h"
 
 #if defined(USE_AURA)
@@ -261,15 +262,8 @@ CefRefPtr<CefResourceHandler> TestHandler::GetResourceHandler(
   EXPECT_IO_THREAD();
 
   if (resource_map_.size() > 0) {
-    CefString url = request->GetURL();
+    const std::string& url = test_request::GetPathURL(request->GetURL());
-
+    ResourceMap::const_iterator it = resource_map_.find(url);
-    // Ignore the query component, if any.
-    std::string urlStr = url;
-    size_t idx = urlStr.find('?');
-    if (idx > 0)
-      urlStr = urlStr.substr(0, idx);
-
-    ResourceMap::const_iterator it = resource_map_.find(urlStr);
     if (it != resource_map_.end()) {
       // Return the previously mapped resource
       CefRefPtr<CefStreamReader> stream = CefStreamReader::CreateForData(

tests/ceftests/test_handler.h

@@ -2,8 +2,8 @@
 // reserved. Use of this source code is governed by a BSD-style license that
 // can be found in the LICENSE file.
 
-#ifndef CEF_TESTS_UNITTESTS_TEST_HANDLER_H_
+#ifndef CEF_TESTS_CEFTESTS_TEST_HANDLER_H_
-#define CEF_TESTS_UNITTESTS_TEST_HANDLER_H_
+#define CEF_TESTS_CEFTESTS_TEST_HANDLER_H_
 #pragma once
 
 #include <list>
@@ -19,20 +19,9 @@
 #include "include/cef_task.h"
 #include "include/cef_waitable_event.h"
 #include "tests/ceftests/thread_helper.h"
+#include "tests/ceftests/track_callback.h"
 #include "tests/gtest/include/gtest/gtest.h"
 
-class TrackCallback {
- public:
-  TrackCallback() : gotit_(false) {}
-  void yes() { gotit_ = true; }
-  bool isSet() { return gotit_; }
-  void reset() { gotit_ = false; }
-  operator bool() const { return gotit_; }
-
- protected:
-  bool gotit_;
-};
-
 class ResourceContent {
  public:
   typedef std::multimap<std::string, std::string> HeaderMap;
@@ -363,4 +352,4 @@ bool TestFailed();
   GTEST_TEST_BOOLEAN_(!(__result), #condition, true, false, \
                       GTEST_NONFATAL_FAILURE_)
 
-#endif  // CEF_TESTS_UNITTESTS_TEST_HANDLER_H_
+#endif  // CEF_TESTS_CEFTESTS_TEST_HANDLER_H_

tests/ceftests/test_request.cc

@@ -0,0 +1,202 @@
+// Copyright (c) 2020 The Chromium Embedded Framework Authors. All rights
+// reserved. Use of this source code is governed by a BSD-style license that
+// can be found in the LICENSE file.
+
+#include "tests/ceftests/test_request.h"
+
+#include <algorithm>
+
+#include "include/cef_stream.h"
+#include "include/cef_urlrequest.h"
+#include "include/wrapper/cef_closure_task.h"
+#include "include/wrapper/cef_helpers.h"
+#include "include/wrapper/cef_stream_resource_handler.h"
+
+namespace test_request {
+
+namespace {
+
+// Implementation of CefURLRequestClient that stores response information.
+class RequestClient : public CefURLRequestClient, public State {
+ public:
+  RequestClient(const bool has_credentials,
+                const std::string& username,
+                const std::string& password,
+                const RequestDoneCallback& done_callback)
+      : has_credentials_(has_credentials),
+        username_(username),
+        password_(password),
+        done_callback_(done_callback) {
+    DCHECK(!done_callback_.is_null());
+  }
+
+  void OnUploadProgress(CefRefPtr<CefURLRequest> request,
+                        int64 current,
+                        int64 total) override {
+    upload_progress_ct_++;
+    upload_total_ = total;
+  }
+
+  void OnDownloadProgress(CefRefPtr<CefURLRequest> request,
+                          int64 current,
+                          int64 total) override {
+    response_ = request->GetResponse();
+    DCHECK(response_.get());
+    DCHECK(response_->IsReadOnly());
+    download_progress_ct_++;
+    download_total_ = total;
+  }
+
+  void OnDownloadData(CefRefPtr<CefURLRequest> request,
+                      const void* data,
+                      size_t data_length) override {
+    response_ = request->GetResponse();
+    DCHECK(response_.get());
+    DCHECK(response_->IsReadOnly());
+    download_data_ct_++;
+    download_data_ += std::string(static_cast<const char*>(data), data_length);
+  }
+
+  bool GetAuthCredentials(bool isProxy,
+                          const CefString& host,
+                          int port,
+                          const CefString& realm,
+                          const CefString& scheme,
+                          CefRefPtr<CefAuthCallback> callback) override {
+    auth_credentials_ct_++;
+    if (has_credentials_) {
+      callback->Continue(username_, password_);
+      return true;
+    }
+    return false;
+  }
+
+  void OnRequestComplete(CefRefPtr<CefURLRequest> request) override {
+    request_complete_ct_++;
+
+    request_ = request->GetRequest();
+    DCHECK(request_->IsReadOnly());
+    status_ = request->GetRequestStatus();
+    error_code_ = request->GetRequestError();
+    response_was_cached_ = request->ResponseWasCached();
+    response_ = request->GetResponse();
+    if (response_) {
+      DCHECK(response_->IsReadOnly());
+    }
+
+    done_callback_.Run(*this);
+  }
+
+ private:
+  const bool has_credentials_;
+  const std::string username_;
+  const std::string password_;
+  const RequestDoneCallback done_callback_;
+
+  IMPLEMENT_REFCOUNTING(RequestClient);
+  DISALLOW_COPY_AND_ASSIGN(RequestClient);
+};
+
+// Implementation that collects all cookies, and optionally deletes them.
+class CookieVisitor : public CefCookieVisitor {
+ public:
+  CookieVisitor(bool deleteCookies, const CookieDoneCallback& callback)
+      : delete_cookies_(deleteCookies), callback_(callback) {
+    DCHECK(!callback_.is_null());
+  }
+
+  ~CookieVisitor() override {
+    CEF_REQUIRE_UI_THREAD();
+    callback_.Run(cookies_);
+  }
+
+  bool Visit(const CefCookie& cookie,
+             int count,
+             int total,
+             bool& deleteCookie) override {
+    CEF_REQUIRE_UI_THREAD();
+    cookies_.push_back(cookie);
+    if (delete_cookies_)
+      deleteCookie = true;
+    return true;
+  }
+
+ private:
+  CookieVector cookies_;
+  bool delete_cookies_;
+  CookieDoneCallback callback_;
+
+  IMPLEMENT_REFCOUNTING(CookieVisitor);
+  DISALLOW_COPY_AND_ASSIGN(CookieVisitor);
+};
+
+}  // namespace
+
+void Send(const SendConfig& config, const RequestDoneCallback& callback) {
+  DCHECK(config.request_);
+  CefRefPtr<RequestClient> client = new RequestClient(
+      config.has_credentials_, config.username_, config.password_, callback);
+  if (config.frame_) {
+    config.frame_->CreateURLRequest(config.request_, client.get());
+  } else {
+    CefURLRequest::Create(config.request_, client.get(),
+                          config.request_context_);
+  }
+}
+
+std::string GetPathURL(const std::string& url) {
+  const size_t index1 = url.find('?');
+  const size_t index2 = url.find('#');
+  size_t index = std::string::npos;
+  if (index1 != std::string::npos && index2 != std::string::npos) {
+    index = std::min(index1, index2);
+  } else if (index1 != std::string::npos) {
+    index = index1;
+  } else if (index2 != std::string::npos) {
+    index = index2;
+  }
+  if (index != std::string::npos) {
+    return url.substr(0, index);
+  }
+  return url;
+}
+
+CefRefPtr<CefResourceHandler> CreateResourceHandler(
+    CefRefPtr<CefResponse> response,
+    const std::string& response_data) {
+  CefRefPtr<CefStreamReader> stream;
+  if (!response_data.empty()) {
+    stream = CefStreamReader::CreateForData(
+        static_cast<void*>(const_cast<char*>(response_data.c_str())),
+        response_data.length());
+  }
+
+  CefResponse::HeaderMap headerMap;
+  response->GetHeaderMap(headerMap);
+
+  return new CefStreamResourceHandler(
+      response->GetStatus(), response->GetStatusText(), response->GetMimeType(),
+      headerMap, stream);
+}
+
+void GetAllCookies(CefRefPtr<CefCookieManager> manager,
+                   bool deleteCookies,
+                   const CookieDoneCallback& callback) {
+  bool result =
+      manager->VisitAllCookies(new CookieVisitor(deleteCookies, callback));
+  DCHECK(result);
+}
+
+// Retrieves URL cookies from |manager| and executes |callback| upon completion.
+// If |deleteCookies| is true the cookies will also be deleted.
+void GetUrlCookies(CefRefPtr<CefCookieManager> manager,
+                   const CefString& url,
+                   bool includeHttpOnly,
+                   bool deleteCookies,
+                   const CookieDoneCallback& callback) {
+  bool result = manager->VisitUrlCookies(
+      url, includeHttpOnly, new CookieVisitor(deleteCookies, callback));
+  DCHECK(result);
+}
+
+}  // namespace test_request