Don't override Accept-Language header if set by the client (fixes issue #3139)

Calling DetachToUserFree() on a CefString holding a reference should copy the
value instead of transferring ownership.

A new `StringTest.Ownership` test has been added for this behavior.

BUILD.gn

@@ -489,6 +489,8 @@ static_library("libcef_static") {
     "libcef/browser/download_manager_delegate.h",
     "libcef/browser/extension_impl.cc",
     "libcef/browser/extension_impl.h",
+    "libcef/browser/extensions/api/file_system/cef_file_system_delegate.cc",
+    "libcef/browser/extensions/api/file_system/cef_file_system_delegate.h",
     "libcef/browser/extensions/api/storage/sync_value_store_cache.cc",
     "libcef/browser/extensions/api/storage/sync_value_store_cache.h",
     "libcef/browser/extensions/api/tabs/tabs_api.cc",

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,6 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/100.0.4896.0'
+  'chromium_checkout': 'refs/tags/100.0.4896.127',
+  'depot_tools_checkout': '32645dfee9'
 }

cef_create_projects.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/gclient_hook.py
+python3 tools/gclient_hook.py

include/base/cef_template_util.h

@@ -276,8 +276,13 @@ struct negation : bool_constant<!static_cast<bool>(B::value)> {};
 // References:
 // [1] https://en.cppreference.com/w/cpp/types/result_of
 // [2] https://wg21.link/meta.trans.other#lib:invoke_result
+#if ((defined(_MSVC_LANG) && _MSVC_LANG >= 201703L) || __cplusplus >= 201703L)
+template <typename Functor, typename... Args>
+using invoke_result = std::invoke_result<Functor, Args...>;
+#else
 template <typename Functor, typename... Args>
 using invoke_result = std::result_of<Functor && (Args && ...)>;
+#endif
 
 // Implementation of C++17's std::invoke_result_t.
 //

include/internal/cef_string_wrappers.h

@@ -584,10 +584,16 @@ class CefStringBase {
       return NULL;
 
     userfree_struct_type str = traits::userfree_alloc();
-    memcpy(str, string_, sizeof(struct_type));
+    if (owner_) {
+      // Transfer ownership of the data to |str|.
+      memcpy(str, string_, sizeof(struct_type));
+      // Free this class' structure but not the data.
+      memset(string_, 0, sizeof(struct_type));
+    } else {
+      // Copy the data to |str|.
+      traits::set(string_->str, string_->length, str, /*copy=*/true);
+    }
 
-    // Free this class' structure but not the data.
-    memset(string_, 0, sizeof(struct_type));
     ClearAndFree();
 
     return str;

libcef/browser/alloy/alloy_dialog_util.cc

@@ -5,6 +5,8 @@
 #include "libcef/browser/alloy/alloy_dialog_util.h"
 
 #include "libcef/browser/alloy/alloy_browser_host_impl.h"
+#include "libcef/browser/extensions/browser_extensions_util.h"
+#include "libcef/browser/file_dialog_runner.h"
 
 #include "base/strings/utf_string_conversions.h"
 
@@ -13,9 +15,12 @@ namespace alloy {
 void RunFileChooser(content::WebContents* web_contents,
                     const blink::mojom::FileChooserParams& params,
                     RunFileChooserCallback callback) {
-  CefRefPtr<AlloyBrowserHostImpl> browser =
-      AlloyBrowserHostImpl::GetBrowserForContents(web_contents);
+  CefRefPtr<AlloyBrowserHostImpl> browser = static_cast<AlloyBrowserHostImpl*>(
+      extensions::GetOwnerBrowserForHost(web_contents->GetRenderViewHost(),
+                                         nullptr)
+          .get());
   if (!browser) {
+    LOG(ERROR) << "Failed to identify browser; canceling file dialog";
     std::move(callback).Run(-1, {});
     return;
   }

libcef/browser/alloy/browser_platform_delegate_alloy.cc

@@ -261,14 +261,11 @@ void CefBrowserPlatformDelegateAlloy::SendCaptureLostEvent() {
 
 #if BUILDFLAG(IS_WIN) || (BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC))
 void CefBrowserPlatformDelegateAlloy::NotifyMoveOrResizeStarted() {
-  if (!browser_)
+  if (!web_contents_)
     return;
 
   // Dismiss any existing popups.
-  auto frame = browser_->GetMainFrame();
-  if (frame && frame->IsValid()) {
-    static_cast<CefFrameHostImpl*>(frame.get())->NotifyMoveOrResizeStarted();
-  }
+  web_contents_->ClearFocusedElement();
 }
 #endif
 

libcef/browser/extensions/api/file_system/cef_file_system_delegate.cc

@@ -0,0 +1,134 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "libcef/browser/extensions/api/file_system/cef_file_system_delegate.h"
+
+#include "libcef/browser/alloy/alloy_dialog_util.h"
+
+#include "apps/saved_files_service.h"
+#include "base/callback.h"
+#include "base/callback_forward.h"
+#include "base/files/file_path.h"
+#include "chrome/grit/generated_resources.h"
+#include "extensions/common/api/file_system.h"
+#include "extensions/common/extension.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
+
+using blink::mojom::FileChooserParams;
+
+namespace extensions {
+namespace cef {
+
+CefFileSystemDelegate::CefFileSystemDelegate() = default;
+
+CefFileSystemDelegate::~CefFileSystemDelegate() = default;
+
+base::FilePath CefFileSystemDelegate::GetDefaultDirectory() {
+  return base::FilePath();
+}
+
+base::FilePath CefFileSystemDelegate::GetManagedSaveAsDirectory(
+    content::BrowserContext* browser_context,
+    const Extension& extension) {
+  return base::FilePath();
+}
+
+bool CefFileSystemDelegate::ShowSelectFileDialog(
+    scoped_refptr<ExtensionFunction> extension_function,
+    ui::SelectFileDialog::Type type,
+    const base::FilePath& default_path,
+    const ui::SelectFileDialog::FileTypeInfo* file_types,
+    FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+    base::OnceClosure file_selection_canceled_callback) {
+  auto web_contents = extension_function->GetSenderWebContents();
+  if (!web_contents) {
+    return false;
+  }
+
+  absl::optional<FileChooserParams::Mode> mode;
+  switch (type) {
+    case ui::SelectFileDialog::Type::SELECT_UPLOAD_FOLDER:
+      mode = FileChooserParams::Mode::kUploadFolder;
+      break;
+    case ui::SelectFileDialog::Type::SELECT_SAVEAS_FILE:
+      mode = FileChooserParams::Mode::kSave;
+      break;
+    case ui::SelectFileDialog::Type::SELECT_OPEN_FILE:
+      mode = FileChooserParams::Mode::kOpen;
+      break;
+    case ui::SelectFileDialog::Type::SELECT_OPEN_MULTI_FILE:
+      mode = FileChooserParams::Mode::kOpenMultiple;
+      break;
+    default:
+      NOTIMPLEMENTED();
+      return false;
+  }
+
+  FileChooserParams params;
+  params.mode = *mode;
+  params.default_file_name = default_path;
+  if (file_types) {
+    // A list of allowed extensions. For example, it might be
+    //   { { "htm", "html" }, { "txt" } }
+    for (auto& vec : file_types->extensions) {
+      for (auto& ext : vec) {
+        params.accept_types.push_back(
+            alloy::FilePathTypeToString16(FILE_PATH_LITERAL(".") + ext));
+      }
+    }
+  }
+
+  alloy::RunFileChooser(
+      web_contents, params,
+      base::BindOnce(&CefFileSystemDelegate::FileDialogDismissed,
+                     weak_ptr_factory_.GetWeakPtr(),
+                     std::move(files_selected_callback),
+                     std::move(file_selection_canceled_callback)));
+
+  return true;
+}
+
+void CefFileSystemDelegate::FileDialogDismissed(
+    FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+    base::OnceClosure file_selection_canceled_callback,
+    int selected_accept_filter,
+    const std::vector<base::FilePath>& file_paths) {
+  if (!file_paths.empty()) {
+    std::move(files_selected_callback).Run(file_paths);
+  } else {
+    std::move(file_selection_canceled_callback).Run();
+  }
+}
+
+void CefFileSystemDelegate::ConfirmSensitiveDirectoryAccess(
+    bool has_write_permission,
+    const std::u16string& app_name,
+    content::WebContents* web_contents,
+    base::OnceClosure on_accept,
+    base::OnceClosure on_cancel) {
+  NOTIMPLEMENTED();
+
+  // Run the cancel callback by default.
+  std::move(on_cancel).Run();
+}
+
+// Based on ChromeFileSystemDelegate::GetDescriptionIdForAcceptType.
+int CefFileSystemDelegate::GetDescriptionIdForAcceptType(
+    const std::string& accept_type) {
+  if (accept_type == "image/*")
+    return IDS_IMAGE_FILES;
+  if (accept_type == "audio/*")
+    return IDS_AUDIO_FILES;
+  if (accept_type == "video/*")
+    return IDS_VIDEO_FILES;
+  return 0;
+}
+
+SavedFilesServiceInterface* CefFileSystemDelegate::GetSavedFilesService(
+    content::BrowserContext* browser_context) {
+  return apps::SavedFilesService::Get(browser_context);
+}
+
+}  // namespace cef
+}  // namespace extensions

libcef/browser/extensions/api/file_system/cef_file_system_delegate.h

@@ -0,0 +1,68 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_EXTENSIONS_API_FILE_SYSTEM_FILE_SYSTEM_DELEGATE_H_
+#define CEF_LIBCEF_BROWSER_EXTENSIONS_API_FILE_SYSTEM_FILE_SYSTEM_DELEGATE_H_
+
+#include <memory>
+
+#include "base/callback.h"
+#include "base/compiler_specific.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/weak_ptr.h"
+#include "extensions/browser/api/execute_code_function.h"
+#include "extensions/browser/api/file_system/file_system_delegate.h"
+#include "extensions/browser/extension_function.h"
+
+namespace content {
+class WebContents;
+}
+
+namespace extensions {
+namespace cef {
+
+class CefFileSystemDelegate : public FileSystemDelegate {
+ public:
+  CefFileSystemDelegate();
+
+  CefFileSystemDelegate(const CefFileSystemDelegate&) = delete;
+  CefFileSystemDelegate& operator=(const CefFileSystemDelegate&) = delete;
+
+  ~CefFileSystemDelegate() override;
+
+  // FileSystemDelegate
+  base::FilePath GetDefaultDirectory() override;
+  base::FilePath GetManagedSaveAsDirectory(
+      content::BrowserContext* browser_context,
+      const Extension& extension) override;
+  bool ShowSelectFileDialog(
+      scoped_refptr<ExtensionFunction> extension_function,
+      ui::SelectFileDialog::Type type,
+      const base::FilePath& default_path,
+      const ui::SelectFileDialog::FileTypeInfo* file_types,
+      FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+      base::OnceClosure file_selection_canceled_callback) override;
+  void ConfirmSensitiveDirectoryAccess(bool has_write_permission,
+                                       const std::u16string& app_name,
+                                       content::WebContents* web_contents,
+                                       base::OnceClosure on_accept,
+                                       base::OnceClosure on_cancel) override;
+  int GetDescriptionIdForAcceptType(const std::string& accept_type) override;
+  SavedFilesServiceInterface* GetSavedFilesService(
+      content::BrowserContext* browser_context) override;
+
+ private:
+  void FileDialogDismissed(
+      FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+      base::OnceClosure file_selection_canceled_callback,
+      int selected_accept_filter,
+      const std::vector<base::FilePath>& file_paths);
+
+  base::WeakPtrFactory<CefFileSystemDelegate> weak_ptr_factory_{this};
+};
+
+}  // namespace cef
+}  // namespace extensions
+
+#endif  // CEF_LIBCEF_BROWSER_EXTENSIONS_API_FILE_SYSTEM_FILE_SYSTEM_DELEGATE_H_

libcef/browser/extensions/extensions_api_client.cc

@@ -7,6 +7,7 @@
 
 #include "include/internal/cef_types_wrappers.h"
 #include "libcef/browser/browser_context.h"
+#include "libcef/browser/extensions/api/file_system/cef_file_system_delegate.h"
 #include "libcef/browser/extensions/api/storage/sync_value_store_cache.h"
 #include "libcef/browser/extensions/extension_web_contents_observer.h"
 #include "libcef/browser/extensions/mime_handler_view_guest_delegate.h"
@@ -74,4 +75,10 @@ void CefExtensionsAPIClient::AddAdditionalValueStoreCaches(
   (*caches)[settings_namespace::SYNC] = new cef::SyncValueStoreCache(factory);
 }
 
+FileSystemDelegate* CefExtensionsAPIClient::GetFileSystemDelegate() {
+  if (!file_system_delegate_)
+    file_system_delegate_ = std::make_unique<cef::CefFileSystemDelegate>();
+  return file_system_delegate_.get();
+}
+
 }  // namespace extensions

libcef/browser/extensions/extensions_api_client.h

@@ -25,6 +25,7 @@ class CefExtensionsAPIClient : public ExtensionsAPIClient {
       MimeHandlerViewGuest* guest) const override;
   void AttachWebContentsHelpers(
       content::WebContents* web_contents) const override;
+  FileSystemDelegate* GetFileSystemDelegate() override;
 
   // Storage API support.
 
@@ -37,6 +38,9 @@ class CefExtensionsAPIClient : public ExtensionsAPIClient {
           observers,
       std::map<settings_namespace::Namespace, ValueStoreCache*>* caches)
       override;
+
+ private:
+  std::unique_ptr<FileSystemDelegate> file_system_delegate_;
 };
 
 }  // namespace extensions

libcef/browser/frame_host_impl.cc

@@ -283,13 +283,6 @@ void CefFrameHostImpl::RefreshAttributes() {
   }
 }
 
-void CefFrameHostImpl::NotifyMoveOrResizeStarted() {
-  SendToRenderFrame(__FUNCTION__,
-                    base::BindOnce([](const RenderFrameType& render_frame) {
-                      render_frame->MoveOrResizeStarted();
-                    }));
-}
-
 void CefFrameHostImpl::LoadRequest(cef::mojom::RequestParamsPtr params) {
   if (!url_util::FixupGURL(params->url))
     return;

libcef/browser/frame_host_impl.h

@@ -82,10 +82,6 @@ class CefFrameHostImpl : public CefFrame, public cef::mojom::BrowserFrame {
   void SetFocused(bool focused);
   void RefreshAttributes();
 
-  // Notification that a move or resize of the renderer's containing window has
-  // started. Used on Windows and Linux with the Alloy runtime.
-  void NotifyMoveOrResizeStarted();
-
   // Load the specified request.
   void LoadRequest(cef::mojom::RequestParamsPtr params);
 

libcef/browser/main_runner.cc

@@ -482,6 +482,16 @@ void CefMainRunner::FinishShutdownOnUIThread(
     base::WaitableEvent* uithread_shutdown_event) {
   CEF_REQUIRE_UIT();
 
+  // Execute all pending tasks now before proceeding with shutdown. Otherwise,
+  // objects bound to tasks and released at the end of shutdown via
+  // BrowserTaskExecutor::Shutdown may attempt to access other objects that have
+  // already been destroyed (for example, if teardown results in a call to
+  // RenderProcessHostImpl::Cleanup).
+  content::BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(
+      content::BrowserThread::UI);
+  content::BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(
+      content::BrowserThread::IO);
+
   static_cast<content::ContentMainRunnerImpl*>(main_runner_.get())
       ->ShutdownOnUIThread();
 

libcef/browser/native/cursor_util_win.cc

@@ -131,7 +131,8 @@ LPCWSTR ToCursorID(ui::mojom::CursorType type) {
 }
 
 bool IsSystemCursorID(LPCWSTR cursor_id) {
-  return cursor_id >= IDC_ARROW;  // See WinUser.h
+  // Check the range of values from WinUser.h.
+  return cursor_id >= IDC_ARROW && cursor_id <= IDC_HELP;
 }
 
 }  // namespace

libcef/browser/net/internal_scheme_handler.cc

@@ -42,6 +42,8 @@ std::string GetMimeType(const std::string& filename) {
   // Check for newer extensions used by internal resources but not yet
   // recognized by the mime type detector.
   const std::string& extension = CefString(file_path.FinalExtension());
+  if (extension == ".md")
+    return "text/markdown";
   if (extension == ".woff2")
     return "application/font-woff2";
 

libcef/browser/net_service/resource_request_handler_wrapper.cc

@@ -112,6 +112,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     CefRefPtr<CefResponseImpl> pending_response_;
     bool request_was_redirected_ = false;
     bool was_custom_handled_ = false;
+    bool accept_language_added_ = false;
     CancelRequestCallback cancel_callback_;
   };
 
@@ -514,9 +515,12 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     }
 
     // Add standard headers, if currently unspecified.
-    request->headers.SetHeaderIfMissing(
-        net::HttpRequestHeaders::kAcceptLanguage,
-        init_state_->accept_language_);
+    if (!request->headers.HasHeader(net::HttpRequestHeaders::kAcceptLanguage)) {
+      request->headers.SetHeaderIfMissing(
+          net::HttpRequestHeaders::kAcceptLanguage,
+          init_state_->accept_language_);
+      state->accept_language_added_ = true;
+    }
     request->headers.SetHeaderIfMissing(net::HttpRequestHeaders::kUserAgent,
                                         init_state_->user_agent_);
 
@@ -771,7 +775,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       resource_response = CreateResourceResponse(request_id, resource_handler);
       DCHECK(resource_response);
       state->was_custom_handled_ = true;
-    } else {
+    } else if (state->accept_language_added_) {
       // The request will be handled by the NetworkService. Remove the
       // "Accept-Language" header here so that it can be re-added in
       // URLRequestHttpJob::AddExtraHeaders with correct ordering applied.

libcef/browser/views/browser_view_view.h

@@ -16,7 +16,13 @@
 // CefViewView template.
 class WebViewEx : public views::WebView {
  public:
-  WebViewEx() : views::WebView(nullptr) {}
+  WebViewEx() : views::WebView(nullptr) {
+    // Mouse events on draggable regions will not be handled by the WebView.
+    // Avoid the resulting DCHECK in NativeViewHost::OnMousePressed by
+    // configuring the NativeViewHost not to process events via the view
+    // hierarchy.
+    holder()->SetCanProcessEventsWithinSubtree(false);
+  }
 };
 
 class CefBrowserViewView

libcef/browser/views/view_util.cc

@@ -217,12 +217,12 @@ display::Display GetDisplayMatchingBounds(const gfx::Rect& bounds,
   return display::Screen::GetScreen()->GetDisplayMatching(find_bounds);
 }
 
-void ConvertPointFromPixels(gfx::Point* point, int device_scale_factor) {
+void ConvertPointFromPixels(gfx::Point* point, float device_scale_factor) {
   *point = gfx::ToFlooredPoint(
       gfx::ScalePoint(gfx::PointF(*point), 1.0f / device_scale_factor));
 }
 
-void ConvertPointToPixels(gfx::Point* point, int device_scale_factor) {
+void ConvertPointToPixels(gfx::Point* point, float device_scale_factor) {
   *point = gfx::ToFlooredPoint(
       gfx::ScalePoint(gfx::PointF(*point), device_scale_factor));
 }

libcef/browser/views/view_util.h

@@ -84,11 +84,11 @@ display::Display GetDisplayMatchingBounds(const gfx::Rect& bounds,
 
 // Convert |point| from pixel coordinates to density independent pixels (DIP)
 // using |device_scale_factor|.
-void ConvertPointFromPixels(gfx::Point* point, int device_scale_factor);
+void ConvertPointFromPixels(gfx::Point* point, float device_scale_factor);
 
 // Convert |point| to pixel coordinates from density independent pixels (DIP)
 // using |device_scale_factor|.
-void ConvertPointToPixels(gfx::Point* point, int device_scale_factor);
+void ConvertPointToPixels(gfx::Point* point, float device_scale_factor);
 
 // Convert |point| from |view| to screen coordinates. If |output_pixel_coords|
 // is true then |point| will be output in pixel coordinates instead of density

libcef/common/chrome/chrome_main_runner_delegate.cc

@@ -5,11 +5,13 @@
 
 #include "libcef/common/chrome/chrome_main_runner_delegate.h"
 
+#include "libcef/common/app_manager.h"
 #include "libcef/common/chrome/chrome_main_delegate_cef.h"
 
 #include "base/command_line.h"
 #include "base/run_loop.h"
 #include "chrome/browser/browser_process_impl.h"
+#include "chrome/browser/chrome_content_browser_client.h"
 #include "chrome/common/profiler/main_thread_stack_sampling_profiler.h"
 #include "components/keep_alive_registry/keep_alive_types.h"
 #include "components/keep_alive_registry/scoped_keep_alive.h"
@@ -68,6 +70,12 @@ bool ChromeMainRunnerDelegate::HandleMainMessageLoopQuit() {
   return true;
 }
 
+void ChromeMainRunnerDelegate::AfterUIThreadShutdown() {
+  static_cast<ChromeContentBrowserClient*>(
+      CefAppManager::Get()->GetContentClient()->browser())
+      ->CleanupOnUIThread();
+}
+
 void ChromeMainRunnerDelegate::AfterMainThreadShutdown() {
   sampling_profiler_.reset();
 }

libcef/common/chrome/chrome_main_runner_delegate.h

@@ -35,6 +35,7 @@ class ChromeMainRunnerDelegate : public CefMainRunnerDelegate {
   void BeforeMainThreadInitialize(const CefMainArgs& args) override;
   void BeforeMainMessageLoopRun(base::RunLoop* run_loop) override;
   bool HandleMainMessageLoopQuit() override;
+  void AfterUIThreadShutdown() override;
   void AfterMainThreadShutdown() override;
   void BeforeExecuteProcess(const CefMainArgs& args) override;
   void AfterExecuteProcess() override;

libcef/common/mojom/cef.mojom

@@ -73,10 +73,6 @@ interface RenderFrame {
 
   // Loading has stopped.
   DidStopLoading();
-
-  // Move or resize of the renderer's containing window has started. Used on
-  // Windows and Linux with the Alloy runtime.
-  MoveOrResizeStarted();
 };
 
 // Interface for communicating with a frame in the browser process.

libcef/renderer/frame_impl.cc

@@ -676,14 +676,6 @@ void CefFrameImpl::DidStopLoading() {
   OnDraggableRegionsChanged();
 }
 
-void CefFrameImpl::MoveOrResizeStarted() {
-  if (frame_) {
-    auto web_view = frame_->View();
-    if (web_view)
-      web_view->CancelPagePopup();
-  }
-}
-
 // Enable deprecation warnings on Windows. See http://crbug.com/585142.
 #if BUILDFLAG(IS_WIN)
 #if defined(__clang__)

libcef/renderer/frame_impl.h

@@ -137,7 +137,6 @@ class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
                       int32_t startLine) override;
   void LoadRequest(cef::mojom::RequestParamsPtr params) override;
   void DidStopLoading() override;
-  void MoveOrResizeStarted() override;
 
   CefBrowserImpl* browser_;
   blink::WebLocalFrame* frame_;

libcef/renderer/v8_impl.cc

@@ -1607,7 +1607,7 @@ v8::Local<v8::Value> CefV8ValueImpl::GetV8Value(bool should_persist) {
     case TYPE_INT:
       return v8::Int32::New(isolate_, int_value_);
     case TYPE_UINT:
-      return v8::Uint32::New(isolate_, uint_value_);
+      return v8::Uint32::NewFromUnsigned(isolate_, uint_value_);
     case TYPE_DOUBLE:
       return v8::Number::New(isolate_, double_value_);
     case TYPE_DATE:

patch/patches/base_sandbox_2743.patch

@@ -1,5 +1,5 @@
 diff --git base/BUILD.gn base/BUILD.gn
-index 8243e7ad76529..a013002ac9d1e 100644
+index 855ad1489f456..8c8c6559973a2 100644
 --- base/BUILD.gn
 +++ base/BUILD.gn
 @@ -37,6 +37,7 @@ import("//build/nocompile.gni")
@@ -23,7 +23,7 @@ index 8243e7ad76529..a013002ac9d1e 100644
      sources += [
        "hash/md5_nacl.cc",
        "hash/md5_nacl.h",
-@@ -2136,6 +2141,12 @@ mixed_component("base") {
+@@ -2137,6 +2142,12 @@ mixed_component("base") {
        defines += [ "COM_INIT_CHECK_HOOK_DISABLED" ]
      }
  

patch/patches/browser_security_policy_1081397.patch

@@ -20,10 +20,10 @@ index ec3262207e626..910e0b6a9ff89 100644
  
            // TODO(wjmaclean): We should update the ProcessLock comparison API
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index 5a7fa871f7b26..71fa1b1bcd8fd 100644
+index 933385d532923..569ff1739cf5d 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
-@@ -5940,6 +5940,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithoutFinalFrameHost(
+@@ -5942,6 +5942,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithoutFinalFrameHost(
      network::mojom::WebSandboxFlags sandbox_flags) {
    // Calculate an approximation of the origin. The sandbox/csp are ignored.
    url::Origin origin = GetOriginForURLLoaderFactoryUnchecked(this);
@@ -36,7 +36,7 @@ index 5a7fa871f7b26..71fa1b1bcd8fd 100644
  
    // Apply sandbox flags.
    // See https://html.spec.whatwg.org/#sandboxed-origin-browsing-context-flag
-@@ -5973,6 +5979,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithFinalFrameHost() {
+@@ -5975,6 +5981,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithFinalFrameHost() {
    if (IsSameDocument() || IsPageActivation())
      return GetRenderFrameHost()->GetLastCommittedOrigin();
  

patch/patches/chrome_browser.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index 560930c0979ca..e99dcad7a2e5d 100644
+index 9917fcf771ecb..5818da367fdcb 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
 @@ -12,6 +12,7 @@ import("//build/config/features.gni")

patch/patches/chrome_browser_context_menus.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/renderer_context_menu/render_view_context_menu.cc chrome/browser/renderer_context_menu/render_view_context_menu.cc
-index 1301f3baf5b7f..bebc86d812313 100644
+index 3063256f8922f..3e16e4d46afe2 100644
 --- chrome/browser/renderer_context_menu/render_view_context_menu.cc
 +++ chrome/browser/renderer_context_menu/render_view_context_menu.cc
 @@ -292,6 +292,13 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {

patch/patches/chrome_browser_net_export.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index d0335e2fb75e2..8ffd1efa13703 100644
+index 29b4dabf6c3d5..32ea10d5046a5 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -10,6 +10,7 @@ import("//build/config/features.gni")
@@ -29,7 +29,7 @@ index d0335e2fb75e2..8ffd1efa13703 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -5293,6 +5299,7 @@ static_library("ui") {
+@@ -5300,6 +5306,7 @@ static_library("ui") {
    if (enable_basic_printing) {
      deps += [
        "//components/printing/browser",

patch/patches/chrome_browser_profiles.patch

@@ -85,10 +85,10 @@ index ca2561e412621..febd52df6c971 100644
    virtual bool IsSignedIn() = 0;
  
 diff --git chrome/browser/profiles/profile_impl.cc chrome/browser/profiles/profile_impl.cc
-index bd0c693804407..c4a62b0dae176 100644
+index 7a216c9ffb4d7..0de2540755722 100644
 --- chrome/browser/profiles/profile_impl.cc
 +++ chrome/browser/profiles/profile_impl.cc
-@@ -1002,7 +1002,9 @@ Profile* ProfileImpl::GetOffTheRecordProfile(const OTRProfileID& otr_profile_id,
+@@ -996,7 +996,9 @@ Profile* ProfileImpl::GetOffTheRecordProfile(const OTRProfileID& otr_profile_id,
  
    otr_profiles_[otr_profile_id] = std::move(otr_profile);
  

patch/patches/chrome_runtime.patch

@@ -132,7 +132,7 @@ index 3d59014db49e9..f96b79c02fd92 100644
          GetMainRunLoopInstance()->QuitWhenIdleClosure());
    }
 diff --git chrome/browser/chrome_browser_main_mac.mm chrome/browser/chrome_browser_main_mac.mm
-index 831d7173873d1..594aee58331a7 100644
+index 8bf722c61c059..ac755279227f2 100644
 --- chrome/browser/chrome_browser_main_mac.mm
 +++ chrome/browser/chrome_browser_main_mac.mm
 @@ -16,6 +16,7 @@
@@ -143,7 +143,7 @@ index 831d7173873d1..594aee58331a7 100644
  #import "chrome/browser/app_controller_mac.h"
  #include "chrome/browser/apps/app_shim/app_shim_listener.h"
  #include "chrome/browser/browser_process.h"
-@@ -111,6 +112,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+@@ -112,6 +113,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
      }
    }
  
@@ -151,15 +151,15 @@ index 831d7173873d1..594aee58331a7 100644
    // Create the app delegate. This object is intentionally leaked as a global
    // singleton. It is accessed through -[NSApp delegate].
    AppController* app_controller = [[AppController alloc] init];
-@@ -119,6 +121,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+@@ -120,6 +122,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
    chrome::BuildMainMenu(NSApp, app_controller,
                          l10n_util::GetStringUTF16(IDS_PRODUCT_NAME), false);
    [app_controller mainMenuCreated];
 +#endif  // BUILDFLAG(ENABLE_CEF)
  
    chrome::DeveloperIDCertificateReauthorizeInApp();
- 
-@@ -180,7 +183,9 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
+   chrome::PurgeStaleScreenCapturePermission();
+@@ -182,7 +185,9 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
  }
  
  void ChromeBrowserMainPartsMac::DidEndMainMessageLoop() {
@@ -170,7 +170,7 @@ index 831d7173873d1..594aee58331a7 100644
 +#endif
  }
 diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
-index d590b2d42f416..e1039ef8b78b4 100644
+index 2d3d64f06e330..984fbe18c71bc 100644
 --- chrome/browser/chrome_content_browser_client.cc
 +++ chrome/browser/chrome_content_browser_client.cc
 @@ -28,6 +28,7 @@
@@ -181,7 +181,28 @@ index d590b2d42f416..e1039ef8b78b4 100644
  #include "chrome/browser/accessibility/accessibility_labels_service.h"
  #include "chrome/browser/accessibility/accessibility_labels_service_factory.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -3705,9 +3706,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
+@@ -1253,6 +1254,8 @@ bool IsTopChromeWebUIURL(const GURL& url) {
+ }  // namespace
+ 
+ ChromeContentBrowserClient::ChromeContentBrowserClient() {
++  keepalive_timer_.reset(new base::OneShotTimer());
++
+ #if BUILDFLAG(ENABLE_PLUGINS)
+   extra_parts_.push_back(new ChromeContentBrowserClientPluginsPart);
+ #endif
+@@ -1278,6 +1281,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
+   extra_parts_.clear();
+ }
+ 
++void ChromeContentBrowserClient::CleanupOnUIThread() {
++  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
++  keepalive_timer_.reset();
++}
++
+ // static
+ void ChromeContentBrowserClient::RegisterLocalStatePrefs(
+     PrefRegistrySimple* registry) {
+@@ -3718,9 +3726,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
                            &search::HandleNewTabURLReverseRewrite);
  #endif  // BUILDFLAG(IS_ANDROID)
  
@@ -193,7 +214,7 @@ index d590b2d42f416..e1039ef8b78b4 100644
  }
  
  base::FilePath ChromeContentBrowserClient::GetDefaultDownloadDirectory() {
-@@ -5340,7 +5343,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
+@@ -5353,7 +5363,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
        network_service);
  }
  
@@ -202,7 +223,7 @@ index d590b2d42f416..e1039ef8b78b4 100644
      content::BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -5358,6 +5361,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
+@@ -5371,6 +5381,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
      network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
      network_context_params->accept_language = GetApplicationLocale();
    }
@@ -211,11 +232,52 @@ index d590b2d42f416..e1039ef8b78b4 100644
  }
  
  std::vector<base::FilePath>
+@@ -6215,10 +6227,10 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
+   const auto now = base::TimeTicks::Now();
+   const auto timeout = GetKeepaliveTimerTimeout(context);
+   keepalive_deadline_ = std::max(keepalive_deadline_, now + timeout);
+-  if (keepalive_deadline_ > now && !keepalive_timer_.IsRunning()) {
++  if (keepalive_deadline_ > now && !keepalive_timer_->IsRunning()) {
+     DVLOG(1) << "Starting a keepalive timer(" << timeout.InSecondsF()
+              << " seconds)";
+-    keepalive_timer_.Start(
++    keepalive_timer_->Start(
+         FROM_HERE, keepalive_deadline_ - now,
+         base::BindOnce(
+             &ChromeContentBrowserClient::OnKeepaliveTimerFired,
+@@ -6237,7 +6249,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
+   --num_keepalive_requests_;
+   if (num_keepalive_requests_ == 0) {
+     DVLOG(1) << "Stopping the keepalive timer";
+-    keepalive_timer_.Stop();
++    if (keepalive_timer_)
++      keepalive_timer_->Stop();
+     // This deletes the keep alive handle attached to the timer function and
+     // unblock the shutdown sequence.
+   }
+@@ -6346,7 +6359,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
+   const auto now = base::TimeTicks::Now();
+   const auto then = keepalive_deadline_;
+   if (now < then) {
+-    keepalive_timer_.Start(
++    keepalive_timer_->Start(
+         FROM_HERE, then - now,
+         base::BindOnce(&ChromeContentBrowserClient::OnKeepaliveTimerFired,
+                        weak_factory_.GetWeakPtr(),
 diff --git chrome/browser/chrome_content_browser_client.h chrome/browser/chrome_content_browser_client.h
-index f2a7fdf291652..f106b11e61ab0 100644
+index 79b637d77174d..5d88506456d94 100644
 --- chrome/browser/chrome_content_browser_client.h
 +++ chrome/browser/chrome_content_browser_client.h
-@@ -557,7 +557,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+@@ -120,6 +120,8 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+ 
+   ~ChromeContentBrowserClient() override;
+ 
++  virtual void CleanupOnUIThread();
++
+   // TODO(https://crbug.com/787567): This file is about calls from content/ out
+   // to chrome/ to get values or notify about events, but both of these
+   // functions are from chrome/ to chrome/ and don't involve content/ at all.
+@@ -561,7 +563,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
        override;
    void OnNetworkServiceCreated(
        network::mojom::NetworkService* network_service) override;
@@ -224,6 +286,15 @@ index f2a7fdf291652..f106b11e61ab0 100644
        content::BrowserContext* context,
        bool in_memory,
        const base::FilePath& relative_partition_path,
+@@ -913,7 +915,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+ 
+ #if !BUILDFLAG(IS_ANDROID)
+   uint64_t num_keepalive_requests_ = 0;
+-  base::OneShotTimer keepalive_timer_;
++  std::unique_ptr<base::OneShotTimer> keepalive_timer_;
+   base::TimeTicks keepalive_deadline_;
+ #endif
+ 
 diff --git chrome/browser/prefs/browser_prefs.cc chrome/browser/prefs/browser_prefs.cc
 index 94cf3615137ad..369983be86323 100644
 --- chrome/browser/prefs/browser_prefs.cc

patch/patches/chrome_runtime_views.patch

@@ -139,7 +139,7 @@ index 67496d7ab6c50..fa97b9abe6253 100644
    BrowserFrame(const BrowserFrame&) = delete;
    BrowserFrame& operator=(const BrowserFrame&) = delete;
 diff --git chrome/browser/ui/views/frame/browser_view.cc chrome/browser/ui/views/frame/browser_view.cc
-index 0f9a2e8b91715..355bdf6fa9074 100644
+index adac45808dadb..4309f4acfc219 100644
 --- chrome/browser/ui/views/frame/browser_view.cc
 +++ chrome/browser/ui/views/frame/browser_view.cc
 @@ -297,11 +297,10 @@ using content::WebContents;
@@ -207,7 +207,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
  
    contents_separator_ =
        top_container_->AddChildView(std::make_unique<ContentsSeparator>());
-@@ -1646,6 +1662,8 @@ bool BrowserView::ShouldHideUIForFullscreen() const {
+@@ -1643,6 +1659,8 @@ bool BrowserView::ShouldHideUIForFullscreen() const {
    if (immersive_mode_controller_->IsEnabled())
      return false;
  
@@ -216,7 +216,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
    return frame_->GetFrameView()->ShouldHideTopUIForFullscreen();
  }
  
-@@ -2824,7 +2842,8 @@ BrowserView::GetNativeViewHostsForTopControlsSlide() const {
+@@ -2807,7 +2825,8 @@ BrowserView::GetNativeViewHostsForTopControlsSlide() const {
  }
  
  void BrowserView::ReparentTopContainerForEndOfImmersive() {
@@ -226,7 +226,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
    top_container()->DestroyLayer();
    AddChildViewAt(top_container(), 0);
    EnsureFocusOrder();
-@@ -3313,8 +3332,10 @@ void BrowserView::Layout() {
+@@ -3296,8 +3315,10 @@ void BrowserView::Layout() {
  
    // TODO(jamescook): Why was this in the middle of layout code?
    toolbar_->location_bar()->omnibox_view()->SetFocusBehavior(
@@ -239,7 +239,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
  
    // Some of the situations when the BrowserView is laid out are:
    // - Enter/exit immersive fullscreen mode.
-@@ -3380,6 +3401,11 @@ void BrowserView::AddedToWidget() {
+@@ -3363,6 +3384,11 @@ void BrowserView::AddedToWidget() {
    SetThemeProfileForWindow(GetNativeWindow(), browser_->profile());
  #endif
  
@@ -251,7 +251,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
    toolbar_->Init();
  
    // TODO(pbos): Manage this either inside SidePanel or the corresponding button
-@@ -3432,13 +3458,9 @@ void BrowserView::AddedToWidget() {
+@@ -3415,13 +3441,9 @@ void BrowserView::AddedToWidget() {
  
    EnsureFocusOrder();
  
@@ -267,7 +267,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
    using_native_frame_ = frame_->ShouldUseNativeFrame();
  
    MaybeInitializeWebUITabStrip();
-@@ -3859,7 +3881,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
+@@ -3842,7 +3864,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
    // Undo our anti-jankiness hacks and force a re-layout.
    in_process_fullscreen_ = false;
    ToolbarSizeChanged(false);
@@ -277,7 +277,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
  }
  
  bool BrowserView::ShouldUseImmersiveFullscreenForUrl(const GURL& url) const {
-@@ -4186,6 +4209,8 @@ Profile* BrowserView::GetProfile() {
+@@ -4169,6 +4192,8 @@ Profile* BrowserView::GetProfile() {
  }
  
  void BrowserView::UpdateUIForTabFullscreen() {
@@ -286,7 +286,7 @@ index 0f9a2e8b91715..355bdf6fa9074 100644
    frame()->GetFrameView()->UpdateFullscreenTopUI();
  }
  
-@@ -4208,6 +4233,8 @@ void BrowserView::HideDownloadShelf() {
+@@ -4191,6 +4216,8 @@ void BrowserView::HideDownloadShelf() {
  }
  
  bool BrowserView::CanUserExitFullscreen() const {
@@ -356,6 +356,22 @@ index 5f8af5f46bf46..54aba6eb904d6 100644
    int browser_view_width = vertical_layout_rect_.width();
    bool toolbar_visible = delegate_->IsToolbarVisible();
    int height = toolbar_visible ? toolbar_->GetPreferredSize().height() : 0;
+diff --git chrome/browser/ui/views/frame/contents_web_view.cc chrome/browser/ui/views/frame/contents_web_view.cc
+index 28637ccd206b1..66cb6c09ff4e8 100644
+--- chrome/browser/ui/views/frame/contents_web_view.cc
++++ chrome/browser/ui/views/frame/contents_web_view.cc
+@@ -24,6 +24,11 @@
+ ContentsWebView::ContentsWebView(content::BrowserContext* browser_context)
+     : views::WebView(browser_context),
+       status_bubble_(nullptr) {
++  // Mouse events on draggable regions will not be handled by the WebView.
++  // Avoid the resulting DCHECK in NativeViewHost::OnMousePressed by
++  // configuring the NativeViewHost not to process events via the view
++  // hierarchy.
++  holder()->SetCanProcessEventsWithinSubtree(false);
+ }
+ 
+ ContentsWebView::~ContentsWebView() {
 diff --git chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
 index 9a42c3bd2207b..4de0fb1b33bce 100644
 --- chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
@@ -415,10 +431,10 @@ index 9a42c3bd2207b..4de0fb1b33bce 100644
  }
  
 diff --git chrome/browser/ui/views/toolbar/toolbar_view.cc chrome/browser/ui/views/toolbar/toolbar_view.cc
-index 5ea77d3196bc0..1be02aea8cec6 100644
+index 04d47a837067e..9b2c2127007e3 100644
 --- chrome/browser/ui/views/toolbar/toolbar_view.cc
 +++ chrome/browser/ui/views/toolbar/toolbar_view.cc
-@@ -169,12 +169,13 @@ auto& GetViewCommandMap() {
+@@ -170,12 +170,13 @@ auto& GetViewCommandMap() {
  ////////////////////////////////////////////////////////////////////////////////
  // ToolbarView, public:
  
@@ -434,7 +450,7 @@ index 5ea77d3196bc0..1be02aea8cec6 100644
    SetID(VIEW_ID_TOOLBAR);
  
    UpgradeDetector::GetInstance()->AddObserver(this);
-@@ -209,7 +210,7 @@ void ToolbarView::Init() {
+@@ -210,7 +211,7 @@ void ToolbarView::Init() {
  #endif
    auto location_bar = std::make_unique<LocationBarView>(
        browser_, browser_->profile(), browser_->command_controller(), this,

patch/patches/content_2015.patch

@@ -31,7 +31,7 @@ index b5c2dc992fb19..868661c86c39a 100644
          factory = base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
              std::move(loader_factory));
 diff --git content/public/browser/content_browser_client.cc content/public/browser/content_browser_client.cc
-index 0e2c7f92937f1..31bb164e25bf6 100644
+index a0a9f51b7e62b..3d96e30111cff 100644
 --- content/public/browser/content_browser_client.cc
 +++ content/public/browser/content_browser_client.cc
 @@ -11,7 +11,7 @@
@@ -43,7 +43,7 @@ index 0e2c7f92937f1..31bb164e25bf6 100644
  
  #include <utility>
  
-@@ -883,7 +883,7 @@ ContentBrowserClient::CreateURLLoaderHandlerForServiceWorkerNavigationPreload(
+@@ -889,7 +889,7 @@ ContentBrowserClient::CreateURLLoaderHandlerForServiceWorkerNavigationPreload(
  void ContentBrowserClient::OnNetworkServiceCreated(
      network::mojom::NetworkService* network_service) {}
  
@@ -52,7 +52,7 @@ index 0e2c7f92937f1..31bb164e25bf6 100644
      BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -892,6 +892,7 @@ void ContentBrowserClient::ConfigureNetworkContextParams(
+@@ -898,6 +898,7 @@ void ContentBrowserClient::ConfigureNetworkContextParams(
          cert_verifier_creation_params) {
    network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
    network_context_params->accept_language = "en-us,en";
@@ -61,7 +61,7 @@ index 0e2c7f92937f1..31bb164e25bf6 100644
  
  std::vector<base::FilePath>
 diff --git content/public/browser/content_browser_client.h content/public/browser/content_browser_client.h
-index aa125be3640fe..bf5dec73a5287 100644
+index 3bbb6a39eeb71..bb703dbdc53e7 100644
 --- content/public/browser/content_browser_client.h
 +++ content/public/browser/content_browser_client.h
 @@ -34,6 +34,7 @@
@@ -72,7 +72,7 @@ index aa125be3640fe..bf5dec73a5287 100644
  #include "content/public/browser/web_ui_browser_interface_broker_registry.h"
  #include "content/public/common/alternative_error_page_override_info.mojom.h"
  #include "content/public/common/main_function_params.h"
-@@ -1658,7 +1659,7 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1667,7 +1668,7 @@ class CONTENT_EXPORT ContentBrowserClient {
    //
    // If |relative_partition_path| is the empty string, it means this needs to
    // create the default NetworkContext for the BrowserContext.
@@ -81,7 +81,7 @@ index aa125be3640fe..bf5dec73a5287 100644
        BrowserContext* context,
        bool in_memory,
        const base::FilePath& relative_partition_path,
-@@ -1859,6 +1860,17 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1868,6 +1869,17 @@ class CONTENT_EXPORT ContentBrowserClient {
        RenderFrameHost* initiator_document,
        mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory);
  
@@ -99,7 +99,7 @@ index aa125be3640fe..bf5dec73a5287 100644
    // Creates an OverlayWindow to be used for video or document
    // Picture-in-Picture respectively. This window will house the content shown
    // when in Picture-in-Picture mode. This will return a new OverlayWindow.
-@@ -1920,6 +1932,10 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1929,6 +1941,10 @@ class CONTENT_EXPORT ContentBrowserClient {
    // Used as part of the user agent string.
    virtual std::string GetProduct();
  
@@ -136,7 +136,7 @@ index 63ead7f8ab838..11f606368d9e8 100644
    // started.
    virtual void SetRuntimeFeaturesDefaultsBeforeBlinkInitialization() {}
 diff --git content/renderer/render_thread_impl.cc content/renderer/render_thread_impl.cc
-index 0b42cba866722..d2f0841bd9069 100644
+index 03b92fd7a6218..dee8a66196507 100644
 --- content/renderer/render_thread_impl.cc
 +++ content/renderer/render_thread_impl.cc
 @@ -656,6 +656,8 @@ void RenderThreadImpl::Init() {
@@ -149,10 +149,10 @@ index 0b42cba866722..d2f0841bd9069 100644
        &RenderThreadImpl::OnRendererInterfaceReceiver, base::Unretained(this)));
  
 diff --git content/renderer/renderer_blink_platform_impl.cc content/renderer/renderer_blink_platform_impl.cc
-index a64d78c9d8112..0551db7f7d4cc 100644
+index bd420d1cf8b5c..3f6e0527d21bf 100644
 --- content/renderer/renderer_blink_platform_impl.cc
 +++ content/renderer/renderer_blink_platform_impl.cc
-@@ -1090,6 +1090,15 @@ SkBitmap* RendererBlinkPlatformImpl::GetSadPageBitmap() {
+@@ -1112,6 +1112,15 @@ SkBitmap* RendererBlinkPlatformImpl::GetSadPageBitmap() {
  
  //------------------------------------------------------------------------------
  
@@ -169,10 +169,10 @@ index a64d78c9d8112..0551db7f7d4cc 100644
  RendererBlinkPlatformImpl::GetCodeCacheHost() {
    base::AutoLock lock(code_cache_host_lock_);
 diff --git content/renderer/renderer_blink_platform_impl.h content/renderer/renderer_blink_platform_impl.h
-index 10c96d3915e64..060087d2436ea 100644
+index 7255ac218c8fd..858a6d83e315e 100644
 --- content/renderer/renderer_blink_platform_impl.h
 +++ content/renderer/renderer_blink_platform_impl.h
-@@ -261,6 +261,9 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
+@@ -262,6 +262,9 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
        blink::WebVector<blink::WebContentSecurityPolicyHeader>* csp) override;
    base::PlatformThreadId GetIOThreadId() const override;
  

patch/patches/content_main_654986.patch

@@ -100,7 +100,7 @@ index 332b7d026e036..0d63ad05fde4e 100644
  }
  
 diff --git content/app/content_main_runner_impl.cc content/app/content_main_runner_impl.cc
-index 9d22238878e32..e0833ed4572e9 100644
+index 9d22238878e32..dd231b0d55422 100644
 --- content/app/content_main_runner_impl.cc
 +++ content/app/content_main_runner_impl.cc
 @@ -44,6 +44,7 @@
@@ -111,12 +111,13 @@ index 9d22238878e32..e0833ed4572e9 100644
  #include "base/time/time.h"
  #include "base/trace_event/trace_event.h"
  #include "build/build_config.h"
-@@ -1205,6 +1206,11 @@ void ContentMainRunnerImpl::Shutdown() {
+@@ -1205,6 +1206,12 @@ void ContentMainRunnerImpl::Shutdown() {
    is_shutdown_ = true;
  }
  
 +void ContentMainRunnerImpl::ShutdownOnUIThread() {
 +  base::ScopedAllowBaseSyncPrimitivesForTesting allow_wait;
++  unregister_thread_closure_.RunAndReset();
 +  discardable_shared_memory_manager_.reset();
 +}
 +

patch/patches/libxml_visibility.patch

@@ -1,5 +1,5 @@
 diff --git third_party/libxml/BUILD.gn third_party/libxml/BUILD.gn
-index b8752f6295ab6..641c507e96bfd 100644
+index ece66cd212e65..645d1e56c69b2 100644
 --- third_party/libxml/BUILD.gn
 +++ third_party/libxml/BUILD.gn
 @@ -137,6 +137,7 @@ static_library("libxml") {

patch/patches/net_cookie_flags.patch

@@ -10,10 +10,10 @@ index 96d1a51ec1078..e8120a818b1f2 100644
 +// This load will not send any cookies. For CEF usage.
 +LOAD_FLAG(DO_NOT_SEND_COOKIES, 1 << 17)
 diff --git net/url_request/url_request_http_job.cc net/url_request/url_request_http_job.cc
-index 3faca2e98f4ac..c6729030a53cc 100644
+index ed3542a0fedb9..7490cf6723f65 100644
 --- net/url_request/url_request_http_job.cc
 +++ net/url_request/url_request_http_job.cc
-@@ -1750,7 +1750,8 @@ bool URLRequestHttpJob::ShouldAddCookieHeader() const {
+@@ -1774,7 +1774,8 @@ bool URLRequestHttpJob::ShouldAddCookieHeader() const {
    // Read cookies whenever allow_credentials() is true, even if the PrivacyMode
    // is being overridden by NetworkDelegate and will eventually block them, as
    // blocked cookies still need to be logged in that case.

patch/patches/osr_fling_2745.patch

@@ -41,10 +41,10 @@ index cc4b13a7b9c67..84f3b9ed7cf49 100644
  
  }  // namespace content
 diff --git content/browser/renderer_host/render_widget_host_impl.cc content/browser/renderer_host/render_widget_host_impl.cc
-index 03e318b14025f..0428c5d4b92b1 100644
+index f127b930806bc..83e2a99d0a593 100644
 --- content/browser/renderer_host/render_widget_host_impl.cc
 +++ content/browser/renderer_host/render_widget_host_impl.cc
-@@ -3112,6 +3112,11 @@ void RenderWidgetHostImpl::OnInvalidInputEventSource() {
+@@ -3116,6 +3116,11 @@ void RenderWidgetHostImpl::OnInvalidInputEventSource() {
        GetProcess(), bad_message::INPUT_ROUTER_INVALID_EVENT_SOURCE);
  }
  

patch/patches/print_preview_123.patch

@@ -34,7 +34,7 @@ index 673ed00dc33c8..e7c82dc4dddb0 100644
  }
  
 diff --git chrome/browser/printing/print_preview_dialog_controller.cc chrome/browser/printing/print_preview_dialog_controller.cc
-index 332fbc21aa0e3..1286fc203d6cd 100644
+index d656ccabc3899..a4b7ce6a7dcd8 100644
 --- chrome/browser/printing/print_preview_dialog_controller.cc
 +++ chrome/browser/printing/print_preview_dialog_controller.cc
 @@ -15,6 +15,7 @@

patch/patches/services_network_2622.patch

@@ -42,7 +42,7 @@ index 86cb596c6a4f2..e4f45f5b1c2fa 100644
          ::network::mojom::NetworkContextFilePaths::New();
  
 diff --git net/cookies/cookie_monster.cc net/cookies/cookie_monster.cc
-index 2885d39d1f6e5..bd373d28498c7 100644
+index 3638d994a72a1..7840dc304b0c6 100644
 --- net/cookies/cookie_monster.cc
 +++ net/cookies/cookie_monster.cc
 @@ -547,6 +547,25 @@ void CookieMonster::SetCookieableSchemes(
@@ -72,7 +72,7 @@ index 2885d39d1f6e5..bd373d28498c7 100644
  void CookieMonster::SetPersistSessionCookies(bool persist_session_cookies) {
    DCHECK(thread_checker_.CalledOnValidThread());
 diff --git net/cookies/cookie_monster.h net/cookies/cookie_monster.h
-index 5ba0bcac86588..8efbece455f2b 100644
+index 429ec9d9df500..ca58ec477d249 100644
 --- net/cookies/cookie_monster.h
 +++ net/cookies/cookie_monster.h
 @@ -207,6 +207,8 @@ class NET_EXPORT CookieMonster : public CookieStore {
@@ -85,7 +85,7 @@ index 5ba0bcac86588..8efbece455f2b 100644
    // Enables writing session cookies into the cookie database. If this this
    // method is called, it must be called before first use of the instance
 diff --git net/cookies/cookie_store.h net/cookies/cookie_store.h
-index 4dbe5fd1b2c11..ef797ae9b858c 100644
+index 0cd83a8038362..acc52d3b67c66 100644
 --- net/cookies/cookie_store.h
 +++ net/cookies/cookie_store.h
 @@ -161,6 +161,11 @@ class NET_EXPORT CookieStore {
@@ -101,7 +101,7 @@ index 4dbe5fd1b2c11..ef797ae9b858c 100644
    // reset to null.
    const CookieAccessDelegate* cookie_access_delegate() const {
 diff --git services/network/cookie_manager.cc services/network/cookie_manager.cc
-index f5df9b6c27e9f..ea02e2b379f3a 100644
+index 49c53dc75789f..07c204a826877 100644
 --- services/network/cookie_manager.cc
 +++ services/network/cookie_manager.cc
 @@ -366,14 +366,9 @@ void CookieManager::FlushCookieStore(FlushCookieStoreCallback callback) {
@@ -123,10 +123,10 @@ index f5df9b6c27e9f..ea02e2b379f3a 100644
  
  void CookieManager::SetForceKeepSessionState() {
 diff --git services/network/network_context.cc services/network/network_context.cc
-index 8ff62f92ed6ef..9af2e737a9c01 100644
+index 2ee1a3da9ca15..3afe01c9255ce 100644
 --- services/network/network_context.cc
 +++ services/network/network_context.cc
-@@ -2286,17 +2286,21 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
+@@ -2295,17 +2295,21 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
          network_service_->network_quality_estimator());
    }
  
@@ -157,7 +157,7 @@ index 8ff62f92ed6ef..9af2e737a9c01 100644
      trust_token_store_ = std::make_unique<PendingTrustTokenStore>();
  
 diff --git services/network/public/mojom/network_context.mojom services/network/public/mojom/network_context.mojom
-index 3d5779c980ff7..9d0e0a58ec64d 100644
+index 0b1afd416381c..d6c0480f6e3c3 100644
 --- services/network/public/mojom/network_context.mojom
 +++ services/network/public/mojom/network_context.mojom
 @@ -330,6 +330,9 @@ struct NetworkContextParams {

patch/patches/services_network_2718.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/storage_partition_impl.cc content/browser/storage_partition_impl.cc
-index 4104bde55093c..8992ed51a47d1 100644
+index 6cbe5f15ce3c9..cc89d88767de6 100644
 --- content/browser/storage_partition_impl.cc
 +++ content/browser/storage_partition_impl.cc
 @@ -494,10 +494,6 @@ class LoginHandlerDelegate {
@@ -26,7 +26,7 @@ index 4104bde55093c..8992ed51a47d1 100644
    new LoginHandlerDelegate(
        std::move(auth_challenge_responder), std::move(web_contents_getter),
        auth_info, is_request_for_primary_main_frame, process_id, request_id, url,
-@@ -2737,8 +2727,12 @@ void StoragePartitionImpl::GetQuotaSettings(
+@@ -2747,8 +2737,12 @@ void StoragePartitionImpl::GetQuotaSettings(
      return;
    }
  
@@ -40,7 +40,7 @@ index 4104bde55093c..8992ed51a47d1 100644
        storage::GetDefaultDeviceInfoHelper(), std::move(callback));
  }
  
-@@ -2748,9 +2742,12 @@ void StoragePartitionImpl::InitNetworkContext() {
+@@ -2758,9 +2752,12 @@ void StoragePartitionImpl::InitNetworkContext() {
    cert_verifier::mojom::CertVerifierCreationParamsPtr
        cert_verifier_creation_params =
            cert_verifier::mojom::CertVerifierCreationParams::New();

patch/patches/views_widget.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/renderer_host/render_widget_host_view_base.cc content/browser/renderer_host/render_widget_host_view_base.cc
-index 5fd8cb63f589d..cabf4b90d8078 100644
+index 14b5b4552f807..46b6a77023f11 100644
 --- content/browser/renderer_host/render_widget_host_view_base.cc
 +++ content/browser/renderer_host/render_widget_host_view_base.cc
-@@ -617,6 +617,14 @@ float RenderWidgetHostViewBase::GetDeviceScaleFactor() const {
+@@ -618,6 +618,14 @@ float RenderWidgetHostViewBase::GetDeviceScaleFactor() const {
    return screen_infos_.current().device_scale_factor;
  }
  

patch/patches/web_contents_1257_1565.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index 96ced4715eed9..1094a4e9ec0a4 100644
+index f28855f738e3b..d36ec5b3aa7c2 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
 @@ -3040,6 +3040,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
@@ -39,7 +39,7 @@ index 96ced4715eed9..1094a4e9ec0a4 100644
    std::unique_ptr<WebContentsImpl> new_contents;
    if (!is_guest) {
      create_params.context = view_->GetNativeView();
-@@ -7726,6 +7742,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
+@@ -7729,6 +7745,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
      // frames).
      SetFocusedFrameTree(node->frame_tree());
    }

patch/patches/webkit_popups.patch

@@ -11,7 +11,7 @@ index 14d4a00293ab0..fc574edaaa2ad 100644
    // Cancels and hides the current popup (datetime, select...) if any.
    virtual void CancelPagePopup() = 0;
 diff --git third_party/blink/renderer/core/exported/web_view_impl.cc third_party/blink/renderer/core/exported/web_view_impl.cc
-index d8f8d3114361d..01879d8feceea 100644
+index b9d5a13bcdf98..872070007402e 100644
 --- third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ third_party/blink/renderer/core/exported/web_view_impl.cc
 @@ -247,8 +247,13 @@ void WebView::SetUseExternalPopupMenus(bool use_external_popup_menus) {

tests/ceftests/string_unittest.cc

@@ -362,3 +362,123 @@ TEST(StringTest, Multimap) {
 
   cef_string_multimap_free(mapPtr);
 }
+
+// Test that CefString ownership behaves as expected.
+TEST(StringTest, Ownership) {
+  const char* test_cstr = "Test string";
+
+  // Initial owner makes a copy of |test_cstr|.
+  CefStringUTF8 str(test_cstr);
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  const char* str_str = str.c_str();
+  const auto str_struct = str.GetStruct();
+  EXPECT_NE(test_cstr, str_str);
+
+  // REFERENCE CREATION
+
+  // Take a reference (requires explicit use of GetStruct).
+  CefStringUTF8 str_ref(str.GetStruct());
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str_ref| has the same value.
+  EXPECT_FALSE(str_ref.IsOwner());
+  EXPECT_STREQ(test_cstr, str_ref.c_str());
+  // Referencing the same structure and string.
+  EXPECT_EQ(str.GetStruct(), str_ref.GetStruct());
+  EXPECT_EQ(str.c_str(), str_ref.c_str());
+
+  // REFERENCE DETACH/ATTACH
+
+  // DetachToUserFree. |str_ref| loses its reference.
+  auto userfree = str_ref.DetachToUserFree();
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str_ref| is now empty.
+  EXPECT_FALSE(str_ref.IsOwner());
+  EXPECT_TRUE(str_ref.empty());
+  EXPECT_EQ(nullptr, str_ref.GetStruct());
+
+  // AttachToUserFree. |str2| becomes an owner of the copy.
+  CefStringUTF8 str2;
+  str2.AttachToUserFree(userfree);
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str2| is now an owner of a copy.
+  EXPECT_TRUE(str2.IsOwner());
+  EXPECT_STREQ(test_cstr, str2.c_str());
+  // Not referencing the same structure or string.
+  EXPECT_NE(str.GetStruct(), str2.GetStruct());
+  EXPECT_NE(str.c_str(), str2.c_str());
+
+  // |str_ref| is still empty.
+  EXPECT_FALSE(str_ref.IsOwner());
+  EXPECT_TRUE(str_ref.empty());
+  EXPECT_EQ(nullptr, str_ref.GetStruct());
+
+  // OWNER COPY CREATION
+
+  // Making a copy (default copy constructor behavior).
+  CefStringUTF8 str3(str);
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str3| is now an owner of a copy.
+  EXPECT_TRUE(str3.IsOwner());
+  EXPECT_STREQ(test_cstr, str3.c_str());
+  // Not referencing the same structure or string.
+  EXPECT_NE(str.GetStruct(), str3.GetStruct());
+  EXPECT_NE(str.c_str(), str3.c_str());
+
+  // OWNER DETACH/ATTACH
+
+  // DetachToUserFree. |str3| loses its ownership.
+  const char* str3_str = str3.c_str();
+  auto userfree3 = str3.DetachToUserFree();
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str3| is now empty.
+  EXPECT_FALSE(str3.IsOwner());
+  EXPECT_TRUE(str3.empty());
+  EXPECT_EQ(nullptr, str3.GetStruct());
+
+  // AttachToUserFree. |str3| regains its ownership.
+  str3.AttachToUserFree(userfree3);
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str3| is now an owner of the same string that it had previously.
+  // The structure will also be re-allocated, but we don't test that because
+  // the same address might be reused.
+  EXPECT_TRUE(str3.IsOwner());
+  EXPECT_STREQ(test_cstr, str3.c_str());
+  EXPECT_EQ(str3_str, str3.c_str());
+}

tools/fix_style.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/fix_style.py $@
+python3 tools/fix_style.py $@

tools/gn_args.py

@@ -503,6 +503,10 @@ def GetConfigArgsSandbox(platform, args, is_debug, cpu):
     # Allow non-component Debug builds for the sandbox.
     add_args['forbid_non_component_debug_builds'] = False
 
+  if not is_debug:
+    # Disable DCHECKs in Release builds.
+    add_args['dcheck_always_on'] = False
+
   result = MergeDicts(args, add_args, {
       'is_debug': is_debug,
       'target_cpu': cpu,

tools/make_distrib.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python make_distrib.py --output-dir ../binary_distrib/ $@
+python3 make_distrib.py --output-dir ../binary_distrib/ $@

tools/make_version_header.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/make_version_header.py include/cef_version.h
+python3 tools/make_version_header.py include/cef_version.h

tools/patch.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/patcher.py
+python3 tools/patcher.py

tools/patch_updater.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/patch_updater.py $@
+python3 tools/patch_updater.py $@

tools/translator.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python translator.py --root-dir .. $@
+python3 translator.py --root-dir .. $@