Set dcheck_always_on=false for cef_sandbox Release builds (fixes issue #3302)

Execute all pending UI thread tasks at the beginning of the shutdown sequence.

BUILD.gn

@@ -489,6 +489,8 @@ static_library("libcef_static") {
     "libcef/browser/download_manager_delegate.h",
     "libcef/browser/extension_impl.cc",
     "libcef/browser/extension_impl.h",
+    "libcef/browser/extensions/api/file_system/cef_file_system_delegate.cc",
+    "libcef/browser/extensions/api/file_system/cef_file_system_delegate.h",
     "libcef/browser/extensions/api/storage/sync_value_store_cache.cc",
     "libcef/browser/extensions/api/storage/sync_value_store_cache.h",
     "libcef/browser/extensions/api/tabs/tabs_api.cc",
@@ -1291,6 +1293,8 @@ static_library("libcef_dll_wrapper") {
 
   configs += [ ":libcef_dll_wrapper_config" ]
   public_configs = [ ":libcef_dll_wrapper_config" ]
+
+  deps = [ ":cef_make_headers" ]
 }
 
 
@@ -1377,6 +1381,7 @@ make_pack_header("resources") {
     "$root_gen_dir/chrome/grit/common_resources.h",
     "$root_gen_dir/chrome/grit/component_extension_resources.h",
     "$root_gen_dir/chrome/grit/dev_ui_browser_resources.h",
+    "$root_gen_dir/chrome/grit/pdf_resources.h",
     "$root_gen_dir/chrome/grit/renderer_resources.h",
     "$root_gen_dir/components/grit/components_resources.h",
     "$root_gen_dir/components/grit/dev_ui_components_resources.h",
@@ -1402,6 +1407,7 @@ make_pack_header("resources") {
     "//chrome/browser:dev_ui_browser_resources",
     "//chrome/browser:resources",
     "//chrome/browser/resources:component_extension_resources",
+    "//chrome/browser/resources/pdf:resources",
     "//chrome/common:resources",
     "//chrome/renderer:resources",
     "//components/resources:components_resources",
@@ -1483,12 +1489,22 @@ action("make_api_hash_header") {
   args = rebase_path(outputs + include_dir, root_build_dir)
 }
 
+# Generate cef_config.h.
+action("make_config_header") {
+  script = "tools/make_config_header.py"
+
+  outputs = [ "$root_out_dir/includes/include/cef_config.h" ]
+
+  args = rebase_path(outputs + [ "$root_out_dir/args.gn" ], root_build_dir)
+}
+
 # Generate pack files and associated CEF header files.
 group("cef_make_headers") {
   deps = [
     ":make_pack_header_resources",
     ":make_pack_header_strings",
     ":make_api_hash_header",
+    ":make_config_header",
   ]
 }
 

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,6 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/99.0.4844.0'
+  'chromium_checkout': 'refs/tags/99.0.4844.84',
+  'depot_tools_checkout': '289dedd36b'
 }

cef_paths2.gypi

@@ -38,7 +38,6 @@
       'include/base/internal/cef_thread_checker_impl.h',
       'include/cef_api_hash.h',
       'include/cef_base.h',
-      'include/cef_config.h',
       'include/cef_version.h',
       'include/internal/cef_export.h',
       'include/internal/cef_ptr.h',

include/base/cef_template_util.h

@@ -276,8 +276,13 @@ struct negation : bool_constant<!static_cast<bool>(B::value)> {};
 // References:
 // [1] https://en.cppreference.com/w/cpp/types/result_of
 // [2] https://wg21.link/meta.trans.other#lib:invoke_result
+#if ((defined(_MSVC_LANG) && _MSVC_LANG >= 201703L) || __cplusplus >= 201703L)
+template <typename Functor, typename... Args>
+using invoke_result = std::invoke_result<Functor, Args...>;
+#else
 template <typename Functor, typename... Args>
 using invoke_result = std::result_of<Functor && (Args && ...)>;
+#endif
 
 // Implementation of C++17's std::invoke_result_t.
 //

include/capi/cef_browser_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=8af93d03e0b2a6b50d7612b145599600285b76d4$
+// $hash=b80e84c0039ab45d5c4562d64b67a84766c0dab3$
 //
 
 #ifndef CEF_INCLUDE_CAPI_CEF_BROWSER_CAPI_H_
@@ -450,18 +450,15 @@ typedef struct _cef_browser_host_t {
       struct _cef_pdf_print_callback_t* callback);
 
   ///
-  // Search for |searchText|. |identifier| must be a unique ID and these IDs
+  // Search for |searchText|. |forward| indicates whether to search forward or
-  // must strictly increase so that newer requests always have greater IDs than
+  // backward within the page. |matchCase| indicates whether the search should
-  // older requests. If |identifier| is zero or less than the previous ID value
+  // be case-sensitive. |findNext| indicates whether this is the first request
-  // then it will be automatically assigned a new valid ID. |forward| indicates
+  // or a follow-up. The search will be restarted if |searchText| or |matchCase|
-  // whether to search forward or backward within the page. |matchCase|
+  // change. The search will be stopped if |searchText| is NULL. The
-  // indicates whether the search should be case-sensitive. |findNext| indicates
+  // cef_find_handler_t instance, if any, returned via
-  // whether this is the first request or a follow-up. The cef_find_handler_t
+  // cef_client_t::GetFindHandler will be called to report find results.
-  // instance, if any, returned via cef_client_t::GetFindHandler will be called
-  // to report find results.
   ///
   void(CEF_CALLBACK* find)(struct _cef_browser_host_t* self,
-                           int identifier,
                            const cef_string_t* searchText,
                            int forward,
                            int matchCase,

include/capi/cef_find_handler_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=b1fe7f7db5ab92c6ae64dc1288b6fd47c80f9423$
+// $hash=f2e80b8637b07f19adea666e554269de4627e399$
 //
 
 #ifndef CEF_INCLUDE_CAPI_CEF_FIND_HANDLER_CAPI_H_
@@ -59,11 +59,12 @@ typedef struct _cef_find_handler_t {
 
   ///
   // Called to report find results returned by cef_browser_host_t::find().
-  // |identifer| is the identifier passed to find(), |count| is the number of
+  // |identifer| is a unique incremental identifier for the currently active
-  // matches currently identified, |selectionRect| is the location of where the
+  // search, |count| is the number of matches currently identified,
-  // match was found (in window coordinates), |activeMatchOrdinal| is the
+  // |selectionRect| is the location of where the match was found (in window
-  // current position in the search results, and |finalUpdate| is true (1) if
+  // coordinates), |activeMatchOrdinal| is the current position in the search
-  // this is the last find notification.
+  // results, and |finalUpdate| is true (1) if this is the last find
+  // notification.
   ///
   void(CEF_CALLBACK* on_find_result)(struct _cef_find_handler_t* self,
                                      struct _cef_browser_t* browser,

include/cef_api_hash.h

@@ -42,13 +42,13 @@
 // way that may cause binary incompatibility with other builds. The universal
 // hash value will change if any platform is affected whereas the platform hash
 // values will change only if that particular platform is affected.
-#define CEF_API_HASH_UNIVERSAL "6f6a9c0f3b420cd3120cf4f5924cbc91f5095abd"
+#define CEF_API_HASH_UNIVERSAL "58a564a53597120d05cedf5bcd355064168af0a7"
 #if defined(OS_WIN)
-#define CEF_API_HASH_PLATFORM "5835e67ed251fec96837b475df44248a286e422f"
+#define CEF_API_HASH_PLATFORM "5fa37a277dca51dee1d13058e6218dc1e2e68adb"
 #elif defined(OS_MAC)
-#define CEF_API_HASH_PLATFORM "b8187d9f99b028d767dfd6a40490190c25a3d901"
+#define CEF_API_HASH_PLATFORM "77dc909a3d568d3b98fe32fa040801f748656ad2"
 #elif defined(OS_LINUX)
-#define CEF_API_HASH_PLATFORM "d7199dfd396052e1517e55f18ea75d3d61336538"
+#define CEF_API_HASH_PLATFORM "76077b5939104ed96c1378a24d4acbb1ae4e3cb5"
 #endif
 
 #ifdef __cplusplus

include/cef_browser.h

@@ -479,19 +479,16 @@ class CefBrowserHost : public virtual CefBaseRefCounted {
                           CefRefPtr<CefPdfPrintCallback> callback) = 0;
 
   ///
-  // Search for |searchText|. |identifier| must be a unique ID and these IDs
+  // Search for |searchText|. |forward| indicates whether to search forward or
-  // must strictly increase so that newer requests always have greater IDs than
+  // backward within the page. |matchCase| indicates whether the search should
-  // older requests. If |identifier| is zero or less than the previous ID value
+  // be case-sensitive. |findNext| indicates whether this is the first request
-  // then it will be automatically assigned a new valid ID. |forward| indicates
+  // or a follow-up. The search will be restarted if |searchText| or |matchCase|
-  // whether to search forward or backward within the page. |matchCase|
+  // change. The search will be stopped if |searchText| is empty. The
-  // indicates whether the search should be case-sensitive. |findNext| indicates
+  // CefFindHandler instance, if any, returned via CefClient::GetFindHandler
-  // whether this is the first request or a follow-up. The CefFindHandler
+  // will be called to report find results.
-  // instance, if any, returned via CefClient::GetFindHandler will be called to
-  // report find results.
   ///
   /*--cef()--*/
-  virtual void Find(int identifier,
+  virtual void Find(const CefString& searchText,
-                    const CefString& searchText,
                     bool forward,
                     bool matchCase,
                     bool findNext) = 0;

include/cef_find_handler.h

@@ -50,11 +50,11 @@ class CefFindHandler : public virtual CefBaseRefCounted {
  public:
   ///
   // Called to report find results returned by CefBrowserHost::Find().
-  // |identifer| is the identifier passed to Find(), |count| is the number of
+  // |identifer| is a unique incremental identifier for the currently active
-  // matches currently identified, |selectionRect| is the location of where the
+  // search, |count| is the number of matches currently identified,
-  // match was found (in window coordinates), |activeMatchOrdinal| is the
+  // |selectionRect| is the location of where the match was found (in window
-  // current position in the search results, and |finalUpdate| is true if this
+  // coordinates), |activeMatchOrdinal| is the current position in the search
-  // is the last find notification.
+  // results, and |finalUpdate| is true if this is the last find notification.
   ///
   /*--cef()--*/
   virtual void OnFindResult(CefRefPtr<CefBrowser> browser,

include/cef_sandbox_win.h

@@ -50,13 +50,13 @@ extern "C" {
 // 2. Link the executable with the cef_sandbox static library.
 // 3. Call the cef_sandbox_info_create() function from within the executable
 //    (not from a separate DLL) and pass the resulting pointer into both the
-//    CefExecutProcess() and CefInitialize() functions via the
+//    CefExecuteProcess() and CefInitialize() functions via the
 //    |windows_sandbox_info| parameter.
 
 ///
 // Create the sandbox information object for this process. It is safe to create
 // multiple of this object and to destroy the object immediately after passing
-// into the CefExecutProcess() and/or CefInitialize() functions.
+// into the CefExecuteProcess() and/or CefInitialize() functions.
 ///
 void* cef_sandbox_info_create();
 

include/internal/cef_types.h

@@ -202,7 +202,7 @@ typedef struct _cef_settings_t {
 
   ///
   // Set to true (1) to have the browser process message loop run in a separate
-  // thread. If false (0) than the CefDoMessageLoopWork() function must be
+  // thread. If false (0) then the CefDoMessageLoopWork() function must be
   // called from your application message loop. This option is only supported on
   // Windows and Linux.
   ///
@@ -1028,7 +1028,8 @@ typedef enum {
 } cef_postdataelement_type_t;
 
 ///
-// Resource type for a request.
+// Resource type for a request. These constants match their equivalents in
+// Chromium's ResourceType and should not be renumbered.
 ///
 typedef enum {
   ///
@@ -1616,8 +1617,7 @@ typedef enum {
   MENU_ID_NO_SPELLING_SUGGESTIONS = 205,
   MENU_ID_ADD_TO_DICTIONARY = 206,
 
-  // Custom menu items originating from the renderer process. For example,
+  // Custom menu items originating from the renderer process.
-  // plugin placeholder menu items.
   MENU_ID_CUSTOM_FIRST = 220,
   MENU_ID_CUSTOM_LAST = 250,
 
@@ -1819,7 +1819,8 @@ typedef enum {
 } cef_context_menu_type_flags_t;
 
 ///
-// Supported context menu media types.
+// Supported context menu media types. These constants match their equivalents
+// in Chromium's ContextMenuDataMediaType and should not be renumbered.
 ///
 typedef enum {
   ///
@@ -1839,6 +1840,10 @@ typedef enum {
   ///
   CM_MEDIATYPE_AUDIO,
   ///
+  // An canvas node is selected.
+  ///
+  CM_MEDIATYPE_CANVAS,
+  ///
   // A file node is selected.
   ///
   CM_MEDIATYPE_FILE,
@@ -1849,24 +1854,31 @@ typedef enum {
 } cef_context_menu_media_type_t;
 
 ///
-// Supported context menu media state bit flags.
+// Supported context menu media state bit flags. These constants match their
+// equivalents in Chromium's ContextMenuData::MediaFlags and should not be
+// renumbered.
 ///
 typedef enum {
   CM_MEDIAFLAG_NONE = 0,
-  CM_MEDIAFLAG_ERROR = 1 << 0,
+  CM_MEDIAFLAG_IN_ERROR = 1 << 0,
   CM_MEDIAFLAG_PAUSED = 1 << 1,
   CM_MEDIAFLAG_MUTED = 1 << 2,
   CM_MEDIAFLAG_LOOP = 1 << 3,
   CM_MEDIAFLAG_CAN_SAVE = 1 << 4,
   CM_MEDIAFLAG_HAS_AUDIO = 1 << 5,
-  CM_MEDIAFLAG_HAS_VIDEO = 1 << 6,
+  CM_MEDIAFLAG_CAN_TOGGLE_CONTROLS = 1 << 6,
-  CM_MEDIAFLAG_CONTROL_ROOT_ELEMENT = 1 << 7,
+  CM_MEDIAFLAG_CONTROLS = 1 << 7,
   CM_MEDIAFLAG_CAN_PRINT = 1 << 8,
   CM_MEDIAFLAG_CAN_ROTATE = 1 << 9,
+  CM_MEDIAFLAG_CAN_PICTURE_IN_PICTURE = 1 << 10,
+  CM_MEDIAFLAG_PICTURE_IN_PICTURE = 1 << 11,
+  CM_MEDIAFLAG_CAN_LOOP = 1 << 12,
 } cef_context_menu_media_state_flags_t;
 
 ///
-// Supported context menu edit state bit flags.
+// Supported context menu edit state bit flags. These constants match their
+// equivalents in Chromium's ContextMenuDataEditFlags and should not be
+// renumbered.
 ///
 typedef enum {
   CM_EDITFLAG_NONE = 0,
@@ -1878,6 +1890,7 @@ typedef enum {
   CM_EDITFLAG_CAN_DELETE = 1 << 5,
   CM_EDITFLAG_CAN_SELECT_ALL = 1 << 6,
   CM_EDITFLAG_CAN_TRANSLATE = 1 << 7,
+  CM_EDITFLAG_CAN_EDIT_RICHLY = 1 << 8,
 } cef_context_menu_edit_state_flags_t;
 
 ///

include/wrapper/cef_message_router.h

@@ -78,7 +78,7 @@
 // with an error code of -1.
 //
 // Queries can be either persistent or non-persistent. If the query is
-// persistent than the callbacks will remain registered until one of the
+// persistent then the callbacks will remain registered until one of the
 // following conditions are met:
 //
 // A. The query is canceled in JavaScript using the |window.cefQueryCancel|

libcef/browser/alloy/alloy_browser_host_impl.cc

@@ -9,6 +9,7 @@
 #include <utility>
 
 #include "libcef/browser/alloy/alloy_browser_context.h"
+#include "libcef/browser/alloy/browser_platform_delegate_alloy.h"
 #include "libcef/browser/audio_capturer.h"
 #include "libcef/browser/browser_context.h"
 #include "libcef/browser/browser_info.h"
@@ -450,21 +451,19 @@ void AlloyBrowserHostImpl::PrintToPDF(const CefString& path,
   }
 }
 
-void AlloyBrowserHostImpl::Find(int identifier,
+void AlloyBrowserHostImpl::Find(const CefString& searchText,
-                                const CefString& searchText,
                                 bool forward,
                                 bool matchCase,
                                 bool findNext) {
   if (!CEF_CURRENTLY_ON_UIT()) {
     CEF_POST_TASK(CEF_UIT,
-                  base::BindOnce(&AlloyBrowserHostImpl::Find, this, identifier,
+                  base::BindOnce(&AlloyBrowserHostImpl::Find, this, searchText,
-                                 searchText, forward, matchCase, findNext));
+                                 forward, matchCase, findNext));
     return;
   }
 
   if (platform_delegate_) {
-    platform_delegate_->Find(identifier, searchText, forward, matchCase,
+    platform_delegate_->Find(searchText, forward, matchCase, findNext);
-                             findNext);
   }
 }
 
@@ -860,13 +859,21 @@ void AlloyBrowserHostImpl::FindReply(content::WebContents* web_contents,
                                      const gfx::Rect& selection_rect,
                                      int active_match_ordinal,
                                      bool final_update) {
-  if (client_.get()) {
+  auto alloy_delegate =
-    CefRefPtr<CefFindHandler> handler = client_->GetFindHandler();
+      static_cast<CefBrowserPlatformDelegateAlloy*>(platform_delegate());
-    if (handler.get()) {
+  if (alloy_delegate->HandleFindReply(request_id, number_of_matches,
-      CefRect rect(selection_rect.x(), selection_rect.y(),
+                                      selection_rect, active_match_ordinal,
-                   selection_rect.width(), selection_rect.height());
+                                      final_update)) {
-      handler->OnFindResult(this, request_id, number_of_matches, rect,
+    if (client_) {
-                            active_match_ordinal, final_update);
+      if (auto handler = client_->GetFindHandler()) {
+        const auto& details = alloy_delegate->last_search_result();
+        CefRect rect(details.selection_rect().x(), details.selection_rect().y(),
+                     details.selection_rect().width(),
+                     details.selection_rect().height());
+        handler->OnFindResult(
+            this, details.request_id(), details.number_of_matches(), rect,
+            details.active_match_ordinal(), details.final_update());
+      }
     }
   }
 }

libcef/browser/alloy/alloy_browser_host_impl.h

@@ -94,8 +94,7 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
   void PrintToPDF(const CefString& path,
                   const CefPdfPrintSettings& settings,
                   CefRefPtr<CefPdfPrintCallback> callback) override;
-  void Find(int identifier,
+  void Find(const CefString& searchText,
-            const CefString& searchText,
             bool forward,
             bool matchCase,
             bool findNext) override;

libcef/browser/alloy/alloy_browser_main.cc

@@ -13,12 +13,10 @@
 #include "libcef/browser/context.h"
 #include "libcef/browser/devtools/devtools_manager_delegate.h"
 #include "libcef/browser/extensions/extension_system_factory.h"
-#include "libcef/browser/extensions/extensions_browser_client.h"
 #include "libcef/browser/net/chrome_scheme_handler.h"
 #include "libcef/browser/printing/constrained_window_views_client.h"
 #include "libcef/browser/thread_util.h"
 #include "libcef/common/app_manager.h"
-#include "libcef/common/extensions/extensions_client.h"
 #include "libcef/common/extensions/extensions_util.h"
 #include "libcef/common/net/net_resource_provider.h"
 
@@ -35,7 +33,7 @@
 #include "content/public/browser/gpu_data_manager.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/common/result_codes.h"
-#include "extensions/browser/extension_system.h"
+#include "extensions/browser/extensions_browser_client.h"
 #include "extensions/common/constants.h"
 #include "net/base/net_module.h"
 #include "third_party/widevine/cdm/buildflags.h"
@@ -205,14 +203,10 @@ int AlloyBrowserMainParts::PreMainMessageLoopRun() {
 #endif
 
   if (extensions::ExtensionsEnabled()) {
+    // This should be set in ChromeBrowserProcessAlloy::Initialize.
+    DCHECK(extensions::ExtensionsBrowserClient::Get());
     // Initialize extension global objects before creating the global
     // BrowserContext.
-    extensions_client_.reset(new extensions::CefExtensionsClient());
-    extensions::ExtensionsClient::Set(extensions_client_.get());
-    extensions_browser_client_.reset(
-        new extensions::CefExtensionsBrowserClient);
-    extensions::ExtensionsBrowserClient::Set(extensions_browser_client_.get());
-
     extensions::CefExtensionSystemFactory::GetInstance();
   }
 
@@ -283,11 +277,6 @@ void AlloyBrowserMainParts::PostMainMessageLoopRun() {
 }
 
 void AlloyBrowserMainParts::PostDestroyThreads() {
-  if (extensions::ExtensionsEnabled()) {
-    extensions::ExtensionsBrowserClient::Set(nullptr);
-    extensions_browser_client_.reset();
-  }
-
 #if defined(TOOLKIT_VIEWS)
   views_delegate_.reset();
 #if BUILDFLAG(IS_MAC)

libcef/browser/alloy/alloy_browser_main.h

@@ -15,11 +15,6 @@
 #include "content/public/browser/browser_main_parts.h"
 #include "content/public/common/main_function_params.h"
 
-namespace extensions {
-class ExtensionsBrowserClient;
-class ExtensionsClient;
-}  // namespace extensions
-
 #if defined(USE_AURA)
 namespace display {
 class Screen;
@@ -84,10 +79,6 @@ class AlloyBrowserMainParts : public content::BrowserMainParts {
   CefRefPtr<CefRequestContextImpl> global_request_context_;
   CefDevToolsDelegate* devtools_delegate_ = nullptr;  // Deletes itself.
 
-  std::unique_ptr<extensions::ExtensionsClient> extensions_client_;
-  std::unique_ptr<extensions::ExtensionsBrowserClient>
-      extensions_browser_client_;
-
   // Blocking task runners exposed via CefTaskRunner. For consistency with
   // previous named thread behavior always execute all pending tasks before
   // shutdown (e.g. to make sure critical data is saved to disk).

libcef/browser/alloy/alloy_content_browser_client.cc

@@ -633,6 +633,7 @@ void AlloyContentBrowserClient::GetAdditionalAllowedSchemesForFileSystem(
       additional_allowed_schemes);
   additional_allowed_schemes->push_back(content::kChromeDevToolsScheme);
   additional_allowed_schemes->push_back(content::kChromeUIScheme);
+  additional_allowed_schemes->push_back(content::kChromeUIUntrustedScheme);
 }
 
 bool AlloyContentBrowserClient::IsWebUIAllowedToMakeNetworkRequests(
@@ -765,14 +766,6 @@ void AlloyContentBrowserClient::AppendExtraCommandLineSwitches(
     if (extensions::ExtensionsEnabled()) {
       content::RenderProcessHost* process =
           content::RenderProcessHost::FromID(child_process_id);
-#if !BUILDFLAG(IS_WIN)
-      // kPdfRenderer will be set for Windows in
-      // RenderProcessHostImpl::AppendRendererCommandLine.
-      if (process && process->IsPdf()) {
-        command_line->AppendSwitch(switches::kPdfRenderer);
-      }
-#endif  // !BUILDFLAG(IS_WIN)
-
       auto browser_context = process->GetBrowserContext();
       CefBrowserContext* cef_browser_context =
           process ? CefBrowserContext::FromBrowserContext(browser_context)
@@ -1518,6 +1511,18 @@ bool AlloyContentBrowserClient::ShouldAllowPluginCreation(
   return true;
 }
 
+void AlloyContentBrowserClient::OnWebContentsCreated(
+    content::WebContents* web_contents) {
+  // Attach universal WebContentsObservers. These are quite rare, and in most
+  // cases CefBrowserPlatformDelegateAlloy::BrowserCreated and/or
+  // CefExtensionsAPIClient::AttachWebContentsHelpers should be used instead.
+
+  if (extensions::ExtensionsEnabled()) {
+    extensions::CefExtensionWebContentsObserver::CreateForWebContents(
+        web_contents);
+  }
+}
+
 bool AlloyContentBrowserClient::IsFindInPageDisabledForOrigin(
     const url::Origin& origin) {
   // For PDF viewing with the PPAPI-free PDF Viewer, find-in-page should only

libcef/browser/alloy/alloy_content_browser_client.h

@@ -237,6 +237,7 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
   bool ShouldAllowPluginCreation(
       const url::Origin& embedder_origin,
       const content::PepperPluginInfo& plugin_info) override;
+  void OnWebContentsCreated(content::WebContents* web_contents) override;
   bool IsFindInPageDisabledForOrigin(const url::Origin& origin) override;
 
   CefRefPtr<CefRequestContextImpl> request_context() const;

libcef/browser/alloy/alloy_dialog_util.cc

@@ -5,6 +5,8 @@
 #include "libcef/browser/alloy/alloy_dialog_util.h"
 
 #include "libcef/browser/alloy/alloy_browser_host_impl.h"
+#include "libcef/browser/extensions/browser_extensions_util.h"
+#include "libcef/browser/file_dialog_runner.h"
 
 #include "base/strings/utf_string_conversions.h"
 
@@ -13,9 +15,12 @@ namespace alloy {
 void RunFileChooser(content::WebContents* web_contents,
                     const blink::mojom::FileChooserParams& params,
                     RunFileChooserCallback callback) {
-  CefRefPtr<AlloyBrowserHostImpl> browser =
+  CefRefPtr<AlloyBrowserHostImpl> browser = static_cast<AlloyBrowserHostImpl*>(
-      AlloyBrowserHostImpl::GetBrowserForContents(web_contents);
+      extensions::GetOwnerBrowserForHost(web_contents->GetRenderViewHost(),
+                                         nullptr)
+          .get());
   if (!browser) {
+    LOG(ERROR) << "Failed to identify browser; canceling file dialog";
     std::move(callback).Run(-1, {});
     return;
   }

libcef/browser/alloy/browser_platform_delegate_alloy.cc

@@ -17,13 +17,17 @@
 
 #include "base/logging.h"
 #include "chrome/browser/printing/print_view_manager.h"
+#include "chrome/browser/printing/print_view_manager_common.h"
 #include "chrome/browser/ui/prefs/prefs_tab_helper.h"
+#include "components/find_in_page/find_tab_helper.h"
+#include "components/find_in_page/find_types.h"
 #include "components/zoom/zoom_controller.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
 #include "extensions/browser/process_manager.h"
+#include "pdf/pdf_features.h"
 #include "printing/mojom/print.mojom.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom.h"
 
@@ -108,6 +112,7 @@ void CefBrowserPlatformDelegateAlloy::WebContentsCreated(
     content::WebContents* web_contents,
     bool owned) {
   CefBrowserPlatformDelegate::WebContentsCreated(web_contents, owned);
+  find_in_page::FindTabHelper::CreateForWebContents(web_contents);
 
   if (owned) {
     SetOwnedWebContents(web_contents);
@@ -179,9 +184,6 @@ void CefBrowserPlatformDelegateAlloy::BrowserCreated(
   printing::CefPrintViewManager::CreateForWebContents(web_contents_);
 
   if (extensions::ExtensionsEnabled()) {
-    extensions::CefExtensionWebContentsObserver::CreateForWebContents(
-        web_contents_);
-
     // Used by the tabs extension API.
     zoom::ZoomController::CreateForWebContents(web_contents_);
   }
@@ -341,33 +343,30 @@ void CefBrowserPlatformDelegateAlloy::SetAccessibilityState(
 bool CefBrowserPlatformDelegateAlloy::IsPrintPreviewSupported() const {
   REQUIRE_ALLOY_RUNTIME();
 
-  auto actionable_contents = GetActionableWebContents();
-  if (!actionable_contents)
-    return false;
-
-  auto cef_browser_context = CefBrowserContext::FromBrowserContext(
-      actionable_contents->GetBrowserContext());
-  if (!cef_browser_context->IsPrintPreviewSupported()) {
-    return false;
-  }
-
   // Print preview is not currently supported with OSR.
-  return !IsWindowless();
+  if (IsWindowless())
+    return false;
+
+  auto cef_browser_context =
+      CefBrowserContext::FromBrowserContext(web_contents_->GetBrowserContext());
+  return cef_browser_context->IsPrintPreviewSupported();
 }
 
 void CefBrowserPlatformDelegateAlloy::Print() {
   REQUIRE_ALLOY_RUNTIME();
 
-  auto actionable_contents = GetActionableWebContents();
+  auto contents_to_use = printing::GetWebContentsToUse(web_contents_);
-  if (!actionable_contents)
+  if (!contents_to_use)
     return;
 
-  auto rfh = actionable_contents->GetMainFrame();
+  auto rfh_to_use = printing::GetRenderFrameHostToUse(contents_to_use);
+  if (!rfh_to_use)
+    return;
 
   if (IsPrintPreviewSupported()) {
-    GetPrintViewManager(actionable_contents)->PrintPreviewNow(rfh, false);
+    GetPrintViewManager(contents_to_use)->PrintPreviewNow(rfh_to_use, false);
   } else {
-    GetPrintViewManager(actionable_contents)->PrintNow(rfh);
+    GetPrintViewManager(contents_to_use)->PrintNow(rfh_to_use);
   }
 }
 
@@ -377,50 +376,65 @@ void CefBrowserPlatformDelegateAlloy::PrintToPDF(
     CefRefPtr<CefPdfPrintCallback> callback) {
   REQUIRE_ALLOY_RUNTIME();
 
-  content::WebContents* actionable_contents = GetActionableWebContents();
+  auto contents_to_use = printing::GetWebContentsToUse(web_contents_);
-  if (!actionable_contents)
+  if (!contents_to_use)
     return;
+
+  auto rfh_to_use = printing::GetRenderFrameHostToUse(contents_to_use);
+  if (!rfh_to_use)
+    return;
+
   printing::CefPrintViewManager::PdfPrintCallback pdf_callback;
   if (callback.get()) {
     pdf_callback = base::BindOnce(&CefPdfPrintCallback::OnPdfPrintFinished,
                                   callback.get(), path);
   }
-  GetPrintViewManager(actionable_contents)
+  GetPrintViewManager(contents_to_use)
-      ->PrintToPDF(actionable_contents->GetMainFrame(), base::FilePath(path),
+      ->PrintToPDF(rfh_to_use, base::FilePath(path), settings,
-                   settings, std::move(pdf_callback));
+                   std::move(pdf_callback));
 }
 
-void CefBrowserPlatformDelegateAlloy::Find(int identifier,
+void CefBrowserPlatformDelegateAlloy::Find(const CefString& searchText,
-                                           const CefString& searchText,
                                            bool forward,
                                            bool matchCase,
                                            bool findNext) {
   if (!web_contents_)
     return;
 
-  // Every find request must have a unique ID and these IDs must strictly
+  find_in_page::FindTabHelper::FromWebContents(web_contents_)
-  // increase so that newer requests always have greater IDs than older
+      ->StartFinding(searchText.ToString16(), forward, matchCase, findNext,
-  // requests.
+                     /*run_synchronously_for_testing=*/false);
-  if (identifier <= find_request_id_counter_)
-    identifier = ++find_request_id_counter_;
-  else
-    find_request_id_counter_ = identifier;
-
-  auto options = blink::mojom::FindOptions::New();
-  options->forward = forward;
-  options->match_case = matchCase;
-  options->find_match = findNext;
-  web_contents_->Find(identifier, searchText, std::move(options));
 }
 
 void CefBrowserPlatformDelegateAlloy::StopFinding(bool clearSelection) {
   if (!web_contents_)
     return;
 
-  content::StopFindAction action =
+  last_search_result_ = find_in_page::FindNotificationDetails();
-      clearSelection ? content::STOP_FIND_ACTION_CLEAR_SELECTION
+  find_in_page::FindTabHelper::FromWebContents(web_contents_)
-                     : content::STOP_FIND_ACTION_KEEP_SELECTION;
+      ->StopFinding(clearSelection ? find_in_page::SelectionAction::kClear
-  web_contents_->StopFinding(action);
+                                   : find_in_page::SelectionAction::kKeep);
+}
+
+bool CefBrowserPlatformDelegateAlloy::HandleFindReply(
+    int request_id,
+    int number_of_matches,
+    const gfx::Rect& selection_rect,
+    int active_match_ordinal,
+    bool final_update) {
+  if (!web_contents_)
+    return false;
+
+  auto find_in_page =
+      find_in_page::FindTabHelper::FromWebContents(web_contents_);
+
+  find_in_page->HandleFindReply(request_id, number_of_matches, selection_rect,
+                                active_match_ordinal, final_update);
+  if (!(find_in_page->find_result() == last_search_result_)) {
+    last_search_result_ = find_in_page->find_result();
+    return true;
+  }
+  return false;
 }
 
 base::RepeatingClosure
@@ -432,17 +446,6 @@ CefBrowserPlatformDelegateAlloy::GetBoundsChangedCallback() {
   return base::RepeatingClosure();
 }
 
-content::WebContents*
-CefBrowserPlatformDelegateAlloy::GetActionableWebContents() const {
-  if (web_contents_ && extensions::ExtensionsEnabled()) {
-    content::WebContents* guest_contents =
-        extensions::GetFullPageGuestForOwnerContents(web_contents_);
-    if (guest_contents)
-      return guest_contents;
-  }
-  return web_contents_;
-}
-
 void CefBrowserPlatformDelegateAlloy::SetOwnedWebContents(
     content::WebContents* owned_contents) {
   DCHECK(primary_);

libcef/browser/alloy/browser_platform_delegate_alloy.h

@@ -10,6 +10,7 @@
 #include "libcef/browser/web_contents_dialog_helper.h"
 
 #include "base/memory/weak_ptr.h"
+#include "components/find_in_page/find_notification_details.h"
 #include "content/public/browser/web_contents.h"
 #include "ui/gfx/geometry/size.h"
 
@@ -58,24 +59,28 @@ class CefBrowserPlatformDelegateAlloy : public CefBrowserPlatformDelegate {
   void PrintToPDF(const CefString& path,
                   const CefPdfPrintSettings& settings,
                   CefRefPtr<CefPdfPrintCallback> callback) override;
-  void Find(int identifier,
+  void Find(const CefString& searchText,
-            const CefString& searchText,
             bool forward,
             bool matchCase,
             bool findNext) override;
   void StopFinding(bool clearSelection) override;
 
+  // Called from AlloyBrowserHostImpl::FindReply().
+  bool HandleFindReply(int request_id,
+                       int number_of_matches,
+                       const gfx::Rect& selection_rect,
+                       int active_match_ordinal,
+                       bool final_update);
+
+  const find_in_page::FindNotificationDetails& last_search_result() const {
+    return last_search_result_;
+  }
+
  protected:
   CefBrowserPlatformDelegateAlloy();
 
   base::RepeatingClosure GetBoundsChangedCallback();
 
-  // Returns the WebContents most likely to handle an action. If extensions are
-  // enabled and this browser has a full-page guest (for example, a full-page
-  // PDF viewer extension) then the guest's WebContents will be returned.
-  // Otherwise, the browser's WebContents will be returned.
-  content::WebContents* GetActionableWebContents() const;
-
   // Called from BrowserPlatformDelegateNative::set_windowless_handler().
   void set_as_secondary() { primary_ = false; }
 
@@ -96,8 +101,9 @@ class CefBrowserPlatformDelegateAlloy : public CefBrowserPlatformDelegate {
   // Used for the print preview dialog.
   std::unique_ptr<CefWebContentsDialogHelper> web_contents_dialog_helper_;
 
-  // Used to provide unique incremental IDs for each find request.
+  // The last find result. This object contains details about the number of
-  int find_request_id_counter_ = 0;
+  // matches, the find selection rectangle, etc.
+  find_in_page::FindNotificationDetails last_search_result_;
 
   // Used when the browser is hosting an extension.
   extensions::ExtensionHost* extension_host_ = nullptr;

libcef/browser/alloy/chrome_browser_process_alloy.cc

@@ -8,9 +8,12 @@
 #include "libcef/browser/alloy/chrome_profile_manager_alloy.h"
 #include "libcef/browser/browser_context.h"
 #include "libcef/browser/context.h"
+#include "libcef/browser/extensions/extensions_browser_client.h"
 #include "libcef/browser/prefs/browser_prefs.h"
 #include "libcef/browser/thread_util.h"
 #include "libcef/common/cef_switches.h"
+#include "libcef/common/extensions/extensions_client.h"
+#include "libcef/common/extensions/extensions_util.h"
 
 #include "base/command_line.h"
 #include "chrome/browser/component_updater/chrome_component_updater_configurator.h"
@@ -38,6 +41,11 @@ ChromeBrowserProcessAlloy::ChromeBrowserProcessAlloy()
 
 ChromeBrowserProcessAlloy::~ChromeBrowserProcessAlloy() {
   DCHECK((!initialized_ && !context_initialized_) || shutdown_);
+
+  if (extensions::ExtensionsEnabled()) {
+    extensions::ExtensionsBrowserClient::Set(nullptr);
+    extensions_browser_client_.reset();
+  }
 }
 
 void ChromeBrowserProcessAlloy::Initialize() {
@@ -49,6 +57,16 @@ void ChromeBrowserProcessAlloy::Initialize() {
   // Initialize this early before any code tries to check feature flags.
   field_trial_list_ = content::SetUpFieldTrialsAndFeatureList();
 
+  if (extensions::ExtensionsEnabled()) {
+    // Initialize extension global objects before creating the global
+    // BrowserContext.
+    extensions_client_.reset(new extensions::CefExtensionsClient());
+    extensions::ExtensionsClient::Set(extensions_client_.get());
+    extensions_browser_client_.reset(
+        new extensions::CefExtensionsBrowserClient);
+    extensions::ExtensionsBrowserClient::Set(extensions_browser_client_.get());
+  }
+
   initialized_ = true;
 }
 

libcef/browser/alloy/chrome_browser_process_alloy.h

@@ -18,6 +18,11 @@
 #include "chrome/browser/extensions/event_router_forwarder.h"
 #include "media/media_buildflags.h"
 
+namespace extensions {
+class ExtensionsBrowserClient;
+class ExtensionsClient;
+}  // namespace extensions
+
 class ChromeProfileManagerAlloy;
 
 class BackgroundModeManager {
@@ -112,6 +117,10 @@ class ChromeBrowserProcessAlloy : public BrowserProcess {
   bool context_initialized_;
   bool shutdown_;
 
+  std::unique_ptr<extensions::ExtensionsClient> extensions_client_;
+  std::unique_ptr<extensions::ExtensionsBrowserClient>
+      extensions_browser_client_;
+
   std::string locale_;
   std::unique_ptr<printing::PrintJobManager> print_job_manager_;
   std::unique_ptr<ChromeProfileManagerAlloy> profile_manager_;

libcef/browser/browser_frame.cc

@@ -35,18 +35,20 @@ void CefBrowserFrame::RegisterBrowserInterfaceBindersForFrame(
 
 void CefBrowserFrame::SendMessage(const std::string& name,
                                   base::Value arguments) {
-  // Always associate with the newly created RFH, which may be speculative when
+  // Always send to the newly created RFH, which may be speculative when
   // navigating cross-origin.
   if (auto host = GetFrameHost(/*prefer_speculative=*/true)) {
     host->SendMessage(name, std::move(arguments));
   }
 }
 
-void CefBrowserFrame::FrameAttached() {
+void CefBrowserFrame::FrameAttached(
+    mojo::PendingRemote<cef::mojom::RenderFrame> render_frame,
+    bool reattached) {
   // Always send to the newly created RFH, which may be speculative when
   // navigating cross-origin.
   if (auto host = GetFrameHost(/*prefer_speculative=*/true)) {
-    host->FrameAttached();
+    host->FrameAttached(std::move(render_frame), reattached);
   }
 }
 

libcef/browser/browser_frame.h

@@ -36,7 +36,8 @@ class CefBrowserFrame
  private:
   // cef::mojom::BrowserFrame methods:
   void SendMessage(const std::string& name, base::Value arguments) override;
-  void FrameAttached() override;
+  void FrameAttached(mojo::PendingRemote<cef::mojom::RenderFrame> render_frame,
+                     bool reattached) override;
   void DidFinishFrameLoad(const GURL& validated_url,
                           int32_t http_status_code) override;
   void UpdateDraggableRegions(

libcef/browser/browser_info.cc

@@ -168,10 +168,13 @@ void CefBrowserInfo::FrameHostStateChanged(
            content::RenderFrameHost::LifecycleState::kInBackForwardCache) &&
       new_state == content::RenderFrameHost::LifecycleState::kActive) {
     if (auto frame = GetFrameForHost(host)) {
+      // Should only occur for the main frame.
+      CHECK(frame->IsMain());
+
       // Update the associated RFH, which may have changed.
       frame->MaybeReAttach(this, host);
 
-      if (frame->IsMain()) {
+      {
         // Update the main frame object.
         NotificationStateLock lock_scope(this);
         SetMainFrame(browser_, frame);

libcef/browser/browser_platform_delegate.cc

@@ -381,8 +381,7 @@ void CefBrowserPlatformDelegate::PrintToPDF(
   NOTIMPLEMENTED();
 }
 
-void CefBrowserPlatformDelegate::Find(int identifier,
+void CefBrowserPlatformDelegate::Find(const CefString& searchText,
-                                      const CefString& searchText,
                                       bool forward,
                                       bool matchCase,
                                       bool findNext) {

libcef/browser/browser_platform_delegate.h

@@ -353,8 +353,7 @@ class CefBrowserPlatformDelegate {
   virtual void PrintToPDF(const CefString& path,
                           const CefPdfPrintSettings& settings,
                           CefRefPtr<CefPdfPrintCallback> callback);
-  virtual void Find(int identifier,
+  virtual void Find(const CefString& searchText,
-                    const CefString& searchText,
                     bool forward,
                     bool matchCase,
                     bool findNext);

libcef/browser/chrome/chrome_browser_host_impl.cc

@@ -215,8 +215,7 @@ void ChromeBrowserHostImpl::PrintToPDF(
   callback->OnPdfPrintFinished(CefString(), false);
 }
 
-void ChromeBrowserHostImpl::Find(int identifier,
+void ChromeBrowserHostImpl::Find(const CefString& searchText,
-                                 const CefString& searchText,
                                  bool forward,
                                  bool matchCase,
                                  bool findNext) {

libcef/browser/chrome/chrome_browser_host_impl.h

@@ -74,8 +74,7 @@ class ChromeBrowserHostImpl : public CefBrowserHostBase {
   void PrintToPDF(const CefString& path,
                   const CefPdfPrintSettings& settings,
                   CefRefPtr<CefPdfPrintCallback> callback) override;
-  void Find(int identifier,
+  void Find(const CefString& searchText,
-            const CefString& searchText,
             bool forward,
             bool matchCase,
             bool findNext) override;

libcef/browser/chrome/chrome_content_browser_client_cef.cc

@@ -127,16 +127,6 @@ void ChromeContentBrowserClientCef::AppendExtraCommandLineSwitches(
     };
     command_line->CopySwitchesFrom(*browser_cmd, kSwitchNames,
                                    base::size(kSwitchNames));
-
-#if !BUILDFLAG(IS_WIN)
-    // kPdfRenderer will be set for Windows in
-    // RenderProcessHostImpl::AppendRendererCommandLine.
-    content::RenderProcessHost* process =
-        content::RenderProcessHost::FromID(child_process_id);
-    if (process && process->IsPdf()) {
-      command_line->AppendSwitch(switches::kPdfRenderer);
-    }
-#endif  // !BUILDFLAG(IS_WIN)
   }
 
   CefRefPtr<CefApp> app = CefAppManager::Get()->GetApplication();

libcef/browser/extensions/api/file_system/cef_file_system_delegate.cc

@@ -0,0 +1,134 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "libcef/browser/extensions/api/file_system/cef_file_system_delegate.h"
+
+#include "libcef/browser/alloy/alloy_dialog_util.h"
+
+#include "apps/saved_files_service.h"
+#include "base/callback.h"
+#include "base/callback_forward.h"
+#include "base/files/file_path.h"
+#include "chrome/grit/generated_resources.h"
+#include "extensions/common/api/file_system.h"
+#include "extensions/common/extension.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
+
+using blink::mojom::FileChooserParams;
+
+namespace extensions {
+namespace cef {
+
+CefFileSystemDelegate::CefFileSystemDelegate() = default;
+
+CefFileSystemDelegate::~CefFileSystemDelegate() = default;
+
+base::FilePath CefFileSystemDelegate::GetDefaultDirectory() {
+  return base::FilePath();
+}
+
+base::FilePath CefFileSystemDelegate::GetManagedSaveAsDirectory(
+    content::BrowserContext* browser_context,
+    const Extension& extension) {
+  return base::FilePath();
+}
+
+bool CefFileSystemDelegate::ShowSelectFileDialog(
+    scoped_refptr<ExtensionFunction> extension_function,
+    ui::SelectFileDialog::Type type,
+    const base::FilePath& default_path,
+    const ui::SelectFileDialog::FileTypeInfo* file_types,
+    FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+    base::OnceClosure file_selection_canceled_callback) {
+  auto web_contents = extension_function->GetSenderWebContents();
+  if (!web_contents) {
+    return false;
+  }
+
+  absl::optional<FileChooserParams::Mode> mode;
+  switch (type) {
+    case ui::SelectFileDialog::Type::SELECT_UPLOAD_FOLDER:
+      mode = FileChooserParams::Mode::kUploadFolder;
+      break;
+    case ui::SelectFileDialog::Type::SELECT_SAVEAS_FILE:
+      mode = FileChooserParams::Mode::kSave;
+      break;
+    case ui::SelectFileDialog::Type::SELECT_OPEN_FILE:
+      mode = FileChooserParams::Mode::kOpen;
+      break;
+    case ui::SelectFileDialog::Type::SELECT_OPEN_MULTI_FILE:
+      mode = FileChooserParams::Mode::kOpenMultiple;
+      break;
+    default:
+      NOTIMPLEMENTED();
+      return false;
+  }
+
+  FileChooserParams params;
+  params.mode = *mode;
+  params.default_file_name = default_path;
+  if (file_types) {
+    // A list of allowed extensions. For example, it might be
+    //   { { "htm", "html" }, { "txt" } }
+    for (auto& vec : file_types->extensions) {
+      for (auto& ext : vec) {
+        params.accept_types.push_back(
+            alloy::FilePathTypeToString16(FILE_PATH_LITERAL(".") + ext));
+      }
+    }
+  }
+
+  alloy::RunFileChooser(
+      web_contents, params,
+      base::BindOnce(&CefFileSystemDelegate::FileDialogDismissed,
+                     weak_ptr_factory_.GetWeakPtr(),
+                     std::move(files_selected_callback),
+                     std::move(file_selection_canceled_callback)));
+
+  return true;
+}
+
+void CefFileSystemDelegate::FileDialogDismissed(
+    FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+    base::OnceClosure file_selection_canceled_callback,
+    int selected_accept_filter,
+    const std::vector<base::FilePath>& file_paths) {
+  if (!file_paths.empty()) {
+    std::move(files_selected_callback).Run(file_paths);
+  } else {
+    std::move(file_selection_canceled_callback).Run();
+  }
+}
+
+void CefFileSystemDelegate::ConfirmSensitiveDirectoryAccess(
+    bool has_write_permission,
+    const std::u16string& app_name,
+    content::WebContents* web_contents,
+    base::OnceClosure on_accept,
+    base::OnceClosure on_cancel) {
+  NOTIMPLEMENTED();
+
+  // Run the cancel callback by default.
+  std::move(on_cancel).Run();
+}
+
+// Based on ChromeFileSystemDelegate::GetDescriptionIdForAcceptType.
+int CefFileSystemDelegate::GetDescriptionIdForAcceptType(
+    const std::string& accept_type) {
+  if (accept_type == "image/*")
+    return IDS_IMAGE_FILES;
+  if (accept_type == "audio/*")
+    return IDS_AUDIO_FILES;
+  if (accept_type == "video/*")
+    return IDS_VIDEO_FILES;
+  return 0;
+}
+
+SavedFilesServiceInterface* CefFileSystemDelegate::GetSavedFilesService(
+    content::BrowserContext* browser_context) {
+  return apps::SavedFilesService::Get(browser_context);
+}
+
+}  // namespace cef
+}  // namespace extensions

libcef/browser/extensions/api/file_system/cef_file_system_delegate.h

@@ -0,0 +1,68 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_EXTENSIONS_API_FILE_SYSTEM_FILE_SYSTEM_DELEGATE_H_
+#define CEF_LIBCEF_BROWSER_EXTENSIONS_API_FILE_SYSTEM_FILE_SYSTEM_DELEGATE_H_
+
+#include <memory>
+
+#include "base/callback.h"
+#include "base/compiler_specific.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/weak_ptr.h"
+#include "extensions/browser/api/execute_code_function.h"
+#include "extensions/browser/api/file_system/file_system_delegate.h"
+#include "extensions/browser/extension_function.h"
+
+namespace content {
+class WebContents;
+}
+
+namespace extensions {
+namespace cef {
+
+class CefFileSystemDelegate : public FileSystemDelegate {
+ public:
+  CefFileSystemDelegate();
+
+  CefFileSystemDelegate(const CefFileSystemDelegate&) = delete;
+  CefFileSystemDelegate& operator=(const CefFileSystemDelegate&) = delete;
+
+  ~CefFileSystemDelegate() override;
+
+  // FileSystemDelegate
+  base::FilePath GetDefaultDirectory() override;
+  base::FilePath GetManagedSaveAsDirectory(
+      content::BrowserContext* browser_context,
+      const Extension& extension) override;
+  bool ShowSelectFileDialog(
+      scoped_refptr<ExtensionFunction> extension_function,
+      ui::SelectFileDialog::Type type,
+      const base::FilePath& default_path,
+      const ui::SelectFileDialog::FileTypeInfo* file_types,
+      FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+      base::OnceClosure file_selection_canceled_callback) override;
+  void ConfirmSensitiveDirectoryAccess(bool has_write_permission,
+                                       const std::u16string& app_name,
+                                       content::WebContents* web_contents,
+                                       base::OnceClosure on_accept,
+                                       base::OnceClosure on_cancel) override;
+  int GetDescriptionIdForAcceptType(const std::string& accept_type) override;
+  SavedFilesServiceInterface* GetSavedFilesService(
+      content::BrowserContext* browser_context) override;
+
+ private:
+  void FileDialogDismissed(
+      FileSystemDelegate::FilesSelectedCallback files_selected_callback,
+      base::OnceClosure file_selection_canceled_callback,
+      int selected_accept_filter,
+      const std::vector<base::FilePath>& file_paths);
+
+  base::WeakPtrFactory<CefFileSystemDelegate> weak_ptr_factory_{this};
+};
+
+}  // namespace cef
+}  // namespace extensions
+
+#endif  // CEF_LIBCEF_BROWSER_EXTENSIONS_API_FILE_SYSTEM_FILE_SYSTEM_DELEGATE_H_

libcef/browser/extensions/browser_extensions_util.cc

@@ -15,7 +15,6 @@
 
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/printing/print_preview_dialog_controller.h"
-#include "content/browser/browser_plugin/browser_plugin_embedder.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
@@ -36,21 +35,6 @@ bool InsertWebContents(std::vector<content::WebContents*>* vector,
 
 }  // namespace
 
-content::WebContents* GetFullPageGuestForOwnerContents(
-    content::WebContents* owner) {
-  content::WebContentsImpl* owner_impl =
-      static_cast<content::WebContentsImpl*>(owner);
-  content::BrowserPluginEmbedder* plugin_embedder =
-      owner_impl->GetBrowserPluginEmbedder();
-  if (plugin_embedder) {
-    content::BrowserPluginGuest* plugin_guest =
-        plugin_embedder->GetFullPageGuest();
-    if (plugin_guest)
-      return plugin_guest->web_contents();
-  }
-  return nullptr;
-}
-
 void GetAllGuestsForOwnerContents(content::WebContents* owner,
                                   std::vector<content::WebContents*>* guests) {
   content::BrowserPluginGuestManager* plugin_guest_manager =

libcef/browser/extensions/browser_extensions_util.h

@@ -26,10 +26,6 @@ namespace extensions {
 
 class Extension;
 
-// Returns the full-page guest WebContents for the specified |owner|, if any.
-content::WebContents* GetFullPageGuestForOwnerContents(
-    content::WebContents* owner);
-
 // Populates |guests| with all guest WebContents with the specified |owner|.
 void GetAllGuestsForOwnerContents(content::WebContents* owner,
                                   std::vector<content::WebContents*>* guests);

libcef/browser/extensions/extensions_api_client.cc

@@ -7,6 +7,7 @@
 
 #include "include/internal/cef_types_wrappers.h"
 #include "libcef/browser/browser_context.h"
+#include "libcef/browser/extensions/api/file_system/cef_file_system_delegate.h"
 #include "libcef/browser/extensions/api/storage/sync_value_store_cache.h"
 #include "libcef/browser/extensions/extension_web_contents_observer.h"
 #include "libcef/browser/extensions/mime_handler_view_guest_delegate.h"
@@ -52,8 +53,6 @@ void CefExtensionsAPIClient::AttachWebContentsHelpers(
   PrefsTabHelper::CreateForWebContents(web_contents);
   printing::CefPrintViewManager::CreateForWebContents(web_contents);
 
-  CefExtensionWebContentsObserver::CreateForWebContents(web_contents);
-
   // Used by the PDF extension.
   pdf::PDFWebContentsHelper::CreateForWebContentsWithClient(
       web_contents, std::unique_ptr<pdf::PDFWebContentsHelperClient>(
@@ -76,4 +75,10 @@ void CefExtensionsAPIClient::AddAdditionalValueStoreCaches(
   (*caches)[settings_namespace::SYNC] = new cef::SyncValueStoreCache(factory);
 }
 
+FileSystemDelegate* CefExtensionsAPIClient::GetFileSystemDelegate() {
+  if (!file_system_delegate_)
+    file_system_delegate_ = std::make_unique<cef::CefFileSystemDelegate>();
+  return file_system_delegate_.get();
+}
+
 }  // namespace extensions

libcef/browser/extensions/extensions_api_client.h

@@ -25,6 +25,7 @@ class CefExtensionsAPIClient : public ExtensionsAPIClient {
       MimeHandlerViewGuest* guest) const override;
   void AttachWebContentsHelpers(
       content::WebContents* web_contents) const override;
+  FileSystemDelegate* GetFileSystemDelegate() override;
 
   // Storage API support.
 
@@ -37,6 +38,9 @@ class CefExtensionsAPIClient : public ExtensionsAPIClient {
           observers,
       std::map<settings_namespace::Namespace, ValueStoreCache*>* caches)
       override;
+
+ private:
+  std::unique_ptr<FileSystemDelegate> file_system_delegate_;
 };
 
 }  // namespace extensions

libcef/browser/frame_host_impl.cc

@@ -449,13 +449,12 @@ bool CefFrameHostImpl::Detach() {
   }
 
   // In case we never attached, clean up.
-  while (!queued_actions_.empty()) {
+  while (!queued_renderer_actions_.empty()) {
-    queued_actions_.pop();
+    queued_renderer_actions_.pop();
   }
 
   render_frame_.reset();
   render_frame_host_ = nullptr;
-  is_attached_ = false;
 
   return first_detach;
 }
@@ -464,14 +463,14 @@ void CefFrameHostImpl::MaybeReAttach(
     scoped_refptr<CefBrowserInfo> browser_info,
     content::RenderFrameHost* render_frame_host) {
   CEF_REQUIRE_UIT();
-  if (is_attached_ && render_frame_host_ == render_frame_host) {
+  if (render_frame_.is_bound() && render_frame_host_ == render_frame_host) {
     // Nothing to do here.
     return;
   }
 
   // We expect that Detach() was called previously.
   CHECK(!is_temporary());
-  CHECK(!is_attached_);
+  CHECK(!render_frame_.is_bound());
   CHECK(!render_frame_host_);
 
   // The RFH may change but the GlobalId should remain the same.
@@ -486,8 +485,7 @@ void CefFrameHostImpl::MaybeReAttach(
   render_frame_host_ = render_frame_host;
   RefreshAttributes();
 
-  // Restore the RenderFrame connection.
+  // We expect a reconnect to be triggered via FrameAttached().
-  FrameAttachedInternal(/*reattached=*/true);
 }
 
 // kMainFrameId must be -1 to align with renderer expectations.
@@ -517,20 +515,6 @@ CefRefPtr<CefBrowserHostBase> CefFrameHostImpl::GetBrowserHostBase() const {
   return nullptr;
 }
 
-const mojo::Remote<cef::mojom::RenderFrame>&
-CefFrameHostImpl::GetRenderFrame() {
-  CEF_REQUIRE_UIT();
-  DCHECK(is_attached_);
-
-  if (!render_frame_.is_bound() && render_frame_host_ &&
-      render_frame_host_->GetRemoteInterfaces()) {
-    // Connects to a CefFrameImpl that already exists in the renderer process.
-    render_frame_host_->GetRemoteInterfaces()->GetInterface(
-        render_frame_.BindNewPipeAndPassReceiver());
-  }
-  return render_frame_;
-}
-
 void CefFrameHostImpl::SendToRenderFrame(const std::string& function_name,
                                          RenderFrameAction action) {
   if (!CEF_CURRENTLY_ON_UIT()) {
@@ -553,18 +537,22 @@ void CefFrameHostImpl::SendToRenderFrame(const std::string& function_name,
     return;
   }
 
-  if (!is_attached_) {
+  if (!render_frame_.is_bound()) {
     // Queue actions until we're notified by the renderer that it's ready to
     // handle them.
-    queued_actions_.push(std::make_pair(function_name, std::move(action)));
+    queued_renderer_actions_.push(
+        std::make_pair(function_name, std::move(action)));
     return;
   }
 
-  auto& render_frame = GetRenderFrame();
+  std::move(action).Run(render_frame_);
-  if (!render_frame)
+}
-    return;
 
-  std::move(action).Run(render_frame);
+void CefFrameHostImpl::OnRenderFrameDisconnect() {
+  CEF_REQUIRE_UIT();
+
+  // Reconnect, if any, will be triggered via FrameAttached().
+  render_frame_.reset();
 }
 
 void CefFrameHostImpl::SendMessage(const std::string& name,
@@ -581,12 +569,11 @@ void CefFrameHostImpl::SendMessage(const std::string& name,
   }
 }
 
-void CefFrameHostImpl::FrameAttached() {
+void CefFrameHostImpl::FrameAttached(
-  FrameAttachedInternal(/*reattached=*/false);
+    mojo::PendingRemote<cef::mojom::RenderFrame> render_frame_remote,
-}
+    bool reattached) {
-
-void CefFrameHostImpl::FrameAttachedInternal(bool reattached) {
   CEF_REQUIRE_UIT();
+  CHECK(render_frame_remote);
 
   auto browser_info = GetBrowserInfo();
   if (!browser_info) {
@@ -594,27 +581,32 @@ void CefFrameHostImpl::FrameAttachedInternal(bool reattached) {
     return;
   }
 
-  DCHECK(!is_attached_);
+  if (reattached) {
-  if (!is_attached_) {
+    LOG(INFO) << (is_main_frame_ ? "main" : "sub") << "frame "
-    is_attached_ = true;
+              << frame_util::GetFrameDebugString(frame_id_)
-
+              << " has reconnected";
-    auto& render_frame = GetRenderFrame();
-    while (!queued_actions_.empty()) {
-      if (render_frame) {
-        std::move(queued_actions_.front().second).Run(render_frame);
-      }
-      queued_actions_.pop();
-    }
-
-    browser_info->MaybeExecuteFrameNotification(base::BindOnce(
-        [](CefRefPtr<CefFrameHostImpl> self, bool reattached,
-           CefRefPtr<CefFrameHandler> handler) {
-          if (auto browser = self->GetBrowserHostBase()) {
-            handler->OnFrameAttached(browser, self, reattached);
-          }
-        },
-        CefRefPtr<CefFrameHostImpl>(this), reattached));
   }
+
+  render_frame_.Bind(std::move(render_frame_remote));
+  render_frame_.set_disconnect_handler(
+      base::BindOnce(&CefFrameHostImpl::OnRenderFrameDisconnect, this));
+
+  // Notify the renderer process that it can start sending messages.
+  render_frame_->FrameAttachedAck();
+
+  while (!queued_renderer_actions_.empty()) {
+    std::move(queued_renderer_actions_.front().second).Run(render_frame_);
+    queued_renderer_actions_.pop();
+  }
+
+  browser_info->MaybeExecuteFrameNotification(base::BindOnce(
+      [](CefRefPtr<CefFrameHostImpl> self, bool reattached,
+         CefRefPtr<CefFrameHandler> handler) {
+        if (auto browser = self->GetBrowserHostBase()) {
+          handler->OnFrameAttached(browser, self, reattached);
+        }
+      },
+      CefRefPtr<CefFrameHostImpl>(this), reattached));
 }
 
 void CefFrameHostImpl::DidFinishFrameLoad(const GURL& validated_url,

libcef/browser/frame_host_impl.h

@@ -130,7 +130,8 @@ class CefFrameHostImpl : public CefFrame, public cef::mojom::BrowserFrame {
 
   // cef::mojom::BrowserFrame methods forwarded from CefBrowserFrame.
   void SendMessage(const std::string& name, base::Value arguments) override;
-  void FrameAttached() override;
+  void FrameAttached(mojo::PendingRemote<cef::mojom::RenderFrame> render_frame,
+                     bool reattached) override;
   void DidFinishFrameLoad(const GURL& validated_url,
                           int32_t http_status_code) override;
   void UpdateDraggableRegions(
@@ -152,17 +153,14 @@ class CefFrameHostImpl : public CefFrame, public cef::mojom::BrowserFrame {
   scoped_refptr<CefBrowserInfo> GetBrowserInfo() const;
   CefRefPtr<CefBrowserHostBase> GetBrowserHostBase() const;
 
-  // Returns the remote RenderFrame object.
-  using RenderFrameType = mojo::Remote<cef::mojom::RenderFrame>;
-  const RenderFrameType& GetRenderFrame();
-
   // Send an action to the remote RenderFrame. This will queue the action if the
   // remote frame is not yet attached.
+  using RenderFrameType = mojo::Remote<cef::mojom::RenderFrame>;
   using RenderFrameAction = base::OnceCallback<void(const RenderFrameType&)>;
   void SendToRenderFrame(const std::string& function_name,
                          RenderFrameAction action);
 
-  void FrameAttachedInternal(bool reattached);
+  void OnRenderFrameDisconnect();
 
   const bool is_main_frame_;
 
@@ -179,9 +177,8 @@ class CefFrameHostImpl : public CefFrame, public cef::mojom::BrowserFrame {
   // The following members are only accessed on the UI thread.
   content::RenderFrameHost* render_frame_host_ = nullptr;
 
-  bool is_attached_ = false;
+  std::queue<std::pair<std::string, RenderFrameAction>>
-
+      queued_renderer_actions_;
-  std::queue<std::pair<std::string, RenderFrameAction>> queued_actions_;
 
   mojo::Remote<cef::mojom::RenderFrame> render_frame_;
 

libcef/browser/main_runner.cc

@@ -482,6 +482,16 @@ void CefMainRunner::FinishShutdownOnUIThread(
     base::WaitableEvent* uithread_shutdown_event) {
   CEF_REQUIRE_UIT();
 
+  // Execute all pending tasks now before proceeding with shutdown. Otherwise,
+  // objects bound to tasks and released at the end of shutdown via
+  // BrowserTaskExecutor::Shutdown may attempt to access other objects that have
+  // already been destroyed (for example, if teardown results in a call to
+  // RenderProcessHostImpl::Cleanup).
+  content::BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(
+      content::BrowserThread::UI);
+  content::BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(
+      content::BrowserThread::IO);
+
   static_cast<content::ContentMainRunnerImpl*>(main_runner_.get())
       ->ShutdownOnUIThread();
 

libcef/browser/net/chrome_scheme_handler.cc

@@ -32,6 +32,7 @@
 #include "cef/grit/cef_resources.h"
 #include "chrome/browser/browser_about_handler.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.h"
 #include "chrome/browser/ui/webui/chrome_web_ui_controller_factory.h"
 #include "chrome/browser/ui/webui/theme_source.h"
 #include "chrome/common/url_constants.h"
@@ -530,8 +531,10 @@ class CefWebUIControllerFactory : public content::WebUIControllerFactory {
 
   // Returns true if WebUI is allowed to handle the specified |url|.
   static bool AllowWebUIForURL(const GURL& url) {
-    if (!url.SchemeIs(content::kChromeUIScheme))
+    if (!url.SchemeIs(content::kChromeUIScheme) &&
+        !url.SchemeIs(content::kChromeUIUntrustedScheme)) {
       return false;
+    }
 
     if (IsAllowedWebUIHost(url.host()))
       return true;
@@ -579,6 +582,11 @@ class CefWebUIControllerFactory : public content::WebUIControllerFactory {
     if (controller.get())
       return controller;
 
+    controller = ChromeUntrustedWebUIControllerFactory::GetInstance()
+                     ->CreateWebUIControllerForURL(web_ui, url);
+    if (controller.get())
+      return controller;
+
     return ChromeWebUIControllerFactory::GetInstance()
         ->CreateWebUIControllerForURL(web_ui, url);
   }
@@ -599,6 +607,11 @@ class CefWebUIControllerFactory : public content::WebUIControllerFactory {
     if (type != content::WebUI::kNoWebUI)
       return type;
 
+    type = ChromeUntrustedWebUIControllerFactory::GetInstance()->GetWebUIType(
+        browser_context, url);
+    if (type != content::WebUI::kNoWebUI)
+      return type;
+
     type = ChromeWebUIControllerFactory::GetInstance()->GetWebUIType(
         browser_context, url);
     if (type != content::WebUI::kNoWebUI)
@@ -619,6 +632,8 @@ class CefWebUIControllerFactory : public content::WebUIControllerFactory {
 
     if (content::ContentWebUIControllerFactory::GetInstance()->UseWebUIForURL(
             browser_context, url) ||
+        ChromeUntrustedWebUIControllerFactory::GetInstance()->UseWebUIForURL(
+            browser_context, url) ||
         ChromeWebUIControllerFactory::GetInstance()->UseWebUIForURL(
             browser_context, url)) {
       return true;

libcef/browser/net/internal_scheme_handler.cc

@@ -42,6 +42,8 @@ std::string GetMimeType(const std::string& filename) {
   // Check for newer extensions used by internal resources but not yet
   // recognized by the mime type detector.
   const std::string& extension = CefString(file_path.FinalExtension());
+  if (extension == ".md")
+    return "text/markdown";
   if (extension == ".woff2")
     return "application/font-woff2";
 

libcef/browser/net_service/proxy_url_loader_factory.cc

@@ -227,7 +227,8 @@ class InterceptedRequest : public network::mojom::URLLoader,
 
   // mojom::URLLoaderClient methods:
   void OnReceiveEarlyHints(network::mojom::EarlyHintsPtr early_hints) override;
-  void OnReceiveResponse(network::mojom::URLResponseHeadPtr head) override;
+  void OnReceiveResponse(network::mojom::URLResponseHeadPtr head,
+                         mojo::ScopedDataPipeConsumerHandle body) override;
   void OnReceiveRedirect(const net::RedirectInfo& redirect_info,
                          network::mojom::URLResponseHeadPtr head) override;
   void OnUploadProgress(int64_t current_position,
@@ -333,6 +334,7 @@ class InterceptedRequest : public network::mojom::URLLoader,
 
   network::ResourceRequest request_;
   network::mojom::URLResponseHeadPtr current_response_;
+  mojo::ScopedDataPipeConsumerHandle current_body_;
   scoped_refptr<net::HttpResponseHeaders> current_headers_;
   scoped_refptr<net::HttpResponseHeaders> override_headers_;
   GURL original_url_;
@@ -556,8 +558,10 @@ void InterceptedRequest::OnReceiveEarlyHints(
 }
 
 void InterceptedRequest::OnReceiveResponse(
-    network::mojom::URLResponseHeadPtr head) {
+    network::mojom::URLResponseHeadPtr head,
+    mojo::ScopedDataPipeConsumerHandle body) {
   current_response_ = std::move(head);
+  current_body_ = std::move(body);
 
   if (current_request_uses_header_client_) {
     // Use the headers we got from OnHeadersReceived as that'll contain
@@ -580,6 +584,7 @@ void InterceptedRequest::OnReceiveRedirect(
   bool needs_callback = false;
 
   current_response_ = std::move(head);
+  current_body_.reset();
 
   if (current_request_uses_header_client_) {
     // Use the headers we got from OnHeadersReceived as that'll contain
@@ -743,6 +748,7 @@ void InterceptedRequest::InterceptResponseReceived(
     current_response_ = network::mojom::URLResponseHead::New();
     current_response_->request_start = base::TimeTicks::Now();
     current_response_->response_start = base::TimeTicks::Now();
+    current_body_.reset();
 
     auto headers = MakeResponseHeaders(
         net::HTTP_TEMPORARY_REDIRECT, std::string(), std::string(),
@@ -1041,7 +1047,8 @@ void InterceptedRequest::ContinueToResponseStarted(int error_code) {
     if (proxied_client_receiver_.is_bound())
       proxied_client_receiver_.Resume();
 
-    target_client_->OnReceiveResponse(std::move(current_response_));
+    target_client_->OnReceiveResponse(std::move(current_response_),
+                                      std::move(current_body_));
   }
 
   if (stream_loader_)

libcef/browser/net_service/stream_reader_url_loader.cc

@@ -697,7 +697,8 @@ void StreamReaderURLLoader::ContinueWithResponseHeaders(
     // |this| will be deleted.
     CleanUp();
   } else {
-    client_->OnReceiveResponse(std::move(pending_response));
+    client_->OnReceiveResponse(std::move(pending_response),
+                               mojo::ScopedDataPipeConsumerHandle());
   }
 }
 

libcef/common/alloy/alloy_main_delegate.cc

@@ -38,6 +38,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
+#include "content/public/common/url_constants.h"
 #include "extensions/common/constants.h"
 #include "net/base/features.h"
 #include "pdf/pdf_ppapi.h"
@@ -60,7 +61,8 @@
 namespace {
 
 const char* const kNonWildcardDomainNonPortSchemes[] = {
-    extensions::kExtensionScheme};
+    extensions::kExtensionScheme, content::kChromeDevToolsScheme,
+    content::kChromeUIScheme, content::kChromeUIUntrustedScheme};
 const size_t kNonWildcardDomainNonPortSchemesSize =
     base::size(kNonWildcardDomainNonPortSchemes);
 

libcef/common/cef_switches.cc

@@ -137,10 +137,4 @@ const char kFrameworkDirPath[] = "framework-dir-path";
 const char kMainBundlePath[] = "main-bundle-path";
 #endif
 
-#if !BUILDFLAG(IS_WIN)
-// Renderer process that runs the non-PPAPI PDF plugin.
-// This is defined in content/public/common/content_switches.h for Windows.
-const char kPdfRenderer[] = "pdf-renderer";
-#endif
-
 }  // namespace switches

libcef/common/cef_switches.h

@@ -62,10 +62,6 @@ extern const char kFrameworkDirPath[];
 extern const char kMainBundlePath[];
 #endif
 
-#if !BUILDFLAG(IS_WIN)
-extern const char kPdfRenderer[];
-#endif
-
 }  // namespace switches
 
 #endif  // CEF_LIBCEF_COMMON_CEF_SWITCHES_H_

libcef/common/mojom/cef.mojom

@@ -19,21 +19,6 @@ struct DraggableRegionEntry {
   bool draggable;
 };
 
-// Interface for communicating with a frame in the browser process.
-interface BrowserFrame {
-  // Send a message to the browser process.
-  SendMessage(string name, mojo_base.mojom.ListValue arguments);
-
-  // The render frame is ready to begin handling actions.
-  FrameAttached();
-
-  // The render frame has finished loading.
-  DidFinishFrameLoad(url.mojom.Url validated_url, int32 http_status_code);
-
-  // Draggable regions have updated.
-  UpdateDraggableRegions(array<DraggableRegionEntry>? regions);
-};
-
 // Structure passed to LoadRequest().
 struct RequestParams {
   // Request method.
@@ -64,6 +49,9 @@ struct RequestParams {
 
 // Interface for communicating with a frame in the renderer process.
 interface RenderFrame {
+  // Browser process has received the FrameAttached() message.
+  FrameAttachedAck();
+
   // Send a message to the render process.
   SendMessage(string name, mojo_base.mojom.ListValue arguments);
 
@@ -91,6 +79,22 @@ interface RenderFrame {
   MoveOrResizeStarted();
 };
 
+// Interface for communicating with a frame in the browser process.
+interface BrowserFrame {
+  // Send a message to the browser process.
+  SendMessage(string name, mojo_base.mojom.ListValue arguments);
+
+  // The render frame is ready to begin handling actions.
+  FrameAttached(pending_remote<RenderFrame> render_frame,
+                bool reattached);
+
+  // The render frame has finished loading.
+  DidFinishFrameLoad(url.mojom.Url validated_url, int32 http_status_code);
+
+  // Draggable regions have updated.
+  UpdateDraggableRegions(array<DraggableRegionEntry>? regions);
+};
+
 struct CrossOriginWhiteListEntry {
   string source_origin;
   string target_protocol;

libcef/common/net/scheme_registration.cc

@@ -59,6 +59,7 @@ bool IsInternalHandledScheme(const std::string& scheme) {
       url::kBlobScheme,
       content::kChromeDevToolsScheme,
       content::kChromeUIScheme,
+      content::kChromeUIUntrustedScheme,
       url::kDataScheme,
       extensions::kExtensionScheme,
       url::kFileScheme,

libcef/features/BUILD.gn

@@ -88,7 +88,12 @@ buildflag_header("features") {
 # Configuration for all targets that include CEF source code library-side.
 config("config") {
   # CEF sources use includes relative to the CEF root directory.
-  include_dirs = [ "//cef" ]
+  include_dirs = [
+    "//cef",
+
+    # CEF generates some header files that also need to be discoverable.
+    "$root_build_dir/includes",
+  ]
   defines = [
     "BUILDING_CEF_SHARED",
     "USING_CHROMIUM_INCLUDES",

libcef/renderer/blink_glue.cc

@@ -29,12 +29,14 @@
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/core/loader/frame_load_request.h"
+#include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/platform/bindings/script_forbidden_scope.h"
 #include "third_party/blink/renderer/platform/bindings/v8_binding.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_response.h"
 #include "third_party/blink/renderer/platform/loader/fetch/script_fetch_options.h"
 #include "third_party/blink/renderer/platform/scheduler/public/frame_scheduler.h"
+#include "third_party/blink/renderer/platform/scheduler/public/page_scheduler.h"
 #include "third_party/blink/renderer/platform/weborigin/scheme_registry.h"
 #undef LOG
 
@@ -86,6 +88,14 @@ void GoForward(blink::WebView* view) {
   }
 }
 
+bool IsInBackForwardCache(blink::WebLocalFrame* frame) {
+  blink::Frame* core_frame = blink::WebFrame::ToCoreFrame(*frame);
+  return blink::To<blink::LocalFrame>(core_frame)
+      ->GetPage()
+      ->GetPageScheduler()
+      ->IsInBackForwardCache();
+}
+
 blink::WebString DumpDocumentText(blink::WebLocalFrame* frame) {
   // We use the document element's text instead of the body text here because
   // not all documents have a body, such as XML documents.

libcef/renderer/blink_glue.h

@@ -39,6 +39,8 @@ BLINK_EXPORT bool CanGoForward(blink::WebView* view);
 BLINK_EXPORT void GoBack(blink::WebView* view);
 BLINK_EXPORT void GoForward(blink::WebView* view);
 
+BLINK_EXPORT bool IsInBackForwardCache(blink::WebLocalFrame* frame);
+
 // Returns the text of the document element.
 BLINK_EXPORT blink::WebString DumpDocumentText(blink::WebLocalFrame* frame);
 // Returns the markup of the document element.

libcef/renderer/frame_impl.cc

@@ -48,6 +48,19 @@
 #include "third_party/blink/public/web/web_script_source.h"
 #include "third_party/blink/public/web/web_view.h"
 
+namespace {
+
+// Maximum number of times to retry the browser connection.
+constexpr size_t kConnectionRetryMaxCt = 3U;
+
+// Length of time to wait before initiating a browser connection retry.
+constexpr auto kConnectionRetryDelay = base::Seconds(1);
+
+// Length of time to wait for the browser connection ACK before timing out.
+constexpr auto kConnectionTimeout = base::Seconds(4);
+
+}  // namespace
+
 CefFrameImpl::CefFrameImpl(CefBrowserImpl* browser,
                            blink::WebLocalFrame* frame,
                            int64_t frame_id)
@@ -254,15 +267,16 @@ void CefFrameImpl::SendProcessMessage(CefProcessId target_process,
   if (!message || !message->IsValid())
     return;
 
-  if (!frame_)
+  SendToBrowserFrame(
-    return;
+      __FUNCTION__,
-
+      base::BindOnce(
-  auto& browser_frame = GetBrowserFrame();
+          [](CefRefPtr<CefProcessMessage> message,
-  if (!browser_frame)
+             const BrowserFrameType& browser_frame) {
-    return;
+            auto impl = static_cast<CefProcessMessageImpl*>(message.get());
-
+            browser_frame->SendMessage(impl->GetName(),
-  auto impl = static_cast<CefProcessMessageImpl*>(message.get());
+                                       impl->TakeArgumentList());
-  browser_frame->SendMessage(impl->GetName(), impl->TakeArgumentList());
+          },
+          message));
 }
 
 std::unique_ptr<blink::WebURLLoader> CefFrameImpl::CreateURLLoader() {
@@ -298,14 +312,15 @@ CefFrameImpl::CreateResourceLoadInfoNotifierWrapper() {
   return nullptr;
 }
 
-void CefFrameImpl::OnAttached(service_manager::BinderRegistry* registry) {
+void CefFrameImpl::OnAttached() {
   // Called indirectly from RenderFrameCreated.
-  registry->AddInterface(base::BindRepeating(
+  ConnectBrowserFrame();
-      &CefFrameImpl::BindRenderFrameReceiver, weak_ptr_factory_.GetWeakPtr()));
+}
 
-  auto& browser_frame = GetBrowserFrame();
+void CefFrameImpl::OnWasShown() {
-  if (browser_frame) {
+  if (browser_connection_state_ == ConnectionState::DISCONNECTED) {
-    browser_frame->FrameAttached();
+    // Reconnect a frame that has exited the bfcache.
+    ConnectBrowserFrame();
   }
 }
 
@@ -317,10 +332,15 @@ void CefFrameImpl::OnDidFinishLoad() {
 
   blink::WebDocumentLoader* dl = frame_->GetDocumentLoader();
   const int http_status_code = dl->GetResponse().HttpStatusCode();
-  auto& browser_frame = GetBrowserFrame();
+
-  if (browser_frame) {
+  SendToBrowserFrame(__FUNCTION__,
-    browser_frame->DidFinishFrameLoad(dl->GetUrl(), http_status_code);
+                     base::BindOnce(
-  }
+                         [](const GURL& url, int http_status_code,
+                            const BrowserFrameType& browser_frame) {
+                           browser_frame->DidFinishFrameLoad(url,
+                                                             http_status_code);
+                         },
+                         dl->GetUrl(), http_status_code));
 
   CefRefPtr<CefApp> app = CefAppManager::Get()->GetApplication();
   if (app) {
@@ -356,22 +376,28 @@ void CefFrameImpl::OnDraggableRegionsChanged() {
     }
   }
 
-  auto& browser_frame = GetBrowserFrame();
+  using RegionsArg =
-  if (browser_frame) {
+      absl::optional<std::vector<cef::mojom::DraggableRegionEntryPtr>>;
-    browser_frame->UpdateDraggableRegions(
+  RegionsArg regions_arg =
-        regions.empty() ? absl::nullopt
+      regions.empty() ? absl::nullopt : absl::make_optional(std::move(regions));
-                        : absl::make_optional(std::move(regions)));
+
-  }
+  SendToBrowserFrame(
+      __FUNCTION__,
+      base::BindOnce(
+          [](RegionsArg regions_arg, const BrowserFrameType& browser_frame) {
+            browser_frame->UpdateDraggableRegions(std::move(regions_arg));
+          },
+          std::move(regions_arg)));
 }
 
 void CefFrameImpl::OnContextCreated() {
   context_created_ = true;
 
   CHECK(frame_);
-  while (!queued_actions_.empty()) {
+  while (!queued_context_actions_.empty()) {
-    auto& action = queued_actions_.front();
+    auto& action = queued_context_actions_.front();
     std::move(action.second).Run(frame_);
-    queued_actions_.pop();
+    queued_context_actions_.pop();
   }
 }
 
@@ -382,21 +408,31 @@ void CefFrameImpl::OnDetached() {
   // keep |this| alive until after this method returns.
   CefRefPtr<CefFrameImpl> self = this;
 
+  frame_ = nullptr;
+
   browser_->FrameDetached(frame_id_);
 
-  receivers_.Clear();
+  OnBrowserFrameDisconnect();
-  browser_frame_.reset();
+
   browser_ = nullptr;
-  frame_ = nullptr;
   url_loader_factory_.reset();
 
-  // In case we're destroyed without the context being created.
+  // In case we never attached.
-  while (!queued_actions_.empty()) {
+  while (!queued_browser_actions_.empty()) {
-    auto& action = queued_actions_.front();
+    auto& action = queued_browser_actions_.front();
     LOG(WARNING) << action.first << " sent to detached frame "
                  << frame_util::GetFrameDebugString(frame_id_)
                  << " will be ignored";
-    queued_actions_.pop();
+    queued_browser_actions_.pop();
+  }
+
+  // In case we're destroyed without the context being created.
+  while (!queued_context_actions_.empty()) {
+    auto& action = queued_context_actions_.front();
+    LOG(WARNING) << action.first << " sent to detached frame "
+                 << frame_util::GetFrameDebugString(frame_id_)
+                 << " will be ignored";
+    queued_context_actions_.pop();
   }
 }
 
@@ -405,7 +441,8 @@ void CefFrameImpl::ExecuteOnLocalFrame(const std::string& function_name,
   CEF_REQUIRE_RT_RETURN_VOID();
 
   if (!context_created_) {
-    queued_actions_.push(std::make_pair(function_name, std::move(action)));
+    queued_context_actions_.push(
+        std::make_pair(function_name, std::move(action)));
     return;
   }
 
@@ -418,21 +455,140 @@ void CefFrameImpl::ExecuteOnLocalFrame(const std::string& function_name,
   }
 }
 
-const mojo::Remote<cef::mojom::BrowserFrame>& CefFrameImpl::GetBrowserFrame() {
+void CefFrameImpl::ConnectBrowserFrame() {
+  DCHECK(browser_connection_state_ == ConnectionState::DISCONNECTED ||
+         browser_connection_state_ == ConnectionState::RECONNECT_PENDING);
+
+  // Don't attempt to connect an invalid or bfcache'd frame. If a bfcache'd
+  // frame returns to active status a reconnect will be triggered via
+  // OnWasShown().
+  if (!frame_ || blink_glue::IsInBackForwardCache(frame_)) {
+    browser_connection_state_ = ConnectionState::DISCONNECTED;
+    browser_connect_timer_.Stop();
+    LOG(INFO) << "Connection retry canceled for frame "
+              << frame_util::GetFrameDebugString(frame_id_);
+    return;
+  }
+
+  if (browser_connect_retry_ct_ > 0) {
+    LOG(INFO) << "Connection retry " << browser_connect_retry_ct_ << "/"
+              << kConnectionRetryMaxCt << " for frame "
+              << frame_util::GetFrameDebugString(frame_id_);
+  }
+
+  browser_connection_state_ = ConnectionState::CONNECTION_PENDING;
+  browser_connect_timer_.Start(FROM_HERE, kConnectionTimeout, this,
+                               &CefFrameImpl::OnBrowserFrameTimeout);
+
+  auto& browser_frame = GetBrowserFrame(/*expect_acked=*/false);
+  CHECK(browser_frame);
+
+  // If the channel is working we should get a call to FrameAttachedAck().
+  // Otherwise, OnBrowserFrameDisconnect() should be called to retry the
+  // connection.
+  browser_frame->FrameAttached(receiver_.BindNewPipeAndPassRemote(),
+                               browser_connect_retry_ct_ > 0);
+  receiver_.set_disconnect_handler(
+      base::BindOnce(&CefFrameImpl::OnBrowserFrameDisconnect, this));
+}
+
+const mojo::Remote<cef::mojom::BrowserFrame>& CefFrameImpl::GetBrowserFrame(
+    bool expect_acked) {
+  DCHECK_EQ(expect_acked,
+            browser_connection_state_ == ConnectionState::CONNECTION_ACKED);
+
   if (!browser_frame_.is_bound()) {
     auto render_frame = content::RenderFrameImpl::FromWebFrame(frame_);
     if (render_frame) {
       // Triggers creation of a CefBrowserFrame in the browser process.
       render_frame->GetBrowserInterfaceBroker()->GetInterface(
           browser_frame_.BindNewPipeAndPassReceiver());
+      browser_frame_.set_disconnect_handler(
+          base::BindOnce(&CefFrameImpl::OnBrowserFrameDisconnect, this));
     }
   }
   return browser_frame_;
 }
 
-void CefFrameImpl::BindRenderFrameReceiver(
+void CefFrameImpl::OnBrowserFrameTimeout() {
-    mojo::PendingReceiver<cef::mojom::RenderFrame> receiver) {
+  LOG(ERROR) << "Connection timeout for frame "
-  receivers_.Add(this, std::move(receiver));
+             << frame_util::GetFrameDebugString(frame_id_);
+  OnBrowserFrameDisconnect();
+}
+
+void CefFrameImpl::OnBrowserFrameDisconnect() {
+  // Ignore multiple calls in close proximity (which may occur if both
+  // |browser_frame_| and |receiver_| disconnect). |frame_| will be nullptr
+  // when called from/after OnDetached().
+  if (frame_ &&
+      browser_connection_state_ == ConnectionState::RECONNECT_PENDING) {
+    return;
+  }
+
+  browser_frame_.reset();
+  receiver_.reset();
+  browser_connection_state_ = ConnectionState::DISCONNECTED;
+  browser_connect_timer_.Stop();
+
+  // Only retry if the frame is still valid.
+  if (frame_) {
+    if (browser_connect_retry_ct_++ < kConnectionRetryMaxCt) {
+      // Retry after a delay in case the frame is currently navigating, being
+      // destroyed, or entering the bfcache. In the navigation case the retry
+      // will likely succeed. In the destruction case the retry will be
+      // ignored/canceled due to OnDetached(). In the bfcache case the status
+      // may not be updated immediately, so we allow the reconnect timer to
+      // trigger and check the status in ConnectBrowserFrame() instead.
+      browser_connection_state_ = ConnectionState::RECONNECT_PENDING;
+      browser_connect_timer_.Start(FROM_HERE, kConnectionRetryDelay, this,
+                                   &CefFrameImpl::ConnectBrowserFrame);
+    } else {
+      // Trigger a crash in official builds.
+      LOG(FATAL) << "Connection retry failure for frame "
+                 << frame_util::GetFrameDebugString(frame_id_);
+    }
+  }
+}
+
+void CefFrameImpl::SendToBrowserFrame(const std::string& function_name,
+                                      BrowserFrameAction action) {
+  if (!frame_) {
+    // We've been detached.
+    LOG(WARNING) << function_name << " sent to detached frame "
+                 << frame_util::GetFrameDebugString(frame_id_)
+                 << " will be ignored";
+    return;
+  }
+
+  if (browser_connection_state_ != ConnectionState::CONNECTION_ACKED) {
+    // Queue actions until we're notified by the browser that it's ready to
+    // handle them.
+    queued_browser_actions_.push(
+        std::make_pair(function_name, std::move(action)));
+    return;
+  }
+
+  auto& browser_frame = GetBrowserFrame();
+  CHECK(browser_frame);
+
+  std::move(action).Run(browser_frame);
+}
+
+void CefFrameImpl::FrameAttachedAck() {
+  // Sent from the browser process in response to ConnectBrowserFrame() sending
+  // FrameAttached().
+  CHECK_EQ(ConnectionState::CONNECTION_PENDING, browser_connection_state_);
+  browser_connection_state_ = ConnectionState::CONNECTION_ACKED;
+  browser_connect_retry_ct_ = 0;
+  browser_connect_timer_.Stop();
+
+  auto& browser_frame = GetBrowserFrame();
+  CHECK(browser_frame);
+
+  while (!queued_browser_actions_.empty()) {
+    std::move(queued_browser_actions_.front().second).Run(browser_frame);
+    queued_browser_actions_.pop();
+  }
 }
 
 void CefFrameImpl::SendMessage(const std::string& name, base::Value arguments) {

libcef/renderer/frame_impl.h

@@ -6,16 +6,18 @@
 #define CEF_LIBCEF_RENDERER_FRAME_IMPL_H_
 #pragma once
 
+#include <queue>
 #include <string>
+
 #include "include/cef_frame.h"
 #include "include/cef_v8.h"
 
 #include "base/memory/weak_ptr.h"
+#include "base/timer/timer.h"
 #include "cef/libcef/common/mojom/cef.mojom.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/receiver_set.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/service_manager/public/cpp/binder_registry.h"
 
 namespace base {
 class ListValue;
@@ -84,7 +86,8 @@ class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
   CreateResourceLoadInfoNotifierWrapper();
 
   // Forwarded from CefRenderFrameObserver.
-  void OnAttached(service_manager::BinderRegistry* registry);
+  void OnAttached();
+  void OnWasShown();
   void OnDidFinishLoad();
   void OnDraggableRegionsChanged();
   void OnContextCreated();
@@ -100,13 +103,29 @@ class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
   void ExecuteOnLocalFrame(const std::string& function_name,
                            LocalFrameAction action);
 
-  // Returns the remote BrowserFrame object.
+  // Initiate the connection to the BrowserFrame channel.
-  const mojo::Remote<cef::mojom::BrowserFrame>& GetBrowserFrame();
+  void ConnectBrowserFrame();
 
-  void BindRenderFrameReceiver(
+  // Returns the remote BrowserFrame object.
-      mojo::PendingReceiver<cef::mojom::RenderFrame> receiver);
+  using BrowserFrameType = mojo::Remote<cef::mojom::BrowserFrame>;
+  const BrowserFrameType& GetBrowserFrame(bool expect_acked = true);
+
+  // Called if the BrowserFrame connection attempt times out.
+  void OnBrowserFrameTimeout();
+
+  // Called if/when the BrowserFrame channel is disconnected. This may occur due
+  // to frame navigation, destruction, or insertion into the bfcache (when the
+  // browser-side frame representation is destroyed and closes the connection).
+  void OnBrowserFrameDisconnect();
+
+  // Send an action to the remote BrowserFrame. This will queue the action if
+  // the remote frame is not yet attached.
+  using BrowserFrameAction = base::OnceCallback<void(const BrowserFrameType&)>;
+  void SendToBrowserFrame(const std::string& function_name,
+                          BrowserFrameAction action);
 
   // cef::mojom::RenderFrame methods:
+  void FrameAttachedAck() override;
   void SendMessage(const std::string& name, base::Value arguments) override;
   void SendCommand(const std::string& command) override;
   void SendCommandWithResponse(
@@ -125,11 +144,27 @@ class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
   const int64 frame_id_;
 
   bool context_created_ = false;
-  std::queue<std::pair<std::string, LocalFrameAction>> queued_actions_;
+  std::queue<std::pair<std::string, LocalFrameAction>> queued_context_actions_;
+
+  // Number of times that browser reconnect has been attempted.
+  size_t browser_connect_retry_ct_ = 0;
+
+  // Current browser connection state.
+  enum class ConnectionState {
+    DISCONNECTED,
+    CONNECTION_PENDING,
+    CONNECTION_ACKED,
+    RECONNECT_PENDING,
+  } browser_connection_state_ = ConnectionState::DISCONNECTED;
+
+  base::OneShotTimer browser_connect_timer_;
+
+  std::queue<std::pair<std::string, BrowserFrameAction>>
+      queued_browser_actions_;
 
   std::unique_ptr<blink::WebURLLoaderFactory> url_loader_factory_;
 
-  mojo::ReceiverSet<cef::mojom::RenderFrame> receivers_;
+  mojo::Receiver<cef::mojom::RenderFrame> receiver_{this};
 
   mojo::Remote<cef::mojom::BrowserFrame> browser_frame_;
 

libcef/renderer/render_frame_observer.cc

@@ -50,6 +50,12 @@ void CefRenderFrameObserver::DidCommitProvisionalLoad(
   OnLoadStart();
 }
 
+void CefRenderFrameObserver::WasShown() {
+  if (frame_) {
+    frame_->OnWasShown();
+  }
+}
+
 void CefRenderFrameObserver::DidFailProvisionalLoad() {
   if (frame_) {
     OnLoadError();
@@ -199,7 +205,7 @@ void CefRenderFrameObserver::AttachFrame(CefFrameImpl* frame) {
   DCHECK(frame);
   DCHECK(!frame_);
   frame_ = frame;
-  frame_->OnAttached(&registry_);
+  frame_->OnAttached();
 }
 
 void CefRenderFrameObserver::OnLoadStart() {

libcef/renderer/render_frame_observer.h

@@ -27,6 +27,7 @@ class CefRenderFrameObserver : public content::RenderFrameObserver {
   ~CefRenderFrameObserver() override;
 
   // RenderFrameObserver methods:
+  void WasShown() override;
   void DidCommitProvisionalLoad(ui::PageTransition transition) override;
   void DidFailProvisionalLoad() override;
   void DidFinishLoad() override;

libcef_dll/cpptoc/browser_host_cpptoc.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=3e851a9007832ba6543257d90cfd8588e3540500$
+// $hash=a45e96e634e88deb54637d0d570a827d49282150$
 //
 
 #include "libcef_dll/cpptoc/browser_host_cpptoc.h"
@@ -424,7 +424,6 @@ browser_host_print_to_pdf(struct _cef_browser_host_t* self,
 }
 
 void CEF_CALLBACK browser_host_find(struct _cef_browser_host_t* self,
-                                    int identifier,
                                     const cef_string_t* searchText,
                                     int forward,
                                     int matchCase,
@@ -443,8 +442,8 @@ void CEF_CALLBACK browser_host_find(struct _cef_browser_host_t* self,
 
   // Execute
   CefBrowserHostCppToC::Get(self)->Find(
-      identifier, CefString(searchText), forward ? true : false,
+      CefString(searchText), forward ? true : false, matchCase ? true : false,
-      matchCase ? true : false, findNext ? true : false);
+      findNext ? true : false);
 }
 
 void CEF_CALLBACK browser_host_stop_finding(struct _cef_browser_host_t* self,

libcef_dll/ctocpp/browser_host_ctocpp.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=80f473fbb920009cc911a60c2ed7517eeccad06e$
+// $hash=2edab12ab1759213ab9a6b7620ea39a74291abc7$
 //
 
 #include "libcef_dll/ctocpp/browser_host_ctocpp.h"
@@ -384,8 +384,7 @@ void CefBrowserHostCToCpp::PrintToPDF(const CefString& path,
 }
 
 NO_SANITIZE("cfi-icall")
-void CefBrowserHostCToCpp::Find(int identifier,
+void CefBrowserHostCToCpp::Find(const CefString& searchText,
-                                const CefString& searchText,
                                 bool forward,
                                 bool matchCase,
                                 bool findNext) {
@@ -403,8 +402,7 @@ void CefBrowserHostCToCpp::Find(int identifier,
     return;
 
   // Execute
-  _struct->find(_struct, identifier, searchText.GetStruct(), forward, matchCase,
+  _struct->find(_struct, searchText.GetStruct(), forward, matchCase, findNext);
-                findNext);
 }
 
 NO_SANITIZE("cfi-icall")

libcef_dll/ctocpp/browser_host_ctocpp.h

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=90e6257bcf2ef9af754ac47c5948ab8cc3171e21$
+// $hash=6de4205143b6855e7ccf54da14a0494db0b4aaa3$
 //
 
 #ifndef CEF_LIBCEF_DLL_CTOCPP_BROWSER_HOST_CTOCPP_H_
@@ -64,8 +64,7 @@ class CefBrowserHostCToCpp : public CefCToCppRefCounted<CefBrowserHostCToCpp,
   void PrintToPDF(const CefString& path,
                   const CefPdfPrintSettings& settings,
                   CefRefPtr<CefPdfPrintCallback> callback) override;
-  void Find(int identifier,
+  void Find(const CefString& searchText,
-            const CefString& searchText,
             bool forward,
             bool matchCase,
             bool findNext) override;

patch/patch.cfg

@@ -333,6 +333,11 @@ patches = [
     # https://bitbucket.org/chromiumembedded/cef/issues/2196
     'name': 'printing_context_2196',
   },
+  {
+    # Expose the printing::GetRenderFrameHostToUse() method.
+    # https://bitbucket.org/chromiumembedded/cef/issues/3057
+    'name': 'printing_pdf_3047',
+  },
   {
     # Windows: Remove llvmlibthin as the combine_libs.py can't handle those.
     # https://bitbucket.org/chromiumembedded/cef/issues/2470
@@ -534,5 +539,16 @@ patches = [
     # Windows: Fix crash when |sandbox_info| parameter is nullptr.
     # https://bitbucket.org/chromiumembedded/cef/issues/3210
     'name': 'win_sandbox_3210',
+  },
+  {
+    # Remove DCHECK that triggers while loading DevTools resources.
+    # https://bugs.chromium.org/p/chromium/issues/detail?id=1289230
+    'name': 'blink_security_policy_1289230',
+  },
+  {
+    # Add ChromeUntrustedWebUIControllerFactory::GetInstance() method.
+    # https://crrev.com/643a88a591e1fa448c9ee72679498e4288e7a164
+    # https://bitbucket.org/chromiumembedded/cef/issues/3047
+    'name': 'chrome_untrusted_webui_3047',
   }
 ]

patch/patches/blink_security_policy_1289230.patch

@@ -0,0 +1,13 @@
+diff --git third_party/blink/renderer/platform/weborigin/security_policy.cc third_party/blink/renderer/platform/weborigin/security_policy.cc
+index 4ebbed336ebd8..845f7ec694721 100644
+--- third_party/blink/renderer/platform/weborigin/security_policy.cc
++++ third_party/blink/renderer/platform/weborigin/security_policy.cc
+@@ -90,7 +90,7 @@ Referrer SecurityPolicy::GenerateReferrer(
+       ReferrerUtils::MojoReferrerPolicyResolveDefault(referrer_policy);
+   if (referrer == Referrer::NoReferrer())
+     return Referrer(Referrer::NoReferrer(), referrer_policy_no_default);
+-  DCHECK(!referrer.IsEmpty());
++  // DCHECK(!referrer.IsEmpty());
+ 
+   KURL referrer_url = KURL(NullURL(), referrer).UrlStrippedForUseAsReferrer();
+ 

patch/patches/browser_security_policy_1081397.patch

@@ -20,7 +20,7 @@ index 620b3fdc4403a..f20399d453680 100644
  
            // TODO(wjmaclean): We should update the ProcessLock comparison API
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index 8a84c355e4d56..2545e0e828fe5 100644
+index 2f17127dc4ba6..32c7890a69379 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
 @@ -5896,6 +5896,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithoutFinalFrameHost(

patch/patches/chrome_browser.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index 09b5c00891717..cfa169e00b104 100644
+index 5d956361e7bae..81e2df3f04e51 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
 @@ -12,6 +12,7 @@ import("//build/config/features.gni")

patch/patches/chrome_browser_context_menus.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/renderer_context_menu/render_view_context_menu.cc chrome/browser/renderer_context_menu/render_view_context_menu.cc
-index 0c42ba3e13fe9..2bb347fe9cd50 100644
+index a041fceb8e425..05cd500de13aa 100644
 --- chrome/browser/renderer_context_menu/render_view_context_menu.cc
 +++ chrome/browser/renderer_context_menu/render_view_context_menu.cc
-@@ -293,6 +293,13 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {
+@@ -294,6 +294,13 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {
    return callback.get();
  }
  
@@ -16,7 +16,7 @@ index 0c42ba3e13fe9..2bb347fe9cd50 100644
  enum class UmaEnumIdLookupType {
    GeneralEnumId,
    ContextSpecificEnumId,
-@@ -506,6 +513,10 @@ int FindUMAEnumValueForCommand(int id, UmaEnumIdLookupType type) {
+@@ -504,6 +511,10 @@ int FindUMAEnumValueForCommand(int id, UmaEnumIdLookupType type) {
    if (ContextMenuMatcher::IsExtensionsCustomCommandId(id))
      return 1;
  
@@ -27,7 +27,7 @@ index 0c42ba3e13fe9..2bb347fe9cd50 100644
    id = CollapseCommandsForUMA(id);
    const auto& map = GetIdcToUmaMap(type);
    auto it = map.find(id);
-@@ -697,6 +708,14 @@ RenderViewContextMenu::RenderViewContextMenu(
+@@ -695,6 +706,14 @@ RenderViewContextMenu::RenderViewContextMenu(
    system_app_ = GetBrowser() && GetBrowser()->app_controller()
                      ? GetBrowser()->app_controller()->system_app()
                      : nullptr;
@@ -42,7 +42,7 @@ index 0c42ba3e13fe9..2bb347fe9cd50 100644
  }
  
  RenderViewContextMenu::~RenderViewContextMenu() = default;
-@@ -1064,6 +1083,12 @@ void RenderViewContextMenu::InitMenu() {
+@@ -1062,6 +1081,12 @@ void RenderViewContextMenu::InitMenu() {
    // menu, meaning that each menu item added/removed in this function will cause
    // it to visibly jump on the screen (see b/173569669).
    AppendQuickAnswersItems();
@@ -55,7 +55,7 @@ index 0c42ba3e13fe9..2bb347fe9cd50 100644
  }
  
  Profile* RenderViewContextMenu::GetProfile() const {
-@@ -2893,6 +2918,12 @@ void RenderViewContextMenu::RegisterExecutePluginActionCallbackForTesting(
+@@ -2822,6 +2847,12 @@ void RenderViewContextMenu::RegisterExecutePluginActionCallbackForTesting(
    execute_plugin_action_callback_ = std::move(cb);
  }
  

patch/patches/chrome_browser_net_export.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index df174d7d1ec4d..8bb63dcc89f20 100644
+index c1f030ecb40ec..1ce574eac188f 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -10,6 +10,7 @@ import("//build/config/features.gni")
@@ -29,7 +29,7 @@ index df174d7d1ec4d..8bb63dcc89f20 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -5209,6 +5215,7 @@ static_library("ui") {
+@@ -5210,6 +5216,7 @@ static_library("ui") {
    if (enable_basic_printing) {
      deps += [
        "//components/printing/browser",

patch/patches/chrome_plugins.patch

@@ -125,7 +125,7 @@ index 8b72897491669..546919dd70afc 100644
    // that the X-Frame-Options protection mechanism is set to either DENY or
    // SAMEORIGIN.
 diff --git chrome/renderer/chrome_content_renderer_client.cc chrome/renderer/chrome_content_renderer_client.cc
-index 9e2e8d1892366..262659f9e3204 100644
+index 034a223e5803f..98e7c82671f5c 100644
 --- chrome/renderer/chrome_content_renderer_client.cc
 +++ chrome/renderer/chrome_content_renderer_client.cc
 @@ -940,6 +940,7 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(

patch/patches/chrome_runtime.patch

@@ -78,7 +78,7 @@ index 132735e3a1200..0d392976799a4 100644
  
  #endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
 diff --git chrome/browser/chrome_browser_main.cc chrome/browser/chrome_browser_main.cc
-index 4e9969d9c5b0b..0e734d8661db0 100644
+index 4e9969d9c5b0b..e599b114f021d 100644
 --- chrome/browser/chrome_browser_main.cc
 +++ chrome/browser/chrome_browser_main.cc
 @@ -52,6 +52,7 @@
@@ -89,7 +89,21 @@ index 4e9969d9c5b0b..0e734d8661db0 100644
  #include "chrome/browser/about_flags.h"
  #include "chrome/browser/active_use_util.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -1757,11 +1758,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1530,11 +1531,13 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+         browser_process_->local_state());
+   }
+ 
++#if !BUILDFLAG(ENABLE_CEF)
+   // Needs to be done before PostProfileInit, since login manager on CrOS is
+   // called inside PostProfileInit.
+   content::WebUIControllerFactory::RegisterFactory(
+       ChromeWebUIControllerFactory::GetInstance());
+   ChromeUntrustedWebUIControllerFactory::RegisterInstance();
++#endif
+ 
+ #if BUILDFLAG(IS_ANDROID)
+   page_info::SetPageInfoClient(new ChromePageInfoClient());
+@@ -1757,11 +1760,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
    // This step is costly and is already measured in
    // Startup.StartupBrowserCreator_Start.
    // See the comment above for an explanation of |process_command_line|.
@@ -105,7 +119,7 @@ index 4e9969d9c5b0b..0e734d8661db0 100644
  // TODO(crbug.com/1052397): Revisit the macro expression once build flag switch
  // of lacros-chrome is complete.
  #if BUILDFLAG(IS_WIN) || (BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS_LACROS))
-@@ -1789,8 +1793,10 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1789,8 +1795,10 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
  
      // Create the RunLoop for MainMessageLoopRun() to use and transfer
      // ownership of the browser's lifetime to the BrowserProcess.
@@ -118,7 +132,7 @@ index 4e9969d9c5b0b..0e734d8661db0 100644
          GetMainRunLoopInstance()->QuitWhenIdleClosure());
    }
 diff --git chrome/browser/chrome_browser_main_mac.mm chrome/browser/chrome_browser_main_mac.mm
-index dbd8f7ebe071d..b0f8d3d7bcff9 100644
+index 8bf722c61c059..ac755279227f2 100644
 --- chrome/browser/chrome_browser_main_mac.mm
 +++ chrome/browser/chrome_browser_main_mac.mm
 @@ -16,6 +16,7 @@
@@ -129,7 +143,7 @@ index dbd8f7ebe071d..b0f8d3d7bcff9 100644
  #import "chrome/browser/app_controller_mac.h"
  #include "chrome/browser/apps/app_shim/app_shim_listener.h"
  #include "chrome/browser/browser_process.h"
-@@ -110,6 +111,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+@@ -112,6 +113,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
      }
    }
  
@@ -137,15 +151,15 @@ index dbd8f7ebe071d..b0f8d3d7bcff9 100644
    // Create the app delegate. This object is intentionally leaked as a global
    // singleton. It is accessed through -[NSApp delegate].
    AppController* app_controller = [[AppController alloc] init];
-@@ -118,6 +120,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+@@ -120,6 +122,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
    chrome::BuildMainMenu(NSApp, app_controller,
                          l10n_util::GetStringUTF16(IDS_PRODUCT_NAME), false);
    [app_controller mainMenuCreated];
 +#endif  // BUILDFLAG(ENABLE_CEF)
  
-   PrefService* local_state = g_browser_process->local_state();
+   chrome::DeveloperIDCertificateReauthorizeInApp();
-   DCHECK(local_state);
+   chrome::PurgeStaleScreenCapturePermission();
-@@ -177,7 +180,9 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
+@@ -182,7 +185,9 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
  }
  
  void ChromeBrowserMainPartsMac::DidEndMainMessageLoop() {
@@ -156,7 +170,7 @@ index dbd8f7ebe071d..b0f8d3d7bcff9 100644
 +#endif
  }
 diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
-index 70df7bef3a7b1..97d130a0a1be6 100644
+index db9c606e0ebc3..e08f55ee85c61 100644
 --- chrome/browser/chrome_content_browser_client.cc
 +++ chrome/browser/chrome_content_browser_client.cc
 @@ -28,6 +28,7 @@
@@ -167,7 +181,7 @@ index 70df7bef3a7b1..97d130a0a1be6 100644
  #include "chrome/browser/accessibility/accessibility_labels_service.h"
  #include "chrome/browser/accessibility/accessibility_labels_service_factory.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -3682,9 +3683,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
+@@ -3684,9 +3685,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
                            &search::HandleNewTabURLReverseRewrite);
  #endif  // BUILDFLAG(IS_ANDROID)
  
@@ -179,7 +193,7 @@ index 70df7bef3a7b1..97d130a0a1be6 100644
  }
  
  base::FilePath ChromeContentBrowserClient::GetDefaultDownloadDirectory() {
-@@ -5333,7 +5336,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
+@@ -5338,7 +5341,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
        network_service);
  }
  
@@ -188,7 +202,7 @@ index 70df7bef3a7b1..97d130a0a1be6 100644
      content::BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -5351,6 +5354,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
+@@ -5356,6 +5359,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
      network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
      network_context_params->accept_language = GetApplicationLocale();
    }
@@ -198,10 +212,10 @@ index 70df7bef3a7b1..97d130a0a1be6 100644
  
  std::vector<base::FilePath>
 diff --git chrome/browser/chrome_content_browser_client.h chrome/browser/chrome_content_browser_client.h
-index 71dfd396b405e..879210ff7c8fd 100644
+index 87f0af8fb00cf..87332d3120c1a 100644
 --- chrome/browser/chrome_content_browser_client.h
 +++ chrome/browser/chrome_content_browser_client.h
-@@ -549,7 +549,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+@@ -550,7 +550,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
        override;
    void OnNetworkServiceCreated(
        network::mojom::NetworkService* network_service) override;

patch/patches/chrome_untrusted_webui_3047.patch

@@ -0,0 +1,34 @@
+diff --git chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.cc chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.cc
+index 78d2b6eef6ca6..ebefa586902c9 100644
+--- chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.cc
++++ chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.cc
+@@ -94,9 +94,15 @@ WebUIConfigList CreateConfigs() {
+ }  // namespace
+ 
+ // static
+-void ChromeUntrustedWebUIControllerFactory::RegisterInstance() {
++ChromeUntrustedWebUIControllerFactory*
++ChromeUntrustedWebUIControllerFactory::GetInstance() {
+   static base::NoDestructor<ChromeUntrustedWebUIControllerFactory> instance;
+-  content::WebUIControllerFactory::RegisterFactory(instance.get());
++  return instance.get();
++}
++
++// static
++void ChromeUntrustedWebUIControllerFactory::RegisterInstance() {
++  content::WebUIControllerFactory::RegisterFactory(GetInstance());
+ }
+ 
+ ChromeUntrustedWebUIControllerFactory::ChromeUntrustedWebUIControllerFactory()
+diff --git chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.h chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.h
+index fd16bca71a3f0..738afa6654e42 100644
+--- chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.h
++++ chrome/browser/ui/webui/chrome_untrusted_web_ui_controller_factory.h
+@@ -12,6 +12,7 @@ class ChromeUntrustedWebUIControllerFactory
+  public:
+   // Register the singleton instance of this class.
+   static void RegisterInstance();
++  static ChromeUntrustedWebUIControllerFactory* GetInstance();
+ 
+   ChromeUntrustedWebUIControllerFactory();
+   ChromeUntrustedWebUIControllerFactory(

patch/patches/content_2015.patch

@@ -12,7 +12,7 @@ index ec6be2ff24d23..159ed7776c0aa 100644
                        GetContentClient()->browser()->GetUserAgent());
      version.SetString("V8-Version", V8_VERSION_STRING);
 diff --git content/browser/loader/navigation_url_loader_impl.cc content/browser/loader/navigation_url_loader_impl.cc
-index c1235f9658b88..040d9afb0d9ff 100644
+index b5c2dc992fb19..868661c86c39a 100644
 --- content/browser/loader/navigation_url_loader_impl.cc
 +++ content/browser/loader/navigation_url_loader_impl.cc
 @@ -665,6 +665,14 @@ NavigationURLLoaderImpl::PrepareForNonInterceptedRequest(
@@ -136,10 +136,10 @@ index b914cb91a2b49..2f84201ba4d1e 100644
    // started.
    virtual void SetRuntimeFeaturesDefaultsBeforeBlinkInitialization() {}
 diff --git content/renderer/render_thread_impl.cc content/renderer/render_thread_impl.cc
-index 03f9fac832072..1f45e54e32da9 100644
+index f6574e15fc0d3..380b80337da71 100644
 --- content/renderer/render_thread_impl.cc
 +++ content/renderer/render_thread_impl.cc
-@@ -640,6 +640,8 @@ void RenderThreadImpl::Init() {
+@@ -656,6 +656,8 @@ void RenderThreadImpl::Init() {
        GetContentClient()->renderer()->CreateURLLoaderThrottleProvider(
            blink::URLLoaderThrottleProviderType::kFrame);
  

patch/patches/embedder_product_override.patch

@@ -1,5 +1,5 @@
 diff --git components/embedder_support/user_agent_utils.cc components/embedder_support/user_agent_utils.cc
-index a001f60b279ed..b0ee6283be54f 100644
+index 4c38233047000..4601ad9df744d 100644
 --- components/embedder_support/user_agent_utils.cc
 +++ components/embedder_support/user_agent_utils.cc
 @@ -15,6 +15,7 @@
@@ -7,13 +7,13 @@ index a001f60b279ed..b0ee6283be54f 100644
  #include "build/branding_buildflags.h"
  #include "build/build_config.h"
 +#include "cef/libcef/common/cef_switches.h"
+ #include "components/embedder_support/pref_names.h"
  #include "components/embedder_support/switches.h"
  #include "components/policy/core/common/policy_pref_names.h"
- #include "components/prefs/pref_service.h"
+@@ -353,6 +354,12 @@ std::string GetMajorVersionForUserAgentString(
-@@ -276,6 +277,12 @@ blink::UserAgentBrandList GetBrandFullVersionList(
- }  // namespace
  
- std::string GetProduct(const bool allow_version_override) {
+ std::string GetProduct(const bool allow_version_override,
+                        ForceMajorVersionToMinorPosition force_major_to_minor) {
 +  base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
 +  if (command_line->HasSwitch(switches::kUserAgentProductAndVersion)) {
 +    return command_line->GetSwitchValueASCII(

patch/patches/extensions_1947.patch

@@ -196,7 +196,7 @@ index 1fa1e67dddcfd..7af2a0e231824 100644
    // once each time the extensions system is loaded per browser_context. The
    // implementation may wish to use the BrowserContext to record the current
 diff --git extensions/browser/process_manager.cc extensions/browser/process_manager.cc
-index bee1c92ce2b69..31e6d5587de2a 100644
+index 9c5c1404df84a..e09394bb97547 100644
 --- extensions/browser/process_manager.cc
 +++ extensions/browser/process_manager.cc
 @@ -391,9 +391,17 @@ bool ProcessManager::CreateBackgroundHost(const Extension* extension,

patch/patches/gn_config.patch

@@ -66,10 +66,10 @@ index 982fbe8d3f0d0..e757be4688f10 100644
 +         "studio path")
  }
 diff --git chrome/app/framework.order chrome/app/framework.order
-index 839144aa1e9bd..29c8ab32398a7 100644
+index f8f71ef369c08..7a2ed5da7bda3 100644
 --- chrome/app/framework.order
 +++ chrome/app/framework.order
-@@ -28,3 +28,8 @@ _ChromeMain
+@@ -31,3 +31,8 @@ _ChromeMain
  _lprofDirMode
  ___llvm_profile_filename
  ___llvm_profile_raw_version

patch/patches/print_preview_123.patch

@@ -116,29 +116,27 @@ index 920f646f06484..76c0b5e5ee04b 100644
        $i18n{cancel}
      </cr-button>
 diff --git chrome/browser/ui/webui/constrained_web_dialog_ui.cc chrome/browser/ui/webui/constrained_web_dialog_ui.cc
-index 8c5ba47779d24..69dff1ae88000 100644
+index 8c5ba47779d24..91a70d8715f33 100644
 --- chrome/browser/ui/webui/constrained_web_dialog_ui.cc
 +++ chrome/browser/ui/webui/constrained_web_dialog_ui.cc
-@@ -26,6 +26,8 @@
+@@ -13,6 +13,7 @@
- #include "chrome/browser/extensions/tab_helper.h"
+ #include "base/memory/ptr_util.h"
- #endif
+ #include "base/memory/raw_ptr.h"
- 
+ #include "base/values.h"
-+#include "cef/libcef/features/features.h"
++#include "cef/libcef/features/runtime.h"
-+
+ #include "content/public/browser/notification_service.h"
- using content::RenderFrameHost;
+ #include "content/public/browser/render_frame_host.h"
- using content::WebContents;
+ #include "content/public/browser/web_contents.h"
- using content::WebUIMessageHandler;
+@@ -57,7 +58,9 @@ class ConstrainedWebDialogDelegateUserData
-@@ -57,8 +59,10 @@ class ConstrainedWebDialogDelegateUserData
  ConstrainedWebDialogUI::ConstrainedWebDialogUI(content::WebUI* web_ui)
      : WebUIController(web_ui) {
  #if BUILDFLAG(ENABLE_EXTENSIONS)
-+#if !BUILDFLAG(ENABLE_CEF)
++  if (!cef::IsAlloyRuntimeEnabled()) {
    extensions::TabHelper::CreateForWebContents(web_ui->GetWebContents());
++  }
  #endif
-+#endif
  }
  
- ConstrainedWebDialogUI::~ConstrainedWebDialogUI() = default;
 diff --git chrome/browser/ui/webui/print_preview/pdf_printer_handler.cc chrome/browser/ui/webui/print_preview/pdf_printer_handler.cc
 index e5dfa76d26d86..b7dcf7a11479f 100644
 --- chrome/browser/ui/webui/print_preview/pdf_printer_handler.cc

patch/patches/printing_pdf_3047.patch

@@ -0,0 +1,37 @@
+diff --git chrome/browser/printing/print_view_manager_common.cc chrome/browser/printing/print_view_manager_common.cc
+index fe86f14eeacb8..41858f4357f8e 100644
+--- chrome/browser/printing/print_view_manager_common.cc
++++ chrome/browser/printing/print_view_manager_common.cc
+@@ -53,6 +53,8 @@ bool StoreFullPagePlugin(content::WebContents** result,
+ }
+ #endif  // BUILDFLAG(ENABLE_EXTENSIONS)
+ 
++}  // namespace
++
+ // Pick the right RenderFrameHost based on the WebContents.
+ content::RenderFrameHost* GetRenderFrameHostToUse(
+     content::WebContents* contents) {
+@@ -68,8 +70,6 @@ content::RenderFrameHost* GetRenderFrameHostToUse(
+   return contents->GetMainFrame();
+ }
+ 
+-}  // namespace
+-
+ void StartPrint(
+     content::WebContents* contents,
+     mojo::PendingAssociatedRemote<mojom::PrintRenderer> print_renderer,
+diff --git chrome/browser/printing/print_view_manager_common.h chrome/browser/printing/print_view_manager_common.h
+index bf67ddba35b34..7f4dcc216bbb4 100644
+--- chrome/browser/printing/print_view_manager_common.h
++++ chrome/browser/printing/print_view_manager_common.h
+@@ -36,6 +36,10 @@ content::RenderFrameHost* GetFrameToPrint(content::WebContents* contents);
+ // guest's WebContents instead.
+ content::WebContents* GetWebContentsToUse(content::WebContents* contents);
+ 
++// Pick the right RenderFrameHost based on the WebContents.
++content::RenderFrameHost* GetRenderFrameHostToUse(
++    content::WebContents* contents);
++
+ }  // namespace printing
+ 
+ #endif  // CHROME_BROWSER_PRINTING_PRINT_VIEW_MANAGER_COMMON_H_

patch/patches/rwh_background_color_1984.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/renderer_host/render_widget_host_view_aura.cc content/browser/renderer_host/render_widget_host_view_aura.cc
-index 20d613c480ce5..1753448bff5ce 100644
+index 99f3ba03249b3..47566fd1ca43b 100644
 --- content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ content/browser/renderer_host/render_widget_host_view_aura.cc
 @@ -5,6 +5,7 @@

patch/patches/web_contents_1257_1565.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index bf235e7493dd0..1f0eb81769b56 100644
+index 6b742d4635454..ddba5aadb21a1 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
-@@ -2979,6 +2979,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
+@@ -2983,6 +2983,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
        site_instance.get(), params.renderer_initiated_creation,
        params.main_frame_name, GetOriginalOpener(), primary_main_frame_policy);
  
@@ -15,7 +15,7 @@ index bf235e7493dd0..1f0eb81769b56 100644
    WebContentsViewDelegate* delegate =
        GetContentClient()->browser()->GetWebContentsViewDelegate(this);
  
-@@ -2989,6 +2995,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
+@@ -2993,6 +2999,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
      view_.reset(CreateWebContentsView(this, delegate,
                                        &render_view_host_delegate_view_));
    }
@@ -23,7 +23,7 @@ index bf235e7493dd0..1f0eb81769b56 100644
    CHECK(render_view_host_delegate_view_);
    CHECK(view_.get());
  
-@@ -3853,6 +3860,15 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3857,6 +3864,15 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    // objects.
    create_params.renderer_initiated_creation = !is_new_browsing_instance;
  
@@ -39,7 +39,7 @@ index bf235e7493dd0..1f0eb81769b56 100644
    std::unique_ptr<WebContentsImpl> new_contents;
    if (!is_guest) {
      create_params.context = view_->GetNativeView();
-@@ -7625,6 +7641,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
+@@ -7651,6 +7667,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
      // frames).
      SetFocusedFrameTree(node->frame_tree());
    }

patch/patches/webview_plugin_2020.patch

@@ -1,5 +1,5 @@
 diff --git chrome/app/generated_resources.grd chrome/app/generated_resources.grd
-index 2e9301625477b..d941840163cb1 100644
+index 9fa63decc3d89..0d9100be6b128 100644
 --- chrome/app/generated_resources.grd
 +++ chrome/app/generated_resources.grd
 @@ -5424,7 +5424,7 @@ Keep your key file in a safe place. You will need it to create new versions of y

tests/cefclient/browser/root_window_win.cc

@@ -839,7 +839,7 @@ void RootWindowWin::OnFindEvent() {
       find_what_last_ = find_buff_;
     }
 
-    browser->GetHost()->Find(0, find_what,
+    browser->GetHost()->Find(find_what,
                              (find_state_.Flags & FR_DOWN) ? true : false,
                              match_case, find_next_);
     if (!find_next_)

tools/gclient_hook.py

@@ -146,14 +146,3 @@ for dir, config in configs.items():
   RunAction(src_dir, cmd)
   if platform == 'windows':
     issue_1999.apply(out_path)
-
-gn_dir = list(configs.keys())[0]
-out_gn_path = os.path.join(src_dir, 'out', gn_dir)
-gn_path = os.path.join(out_gn_path, 'args.gn')
-print("\nGenerating CEF buildinfo header file...")
-cmd = [
-    sys.executable, 'tools/make_config_header.py', '--header',
-    'include/cef_config.h', '--cef_gn_config', gn_path
-]
-
-RunAction(cef_dir, cmd)

tools/gn_args.py

@@ -503,6 +503,10 @@ def GetConfigArgsSandbox(platform, args, is_debug, cpu):
     # Allow non-component Debug builds for the sandbox.
     add_args['forbid_non_component_debug_builds'] = False
 
+  if not is_debug:
+    # Disable DCHECKs in Release builds.
+    add_args['dcheck_always_on'] = False
+
   result = MergeDicts(args, add_args, {
       'is_debug': is_debug,
       'target_cpu': cpu,

tools/make_config_header.py

@@ -3,122 +3,58 @@
 # can be found in the LICENSE file.
 
 from __future__ import absolute_import
-from date_util import *
+from cef_parser import get_copyright
 from file_util import *
-from optparse import OptionParser
 import sys
 
-# cannot be loaded as a module
-if __name__ != "__main__":
-  sys.stderr.write('This file cannot be loaded as a module!')
-  sys.exit()
 
-# parse command-line options
+def make_config_header(gn_config):
-disc = """
+  """ Creates the header file contents for the cef build configuration. """
-This utility creates the config header file.
+
+  if not path_exists(gn_config):
+    raise Exception('File ' + gn_config + ' does not exist.')
+
+  defines = []
+
+  if sys.platform.startswith('linux'):
+    lines = read_file(gn_config).split("\n")
+
+    # All Linux builds use Ozone, and the X11 platform is enabled by default.
+    # Check if the config is explicitly disabling it.
+    if not 'ozone_platform_x11=false' in lines:
+      defines.append('#define CEF_X11 1')
+
+  result = get_copyright(full=True, translator=False) + \
+"""//
+// ---------------------------------------------------------------------------
+//
+// This file is generated by the make_config_header.py tool.
+//
+
+#ifndef CEF_INCLUDE_CEF_CONFIG_H_
+#define CEF_INCLUDE_CEF_CONFIG_H_
+
+$DEFINES$
+
+#endif  // CEF_INCLUDE_CEF_CONFIG_H_
 """
-parser = OptionParser(description=disc)
-parser.add_option(
-    '--header',
-    dest='header',
-    metavar='FILE',
-    help='output config header file [required]')
-parser.add_option(
-    '--cef_gn_config',
-    dest='cef_gn_config',
-    metavar='FILE',
-    help='input CEF gn config file [required]')
-parser.add_option(
-    '-q',
-    '--quiet',
-    action='store_true',
-    dest='quiet',
-    default=False,
-    help='do not output detailed status information')
-(options, args) = parser.parse_args()
 
-# the header option is required
+  result = result.replace('$DEFINES$', "\n".join(defines))
-if options.header is None or options.cef_gn_config is None:
+  return result
-  parser.print_help(sys.stdout)
-  sys.exit()
 
 
-def check_x11_build(gn_config):
+def write_config_header(output, gn_config):
-  """ Scan gn configuration file and decide whether it's x11 build or not """
+  output = os.path.abspath(output)
-  lines = read_file(gn_config).split("\n")
+  result = make_config_header(gn_config)
-  for line in lines:
+  return write_file_if_changed(output, result)
-    parts = line.split('=', 1)
-    if (parts[0] == "use_x11" and
-        parts[1] == "false") or (parts[0] == "use_ozone" and
-                                 parts[1] == "true"):
-      return False
-
-  return True
 
 
-def write_config_header(header, cef_gn_config):
+def main(argv):
-  """ Creates the header file for the cef build configuration
+  if len(argv) < 3:
-       if the information has changed or if the file doesn't already exist. """
+    print(("Usage:\n  %s <output_header_file> <input_args_gn_file>" % argv[0]))
-
+    sys.exit(-1)
-  if not path_exists(cef_gn_config):
+  write_config_header(argv[1], argv[2])
-    raise Exception('file ' + cef_gn_config + ' does not exist.')
-
-  if path_exists(header):
-    oldcontents = read_file(header)
-  else:
-    oldcontents = ''
-
-  year = get_year()
-
-  cef_x11_defines = "#define CEF_X11 1" if check_x11_build(
-      cef_gn_config) else ""
-
-  newcontents = '// Copyright (c) '+year+' Marshall A. Greenblatt. All rights reserved.\n'+\
-                '//\n'+\
-                '// Redistribution and use in source and binary forms, with or without\n'+\
-                '// modification, are permitted provided that the following conditions are\n'+\
-                '// met:\n'+\
-                '//\n'+\
-                '//    * Redistributions of source code must retain the above copyright\n'+\
-                '// notice, this list of conditions and the following disclaimer.\n'+\
-                '//    * Redistributions in binary form must reproduce the above\n'+\
-                '// copyright notice, this list of conditions and the following disclaimer\n'+\
-                '// in the documentation and/or other materials provided with the\n'+\
-                '// distribution.\n'+\
-                '//    * Neither the name of Google Inc. nor the name Chromium Embedded\n'+\
-                '// Framework nor the names of its contributors may be used to endorse\n'+\
-                '// or promote products derived from this software without specific prior\n'+\
-                '// written permission.\n'+\
-                '//\n'+\
-                '// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n'+\
-                '// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n'+\
-                '// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n'+\
-                '// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n'+\
-                '// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n'+\
-                '// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n'+\
-                '// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n'+\
-                '// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n'+\
-                '// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n'+\
-                '// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n'+\
-                '// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n'+\
-                '//\n'+\
-                '// ---------------------------------------------------------------------------\n'+\
-                '//\n'+\
-                '// This file is generated by the make_config_header.py tool.\n'+\
-                '//\n\n'+\
-                '#ifndef CEF_INCLUDE_CEF_CONFIG_H_\n'+\
-                '#define CEF_INCLUDE_CEF_CONFIG_H_\n\n'+\
-                '' + cef_x11_defines + '\n'+\
-                '#endif  // CEF_INCLUDE_CEF_CONFIG_H_\n'
-  if newcontents != oldcontents:
-    write_file(header, newcontents)
-    return True
-  return False
 
 
-written = write_config_header(options.header, options.cef_gn_config)
+if '__main__' == __name__:
-if not options.quiet:
+  main(sys.argv)
-  if written:
-    sys.stdout.write('File ' + options.header + ' updated.\n')
-  else:
-    sys.stdout.write('File ' + options.header + ' is already up to date.\n')

tools/make_distrib.py

@@ -719,6 +719,7 @@ if mode == 'standard' or mode == 'minimal':
 
   # Transfer generated include files.
   generated_includes = [
+      'cef_config.h',
       'cef_pack_resources.h',
       'cef_pack_strings.h',
   ]