alloy: Disable DocumentPictureInPictureAPI feature (see #3448)

This feature is default-enabled in M116+ but is not supported by the
Alloy runtime.

BUILD.gn

@@ -801,6 +801,7 @@ source_set("libcef_static") {
     "libcef/browser/views/view_util.cc",
     "libcef/browser/views/view_util.h",
     "libcef/browser/views/view_view.h",
+    "libcef/browser/views/widget_destruction_observer.h",
     "libcef/browser/views/window_impl.cc",
     "libcef/browser/views/window_impl.h",
     "libcef/browser/views/window_view.cc",

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,6 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/115.0.5790.0'
+  'chromium_checkout': 'refs/tags/116.0.5845.190',
+  'depot_tools_checkout': '6d0c235dae'
 }

cef_create_projects.bat

@@ -1,2 +1,2 @@
 @echo off
-python.bat tools\gclient_hook.py
+python3.bat tools\gclient_hook.py

cef_paths2.gypi

@@ -23,7 +23,6 @@
       'include/base/cef_ptr_util.h',
       'include/base/cef_ref_counted.h',
       'include/base/cef_scoped_refptr.h',
-      'include/base/cef_template_util.h',
       'include/base/cef_thread_checker.h',
       'include/base/cef_trace_event.h',
       'include/base/cef_tuple.h',

include/base/cef_bind.h

@@ -84,7 +84,6 @@
 
 #include "include/base/cef_build.h"
 #include "include/base/cef_compiler_specific.h"
-#include "include/base/cef_template_util.h"
 #include "include/base/internal/cef_bind_internal.h"
 
 #if defined(OS_APPLE) && !HAS_FEATURE(objc_arc)
@@ -105,7 +104,7 @@ BindOnce(Functor&& functor, Args&&... args) {
                 "BindOnce requires non-const rvalue for OnceCallback binding."
                 " I.e.: base::BindOnce(std::move(callback)).");
   static_assert(
-      conjunction<cef_internal::AssertBindArgIsNotBasePassed<
+      std::conjunction<cef_internal::AssertBindArgIsNotBasePassed<
           std::decay_t<Args>>...>::value,
       "Use std::move() instead of base::Passed() with base::BindOnce()");
 

include/base/cef_ref_counted.h

@@ -50,7 +50,6 @@
 #include "include/base/cef_compiler_specific.h"
 #include "include/base/cef_logging.h"
 #include "include/base/cef_scoped_refptr.h"
-#include "include/base/cef_template_util.h"
 #include "include/base/cef_thread_checker.h"
 
 namespace base {
@@ -485,7 +484,7 @@ class RefCountedData
   RefCountedData(const T& in_value) : data(in_value) {}
   RefCountedData(T&& in_value) : data(std::move(in_value)) {}
   template <typename... Args>
-  explicit RefCountedData(in_place_t, Args&&... args)
+  explicit RefCountedData(std::in_place_t, Args&&... args)
       : data(std::forward<Args>(args)...) {}
 
   T data;

include/base/cef_template_util.h

@@ -1,417 +0,0 @@
-// Copyright (c) 2014 Marshall A. Greenblatt. Portions copyright (c) 2011
-// Google Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//    * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//    * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//    * Neither the name of Google Inc. nor the name Chromium Embedded
-// Framework nor the names of its contributors may be used to endorse
-// or promote products derived from this software without specific prior
-// written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-#ifndef CEF_INCLUDE_BASE_CEF_TEMPLATE_UTIL_H_
-#define CEF_INCLUDE_BASE_CEF_TEMPLATE_UTIL_H_
-#pragma once
-
-#if defined(USING_CHROMIUM_INCLUDES)
-// When building CEF include the Chromium header directly.
-#include "base/template_util.h"
-#else  // !USING_CHROMIUM_INCLUDES
-// The following is substantially similar to the Chromium implementation.
-// If the Chromium implementation diverges the below implementation should be
-// updated to match.
-
-#include <stddef.h>
-#include <iosfwd>
-#include <iterator>
-#include <type_traits>
-#include <utility>
-#include <vector>
-
-#include "include/base/cef_build.h"
-
-// Some versions of libstdc++ have partial support for type_traits, but misses
-// a smaller subset while removing some of the older non-standard stuff. Assume
-// that all versions below 5.0 fall in this category, along with one 5.0
-// experimental release. Test for this by consulting compiler major version,
-// the only reliable option available, so theoretically this could fail should
-// you attempt to mix an earlier version of libstdc++ with >= GCC5. But
-// that's unlikely to work out, especially as GCC5 changed ABI.
-#define CR_GLIBCXX_5_0_0 20150123
-#if (defined(__GNUC__) && __GNUC__ < 5) || \
-    (defined(__GLIBCXX__) && __GLIBCXX__ == CR_GLIBCXX_5_0_0)
-#define CR_USE_FALLBACKS_FOR_OLD_EXPERIMENTAL_GLIBCXX
-#endif
-
-// This hacks around using gcc with libc++ which has some incompatibilies.
-// - is_trivially_* doesn't work: https://llvm.org/bugs/show_bug.cgi?id=27538
-// TODO(danakj): Remove this when android builders are all using a newer version
-// of gcc, or the android ndk is updated to a newer libc++ that works with older
-// gcc versions.
-#if !defined(__clang__) && defined(_LIBCPP_VERSION)
-#define CR_USE_FALLBACKS_FOR_GCC_WITH_LIBCXX
-#endif
-
-namespace base {
-
-template <class T>
-struct is_non_const_reference : std::false_type {};
-template <class T>
-struct is_non_const_reference<T&> : std::true_type {};
-template <class T>
-struct is_non_const_reference<const T&> : std::false_type {};
-
-namespace internal {
-
-// Implementation detail of base::void_t below.
-template <typename...>
-struct make_void {
-  using type = void;
-};
-
-}  // namespace internal
-
-// base::void_t is an implementation of std::void_t from C++17.
-//
-// We use |base::internal::make_void| as a helper struct to avoid a C++14
-// defect:
-//   http://en.cppreference.com/w/cpp/types/void_t
-//   http://open-std.org/JTC1/SC22/WG21/docs/cwg_defects.html#1558
-template <typename... Ts>
-using void_t = typename ::base::internal::make_void<Ts...>::type;
-
-namespace internal {
-
-// Uses expression SFINAE to detect whether using operator<< would work.
-template <typename T, typename = void>
-struct SupportsOstreamOperator : std::false_type {};
-template <typename T>
-struct SupportsOstreamOperator<T,
-                               decltype(void(std::declval<std::ostream&>()
-                                             << std::declval<T>()))>
-    : std::true_type {};
-
-template <typename T, typename = void>
-struct SupportsToString : std::false_type {};
-template <typename T>
-struct SupportsToString<T, decltype(void(std::declval<T>().ToString()))>
-    : std::true_type {};
-
-// Used to detect whether the given type is an iterator.  This is normally used
-// with std::enable_if to provide disambiguation for functions that take
-// templatzed iterators as input.
-template <typename T, typename = void>
-struct is_iterator : std::false_type {};
-
-template <typename T>
-struct is_iterator<T,
-                   void_t<typename std::iterator_traits<T>::iterator_category>>
-    : std::true_type {};
-
-// Helper to express preferences in an overload set. If more than one overload
-// are available for a given set of parameters the overload with the higher
-// priority will be chosen.
-template <size_t I>
-struct priority_tag : priority_tag<I - 1> {};
-
-template <>
-struct priority_tag<0> {};
-
-}  // namespace internal
-
-// is_trivially_copyable is especially hard to get right.
-// - Older versions of libstdc++ will fail to have it like they do for other
-//   type traits. This has become a subset of the second point, but used to be
-//   handled independently.
-// - An experimental release of gcc includes most of type_traits but misses
-//   is_trivially_copyable, so we still have to avoid using libstdc++ in this
-//   case, which is covered by CR_USE_FALLBACKS_FOR_OLD_EXPERIMENTAL_GLIBCXX.
-// - When compiling libc++ from before r239653, with a gcc compiler, the
-//   std::is_trivially_copyable can fail. So we need to work around that by not
-//   using the one in libc++ in this case. This is covered by the
-//   CR_USE_FALLBACKS_FOR_GCC_WITH_LIBCXX define, and is discussed in
-//   https://llvm.org/bugs/show_bug.cgi?id=27538#c1 where they point out that
-//   in libc++'s commit r239653 this is fixed by libc++ checking for gcc 5.1.
-// - In both of the above cases we are using the gcc compiler. When defining
-//   this ourselves on compiler intrinsics, the __is_trivially_copyable()
-//   intrinsic is not available on gcc before version 5.1 (see the discussion in
-//   https://llvm.org/bugs/show_bug.cgi?id=27538#c1 again), so we must check for
-//   that version.
-// - When __is_trivially_copyable() is not available because we are on gcc older
-//   than 5.1, we need to fall back to something, so we use __has_trivial_copy()
-//   instead based on what was done one-off in bit_cast() previously.
-
-// TODO(crbug.com/554293): Remove this when all platforms have this in the std
-// namespace and it works with gcc as needed.
-#if defined(CR_USE_FALLBACKS_FOR_OLD_EXPERIMENTAL_GLIBCXX) || \
-    defined(CR_USE_FALLBACKS_FOR_GCC_WITH_LIBCXX)
-template <typename T>
-struct is_trivially_copyable {
-// TODO(danakj): Remove this when android builders are all using a newer version
-// of gcc, or the android ndk is updated to a newer libc++ that does this for
-// us.
-#if _GNUC_VER >= 501
-  static constexpr bool value = __is_trivially_copyable(T);
-#else
-  static constexpr bool value =
-      __has_trivial_copy(T) && __has_trivial_destructor(T);
-#endif
-};
-#else
-template <class T>
-using is_trivially_copyable = std::is_trivially_copyable<T>;
-#endif
-
-#if defined(__GNUC__) && !defined(__clang__) && __GNUC__ <= 7
-// Workaround for g++7 and earlier family.
-// Due to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80654, without this
-// Optional<std::vector<T>> where T is non-copyable causes a compile error.
-// As we know it is not trivially copy constructible, explicitly declare so.
-template <typename T>
-struct is_trivially_copy_constructible
-    : std::is_trivially_copy_constructible<T> {};
-
-template <typename... T>
-struct is_trivially_copy_constructible<std::vector<T...>> : std::false_type {};
-#else
-// Otherwise use std::is_trivially_copy_constructible as is.
-template <typename T>
-using is_trivially_copy_constructible = std::is_trivially_copy_constructible<T>;
-#endif
-
-// base::in_place_t is an implementation of std::in_place_t from
-// C++17. A tag type used to request in-place construction in template vararg
-// constructors.
-
-// Specification:
-// https://en.cppreference.com/w/cpp/utility/in_place
-struct in_place_t {};
-constexpr in_place_t in_place = {};
-
-// base::in_place_type_t is an implementation of std::in_place_type_t from
-// C++17. A tag type used for in-place construction when the type to construct
-// needs to be specified, such as with base::unique_any, designed to be a
-// drop-in replacement.
-
-// Specification:
-// http://en.cppreference.com/w/cpp/utility/in_place
-template <typename T>
-struct in_place_type_t {};
-
-template <typename T>
-struct is_in_place_type_t {
-  static constexpr bool value = false;
-};
-
-template <typename... Ts>
-struct is_in_place_type_t<in_place_type_t<Ts...>> {
-  static constexpr bool value = true;
-};
-
-// C++14 implementation of C++17's std::bool_constant.
-//
-// Reference: https://en.cppreference.com/w/cpp/types/integral_constant
-// Specification: https://wg21.link/meta.type.synop
-template <bool B>
-using bool_constant = std::integral_constant<bool, B>;
-
-// C++14 implementation of C++17's std::conjunction.
-//
-// Reference: https://en.cppreference.com/w/cpp/types/conjunction
-// Specification: https://wg21.link/meta.logical#1.itemdecl:1
-template <typename...>
-struct conjunction : std::true_type {};
-
-template <typename B1>
-struct conjunction<B1> : B1 {};
-
-template <typename B1, typename... Bn>
-struct conjunction<B1, Bn...>
-    : std::conditional_t<static_cast<bool>(B1::value), conjunction<Bn...>, B1> {
-};
-
-// C++14 implementation of C++17's std::disjunction.
-//
-// Reference: https://en.cppreference.com/w/cpp/types/disjunction
-// Specification: https://wg21.link/meta.logical#itemdecl:2
-template <typename...>
-struct disjunction : std::false_type {};
-
-template <typename B1>
-struct disjunction<B1> : B1 {};
-
-template <typename B1, typename... Bn>
-struct disjunction<B1, Bn...>
-    : std::conditional_t<static_cast<bool>(B1::value), B1, disjunction<Bn...>> {
-};
-
-// C++14 implementation of C++17's std::negation.
-//
-// Reference: https://en.cppreference.com/w/cpp/types/negation
-// Specification: https://wg21.link/meta.logical#itemdecl:3
-template <typename B>
-struct negation : bool_constant<!static_cast<bool>(B::value)> {};
-
-// Implementation of C++17's invoke_result.
-//
-// This implementation adds references to `Functor` and `Args` to work around
-// some quirks of std::result_of. See the #Notes section of [1] for details.
-//
-// References:
-// [1] https://en.cppreference.com/w/cpp/types/result_of
-// [2] https://wg21.link/meta.trans.other#lib:invoke_result
-#if ((defined(_MSVC_LANG) && _MSVC_LANG >= 201703L) || __cplusplus >= 201703L)
-template <typename Functor, typename... Args>
-using invoke_result = std::invoke_result<Functor, Args...>;
-#else
-template <typename Functor, typename... Args>
-using invoke_result = std::result_of<Functor && (Args && ...)>;
-#endif
-
-// Implementation of C++17's std::invoke_result_t.
-//
-// Reference: https://wg21.link/meta.type.synop#lib:invoke_result_t
-template <typename Functor, typename... Args>
-using invoke_result_t = typename invoke_result<Functor, Args...>::type;
-
-namespace internal {
-
-// Base case, `InvokeResult` does not have a nested type member. This means `F`
-// could not be invoked with `Args...` and thus is not invocable.
-template <typename InvokeResult, typename R, typename = void>
-struct IsInvocableImpl : std::false_type {};
-
-// Happy case, `InvokeResult` does have a nested type member. Now check whether
-// `InvokeResult::type` is convertible to `R`. Short circuit in case
-// `std::is_void<R>`.
-template <typename InvokeResult, typename R>
-struct IsInvocableImpl<InvokeResult, R, void_t<typename InvokeResult::type>>
-    : disjunction<std::is_void<R>,
-                  std::is_convertible<typename InvokeResult::type, R>> {};
-
-}  // namespace internal
-
-// Implementation of C++17's std::is_invocable_r.
-//
-// Returns whether `F` can be invoked with `Args...` and the result is
-// convertible to `R`.
-//
-// Reference: https://wg21.link/meta.rel#lib:is_invocable_r
-template <typename R, typename F, typename... Args>
-struct is_invocable_r
-    : internal::IsInvocableImpl<invoke_result<F, Args...>, R> {};
-
-// Implementation of C++17's std::is_invocable.
-//
-// Returns whether `F` can be invoked with `Args...`.
-//
-// Reference: https://wg21.link/meta.rel#lib:is_invocable
-template <typename F, typename... Args>
-struct is_invocable : is_invocable_r<void, F, Args...> {};
-
-namespace internal {
-
-// The indirection with std::is_enum<T> is required, because instantiating
-// std::underlying_type_t<T> when T is not an enum is UB prior to C++20.
-template <typename T, bool = std::is_enum<T>::value>
-struct IsScopedEnumImpl : std::false_type {};
-
-template <typename T>
-struct IsScopedEnumImpl<T, /*std::is_enum<T>::value=*/true>
-    : negation<std::is_convertible<T, std::underlying_type_t<T>>> {};
-
-}  // namespace internal
-
-// Implementation of C++23's std::is_scoped_enum
-//
-// Reference: https://en.cppreference.com/w/cpp/types/is_scoped_enum
-template <typename T>
-struct is_scoped_enum : internal::IsScopedEnumImpl<T> {};
-
-// Implementation of C++20's std::remove_cvref.
-//
-// References:
-// - https://en.cppreference.com/w/cpp/types/remove_cvref
-// - https://wg21.link/meta.trans.other#lib:remove_cvref
-template <typename T>
-struct remove_cvref {
-  using type = std::remove_cv_t<std::remove_reference_t<T>>;
-};
-
-// Implementation of C++20's std::remove_cvref_t.
-//
-// References:
-// - https://en.cppreference.com/w/cpp/types/remove_cvref
-// - https://wg21.link/meta.type.synop#lib:remove_cvref_t
-template <typename T>
-using remove_cvref_t = typename remove_cvref<T>::type;
-
-// Simplified implementation of C++20's std::iter_value_t.
-// As opposed to std::iter_value_t, this implementation does not restrict
-// the type of `Iter` and does not consider specializations of
-// `indirectly_readable_traits`.
-//
-// Reference: https://wg21.link/readable.traits#2
-template <typename Iter>
-using iter_value_t =
-    typename std::iterator_traits<remove_cvref_t<Iter>>::value_type;
-
-// Simplified implementation of C++20's std::iter_reference_t.
-// As opposed to std::iter_reference_t, this implementation does not restrict
-// the type of `Iter`.
-//
-// Reference: https://wg21.link/iterator.synopsis#:~:text=iter_reference_t
-template <typename Iter>
-using iter_reference_t = decltype(*std::declval<Iter&>());
-
-// Simplified implementation of C++20's std::indirect_result_t. As opposed to
-// std::indirect_result_t, this implementation does not restrict the type of
-// `Func` and `Iters`.
-//
-// Reference: https://wg21.link/iterator.synopsis#:~:text=indirect_result_t
-template <typename Func, typename... Iters>
-using indirect_result_t = invoke_result_t<Func, iter_reference_t<Iters>...>;
-
-// Simplified implementation of C++20's std::projected. As opposed to
-// std::projected, this implementation does not explicitly restrict the type of
-// `Iter` and `Proj`, but rather does so implicitly by requiring
-// `indirect_result_t<Proj, Iter>` is a valid type. This is required for SFINAE
-// friendliness.
-//
-// Reference: https://wg21.link/projected
-template <typename Iter,
-          typename Proj,
-          typename IndirectResultT = indirect_result_t<Proj, Iter>>
-struct projected {
-  using value_type = remove_cvref_t<IndirectResultT>;
-
-  IndirectResultT operator*() const;  // not defined
-};
-
-}  // namespace base
-
-#undef CR_USE_FALLBACKS_FOR_GCC_WITH_LIBCXX
-#undef CR_USE_FALLBACKS_FOR_OLD_EXPERIMENTAL_GLIBCXX
-
-#endif  // !USING_CHROMIUM_INCLUDES
-
-#endif  // CEF_INCLUDE_BASE_CEF_TEMPLATE_UTIL_H_

include/base/internal/cef_bind_internal.h

@@ -68,7 +68,6 @@
 #include "include/base/cef_build.h"
 #include "include/base/cef_compiler_specific.h"
 #include "include/base/cef_logging.h"
-#include "include/base/cef_template_util.h"
 #include "include/base/cef_weak_ptr.h"
 #include "include/base/internal/cef_callback_internal.h"
 #include "include/base/internal/cef_raw_scoped_refptr_mismatch_checker.h"
@@ -356,14 +355,14 @@ template <typename Functor, typename SFINAE = void>
 struct IsCallableObject : std::false_type {};
 
 template <typename Callable>
-struct IsCallableObject<Callable, void_t<decltype(&Callable::operator())>>
+struct IsCallableObject<Callable, std::void_t<decltype(&Callable::operator())>>
     : std::true_type {};
 
 // HasRefCountedTypeAsRawPtr inherits from true_type when any of the |Args| is a
 // raw pointer to a RefCounted type.
 template <typename... Ts>
 struct HasRefCountedTypeAsRawPtr
-    : disjunction<NeedsScopedRefptrButGetsRawPtr<Ts>...> {};
+    : std::disjunction<NeedsScopedRefptrButGetsRawPtr<Ts>...> {};
 
 // ForceVoidReturn<>
 //
@@ -878,7 +877,7 @@ BanUnconstructedRefCountedReceiver(const Receiver& receiver, Unused&&...) {
 // This stores all the state passed into Bind().
 template <typename Functor, typename... BoundArgs>
 struct BindState final : BindStateBase {
-  using IsCancellable = bool_constant<
+  using IsCancellable = std::bool_constant<
       CallbackCancellationTraits<Functor,
                                  std::tuple<BoundArgs...>>::is_cancellable>;
   template <typename ForwardFunctor, typename... ForwardBoundArgs>
@@ -1252,7 +1251,7 @@ decltype(auto) BindImpl(Functor&& functor, Args&&... args) {
   // PolymorphicInvoke, to which CallbackType will cast back.
   using PolymorphicInvoke = typename CallbackType::PolymorphicInvoke;
   PolymorphicInvoke invoke_func =
-      GetInvokeFunc<Invoker>(bool_constant<kIsOnce>());
+      GetInvokeFunc<Invoker>(std::bool_constant<kIsOnce>());
 
   using InvokeFuncStorage = BindStateBase::InvokeFuncStorage;
   return CallbackType(BindState::Create(

include/base/internal/cef_raw_scoped_refptr_mismatch_checker.h

@@ -34,8 +34,6 @@
 
 #include <type_traits>
 
-#include "include/base/cef_template_util.h"
-
 // It is dangerous to post a task with a T* argument where T is a subtype of
 // RefCounted(Base|ThreadSafeBase), since by the time the parameter is used, the
 // object may already have been deleted since it was not held with a
@@ -54,16 +52,16 @@ struct IsRefCountedType : std::false_type {};
 
 template <typename T>
 struct IsRefCountedType<T,
-                        void_t<decltype(std::declval<T*>()->AddRef()),
-                               decltype(std::declval<T*>()->Release())>>
+                        std::void_t<decltype(std::declval<T*>()->AddRef()),
+                                    decltype(std::declval<T*>()->Release())>>
     : std::true_type {};
 
 // Human readable translation: you needed to be a scoped_refptr if you are a raw
 // pointer type and are convertible to a RefCounted(Base|ThreadSafeBase) type.
 template <typename T>
 struct NeedsScopedRefptrButGetsRawPtr
-    : conjunction<std::is_pointer<T>,
-                  IsRefCountedType<std::remove_pointer_t<T>>> {
+    : std::conjunction<std::is_pointer<T>,
+                       IsRefCountedType<std::remove_pointer_t<T>>> {
   static_assert(!std::is_reference<T>::value,
                 "NeedsScopedRefptrButGetsRawPtr requires non-reference type.");
 };

include/capi/cef_crash_util_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=5c6e0b9e37b8103a182f200fccdf5973104fcd70$
+// $hash=22cfd717df9032a01214d9abfe3e0e51949b3319$
 //
 
 #ifndef CEF_INCLUDE_CAPI_CEF_CRASH_UTIL_CAPI_H_
@@ -90,7 +90,7 @@ extern "C" {
 /// If "AppName" is set on Windows then crash report information (metrics,
 /// database and dumps) will be stored locally on disk under the
 /// "C:\Users\[CurrentUser]\AppData\Local\[AppName]\User Data" folder. On other
-/// platforms the cef_settings_t.user_data_path value will be used.
+/// platforms the cef_settings_t.root_cache_path value will be used.
 ///
 /// If "ExternalHandler" is set on Windows then the specified exe will be
 /// launched as the crashpad-handler instead of re-launching the main process

include/capi/views/cef_browser_view_delegate_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=94e93810316b74e54eb315d97c6fc6f1cc0c9cc5$
+// $hash=d49d6b19e52e8a0496c69ec5cbd00750f7ac4740$
 //
 
 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_BROWSER_VIEW_DELEGATE_CAPI_H_
@@ -124,9 +124,8 @@ typedef struct _cef_browser_view_delegate_t {
   ///
   /// Called when |browser_view| receives a gesture command. Return true (1) to
   /// handle (or disable) a |gesture_command| or false (0) to propagate the
-  /// gesture to the browser for default handling. This function will only be
-  /// called with the Alloy runtime. To handle these commands with the Chrome
-  /// runtime implement cef_command_handler_t::OnChromeCommand instead.
+  /// gesture to the browser for default handling. With the Chrome runtime these
+  /// commands can also be handled via cef_command_handler_t::OnChromeCommand.
   ///
   int(CEF_CALLBACK* on_gesture_command)(
       struct _cef_browser_view_delegate_t* self,

include/capi/views/cef_window_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=e09c33a3604cb7a80ef7fdea72c838619e26dc8c$
+// $hash=d53c4a0a7e731a56a0edcb9d705c76b0a2770155$
 //
 
 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_WINDOW_CAPI_H_
@@ -51,6 +51,8 @@
 extern "C" {
 #endif
 
+struct _cef_browser_view_t;
+
 ///
 /// A Window is a top-level Window/widget in the Views hierarchy. By default it
 /// will have a non-client area with title bar, icon and buttons that supports
@@ -69,6 +71,21 @@ typedef struct _cef_window_t {
   ///
   void(CEF_CALLBACK* show)(struct _cef_window_t* self);
 
+  ///
+  /// Show the Window as a browser modal dialog relative to |browser_view|. A
+  /// parent Window must be returned via
+  /// cef_window_delegate_t::get_parent_window() and |browser_view| must belong
+  /// to that parent Window. While this Window is visible, |browser_view| will
+  /// be disabled while other controls in the parent Window remain enabled.
+  /// Navigating or destroying the |browser_view| will close this Window
+  /// automatically. Alternately, use show() and return true (1) from
+  /// cef_window_delegate_t::is_window_modal_dialog() for a window modal dialog
+  /// where all controls in the parent Window are disabled.
+  ///
+  void(CEF_CALLBACK* show_as_browser_modal_dialog)(
+      struct _cef_window_t* self,
+      struct _cef_browser_view_t* browser_view);
+
   ///
   /// Hide the Window.
   ///

include/capi/views/cef_window_delegate_capi.h

@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=7201d268e16fc89f255b6ccd00d043f34fe77584$
+// $hash=61099a1ba8b16a5e46f5a80d326d1f9bfc99317d$
 //
 
 #ifndef CEF_INCLUDE_CAPI_VIEWS_CEF_WINDOW_DELEGATE_CAPI_H_
@@ -110,6 +110,18 @@ typedef struct _cef_window_delegate_t {
       int* is_menu,
       int* can_activate_menu);
 
+  ///
+  /// Return true (1) if |window| should be created as a window modal dialog.
+  /// Only called when a Window is returned via get_parent_window() with
+  /// |is_menu| set to false (0). All controls in the parent Window will be
+  /// disabled while |window| is visible. This functionality is not supported by
+  /// all Linux window managers. Alternately, use
+  /// cef_window_t::show_as_browser_modal_dialog() for a browser modal dialog
+  /// that works on all platforms.
+  ///
+  int(CEF_CALLBACK* is_window_modal_dialog)(struct _cef_window_delegate_t* self,
+                                            struct _cef_window_t* window);
+
   ///
   /// Return the initial bounds for |window| in density independent pixel (DIP)
   /// coordinates. If this function returns an NULL CefRect then

include/cef_api_hash.h

@@ -42,13 +42,13 @@
 // way that may cause binary incompatibility with other builds. The universal
 // hash value will change if any platform is affected whereas the platform hash
 // values will change only if that particular platform is affected.
-#define CEF_API_HASH_UNIVERSAL "ea590fbd1cbe2c80698a52efb712357a307fee34"
+#define CEF_API_HASH_UNIVERSAL "515045085896c9e45c1aaf734ee201efad822f6a"
 #if defined(OS_WIN)
-#define CEF_API_HASH_PLATFORM "8a76490c640051ed3500b3b19035be58daf755f7"
+#define CEF_API_HASH_PLATFORM "1091d9b7f17abbbf86cbbf50db7106a2bad98ab5"
 #elif defined(OS_MAC)
-#define CEF_API_HASH_PLATFORM "725ff527623c12c783b999212b01f5d721622779"
+#define CEF_API_HASH_PLATFORM "bfb5a9cb4551e80a0606531399e3244eac457a33"
 #elif defined(OS_LINUX)
-#define CEF_API_HASH_PLATFORM "52bd91427e6857b3f43a3bed552703d210927cff"
+#define CEF_API_HASH_PLATFORM "1ef1d39d8c95b1d6c93fa60a29e158a96f76ab9d"
 #endif
 
 #ifdef __cplusplus

include/cef_crash_util.h

@@ -82,7 +82,7 @@
 /// If "AppName" is set on Windows then crash report information (metrics,
 /// database and dumps) will be stored locally on disk under the
 /// "C:\Users\[CurrentUser]\AppData\Local\[AppName]\User Data" folder. On other
-/// platforms the cef_settings_t.user_data_path value will be used.
+/// platforms the cef_settings_t.root_cache_path value will be used.
 ///
 /// If "ExternalHandler" is set on Windows then the specified exe will be
 /// launched as the crashpad-handler instead of re-launching the main process

include/internal/cef_string_types.h

@@ -32,7 +32,18 @@
 #pragma once
 
 #include <stddef.h>
+
+#ifdef __clang__
+// On macOS, <uchar.h> is only available with Xcode 14.3+.
+#if __has_include(<uchar.h>)
 #include <uchar.h>
+#elif !defined(__cplusplus)
+#include <stdint.h>
+typedef uint_least16_t char16_t;
+#endif
+#else
+#include <uchar.h>
+#endif
 
 #include "include/internal/cef_export.h"
 

include/internal/cef_types.h

@@ -34,7 +34,6 @@
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
-#include <uchar.h>
 
 #include "include/internal/cef_string.h"
 #include "include/internal/cef_string_list.h"
@@ -261,24 +260,16 @@ typedef struct _cef_settings_t {
   /// The root directory that all CefSettings.cache_path and
   /// CefRequestContextSettings.cache_path values must have in common. If this
   /// value is empty and CefSettings.cache_path is non-empty then it will
-  /// default to the CefSettings.cache_path value. If this value is non-empty
-  /// then it must be an absolute path. Failure to set this value correctly may
-  /// result in the sandbox blocking read/write access to the cache_path
-  /// directory.
-  ///
-  cef_string_t root_cache_path;
-
-  ///
-  /// The location where user data such as the Widevine CDM module and spell
-  /// checking dictionary files will be stored on disk. If this value is empty
-  /// then the default platform-specific user data directory will be used
+  /// default to the CefSettings.cache_path value. If both values are empty
+  /// then the default platform-specific directory will be used
   /// ("~/.config/cef_user_data" directory on Linux, "~/Library/Application
   /// Support/CEF/User Data" directory on MacOS, "AppData\Local\CEF\User Data"
   /// directory under the user profile directory on Windows). If this value is
-  /// non-empty then it must be an absolute path. When using the Chrome runtime
-  /// this value will be ignored in favor of the |root_cache_path| value.
+  /// non-empty then it must be an absolute path. Failure to set this value
+  /// correctly may result in the sandbox blocking read/write access to certain
+  /// files.
   ///
-  cef_string_t user_data_path;
+  cef_string_t root_cache_path;
 
   ///
   /// To persist session cookies (cookies without an expiry date or validity
@@ -3296,7 +3287,8 @@ typedef enum {
   CEF_CPAIT_ZOOM,
   CEF_CPAIT_SAVE_IBAN,
   CEF_CPAIT_MANDATORY_REAUTH,
-  CEF_CPAIT_MAX_VALUE = CEF_CPAIT_MANDATORY_REAUTH,
+  CEF_CPAIT_PRICE_INSIGHTS,
+  CEF_CPAIT_MAX_VALUE = CEF_CPAIT_PRICE_INSIGHTS,
 } cef_chrome_page_action_icon_type_t;
 
 ///
@@ -3426,16 +3418,17 @@ typedef enum {
   CEF_PERMISSION_TYPE_GEOLOCATION = 1 << 8,
   CEF_PERMISSION_TYPE_IDLE_DETECTION = 1 << 9,
   CEF_PERMISSION_TYPE_MIC_STREAM = 1 << 10,
-  CEF_PERMISSION_TYPE_MIDI_SYSEX = 1 << 11,
-  CEF_PERMISSION_TYPE_MULTIPLE_DOWNLOADS = 1 << 12,
-  CEF_PERMISSION_TYPE_NOTIFICATIONS = 1 << 13,
-  CEF_PERMISSION_TYPE_PROTECTED_MEDIA_IDENTIFIER = 1 << 14,
-  CEF_PERMISSION_TYPE_REGISTER_PROTOCOL_HANDLER = 1 << 15,
-  CEF_PERMISSION_TYPE_SECURITY_ATTESTATION = 1 << 16,
-  CEF_PERMISSION_TYPE_STORAGE_ACCESS = 1 << 17,
-  CEF_PERMISSION_TYPE_U2F_API_REQUEST = 1 << 18,
-  CEF_PERMISSION_TYPE_VR_SESSION = 1 << 19,
-  CEF_PERMISSION_TYPE_WINDOW_MANAGEMENT = 1 << 20,
+  CEF_PERMISSION_TYPE_MIDI = 1 << 11,
+  CEF_PERMISSION_TYPE_MIDI_SYSEX = 1 << 12,
+  CEF_PERMISSION_TYPE_MULTIPLE_DOWNLOADS = 1 << 13,
+  CEF_PERMISSION_TYPE_NOTIFICATIONS = 1 << 14,
+  CEF_PERMISSION_TYPE_PROTECTED_MEDIA_IDENTIFIER = 1 << 15,
+  CEF_PERMISSION_TYPE_REGISTER_PROTOCOL_HANDLER = 1 << 16,
+  CEF_PERMISSION_TYPE_SECURITY_ATTESTATION = 1 << 17,
+  CEF_PERMISSION_TYPE_STORAGE_ACCESS = 1 << 18,
+  CEF_PERMISSION_TYPE_U2F_API_REQUEST = 1 << 19,
+  CEF_PERMISSION_TYPE_VR_SESSION = 1 << 20,
+  CEF_PERMISSION_TYPE_WINDOW_MANAGEMENT = 1 << 21,
 } cef_permission_request_types_t;
 
 ///

include/internal/cef_types_wrappers.h

@@ -364,7 +364,6 @@ struct CefSettingsTraits {
     cef_string_clear(&s->main_bundle_path);
     cef_string_clear(&s->cache_path);
     cef_string_clear(&s->root_cache_path);
-    cef_string_clear(&s->user_data_path);
     cef_string_clear(&s->user_agent);
     cef_string_clear(&s->user_agent_product);
     cef_string_clear(&s->locale);
@@ -397,8 +396,6 @@ struct CefSettingsTraits {
                    &target->cache_path, copy);
     cef_string_set(src->root_cache_path.str, src->root_cache_path.length,
                    &target->root_cache_path, copy);
-    cef_string_set(src->user_data_path.str, src->user_data_path.length,
-                   &target->user_data_path, copy);
     target->persist_session_cookies = src->persist_session_cookies;
     target->persist_user_preferences = src->persist_user_preferences;
 

include/views/cef_browser_view_delegate.h

@@ -118,9 +118,8 @@ class CefBrowserViewDelegate : public CefViewDelegate {
   ///
   /// Called when |browser_view| receives a gesture command. Return true to
   /// handle (or disable) a |gesture_command| or false to propagate the gesture
-  /// to the browser for default handling. This method will only be called with
-  /// the Alloy runtime. To handle these commands with the Chrome runtime
-  /// implement CefCommandHandler::OnChromeCommand instead.
+  /// to the browser for default handling. With the Chrome runtime these
+  /// commands can also be handled via CefCommandHandler::OnChromeCommand.
   ///
   /*--cef()--*/
   virtual bool OnGestureCommand(CefRefPtr<CefBrowserView> browser_view,

include/views/cef_window.h

@@ -45,6 +45,8 @@
 #include "include/views/cef_panel.h"
 #include "include/views/cef_window_delegate.h"
 
+class CefBrowserView;
+
 ///
 /// A Window is a top-level Window/widget in the Views hierarchy. By default it
 /// will have a non-client area with title bar, icon and buttons that supports
@@ -68,6 +70,20 @@ class CefWindow : public CefPanel {
   /*--cef()--*/
   virtual void Show() = 0;
 
+  ///
+  /// Show the Window as a browser modal dialog relative to |browser_view|. A
+  /// parent Window must be returned via CefWindowDelegate::GetParentWindow()
+  /// and |browser_view| must belong to that parent Window. While this Window is
+  /// visible, |browser_view| will be disabled while other controls in the
+  /// parent Window remain enabled. Navigating or destroying the |browser_view|
+  /// will close this Window automatically. Alternately, use Show() and return
+  /// true from CefWindowDelegate::IsWindowModalDialog() for a window modal
+  /// dialog where all controls in the parent Window are disabled.
+  ///
+  /*--cef()--*/
+  virtual void ShowAsBrowserModalDialog(
+      CefRefPtr<CefBrowserView> browser_view) = 0;
+
   ///
   /// Hide the Window.
   ///

include/views/cef_window_delegate.h

@@ -99,6 +99,19 @@ class CefWindowDelegate : public CefPanelDelegate {
     return nullptr;
   }
 
+  ///
+  /// Return true if |window| should be created as a window modal dialog. Only
+  /// called when a Window is returned via GetParentWindow() with |is_menu| set
+  /// to false. All controls in the parent Window will be disabled while
+  /// |window| is visible. This functionality is not supported by all Linux
+  /// window managers. Alternately, use CefWindow::ShowAsBrowserModalDialog()
+  /// for a browser modal dialog that works on all platforms.
+  ///
+  /*--cef()--*/
+  virtual bool IsWindowModalDialog(CefRefPtr<CefWindow> window) {
+    return false;
+  }
+
   ///
   /// Return the initial bounds for |window| in density independent pixel (DIP)
   /// coordinates. If this method returns an empty CefRect then

libcef/browser/alloy/alloy_browser_main.cc

@@ -32,6 +32,7 @@
 #include "chrome/browser/ui/color/chrome_color_mixers.h"
 #include "chrome/browser/ui/javascript_dialogs/chrome_javascript_app_modal_dialog_view_factory.h"
 #include "chrome/browser/ui/ui_features.h"
+#include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "components/constrained_window/constrained_window_views.h"
 #include "content/public/browser/gpu_data_manager.h"
@@ -58,6 +59,7 @@
 
 #if BUILDFLAG(IS_WIN)
 #include "base/enterprise_util.h"
+#include "base/files/file_util.h"
 #include "chrome/browser/chrome_browser_main_win.h"
 #include "chrome/browser/win/parental_controls.h"
 #endif
@@ -82,7 +84,6 @@
 #include "base/path_service.h"
 #include "chrome/browser/themes/theme_service_aura_linux.h"
 #include "chrome/browser/ui/views/theme_profile_key.h"
-#include "chrome/common/chrome_paths.h"
 #include "chrome/grit/chromium_strings.h"
 #include "components/os_crypt/sync/key_storage_config_linux.h"
 #include "libcef/browser/printing/print_dialog_linux.h"
@@ -232,8 +233,6 @@ void AlloyBrowserMainParts::PostCreateMainMessageLoop() {
   config->store = command_line->GetSwitchValueASCII(switches::kPasswordStore);
   // Forward the product name (defaults to "Chromium").
   config->product_name = l10n_util::GetStringUTF8(IDS_PRODUCT_NAME);
-  // OSCrypt may target keyring, which requires calls from the main thread.
-  config->main_thread_runner = content::GetUIThreadTaskRunner({});
   // OSCrypt can be disabled in a special settings file.
   config->should_use_preference =
       command_line->HasSwitch(switches::kEnableEncryptionSelection);
@@ -241,6 +240,10 @@ void AlloyBrowserMainParts::PostCreateMainMessageLoop() {
   DCHECK(!config->user_data_path.empty());
   OSCrypt::SetConfig(std::move(config));
 #endif  // BUILDFLAG(IS_LINUX)
+
+#if BUILDFLAG(IS_WIN)
+  base::SetExtraNoExecuteAllowedPath(chrome::DIR_USER_DATA);
+#endif
 }
 
 int AlloyBrowserMainParts::PreCreateThreads() {

libcef/browser/alloy/alloy_content_browser_client.cc

@@ -300,11 +300,11 @@ void BindNetworkHintsHandler(
   predictors::NetworkHintsHandlerImpl::Create(frame_host, std::move(receiver));
 }
 
-base::FilePath GetRootCachePath() {
-  // The CefContext::ValidateCachePath method enforces the requirement that all
-  // cache_path values be either equal to or a child of root_cache_path.
-  return base::FilePath(
-      CefString(&CefContext::Get()->settings().root_cache_path));
+base::FilePath GetUserDataPath() {
+  base::FilePath user_data_path;
+  base::PathService::Get(chrome::DIR_USER_DATA, &user_data_path);
+  DCHECK(!user_data_path.empty());
+  return user_data_path;
 }
 
 const extensions::Extension* GetEnabledExtensionFromSiteURL(
@@ -322,6 +322,25 @@ const extensions::Extension* GetEnabledExtensionFromSiteURL(
   return registry->enabled_extensions().GetByID(site_url.host());
 }
 
+std::unique_ptr<blink::URLLoaderThrottle> CreateGoogleURLLoaderThrottle(
+    Profile* profile) {
+  chrome::mojom::DynamicParamsPtr dynamic_params =
+      chrome::mojom::DynamicParams::New(
+#if BUILDFLAG(ENABLE_BOUND_SESSION_CREDENTIALS)
+          /*bound_session_params=*/nullptr,
+#endif
+          profile->GetPrefs()->GetBoolean(
+              policy::policy_prefs::kForceGoogleSafeSearch),
+          profile->GetPrefs()->GetInteger(
+              policy::policy_prefs::kForceYouTubeRestrict),
+          profile->GetPrefs()->GetString(prefs::kAllowedDomainsForApps));
+  return std::make_unique<GoogleURLLoaderThrottle>(
+#if BUILDFLAG(ENABLE_BOUND_SESSION_CREDENTIALS)
+      /*bound_session_request_throttled_listener=*/nullptr,
+#endif
+      std::move(dynamic_params));
+}
+
 }  // namespace
 
 AlloyContentBrowserClient::AlloyContentBrowserClient() = default;
@@ -894,21 +913,28 @@ AlloyContentBrowserClient::CreateURLLoaderThrottles(
 
   Profile* profile = Profile::FromBrowserContext(browser_context);
 
-  chrome::mojom::DynamicParamsPtr dynamic_params =
-      chrome::mojom::DynamicParams::New(
-#if BUILDFLAG(ENABLE_BOUND_SESSION_CREDENTIALS)
-          /*bound_session_params=*/nullptr,
-#endif
-          profile->GetPrefs()->GetBoolean(
-              policy::policy_prefs::kForceGoogleSafeSearch),
-          profile->GetPrefs()->GetInteger(
-              policy::policy_prefs::kForceYouTubeRestrict),
-          profile->GetPrefs()->GetString(prefs::kAllowedDomainsForApps));
-  result.push_back(std::make_unique<GoogleURLLoaderThrottle>(
-#if BUILDFLAG(ENABLE_BOUND_SESSION_CREDENTIALS)
-      /*bound_session_request_throttled_listener=*/nullptr,
-#endif
-      std::move(dynamic_params)));
+  if (auto google_throttle = CreateGoogleURLLoaderThrottle(profile)) {
+    result.push_back(std::move(google_throttle));
+  }
+
+  return result;
+}
+
+std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
+AlloyContentBrowserClient::CreateURLLoaderThrottlesForKeepAlive(
+    const network::ResourceRequest& request,
+    content::BrowserContext* browser_context,
+    const base::RepeatingCallback<content::WebContents*()>& wc_getter,
+    int frame_tree_node_id) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  std::vector<std::unique_ptr<blink::URLLoaderThrottle>> result;
+
+  Profile* profile = Profile::FromBrowserContext(browser_context);
+
+  if (auto google_throttle = CreateGoogleURLLoaderThrottle(profile)) {
+    result.push_back(std::move(google_throttle));
+  }
 
   return result;
 }
@@ -916,7 +942,9 @@ AlloyContentBrowserClient::CreateURLLoaderThrottles(
 std::vector<std::unique_ptr<content::URLLoaderRequestInterceptor>>
 AlloyContentBrowserClient::WillCreateURLLoaderRequestInterceptors(
     content::NavigationUIData* navigation_ui_data,
-    int frame_tree_node_id) {
+    int frame_tree_node_id,
+    int64_t navigation_id,
+    scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner) {
   std::vector<std::unique_ptr<content::URLLoaderRequestInterceptor>>
       interceptors;
 
@@ -1091,7 +1119,8 @@ bool AlloyContentBrowserClient::WillCreateURLLoaderFactory(
         header_client,
     bool* bypass_redirect_checks,
     bool* disable_secure_dns,
-    network::mojom::URLLoaderFactoryOverridePtr* factory_override) {
+    network::mojom::URLLoaderFactoryOverridePtr* factory_override,
+    scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner) {
   auto request_handler = net_service::CreateInterceptedRequestHandler(
       browser_context, frame, render_process_id,
       type == URLLoaderFactoryType::kNavigation,
@@ -1159,19 +1188,7 @@ bool AlloyContentBrowserClient::ConfigureNetworkContextParams(
 // directories that are not returned by this method.
 std::vector<base::FilePath>
 AlloyContentBrowserClient::GetNetworkContextsParentDirectory() {
-  base::FilePath user_data_path;
-  base::PathService::Get(chrome::DIR_USER_DATA, &user_data_path);
-  DCHECK(!user_data_path.empty());
-
-  const auto& root_cache_path = GetRootCachePath();
-
-  // root_cache_path may sometimes be empty or a child of user_data_path, so
-  // only return the one path in that case.
-  if (root_cache_path.empty() || user_data_path.IsParent(root_cache_path)) {
-    return {user_data_path};
-  }
-
-  return {user_data_path, root_cache_path};
+  return {GetUserDataPath()};
 }
 
 bool AlloyContentBrowserClient::HandleExternalProtocol(
@@ -1282,7 +1299,7 @@ void AlloyContentBrowserClient::RegisterBrowserInterfaceBindersForServiceWorker(
 
 base::FilePath
 AlloyContentBrowserClient::GetSandboxedStorageServiceDataDirectory() {
-  return GetRootCachePath();
+  return GetUserDataPath();
 }
 
 std::string AlloyContentBrowserClient::GetProduct() {
@@ -1297,14 +1314,6 @@ std::string AlloyContentBrowserClient::GetUserAgent() {
   return embedder_support::GetUserAgent();
 }
 
-std::string AlloyContentBrowserClient::GetFullUserAgent() {
-  return embedder_support::GetFullUserAgent();
-}
-
-std::string AlloyContentBrowserClient::GetReducedUserAgent() {
-  return embedder_support::GetReducedUserAgent();
-}
-
 std::unique_ptr<content::WebContentsViewDelegate>
 AlloyContentBrowserClient::GetWebContentsViewDelegate(
     content::WebContents* web_contents) {

libcef/browser/alloy/alloy_content_browser_client.h

@@ -129,10 +129,19 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
       const base::RepeatingCallback<content::WebContents*()>& wc_getter,
       content::NavigationUIData* navigation_ui_data,
       int frame_tree_node_id) override;
+  std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
+  CreateURLLoaderThrottlesForKeepAlive(
+      const network::ResourceRequest& request,
+      content::BrowserContext* browser_context,
+      const base::RepeatingCallback<content::WebContents*()>& wc_getter,
+      int frame_tree_node_id) override;
   std::vector<std::unique_ptr<content::URLLoaderRequestInterceptor>>
   WillCreateURLLoaderRequestInterceptors(
       content::NavigationUIData* navigation_ui_data,
-      int frame_tree_node_id) override;
+      int frame_tree_node_id,
+      int64_t navigation_id,
+      scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner)
+      override;
 
 #if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC)
   void GetAdditionalMappedFilesForChildProcess(
@@ -178,7 +187,9 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
           header_client,
       bool* bypass_redirect_checks,
       bool* disable_secure_dns,
-      network::mojom::URLLoaderFactoryOverridePtr* factory_override) override;
+      network::mojom::URLLoaderFactoryOverridePtr* factory_override,
+      scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner)
+      override;
   void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service) override;
   bool ConfigureNetworkContextParams(
@@ -230,8 +241,6 @@ class AlloyContentBrowserClient : public content::ContentBrowserClient {
   std::string GetProduct() override;
   std::string GetChromeProduct() override;
   std::string GetUserAgent() override;
-  std::string GetFullUserAgent() override;
-  std::string GetReducedUserAgent() override;
   std::unique_ptr<content::WebContentsViewDelegate> GetWebContentsViewDelegate(
       content::WebContents* web_contents) override;
   blink::UserAgentMetadata GetUserAgentMetadata() override;

libcef/browser/alloy/chrome_browser_process_alloy.cc

@@ -16,6 +16,7 @@
 #include "libcef/common/extensions/extensions_util.h"
 
 #include "base/command_line.h"
+#include "base/path_service.h"
 #include "chrome/browser/component_updater/chrome_component_updater_configurator.h"
 #include "chrome/browser/net/system_network_context_manager.h"
 #include "chrome/browser/permissions/chrome_permissions_client.h"
@@ -24,6 +25,7 @@
 #include "chrome/browser/printing/print_job_manager.h"
 #include "chrome/browser/printing/print_preview_dialog_controller.h"
 #include "chrome/browser/ui/prefs/pref_watcher.h"
+#include "chrome/common/chrome_paths.h"
 #include "components/component_updater/component_updater_service.h"
 #include "components/component_updater/timer_update_scheduler.h"
 #include "components/net_log/chrome_net_log.h"
@@ -32,7 +34,6 @@
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/common/content_switches.h"
 #include "net/log/net_log_capture_mode.h"
-#include "services/device/public/cpp/geolocation/geolocation_manager.h"
 #include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 
@@ -144,11 +145,6 @@ void ChromeBrowserProcessAlloy::FlushLocalStateAndReply(
   DCHECK(false);
 }
 
-device::GeolocationManager* ChromeBrowserProcessAlloy::geolocation_manager() {
-  DCHECK(false);
-  return nullptr;
-}
-
 metrics_services_manager::MetricsServicesManager*
 ChromeBrowserProcessAlloy::GetMetricsServicesManager() {
   DCHECK(false);
@@ -186,16 +182,15 @@ ProfileManager* ChromeBrowserProcessAlloy::profile_manager() {
 PrefService* ChromeBrowserProcessAlloy::local_state() {
   DCHECK(initialized_);
   if (!local_state_) {
-    // Use a location that is shared by all request contexts.
-    const CefSettings& settings = CefContext::Get()->settings();
-    const base::FilePath& root_cache_path =
-        base::FilePath(CefString(&settings.root_cache_path));
+    base::FilePath user_data_path;
+    base::PathService::Get(chrome::DIR_USER_DATA, &user_data_path);
+    DCHECK(!user_data_path.empty());
 
     // Used for very early NetworkService initialization.
     // Always persist preferences for this PrefService if possible because it
     // contains the cookie encryption key on Windows.
     local_state_ =
-        browser_prefs::CreatePrefService(nullptr /* profile */, root_cache_path,
+        browser_prefs::CreatePrefService(nullptr /* profile */, user_data_path,
                                          true /* persist_user_preferences */);
   }
   return local_state_.get();
@@ -234,11 +229,6 @@ ChromeBrowserProcessAlloy::notification_platform_bridge() {
   return nullptr;
 }
 
-void ChromeBrowserProcessAlloy::SetGeolocationManager(
-    std::unique_ptr<device::GeolocationManager> geolocation_manager) {
-  DCHECK(false);
-}
-
 policy::ChromeBrowserPolicyConnector*
 ChromeBrowserProcessAlloy::browser_policy_connector() {
   if (!browser_policy_connector_) {
@@ -427,12 +417,6 @@ ChromeBrowserProcessAlloy::serial_policy_allowed_ports() {
   return nullptr;
 }
 
-HidPolicyAllowedDevices*
-ChromeBrowserProcessAlloy::hid_policy_allowed_devices() {
-  DCHECK(false);
-  return nullptr;
-}
-
 HidSystemTrayIcon* ChromeBrowserProcessAlloy::hid_system_tray_icon() {
   DCHECK(false);
   return nullptr;

libcef/browser/alloy/chrome_browser_process_alloy.h

@@ -51,7 +51,6 @@ class ChromeBrowserProcessAlloy : public BrowserProcess {
   // BrowserProcess implementation.
   void EndSession() override;
   void FlushLocalStateAndReply(base::OnceClosure reply) override;
-  device::GeolocationManager* geolocation_manager() override;
   metrics_services_manager::MetricsServicesManager* GetMetricsServicesManager()
       override;
   metrics::MetricsService* metrics_service() override;
@@ -68,8 +67,6 @@ class ChromeBrowserProcessAlloy : public BrowserProcess {
   extensions::EventRouterForwarder* extension_event_router_forwarder() override;
   NotificationUIManager* notification_ui_manager() override;
   NotificationPlatformBridge* notification_platform_bridge() override;
-  void SetGeolocationManager(
-      std::unique_ptr<device::GeolocationManager> geolocation_manager) override;
   policy::ChromeBrowserPolicyConnector* browser_policy_connector() override;
   policy::PolicyService* policy_service() override;
   IconManager* icon_manager() override;
@@ -111,7 +108,6 @@ class ChromeBrowserProcessAlloy : public BrowserProcess {
       override;
   BuildState* GetBuildState() override;
   SerialPolicyAllowedPorts* serial_policy_allowed_ports() override;
-  HidPolicyAllowedDevices* hid_policy_allowed_devices() override;
   HidSystemTrayIcon* hid_system_tray_icon() override;
 
  private:

libcef/browser/browser_message_loop.cc

@@ -115,7 +115,7 @@ std::unique_ptr<base::MessagePump> MessagePumpFactoryForUI() {
   }
 
 #if BUILDFLAG(IS_MAC)
-  return base::MessagePumpMac::Create();
+  return base::message_pump_mac::Create();
 #else
   return std::make_unique<base::MessagePumpForUI>();
 #endif

libcef/browser/browser_platform_delegate.cc

@@ -5,12 +5,30 @@
 #include "libcef/browser/browser_platform_delegate.h"
 
 #include "libcef/browser/alloy/alloy_browser_host_impl.h"
+#include "libcef/browser/thread_util.h"
 
 #include "base/logging.h"
+#include "chrome/browser/platform_util.h"
+#include "chrome/browser/shell_integration.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 
+namespace {
+
+void ExecuteExternalProtocol(const GURL& url) {
+  CEF_REQUIRE_BLOCKING();
+
+  // Check that an application is associated with the scheme.
+  if (shell_integration::GetApplicationNameForScheme(url).empty()) {
+    return;
+  }
+
+  CEF_POST_TASK(TID_UI, base::BindOnce(&platform_util::OpenExternal, url));
+}
+
+}  // namespace
+
 CefBrowserPlatformDelegate::CefBrowserPlatformDelegate() = default;
 
 CefBrowserPlatformDelegate::~CefBrowserPlatformDelegate() {
@@ -225,6 +243,11 @@ bool CefBrowserPlatformDelegate::IsNeverComposited(
   return false;
 }
 
+// static
+void CefBrowserPlatformDelegate::HandleExternalProtocol(const GURL& url) {
+  CEF_POST_USER_VISIBLE_TASK(base::BindOnce(ExecuteExternalProtocol, url));
+}
+
 CefEventHandle CefBrowserPlatformDelegate::GetEventHandle(
     const content::NativeWebKeyboardEvent& event) const {
   DCHECK(false);

libcef/browser/chrome/chrome_content_browser_client_cef.cc

@@ -241,7 +241,8 @@ bool ChromeContentBrowserClientCef::WillCreateURLLoaderFactory(
         header_client,
     bool* bypass_redirect_checks,
     bool* disable_secure_dns,
-    network::mojom::URLLoaderFactoryOverridePtr* factory_override) {
+    network::mojom::URLLoaderFactoryOverridePtr* factory_override,
+    scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner) {
   // Don't intercept requests for Profiles that were not created by CEF.
   // For example, the User Manager profile created via
   // profiles::CreateSystemProfileForUserManager.
@@ -250,7 +251,8 @@ bool ChromeContentBrowserClientCef::WillCreateURLLoaderFactory(
     return ChromeContentBrowserClient::WillCreateURLLoaderFactory(
         browser_context, frame, render_process_id, type, request_initiator,
         navigation_id, ukm_source_id, factory_receiver, header_client,
-        bypass_redirect_checks, disable_secure_dns, factory_override);
+        bypass_redirect_checks, disable_secure_dns, factory_override,
+        navigation_response_task_runner);
   }
 
   // Based on content/browser/devtools/devtools_instrumentation.cc
@@ -281,7 +283,7 @@ bool ChromeContentBrowserClientCef::WillCreateURLLoaderFactory(
       navigation_id, ukm_source_id,
       &(intercepting_factory->overridden_factory_receiver),
       /*header_client=*/nullptr, bypass_redirect_checks, disable_secure_dns,
-      handler_override);
+      handler_override, navigation_response_task_runner);
 
   if (use_proxy) {
     DCHECK(intercepting_factory->overriding_factory);

libcef/browser/chrome/chrome_content_browser_client_cef.h

@@ -68,7 +68,9 @@ class ChromeContentBrowserClientCef : public ChromeContentBrowserClient {
           header_client,
       bool* bypass_redirect_checks,
       bool* disable_secure_dns,
-      network::mojom::URLLoaderFactoryOverridePtr* factory_override) override;
+      network::mojom::URLLoaderFactoryOverridePtr* factory_override,
+      scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner)
+      override;
   bool HandleExternalProtocol(
       const GURL& url,
       content::WebContents::Getter web_contents_getter,

libcef/browser/chrome/views/chrome_browser_view.cc

@@ -70,6 +70,13 @@ void ChromeBrowserView::OnBoundsChanged(const gfx::Rect& previous_bounds) {
   browser_view_delegate_->OnBoundsChanged();
 }
 
+void ChromeBrowserView::OnGestureEvent(ui::GestureEvent* event) {
+  if (browser_view_delegate_->OnGestureEvent(event)) {
+    return;
+  }
+  ParentClass::OnGestureEvent(event);
+}
+
 ToolbarView* ChromeBrowserView::OverrideCreateToolbar(
     Browser* browser,
     BrowserView* browser_view) {

libcef/browser/chrome/views/chrome_browser_view.h

@@ -45,6 +45,7 @@ class ChromeBrowserView
       const views::ViewHierarchyChangedDetails& details) override;
   void AddedToWidget() override;
   void OnBoundsChanged(const gfx::Rect& previous_bounds) override;
+  void OnGestureEvent(ui::GestureEvent* event) override;
 
   // BrowserView methods:
   ToolbarView* OverrideCreateToolbar(Browser* browser,

libcef/browser/context.cc

@@ -462,7 +462,6 @@ bool CefContext::Initialize(const CefMainArgs& args,
                       "browser_subprocess_path");
   NormalizePathAndSet(settings_.framework_dir_path, "framework_dir_path");
   NormalizePathAndSet(settings_.main_bundle_path, "main_bundle_path");
-  NormalizePathAndSet(settings_.user_data_path, "user_data_path");
   NormalizePathAndSet(settings_.resources_dir_path, "resources_dir_path");
   NormalizePathAndSet(settings_.locales_dir_path, "locales_dir_path");
 

libcef/browser/devtools/devtools_frontend.cc

@@ -19,7 +19,6 @@
 #include "base/base64.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
-#include "base/guid.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
 #include "base/json/string_escape.h"
@@ -28,6 +27,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/uuid.h"
 #include "base/values.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
@@ -341,8 +341,9 @@ void CefDevToolsFrontend::ReadyToCommitNavigation(
   if (it == extensions_api_.end()) {
     return;
   }
-  std::string script = base::StringPrintf("%s(\"%s\")", it->second.c_str(),
-                                          base::GenerateGUID().c_str());
+  std::string script = base::StringPrintf(
+      "%s(\"%s\")", it->second.c_str(),
+      base::Uuid::GenerateRandomV4().AsLowercaseString().c_str());
   content::DevToolsFrontendHost::SetupExtensionsAPI(frame, script);
 }
 

libcef/browser/file_dialog_runner.cc

@@ -8,7 +8,6 @@
 #include "libcef/browser/browser_host_base.h"
 #include "libcef/browser/extensions/browser_extensions_util.h"
 
-#include "base/memory/singleton.h"
 #include "chrome/browser/file_select_helper.h"
 #include "chrome/browser/ui/chrome_select_file_policy.h"
 #include "ui/shell_dialogs/select_file_dialog_factory.h"
@@ -26,27 +25,17 @@ namespace {
 // |run_from_cef=false| to trigger creation of the default platform dialog.
 class CefSelectFileDialogFactory final : public ui::SelectFileDialogFactory {
  public:
+  CefSelectFileDialogFactory() = default;
+
   CefSelectFileDialogFactory(const CefSelectFileDialogFactory&) = delete;
   CefSelectFileDialogFactory& operator=(const CefSelectFileDialogFactory&) =
       delete;
 
-  static CefSelectFileDialogFactory* GetInstance() {
-    // Leaky because there is no useful cleanup to do.
-    return base::Singleton<
-        CefSelectFileDialogFactory,
-        base::LeakySingletonTraits<CefSelectFileDialogFactory>>::get();
-  }
-
   ui::SelectFileDialog* Create(
       ui::SelectFileDialog::Listener* listener,
       std::unique_ptr<ui::SelectFilePolicy> policy) override;
 
   bool IsCefFactory() const override { return true; }
-
- private:
-  friend struct base::DefaultSingletonTraits<CefSelectFileDialogFactory>;
-
-  CefSelectFileDialogFactory() { ui::SelectFileDialog::SetFactory(this); }
 };
 
 // Delegates the running of the dialog to CefFileDialogManager.
@@ -158,8 +147,8 @@ ui::SelectFileDialog* CefSelectFileDialogFactory::Create(
 namespace file_dialog_runner {
 
 void RegisterFactory() {
-  // Implicitly registers on creation.
-  CefSelectFileDialogFactory::GetInstance();
+  ui::SelectFileDialog::SetFactory(
+      std::make_unique<CefSelectFileDialogFactory>());
 }
 
 }  // namespace file_dialog_runner

libcef/browser/main_runner.cc

@@ -273,8 +273,8 @@ void CefMainRunner::Shutdown(base::OnceClosure shutdown_on_ui_thread,
 void CefMainRunner::RunMessageLoop() {
   base::RunLoop run_loop;
 
-  DCHECK(quit_when_idle_callback_.is_null());
-  quit_when_idle_callback_ = run_loop.QuitWhenIdleClosure();
+  DCHECK(quit_callback_.is_null());
+  quit_callback_ = run_loop.QuitClosure();
 
   main_delegate_->BeforeMainMessageLoopRun(&run_loop);
 
@@ -283,11 +283,11 @@ void CefMainRunner::RunMessageLoop() {
 }
 
 void CefMainRunner::QuitMessageLoop() {
-  if (!quit_when_idle_callback_.is_null()) {
+  if (!quit_callback_.is_null()) {
     if (main_delegate_->HandleMainMessageLoopQuit()) {
       return;
     }
-    std::move(quit_when_idle_callback_).Run();
+    std::move(quit_callback_).Run();
   }
 }
 

libcef/browser/main_runner.h

@@ -89,7 +89,7 @@ class CefMainRunner : public CefMainRunnerHandler {
   std::unique_ptr<CefUIThread> ui_thread_;
 
   // Used to quit the current base::RunLoop.
-  base::OnceClosure quit_when_idle_callback_;
+  base::OnceClosure quit_callback_;
 };
 
 #endif  // CEF_LIBCEF_BROWSER_MAIN_RUNNER_H_

libcef/browser/native/browser_platform_delegate_native_linux.cc

@@ -233,9 +233,6 @@ bool CefBrowserPlatformDelegateNativeLinux::HandleKeyboardEvent(
   return false;
 }
 
-// static
-void CefBrowserPlatformDelegate::HandleExternalProtocol(const GURL& url) {}
-
 CefEventHandle CefBrowserPlatformDelegateNativeLinux::GetEventHandle(
     const content::NativeWebKeyboardEvent& event) const {
   // TODO(cef): We need to return an XEvent* from this method, but

libcef/browser/native/browser_platform_delegate_native_mac.mm

@@ -14,6 +14,7 @@
 #include "libcef/browser/native/menu_runner_mac.h"
 #include "libcef/browser/thread_util.h"
 
+#include "base/apple/owned_objc.h"
 #include "base/mac/scoped_nsautorelease_pool.h"
 #include "base/memory/ptr_util.h"
 #include "base/threading/thread_restrictions.h"
@@ -456,18 +457,16 @@ void CefBrowserPlatformDelegateNativeMac::ViewText(const std::string& text) {
 bool CefBrowserPlatformDelegateNativeMac::HandleKeyboardEvent(
     const content::NativeWebKeyboardEvent& event) {
   // Give the top level menu equivalents a chance to handle the event.
-  if ([event.os_event type] == NSEventTypeKeyDown) {
-    return [[NSApp mainMenu] performKeyEquivalent:event.os_event];
+  NSEvent* ns_event = event.os_event.Get();
+  if (ns_event.type == NSEventTypeKeyDown) {
+    return [[NSApp mainMenu] performKeyEquivalent:ns_event];
   }
   return false;
 }
 
-// static
-void CefBrowserPlatformDelegate::HandleExternalProtocol(const GURL& url) {}
-
 CefEventHandle CefBrowserPlatformDelegateNativeMac::GetEventHandle(
     const content::NativeWebKeyboardEvent& event) const {
-  return CAST_NSEVENT_TO_CEF_EVENT_HANDLE(event.os_event);
+  return CAST_NSEVENT_TO_CEF_EVENT_HANDLE(event.os_event.Get());
 }
 
 std::unique_ptr<CefJavaScriptDialogRunner>
@@ -532,7 +531,8 @@ CefBrowserPlatformDelegateNativeMac::TranslateWebKeyEvent(
                             isARepeat:NO
                               keyCode:key_event.native_key_code];
 
-  result = content::NativeWebKeyboardEvent(synthetic_event);
+  result = content::NativeWebKeyboardEvent(
+      base::apple::OwnedNSEvent(synthetic_event));
   if (key_event.type == KEYEVENT_CHAR) {
     result.SetType(blink::WebInputEvent::Type::kChar);
   }

libcef/browser/native/browser_platform_delegate_native_win.cc

@@ -18,7 +18,6 @@
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/win/registry.h"
 #include "base/win/win_util.h"
 #include "content/public/browser/native_web_keyboard_event.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
@@ -60,70 +59,6 @@ void WriteTempFileAndView(const std::string& data) {
   ui::win::OpenFileViaShell(tmp_file);
 }
 
-bool HasExternalHandler(const std::string& scheme) {
-  base::win::RegKey key;
-  const std::wstring registry_path =
-      base::ASCIIToWide(scheme + "\\shell\\open\\command");
-  key.Open(HKEY_CLASSES_ROOT, registry_path.c_str(), KEY_READ);
-  if (key.Valid()) {
-    DWORD size = 0;
-    key.ReadValue(NULL, NULL, &size, NULL);
-    if (size > 2) {
-      // ShellExecute crashes the process when the command is empty.
-      // We check for "2" because it always returns the trailing NULL.
-      return true;
-    }
-  }
-
-  return false;
-}
-
-// Match the logic in chrome/browser/platform_util_win.cc
-// OpenExternalOnWorkerThread.
-void ExecuteExternalProtocol(const GURL& url) {
-  CEF_REQUIRE_BLOCKING();
-
-  if (!HasExternalHandler(url.scheme())) {
-    return;
-  }
-
-  // Quote the input scheme to be sure that the command does not have
-  // parameters unexpected by the external program. This url should already
-  // have been escaped.
-  std::string escaped_url = url.spec();
-  escaped_url.insert(0, "\"");
-  escaped_url += "\"";
-
-  // According to Mozilla in uriloader/exthandler/win/nsOSHelperAppService.cpp:
-  // "Some versions of windows (Win2k before SP3, Win XP before SP1) crash in
-  // ShellExecute on long URLs (bug 161357 on bugzilla.mozilla.org). IE 5 and 6
-  // support URLS of 2083 chars in length, 2K is safe."
-  //
-  // It may be possible to increase this. https://crbug.com/727909
-  const size_t kMaxUrlLength = 2048;
-  if (escaped_url.length() > kMaxUrlLength) {
-    return;
-  }
-
-  // Specify %windir%\system32 as the CWD so that any new proc spawned does not
-  // inherit this proc's CWD. Without this, uninstalls may be broken by a
-  // long-lived child proc that holds a handle to the browser's version
-  // directory (the browser's CWD). A process's CWD is in the standard list of
-  // directories to search when loading a DLL, and precedes the system directory
-  // when safe DLL search mode is disabled (not the default). Setting the CWD to
-  // the system directory is a nice way to mitigate a potential DLL search order
-  // hijack for processes that don't implement their own mitigation.
-  base::FilePath system_dir;
-  base::PathService::Get(base::DIR_SYSTEM, &system_dir);
-  if (reinterpret_cast<ULONG_PTR>(ShellExecuteA(
-          NULL, "open", escaped_url.c_str(), NULL,
-          system_dir.AsUTF8Unsafe().c_str(), SW_SHOWNORMAL)) <= 32) {
-    // On failure, it may be good to display a message to the user.
-    // https://crbug.com/727913
-    return;
-  }
-}
-
 gfx::Rect GetDisplayWorkAreaNearestPoint(gfx::Point dip_point) {
   const auto display =
       display::Screen::GetScreen()->GetDisplayNearestPoint(dip_point);
@@ -483,11 +418,6 @@ bool CefBrowserPlatformDelegateNativeWin::HandleKeyboardEvent(
   }
 }
 
-// static
-void CefBrowserPlatformDelegate::HandleExternalProtocol(const GURL& url) {
-  CEF_POST_USER_VISIBLE_TASK(base::BindOnce(ExecuteExternalProtocol, url));
-}
-
 CefEventHandle CefBrowserPlatformDelegateNativeWin::GetEventHandle(
     const content::NativeWebKeyboardEvent& event) const {
   if (!event.os_event) {

libcef/browser/native/cursor_util_aura.cc

@@ -90,7 +90,7 @@ scoped_refptr<ui::PlatformCursor> ToPlatformCursor(
   if (ui_cursor.type() == ui::mojom::CursorType::kCustom) {
     platform_cursor = ui::CursorFactory::GetInstance()->CreateImageCursor(
         ui::mojom::CursorType::kCustom, ui_cursor.custom_bitmap(),
-        ui_cursor.custom_hotspot());
+        ui_cursor.custom_hotspot(), ui_cursor.image_scale_factor());
   } else {
     cursor_loader.SetDisplay(GetDisplay(browser));
 

libcef/browser/native/window_x11.cc

@@ -127,6 +127,7 @@ CefWindowX11::CefWindowX11(CefRefPtr<CefBrowserHostBase> browser,
       /*visual_has_alpha=*/nullptr);
 
   xwindow_ = connection_->GenerateId<x11::Window>();
+
   connection_->CreateWindow({
       .depth = depth,
       .wid = xwindow_,
@@ -140,12 +141,15 @@ CefWindowX11::CefWindowX11(CefRefPtr<CefBrowserHostBase> browser,
       .background_pixel = 0,
       .border_pixel = 0,
       .override_redirect = x11::Bool32(false),
-      .event_mask = x11::EventMask::FocusChange |
-                    x11::EventMask::StructureNotify |
-                    x11::EventMask::PropertyChange,
       .colormap = colormap,
   });
 
+  auto event_mask = x11::EventMask::FocusChange |
+                    x11::EventMask::StructureNotify |
+                    x11::EventMask::PropertyChange;
+  xwindow_events_ =
+      std::make_unique<x11::XScopedEventSelector>(xwindow_, event_mask);
+
   connection_->Flush();
 
   DCHECK(ui::X11EventSource::HasInstance());

libcef/browser/net_service/url_loader_factory_getter.cc

@@ -70,7 +70,8 @@ scoped_refptr<URLLoaderFactoryGetter> URLLoaderFactoryGetter::Create(
       url::Origin(), absl::nullopt /* navigation_id */, ukm::SourceIdObj(),
       &maybe_proxy_factory_receiver, nullptr /* header_client */,
       nullptr /* bypass_redirect_checks */, nullptr /* disable_secure_dns */,
-      nullptr /* factory_override */);
+      nullptr /* factory_override */,
+      nullptr /* navigation_response_task_runner */);
 
   // If anyone above indicated that they care about proxying, pass the
   // intermediate pipe along to the URLLoaderFactoryGetter.
@@ -133,4 +134,4 @@ void URLLoaderFactoryGetter::DeleteOnCorrectThread() const {
   delete this;
 }
 
-}  // namespace net_service
+}  // namespace net_service

libcef/browser/osr/host_display_client_osr.cc

@@ -77,7 +77,7 @@ void CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory(
   // Make sure |pixel_size| is sane.
   size_t expected_bytes;
   bool size_result = viz::ResourceSizes::MaybeSizeInBytes(
-      pixel_size, viz::ResourceFormat::RGBA_8888, &expected_bytes);
+      pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes);
   if (!size_result) {
     return;
   }

libcef/browser/osr/software_output_device_proxy.cc

@@ -62,8 +62,9 @@ void SoftwareOutputDeviceProxy::Resize(const gfx::Size& viewport_pixel_size,
   canvas_.reset();
 
   size_t required_bytes;
-  if (!ResourceSizes::MaybeSizeInBytes(
-          viewport_pixel_size_, ResourceFormat::RGBA_8888, &required_bytes)) {
+  if (!ResourceSizes::MaybeSizeInBytes(viewport_pixel_size_,
+                                       SinglePlaneFormat::kRGBA_8888,
+                                       &required_bytes)) {
     DLOG(ERROR) << "Invalid viewport size " << viewport_pixel_size_.ToString();
     return;
   }

libcef/browser/permission_prompt.cc

@@ -199,6 +199,8 @@ cef_permission_request_types_t GetCefRequestType(
       return CEF_PERMISSION_TYPE_IDLE_DETECTION;
     case permissions::RequestType::kMicStream:
       return CEF_PERMISSION_TYPE_MIC_STREAM;
+    case permissions::RequestType::kMidi:
+      return CEF_PERMISSION_TYPE_MIDI;
     case permissions::RequestType::kMidiSysex:
       return CEF_PERMISSION_TYPE_MIDI_SYSEX;
     case permissions::RequestType::kMultipleDownloads:

libcef/browser/prefs/renderer_prefs.cc

@@ -41,6 +41,7 @@
 #include "media/media_buildflags.h"
 #include "third_party/blink/public/common/peerconnection/webrtc_ip_handling_policy.h"
 #include "third_party/blink/public/common/web_preferences/web_preferences.h"
+#include "ui/color/color_provider_manager.h"
 #include "ui/native_theme/native_theme.h"
 
 namespace renderer_prefs {
@@ -206,6 +207,7 @@ blink::mojom::PreferredColorScheme ToBlinkPreferredColorScheme(
 // |native_theme| - For other platforms based on native theme scheme.
 bool UpdatePreferredColorScheme(blink::web_pref::WebPreferences* web_prefs,
                                 const GURL& url,
+                                content::WebContents* web_contents,
                                 const ui::NativeTheme* native_theme) {
   auto old_preferred_color_scheme = web_prefs->preferred_color_scheme;
 
@@ -213,19 +215,14 @@ bool UpdatePreferredColorScheme(blink::web_pref::WebPreferences* web_prefs,
   web_prefs->preferred_color_scheme =
       ToBlinkPreferredColorScheme(native_theme->GetPreferredColorScheme());
 
-  // Force a light preferred color scheme on certain URLs if kWebUIDarkMode is
-  // disabled; some of the UI is not yet correctly themed.
-  if (!base::FeatureList::IsEnabled(features::kWebUIDarkMode)) {
-    // Update based on last committed url.
-    bool force_light = url.SchemeIs(content::kChromeUIScheme);
-    if (!force_light) {
-      force_light = url.SchemeIs(extensions::kExtensionScheme) &&
-                    url.host_piece() == extension_misc::kPdfExtensionId;
-    }
-    if (force_light) {
-      web_prefs->preferred_color_scheme =
-          blink::mojom::PreferredColorScheme::kLight;
-    }
+  if (url.SchemeIs(content::kChromeUIScheme)) {
+    // WebUI should track the color mode of the ColorProvider associated with
+    // |web_contents|.
+    web_prefs->preferred_color_scheme =
+        web_contents->GetColorMode() ==
+                ui::ColorProviderManager::ColorMode::kLight
+            ? blink::mojom::PreferredColorScheme::kLight
+            : blink::mojom::PreferredColorScheme::kDark;
   }
 
   return old_preferred_color_scheme != web_prefs->preferred_color_scheme;
@@ -419,7 +416,7 @@ void PopulateWebPreferences(content::RenderViewHost* rvh,
   UpdatePreferredColorScheme(
       &web,
       web_contents->GetPrimaryMainFrame()->GetSiteInstance()->GetSiteURL(),
-      native_theme);
+      web_contents, native_theme);
 
   // Set preferences based on the extension.
   SetExtensionPrefs(web_contents, rvh, web);
@@ -445,7 +442,7 @@ bool PopulateWebPreferencesAfterNavigation(
     blink::web_pref::WebPreferences& web) {
   auto* native_theme = ui::NativeTheme::GetInstanceForWeb();
   return UpdatePreferredColorScheme(&web, web_contents->GetLastCommittedURL(),
-                                    native_theme);
+                                    web_contents, native_theme);
 }
 
 }  // namespace renderer_prefs

libcef/browser/ssl_host_state_delegate.cc

@@ -133,3 +133,13 @@ bool CefSSLHostStateDelegate::HasAllowException(
   return policy_iterator != cert_policy_for_host_.end() &&
          policy_iterator->second.HasAllowException();
 }
+
+bool CefSSLHostStateDelegate::HasAllowExceptionForAnyHost(
+    content::StoragePartition* storage_partition) {
+  for (auto const& it : cert_policy_for_host_) {
+    if (it.second.HasAllowException()) {
+      return true;
+    }
+  }
+  return false;
+}

libcef/browser/ssl_host_state_delegate.h

@@ -83,6 +83,8 @@ class CefSSLHostStateDelegate : public content::SSLHostStateDelegate {
   void RevokeUserAllowExceptions(const std::string& host) override;
   bool HasAllowException(const std::string& host,
                          content::StoragePartition* storage_partition) override;
+  bool HasAllowExceptionForAnyHost(
+      content::StoragePartition* storage_partition) override;
 
  private:
   // Certificate policies for each host.

libcef/browser/views/browser_view_impl.cc

@@ -13,8 +13,27 @@
 #include "libcef/browser/views/window_impl.h"
 
 #include "content/public/browser/native_web_keyboard_event.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 #include "ui/content_accelerators/accelerator_util.h"
 
+namespace {
+
+absl::optional<cef_gesture_command_t> GetGestureCommand(
+    ui::GestureEvent* event) {
+#if BUILDFLAG(IS_MAC)
+  if (event->details().type() == ui::ET_GESTURE_SWIPE) {
+    if (event->details().swipe_left()) {
+      return CEF_GESTURE_COMMAND_BACK;
+    } else if (event->details().swipe_right()) {
+      return CEF_GESTURE_COMMAND_FORWARD;
+    }
+  }
+#endif
+  return absl::nullopt;
+}
+
+}  // namespace
+
 // static
 CefRefPtr<CefBrowserView> CefBrowserView::CreateBrowserView(
     CefRefPtr<CefClient> client,
@@ -218,21 +237,27 @@ void CefBrowserViewImpl::OnBoundsChanged() {
   }
 }
 
-void CefBrowserViewImpl::OnGestureCommand(cef_gesture_command_t command) {
-  if (delegate()->OnGestureCommand(this, command)) {
-    return;
-  }
+bool CefBrowserViewImpl::OnGestureEvent(ui::GestureEvent* event) {
+  if (auto command = GetGestureCommand(event)) {
+    if (delegate() && delegate()->OnGestureCommand(this, *command)) {
+      return true;
+    }
 
-  if (browser_) {
-    switch (command) {
-      case CEF_GESTURE_COMMAND_BACK:
-        browser_->GoBack();
-        break;
-      case CEF_GESTURE_COMMAND_FORWARD:
-        browser_->GoForward();
-        break;
+    if (!cef::IsChromeRuntimeEnabled() && browser_) {
+      // Default handling for the Alloy runtime.
+      switch (*command) {
+        case CEF_GESTURE_COMMAND_BACK:
+          browser_->GoBack();
+          break;
+        case CEF_GESTURE_COMMAND_FORWARD:
+          browser_->GoForward();
+          break;
+      }
+      return true;
     }
   }
+
+  return false;
 }
 
 CefBrowserViewImpl::CefBrowserViewImpl(

libcef/browser/views/browser_view_impl.h

@@ -74,7 +74,7 @@ class CefBrowserViewImpl
   // CefBrowserViewView::Delegate methods:
   void OnBrowserViewAdded() override;
   void OnBoundsChanged() override;
-  void OnGestureCommand(cef_gesture_command_t command) override;
+  bool OnGestureEvent(ui::GestureEvent* event) override;
 
   // Return the WebView representation of this object.
   views::WebView* web_view() const;

libcef/browser/views/browser_view_view.cc

@@ -4,28 +4,8 @@
 
 #include "libcef/browser/views/browser_view_view.h"
 
-#include <optional>
-
 #include "libcef/browser/views/browser_view_impl.h"
 
-namespace {
-
-std::optional<cef_gesture_command_t> GetGestureCommand(
-    ui::GestureEvent* event) {
-#if defined(OS_MAC)
-  if (event->details().type() == ui::ET_GESTURE_SWIPE) {
-    if (event->details().swipe_left()) {
-      return cef_gesture_command_t::CEF_GESTURE_COMMAND_BACK;
-    } else if (event->details().swipe_right()) {
-      return cef_gesture_command_t::CEF_GESTURE_COMMAND_FORWARD;
-    }
-  }
-#endif
-  return std::nullopt;
-}
-
-}  // namespace
-
 CefBrowserViewView::CefBrowserViewView(CefBrowserViewDelegate* cef_delegate,
                                        Delegate* browser_view_delegate)
     : ParentClass(cef_delegate), browser_view_delegate_(browser_view_delegate) {
@@ -60,7 +40,8 @@ void CefBrowserViewView::OnBoundsChanged(const gfx::Rect& previous_bounds) {
 }
 
 void CefBrowserViewView::OnGestureEvent(ui::GestureEvent* event) {
-  if (auto command = GetGestureCommand(event)) {
-    browser_view_delegate_->OnGestureCommand(*command);
+  if (browser_view_delegate_->OnGestureEvent(event)) {
+    return;
   }
+  ParentClass::OnGestureEvent(event);
 }

libcef/browser/views/browser_view_view.h

@@ -41,8 +41,9 @@ class CefBrowserViewView
     // Called when the BrowserView bounds have changed.
     virtual void OnBoundsChanged() = 0;
 
-    // Called when the BrowserView receives a gesture command.
-    virtual void OnGestureCommand(cef_gesture_command_t command) = 0;
+    // Called when the BrowserView receives a gesture event.
+    // Returns true if the gesture was handled.
+    virtual bool OnGestureEvent(ui::GestureEvent* event) = 0;
 
    protected:
     virtual ~Delegate() {}

libcef/browser/views/view_util_aura.cc

@@ -15,16 +15,16 @@ namespace view_util {
 
 gfx::NativeWindow GetNativeWindow(views::Widget* widget) {
   if (widget) {
-    aura::Window* window = widget->GetNativeWindow();
-    if (window) {
-      return window->GetRootWindow();
-    }
+    return widget->GetNativeWindow();
   }
   return nullptr;
 }
 
 gfx::NativeView GetNativeView(views::Widget* widget) {
-  return GetNativeWindow(widget);
+  if (widget) {
+    return widget->GetNativeView();
+  }
+  return nullptr;
 }
 
 CefWindowHandle GetWindowHandle(views::Widget* widget) {

libcef/browser/views/widget_destruction_observer.h

@@ -0,0 +1,34 @@
+// Copyright 2023 The Chromium Embedded Framework Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+#include "base/scoped_observation.h"
+#include "ui/views/widget/widget_observer.h"
+
+// Tracks if a given widget has been destroyed.
+class WidgetDestructionObserver : public views::WidgetObserver {
+ public:
+  explicit WidgetDestructionObserver(views::Widget* widget) : widget_(widget) {
+    DCHECK(widget);
+    observation_.Observe(widget);
+  }
+  WidgetDestructionObserver(const WidgetDestructionObserver&) = delete;
+  WidgetDestructionObserver& operator=(const WidgetDestructionObserver&) =
+      delete;
+  ~WidgetDestructionObserver() override = default;
+
+  // views::WidgetObserver:
+  void OnWidgetDestroyed(views::Widget* widget) override {
+    DCHECK(widget_);
+    widget_ = nullptr;
+    observation_.Reset();
+  }
+
+  views::Widget* widget() const { return widget_; }
+
+ private:
+  views::Widget* widget_;
+
+  base::ScopedObservation<views::Widget, views::WidgetObserver> observation_{
+      this};
+};

libcef/browser/views/window_impl.cc

@@ -6,6 +6,7 @@
 
 #include "libcef/browser/browser_util.h"
 #include "libcef/browser/thread_util.h"
+#include "libcef/browser/views/browser_view_impl.h"
 #include "libcef/browser/views/display_impl.h"
 #include "libcef/browser/views/fill_layout_impl.h"
 #include "libcef/browser/views/layout_util.h"
@@ -13,11 +14,13 @@
 #include "libcef/browser/views/window_view.h"
 
 #include "base/i18n/rtl.h"
+#include "components/constrained_window/constrained_window_views.h"
 #include "ui/base/test/ui_controls.h"
 #include "ui/compositor/compositor.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/views/controls/button/menu_button.h"
 #include "ui/views/controls/menu/menu_runner.h"
+#include "ui/views/controls/webview/webview.h"
 
 #if defined(USE_AURA)
 #include "ui/aura/window.h"
@@ -122,10 +125,38 @@ CefRefPtr<CefWindowImpl> CefWindowImpl::Create(
 void CefWindowImpl::Show() {
   CEF_REQUIRE_VALID_RETURN_VOID();
   if (widget_) {
+    shown_as_browser_modal_ = false;
     widget_->Show();
   }
 }
 
+void CefWindowImpl::ShowAsBrowserModalDialog(
+    CefRefPtr<CefBrowserView> browser_view) {
+  CEF_REQUIRE_VALID_RETURN_VOID();
+  if (widget_) {
+    auto* browser_view_impl =
+        static_cast<CefBrowserViewImpl*>(browser_view.get());
+
+    // |browser_view| must belong to the host widget.
+    auto* host_widget = static_cast<CefWindowView*>(root_view())->host_widget();
+    CHECK(host_widget &&
+          browser_view_impl->root_view()->GetWidget() == host_widget);
+
+    if (auto web_view = browser_view_impl->web_view()) {
+      if (auto web_contents = web_view->web_contents()) {
+        shown_as_browser_modal_ = true;
+        constrained_window::ShowModalDialog(widget_->GetNativeWindow(),
+                                            web_contents);
+
+        // NativeWebContentsModalDialogManagerViews::ManageDialog() disables
+        // movement. That has no impact on native frames but interferes with
+        // draggable regions.
+        widget_->set_movement_disabled(false);
+      }
+    }
+  }
+}
+
 void CefWindowImpl::Hide() {
   CEF_REQUIRE_VALID_RETURN_VOID();
   if (widget_) {
@@ -403,6 +434,11 @@ void CefWindowImpl::SetBackgroundColor(cef_color_t color) {
 }
 
 bool CefWindowImpl::CanWidgetClose() {
+  if (shown_as_browser_modal_) {
+    // Always allow the close for browser modal dialogs to avoid an infinite
+    // loop in WebContentsModalDialogManager::CloseAllDialogs().
+    return true;
+  }
   if (delegate()) {
     return delegate()->CanClose(this);
   }

libcef/browser/views/window_impl.h

@@ -40,6 +40,8 @@ class CefWindowImpl
 
   // CefWindow methods:
   void Show() override;
+  void ShowAsBrowserModalDialog(
+      CefRefPtr<CefBrowserView> browser_view) override;
   void Hide() override;
   void CenterWindow(const CefSize& size) override;
   void Close() override;
@@ -162,6 +164,9 @@ class CefWindowImpl
   std::unique_ptr<ui::EventHandler> unhandled_key_event_handler_;
 #endif
 
+  // True if this window was shown using ShowAsBrowserModalDialog().
+  bool shown_as_browser_modal_ = false;
+
   IMPLEMENT_REFCOUNTING_DELETE_ON_UIT(CefWindowImpl);
 };
 

libcef/browser/views/window_view.cc

@@ -11,6 +11,7 @@
 #include "libcef/features/runtime.h"
 
 #include "ui/base/hit_test.h"
+#include "ui/display/screen.h"
 #include "ui/views/widget/widget.h"
 #include "ui/views/window/native_frame_view.h"
 
@@ -18,11 +19,20 @@
 #include "ui/ozone/buildflags.h"
 #if BUILDFLAG(OZONE_PLATFORM_X11)
 #include "ui/base/x/x11_util.h"
+#include "ui/gfx/x/x11_atom_cache.h"
+#include "ui/gfx/x/xproto_util.h"
+#include "ui/linux/linux_ui_delegate.h"
 #endif
 #endif
 
+#if BUILDFLAG(IS_OZONE)
+#include "ui/ozone/public/ozone_platform.h"
+#endif
+
 #if BUILDFLAG(IS_WIN)
-#include "ui/display/screen.h"
+#include <dwmapi.h>
+#include "base/win/windows_version.h"
+#include "ui/display/win/screen_win.h"
 #include "ui/views/win/hwnd_util.h"
 #endif
 
@@ -67,17 +77,47 @@ class NativeFrameViewEx : public views::NativeFrameView {
 
   gfx::Rect GetWindowBoundsForClientBounds(
       const gfx::Rect& client_bounds) const override {
-#if BUILDFLAG(IS_WIN)
-    // views::GetWindowBoundsForClientBounds() expects the input Rect to be in
-    // pixel coordinates. NativeFrameView does not implement this correctly so
-    // we need to provide our own implementation. See http://crbug.com/602692.
-    gfx::Rect pixel_bounds =
-        display::Screen::GetScreen()->DIPToScreenRectInWindow(
-            view_util::GetNativeWindow(widget_), client_bounds);
-    pixel_bounds = views::GetWindowBoundsForClientBounds(
-        static_cast<View*>(const_cast<NativeFrameViewEx*>(this)), pixel_bounds);
-    return display::Screen::GetScreen()->ScreenToDIPRectInWindow(
-        view_util::GetNativeWindow(widget_), pixel_bounds);
+#if BUILDFLAG(IS_MAC)
+    // From NativeFrameView::GetWindowBoundsForClientBounds:
+    gfx::Rect window_bounds = client_bounds;
+    // Enforce minimum size (1, 1) in case that |client_bounds| is passed with
+    // empty size.
+    if (window_bounds.IsEmpty()) {
+      window_bounds.set_size(gfx::Size(1, 1));
+    }
+
+    if (!view_->IsFrameless()) {
+      if (auto titlebar_height = view_->GetTitlebarHeight()) {
+        window_bounds.Inset(gfx::Insets::TLBR(-(*titlebar_height), 0, 0, 0));
+      }
+    }
+
+    return window_bounds;
+#elif BUILDFLAG(IS_WIN)
+    HWND window = views::HWNDForWidget(widget_);
+    CHECK(window);
+
+    const DWORD style = GetWindowLong(window, GWL_STYLE);
+    const DWORD ex_style = GetWindowLong(window, GWL_EXSTYLE);
+    const bool has_menu = !(style & WS_CHILD) && (GetMenu(window) != NULL);
+
+    // Convert from DIP to pixel coordinates using a method that can handle
+    // multiple displays with different DPI.
+    const auto screen_rect =
+        display::win::ScreenWin::DIPToScreenRect(window, client_bounds);
+
+    RECT rect = {screen_rect.x(), screen_rect.y(),
+                 screen_rect.x() + screen_rect.width(),
+                 screen_rect.y() + screen_rect.height()};
+    AdjustWindowRectEx(&rect, style, has_menu, ex_style);
+
+    // Keep the original origin while potentially increasing the size to include
+    // the frame non-client area.
+    gfx::Rect pixel_rect(screen_rect.x(), screen_rect.y(),
+                         rect.right - rect.left, rect.bottom - rect.top);
+
+    // Convert back to DIP.
+    return display::win::ScreenWin::ScreenToDIPRect(window, pixel_rect);
 #else
     // Use the default implementation.
     return views::NativeFrameView::GetWindowBoundsForClientBounds(
@@ -99,6 +139,25 @@ class NativeFrameViewEx : public views::NativeFrameView {
     return views::NativeFrameView::NonClientHitTest(point);
   }
 
+#if BUILDFLAG(IS_WIN)
+  void OnThemeChanged() override {
+    views::NativeFrameView::OnThemeChanged();
+
+    // Value was 19 prior to Windows 10 20H1, according to
+    // https://stackoverflow.com/a/70693198
+    const DWORD dwAttribute =
+        base::win::GetVersion() >= base::win::Version::WIN10_20H1
+            ? DWMWA_USE_IMMERSIVE_DARK_MODE
+            : 19;
+
+    // From BrowserFrameViewWin::SetSystemMicaTitlebarAttributes:
+    const BOOL dark_titlebar_enabled = GetNativeTheme()->ShouldUseDarkColors();
+    DwmSetWindowAttribute(views::HWNDForWidget(widget_), dwAttribute,
+                          &dark_titlebar_enabled,
+                          sizeof(dark_titlebar_enabled));
+  }
+#endif
+
  private:
   // Not owned by this object.
   views::Widget* widget_;
@@ -253,13 +312,62 @@ bool IsWindowBorderHit(int code) {
 #endif
 }
 
+// Based on UpdateModalDialogPosition() from
+// components/constrained_window/constrained_window_views.cc
+void UpdateModalDialogPosition(views::Widget* widget,
+                               views::Widget* host_widget) {
+  // Do not forcibly update the dialog widget position if it is being dragged.
+  if (widget->HasCapture()) {
+    return;
+  }
+
+  const gfx::Size& size = widget->GetRootView()->GetPreferredSize();
+  const gfx::Size& host_size =
+      host_widget->GetClientAreaBoundsInScreen().size();
+
+  // Center the dialog. Position is relative to the host.
+  gfx::Point position;
+  position.set_x((host_size.width() - size.width()) / 2);
+  position.set_y((host_size.height() - size.height()) / 2);
+
+  // Align the first row of pixels inside the border. This is the apparent top
+  // of the dialog.
+  position.set_y(position.y() -
+                 widget->non_client_view()->frame_view()->GetInsets().top());
+
+  const bool supports_global_screen_coordinates =
+#if !BUILDFLAG(IS_OZONE)
+      true;
+#else
+      ui::OzonePlatform::GetInstance()
+          ->GetPlatformProperties()
+          .supports_global_screen_coordinates;
+#endif
+
+  if (widget->is_top_level() && supports_global_screen_coordinates) {
+    position += host_widget->GetClientAreaBoundsInScreen().OffsetFromOrigin();
+    // If the dialog extends partially off any display, clamp its position to
+    // be fully visible within that display. If the dialog doesn't intersect
+    // with any display clamp its position to be fully on the nearest display.
+    gfx::Rect display_rect = gfx::Rect(position, size);
+    const display::Display display =
+        display::Screen::GetScreen()->GetDisplayNearestView(
+            view_util::GetNativeView(host_widget));
+    const gfx::Rect work_area = display.work_area();
+    if (!work_area.Contains(display_rect)) {
+      display_rect.AdjustToFit(work_area);
+    }
+    position = display_rect.origin();
+  }
+
+  widget->SetBounds(gfx::Rect(position, size));
+}
+
 }  // namespace
 
 CefWindowView::CefWindowView(CefWindowDelegate* cef_delegate,
                              Delegate* window_delegate)
-    : ParentClass(cef_delegate),
-      window_delegate_(window_delegate),
-      is_frameless_(false) {
+    : ParentClass(cef_delegate), window_delegate_(window_delegate) {
   DCHECK(window_delegate_);
 }
 
@@ -274,6 +382,8 @@ void CefWindowView::CreateWidget(gfx::AcceleratedWidget parent_widget) {
   views::Widget::InitParams params;
   params.delegate = this;
 
+  views::Widget* host_widget = nullptr;
+
   bool can_activate = true;
   bool can_resize = true;
 
@@ -343,6 +453,12 @@ void CefWindowView::CreateWidget(gfx::AcceleratedWidget parent_widget) {
         CefWindowImpl* parent_window_impl =
             static_cast<CefWindowImpl*>(parent_window.get());
         params.parent = view_util::GetNativeView(parent_window_impl->widget());
+
+        // Aura uses the same types for NativeView and NativeWindow, which can
+        // be confusing. Verify that we set |params.parent| correctly (to the
+        // expected internal::NativeWidgetPrivate) for Widget::Init usage.
+        DCHECK(views::Widget::GetWidgetForNativeView(params.parent));
+
         if (is_menu) {
           // Don't clip the window to parent bounds.
           params.type = views::Widget::InitParams::TYPE_MENU;
@@ -351,6 +467,24 @@ void CefWindowView::CreateWidget(gfx::AcceleratedWidget parent_widget) {
           params.z_order = ui::ZOrderLevel::kNormal;
 
           can_activate = can_activate_menu;
+        } else {
+          // Create a top-level window that is moveable and can exceed the
+          // bounds of the parent window. By not setting |params.child| here we
+          // cause OnBeforeWidgetInit to create a views::DesktopNativeWidgetAura
+          // instead of a views::NativeWidgetAura. We need to use this desktop
+          // variant with browser windows to get proper focus and shutdown
+          // behavior.
+
+#if !BUILDFLAG(IS_LINUX)
+          // SetModalType doesn't work on Linux (no implementation in
+          // DesktopWindowTreeHostLinux::InitModalType). See the X11-specific
+          // implementation below that may work with some window managers.
+          if (cef_delegate()->IsWindowModalDialog(cef_window)) {
+            SetModalType(ui::MODAL_TYPE_WINDOW);
+          }
+#endif
+
+          host_widget = parent_window_impl->widget();
         }
       }
     }
@@ -395,13 +529,53 @@ void CefWindowView::CreateWidget(gfx::AcceleratedWidget parent_widget) {
 
 #if BUILDFLAG(IS_LINUX)
 #if BUILDFLAG(OZONE_PLATFORM_X11)
+  auto x11window = static_cast<x11::Window>(view_util::GetWindowHandle(widget));
+  CHECK(x11window != x11::Window::None);
+
   if (is_frameless_) {
-    auto window = view_util::GetWindowHandle(widget);
-    DCHECK(window);
-    ui::SetUseOSWindowFrame(static_cast<x11::Window>(window), false);
+    ui::SetUseOSWindowFrame(x11window, false);
+  }
+
+  if (host_widget) {
+    auto parent = static_cast<gfx::AcceleratedWidget>(
+        view_util::GetWindowHandle(host_widget));
+    CHECK(parent);
+
+    if (cef_delegate() && cef_delegate()->IsWindowModalDialog(GetCefWindow())) {
+      // The presence of _NET_WM_STATE_MODAL in _NET_SUPPORTED indicates
+      // possible window manager support. However, some window managers still
+      // don't support this properly.
+      x11::Atom modal_atom = x11::GetAtom("_NET_WM_STATE_MODAL");
+      if (ui::WmSupportsHint(modal_atom)) {
+        ui::SetWMSpecState(x11window, true, modal_atom, x11::Atom::None);
+      } else {
+        LOG(ERROR)
+            << "Window modal dialogs are not supported by the window manager";
+      }
+    }
+
+    // From GtkUiPlatformX11::SetGtkWidgetTransientFor:
+    x11::SetProperty(x11window, x11::Atom::WM_TRANSIENT_FOR, x11::Atom::WINDOW,
+                     parent);
+    x11::SetProperty(x11window, x11::GetAtom("_NET_WM_WINDOW_TYPE"),
+                     x11::Atom::ATOM,
+                     x11::GetAtom("_NET_WM_WINDOW_TYPE_DIALOG"));
+
+    ui::LinuxUiDelegate::GetInstance()->SetTransientWindowForParent(
+        parent, static_cast<gfx::AcceleratedWidget>(x11window));
   }
 #endif
 #endif
+
+  if (host_widget) {
+    // Position |widget| relative to |host_widget|.
+    UpdateModalDialogPosition(widget, host_widget);
+
+    // Track the lifespan of |host_widget|, which may be destroyed before
+    // |widget|.
+    host_widget_destruction_observer_ =
+        std::make_unique<WidgetDestructionObserver>(host_widget);
+  }
 }
 
 CefRefPtr<CefWindow> CefWindowView::GetCefWindow() const {
@@ -457,6 +631,20 @@ ui::ImageModel CefWindowView::GetWindowAppIcon() {
 }
 
 void CefWindowView::WindowClosing() {
+#if BUILDFLAG(IS_LINUX)
+#if BUILDFLAG(OZONE_PLATFORM_X11)
+  if (host_widget()) {
+    auto parent = static_cast<gfx::AcceleratedWidget>(
+        view_util::GetWindowHandle(host_widget()));
+    CHECK(parent);
+
+    // From GtkUiPlatformX11::ClearTransientFor:
+    ui::LinuxUiDelegate::GetInstance()->SetTransientWindowForParent(
+        parent, static_cast<gfx::AcceleratedWidget>(x11::Window::None));
+  }
+#endif
+#endif
+
   window_delegate_->OnWindowClosing();
 }
 
@@ -704,6 +892,13 @@ void CefWindowView::UpdateFindBarBoundingBox(gfx::Rect* bounds) const {
   }
 }
 
+views::Widget* CefWindowView::host_widget() const {
+  if (host_widget_destruction_observer_) {
+    return host_widget_destruction_observer_->widget();
+  }
+  return nullptr;
+}
+
 absl::optional<float> CefWindowView::GetTitlebarHeight() const {
   if (cef_delegate()) {
     float title_bar_height = 0;

libcef/browser/views/window_view.h

@@ -13,6 +13,7 @@
 
 #include "libcef/browser/views/overlay_view_host.h"
 #include "libcef/browser/views/panel_view.h"
+#include "libcef/browser/views/widget_destruction_observer.h"
 
 #include "third_party/skia/include/core/SkRegion.h"
 #include "ui/display/display.h"
@@ -116,19 +117,24 @@ class CefWindowView
   // Optionally modify the bounding box for the Chrome Find bar.
   void UpdateFindBarBoundingBox(gfx::Rect* bounds) const;
 
+  absl::optional<float> GetTitlebarHeight() const;
+  bool IsFrameless() const { return is_frameless_; }
+
+  // The Widget that hosts us, if we're a modal dialog. May return nullptr
+  // during initialization and destruction.
+  views::Widget* host_widget() const;
+
  private:
   // Called when removed from the Widget and before |this| is deleted.
   void DeleteDelegate();
 
   void MoveOverlaysIfNecessary();
 
-  absl::optional<float> GetTitlebarHeight() const;
-
   // Not owned by this object.
   Delegate* window_delegate_;
 
   // True if the window is frameless. It might still be resizable and draggable.
-  bool is_frameless_;
+  bool is_frameless_ = false;
 
   std::u16string title_;
   CefRefPtr<CefImage> window_icon_;
@@ -137,6 +143,9 @@ class CefWindowView
   std::unique_ptr<SkRegion> draggable_region_;
   std::vector<gfx::Rect> draggable_rects_;
 
+  // Tracks the Widget that hosts us, if we're a modal dialog.
+  std::unique_ptr<WidgetDestructionObserver> host_widget_destruction_observer_;
+
   // Hosts for overlay widgets.
   std::vector<std::unique_ptr<CefOverlayViewHost>> overlay_hosts_;
 };

libcef/common/alloy/alloy_main_delegate.cc

@@ -42,6 +42,7 @@
 #include "net/base/features.h"
 #include "sandbox/policy/switches.h"
 #include "services/network/public/cpp/features.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/switches.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/base/ui_base_features.h"
@@ -271,6 +272,15 @@ absl::optional<int> AlloyMainDelegate::BasicStartupComplete() {
       disable_features.push_back(features::kBackForwardCache.name);
     }
 
+    if (blink::features::kDocumentPictureInPictureAPI.default_state ==
+        base::FEATURE_ENABLED_BY_DEFAULT) {
+      // Disable DocumentPictureInPictureAPI globally so that
+      // blink::RuntimeEnabledFeatures::DocumentPictureInPictureAPIEnabled
+      // reports the correct value in the renderer process (see issue #3448).
+      disable_features.push_back(
+          blink::features::kDocumentPictureInPictureAPI.name);
+    }
+
     if (!disable_features.empty()) {
       DCHECK(!base::FeatureList::GetInstance());
       std::string disable_features_str =

libcef/common/chrome/chrome_main_runner_delegate.cc

@@ -61,19 +61,19 @@ void ChromeMainRunnerDelegate::BeforeMainMessageLoopRun(
   keep_alive_ = std::make_unique<ScopedKeepAlive>(
       KeepAliveOrigin::APP_CONTROLLER, KeepAliveRestartOption::DISABLED);
 
-  // The idle callback will be executed from BrowserProcessImpl::Unpin() via
+  // The QuitClosure will be executed from BrowserProcessImpl::Unpin() via
   // KeepAliveRegistry when the last ScopedKeepAlive is released.
   // ScopedKeepAlives are also held by Browser objects.
   DCHECK(g_browser_process);
   static_cast<BrowserProcessImpl*>(g_browser_process)
-      ->SetQuitClosure(run_loop->QuitWhenIdleClosure());
+      ->SetQuitClosure(run_loop->QuitClosure());
 }
 
 bool ChromeMainRunnerDelegate::HandleMainMessageLoopQuit() {
   // May be called multiple times. See comments in RunMainMessageLoopBefore.
   keep_alive_.reset();
 
-  // Cancel direct execution of the QuitWhenIdleClosure() in
+  // Cancel direct execution of the QuitClosure() in
   // CefMainRunner::QuitMessageLoop. We instead wait for all Chrome browser
   // windows to exit.
   return true;

libcef/common/resource_util.cc

@@ -83,18 +83,12 @@ base::FilePath GetUserDataPath(CefSettings* settings,
                                const base::CommandLine* command_line) {
   // |settings| will be non-nullptr in the main process only.
   if (settings) {
-    // With the Chrome runtime Profile paths must always be relative to the
-    // user data directory, so defaulting to |root_cache_path| first is
-    // appropriate.
-    CefString user_data_path;
-    if (cef::IsChromeRuntimeEnabled() && settings->root_cache_path.length > 0) {
-      user_data_path = CefString(&settings->root_cache_path);
+    CefString root_cache_path;
+    if (settings->root_cache_path.length > 0) {
+      root_cache_path = CefString(&settings->root_cache_path);
     }
-    if (user_data_path.empty() && settings->user_data_path.length > 0) {
-      user_data_path = CefString(&settings->user_data_path);
-    }
-    if (!user_data_path.empty()) {
-      return base::FilePath(user_data_path);
+    if (!root_cache_path.empty()) {
+      return base::FilePath(root_cache_path);
     }
   }
 

libcef_dll/cpptoc/views/window_cpptoc.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=2f28922e536557bff211610dd38bb7b4c8a64d5a$
+// $hash=23777aea864e9abf38c2e2c5d79a40d6bd22876d$
 //
 
 #include "libcef_dll/cpptoc/views/window_cpptoc.h"
@@ -66,6 +66,28 @@ void CEF_CALLBACK window_show(struct _cef_window_t* self) {
   CefWindowCppToC::Get(self)->Show();
 }
 
+void CEF_CALLBACK
+window_show_as_browser_modal_dialog(struct _cef_window_t* self,
+                                    cef_browser_view_t* browser_view) {
+  shutdown_checker::AssertNotShutdown();
+
+  // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
+
+  DCHECK(self);
+  if (!self) {
+    return;
+  }
+  // Verify param: browser_view; type: refptr_same
+  DCHECK(browser_view);
+  if (!browser_view) {
+    return;
+  }
+
+  // Execute
+  CefWindowCppToC::Get(self)->ShowAsBrowserModalDialog(
+      CefBrowserViewCppToC::Unwrap(browser_view));
+}
+
 void CEF_CALLBACK window_hide(struct _cef_window_t* self) {
   shutdown_checker::AssertNotShutdown();
 
@@ -1970,6 +1992,8 @@ int CEF_CALLBACK window_convert_point_from_view(struct _cef_view_t* self,
 
 CefWindowCppToC::CefWindowCppToC() {
   GetStruct()->show = window_show;
+  GetStruct()->show_as_browser_modal_dialog =
+      window_show_as_browser_modal_dialog;
   GetStruct()->hide = window_hide;
   GetStruct()->center_window = window_center_window;
   GetStruct()->close = window_close;

libcef_dll/cpptoc/views/window_cpptoc.h

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=12ff3d7d14f9977ff1f62e9a35b04b153a135480$
+// $hash=6700d328968cb5c0141cd2d93ce66835e97a9d66$
 //
 
 #ifndef CEF_LIBCEF_DLL_CPPTOC_VIEWS_WINDOW_CPPTOC_H_
@@ -20,7 +20,9 @@
 #error This file can be included DLL-side only
 #endif
 
+#include "include/capi/views/cef_browser_view_capi.h"
 #include "include/capi/views/cef_window_capi.h"
+#include "include/views/cef_browser_view.h"
 #include "include/views/cef_window.h"
 #include "libcef_dll/cpptoc/cpptoc_ref_counted.h"
 

libcef_dll/cpptoc/views/window_delegate_cpptoc.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=c84eb9772fc902904ccbd0cebe2c2105d06a8164$
+// $hash=10ec416d3aeba7215b08604b1a329adc1c9aaf6f$
 //
 
 #include "libcef_dll/cpptoc/views/window_delegate_cpptoc.h"
@@ -194,6 +194,31 @@ window_delegate_get_parent_window(struct _cef_window_delegate_t* self,
   return CefWindowCToCpp::Unwrap(_retval);
 }
 
+int CEF_CALLBACK
+window_delegate_is_window_modal_dialog(struct _cef_window_delegate_t* self,
+                                       cef_window_t* window) {
+  shutdown_checker::AssertNotShutdown();
+
+  // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
+
+  DCHECK(self);
+  if (!self) {
+    return 0;
+  }
+  // Verify param: window; type: refptr_diff
+  DCHECK(window);
+  if (!window) {
+    return 0;
+  }
+
+  // Execute
+  bool _retval = CefWindowDelegateCppToC::Get(self)->IsWindowModalDialog(
+      CefWindowCToCpp::Wrap(window));
+
+  // Return type: bool
+  return _retval;
+}
+
 cef_rect_t CEF_CALLBACK
 window_delegate_get_initial_bounds(struct _cef_window_delegate_t* self,
                                    cef_window_t* window) {
@@ -781,6 +806,7 @@ CefWindowDelegateCppToC::CefWindowDelegateCppToC() {
   GetStruct()->on_window_bounds_changed =
       window_delegate_on_window_bounds_changed;
   GetStruct()->get_parent_window = window_delegate_get_parent_window;
+  GetStruct()->is_window_modal_dialog = window_delegate_is_window_modal_dialog;
   GetStruct()->get_initial_bounds = window_delegate_get_initial_bounds;
   GetStruct()->get_initial_show_state = window_delegate_get_initial_show_state;
   GetStruct()->is_frameless = window_delegate_is_frameless;

libcef_dll/ctocpp/views/window_ctocpp.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=29399b84620b09e086f65f712b50573d7fcd1be8$
+// $hash=b6b0a2a563b475163aa71b20af6ec2ac8c1f0cae$
 //
 
 #include "libcef_dll/ctocpp/views/window_ctocpp.h"
@@ -65,6 +65,29 @@ NO_SANITIZE("cfi-icall") void CefWindowCToCpp::Show() {
   _struct->show(_struct);
 }
 
+NO_SANITIZE("cfi-icall")
+void CefWindowCToCpp::ShowAsBrowserModalDialog(
+    CefRefPtr<CefBrowserView> browser_view) {
+  shutdown_checker::AssertNotShutdown();
+
+  cef_window_t* _struct = GetStruct();
+  if (CEF_MEMBER_MISSING(_struct, show_as_browser_modal_dialog)) {
+    return;
+  }
+
+  // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
+
+  // Verify param: browser_view; type: refptr_same
+  DCHECK(browser_view.get());
+  if (!browser_view.get()) {
+    return;
+  }
+
+  // Execute
+  _struct->show_as_browser_modal_dialog(
+      _struct, CefBrowserViewCToCpp::Unwrap(browser_view));
+}
+
 NO_SANITIZE("cfi-icall") void CefWindowCToCpp::Hide() {
   shutdown_checker::AssertNotShutdown();
 

libcef_dll/ctocpp/views/window_ctocpp.h

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=5ea05d2b5c24bfc214a529d62fba2e69ea626b78$
+// $hash=2a7aaed7d4296e29dca74345cf2b2d4db221a738$
 //
 
 #ifndef CEF_LIBCEF_DLL_CTOCPP_VIEWS_WINDOW_CTOCPP_H_
@@ -21,7 +21,9 @@
 #endif
 
 #include <vector>
+#include "include/capi/views/cef_browser_view_capi.h"
 #include "include/capi/views/cef_window_capi.h"
+#include "include/views/cef_browser_view.h"
 #include "include/views/cef_window.h"
 #include "libcef_dll/ctocpp/ctocpp_ref_counted.h"
 
@@ -35,6 +37,8 @@ class CefWindowCToCpp
 
   // CefWindow methods.
   void Show() override;
+  void ShowAsBrowserModalDialog(
+      CefRefPtr<CefBrowserView> browser_view) override;
   void Hide() override;
   void CenterWindow(const CefSize& size) override;
   void Close() override;

libcef_dll/ctocpp/views/window_delegate_ctocpp.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=8998830c31f54e6e1199390c42a912033dabd6ad$
+// $hash=12bd03a8fb7d680a4e2b1a6818313c29bf14f011$
 //
 
 #include "libcef_dll/ctocpp/views/window_delegate_ctocpp.h"
@@ -182,6 +182,31 @@ CefRefPtr<CefWindow> CefWindowDelegateCToCpp::GetParentWindow(
   return CefWindowCppToC::Unwrap(_retval);
 }
 
+NO_SANITIZE("cfi-icall")
+bool CefWindowDelegateCToCpp::IsWindowModalDialog(CefRefPtr<CefWindow> window) {
+  shutdown_checker::AssertNotShutdown();
+
+  cef_window_delegate_t* _struct = GetStruct();
+  if (CEF_MEMBER_MISSING(_struct, is_window_modal_dialog)) {
+    return false;
+  }
+
+  // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
+
+  // Verify param: window; type: refptr_diff
+  DCHECK(window.get());
+  if (!window.get()) {
+    return false;
+  }
+
+  // Execute
+  int _retval =
+      _struct->is_window_modal_dialog(_struct, CefWindowCppToC::Wrap(window));
+
+  // Return type: bool
+  return _retval ? true : false;
+}
+
 NO_SANITIZE("cfi-icall")
 CefRect CefWindowDelegateCToCpp::GetInitialBounds(CefRefPtr<CefWindow> window) {
   shutdown_checker::AssertNotShutdown();

libcef_dll/ctocpp/views/window_delegate_ctocpp.h

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=bf87c473a5bafd3f8c30bd06c033b0182f65a7b7$
+// $hash=25487f4d82069d1e4c0c7b27c1c1fcbcebbbacea$
 //
 
 #ifndef CEF_LIBCEF_DLL_CTOCPP_VIEWS_WINDOW_DELEGATE_CTOCPP_H_
@@ -47,6 +47,7 @@ class CefWindowDelegateCToCpp
   CefRefPtr<CefWindow> GetParentWindow(CefRefPtr<CefWindow> window,
                                        bool* is_menu,
                                        bool* can_activate_menu) override;
+  bool IsWindowModalDialog(CefRefPtr<CefWindow> window) override;
   CefRect GetInitialBounds(CefRefPtr<CefWindow> window) override;
   cef_show_state_t GetInitialShowState(CefRefPtr<CefWindow> window) override;
   bool IsFrameless(CefRefPtr<CefWindow> window) override;

patch/patch.cfg

@@ -243,6 +243,9 @@ patches = [
     # - Support nullptr gfx::NativeWindow/gfx::NativeView dialog parent for CEF
     #   windowless rendering.
     # https://github.com/chromiumembedded/cef/issues/3316
+    #
+    # Fix NativeWebContentsModalDialogManagerViews::HostChanged to not reparent
+    # between different root windows.
     'name': 'chrome_browser_dialogs_widget',
   },
   {
@@ -627,5 +630,26 @@ patches = [
     # macOS: Remove run-time dependency on libtest_trace_processor.dylib
     # Reverts the changes from https://crrev.com/8b18bd125d
     'name': 'base_test_4396276'
+  },
+  {
+    # Create top-level widget type when Widget::InitParams::child is false.
+    'name': 'ui_views_widget_type'
+  },
+  {
+    # win/linux: Fix rounding errors with Screen[Win] DIP/pixel conversions.
+    # https://bugs.chromium.org/p/chromium/issues/detail?id=1443650#c18
+    'name': 'screen_1443650'
+  },
+  {
+    # mac: Keep bubble popups on-screen.
+    # https://bugs.chromium.org/p/chromium/issues/detail?id=893292#c10
+    'name': 'mac_platform_style_bubble_893292'
+  },
+  {
+    # win: Add support for "force-light-mode" command-line option.
+    # mac: Add support for "force-light-mode" and "force-dark-mode".
+    # https://github.com/chromiumembedded/cef/issues/3534
+    # https://chromium-review.googlesource.com/c/chromium/src/+/4766248
+    'name': 'light_mode_3534'
   }
 ]

patch/patches/base_sandbox_2743.patch

@@ -1,5 +1,5 @@
 diff --git base/BUILD.gn base/BUILD.gn
-index 4925a756be531..dbd2464d4cf9b 100644
+index 304223b58a706..67eb34f1f2ebb 100644
 --- base/BUILD.gn
 +++ base/BUILD.gn
 @@ -40,6 +40,7 @@ import("//build/config/ui.gni")
@@ -10,7 +10,7 @@ index 4925a756be531..dbd2464d4cf9b 100644
  import("//testing/libfuzzer/fuzzer_test.gni")
  import("//testing/test.gni")
  
-@@ -1529,7 +1530,11 @@ component("base") {
+@@ -1588,7 +1589,11 @@ component("base") {
      "hash/md5_constexpr_internal.h",
      "hash/sha1.h",
    ]
@@ -23,7 +23,7 @@ index 4925a756be531..dbd2464d4cf9b 100644
      sources += [
        "hash/md5_nacl.cc",
        "hash/md5_nacl.h",
-@@ -1928,6 +1933,12 @@ component("base") {
+@@ -1994,6 +1999,12 @@ component("base") {
        defines += [ "COM_INIT_CHECK_HOOK_DISABLED" ]
      }
  

patch/patches/base_sandbox_3519.patch

@@ -33,7 +33,7 @@ index 641bbaf2c7576..afdd641e38452 100644
  // Generic container overload.
  template <typename Range>
 diff --git base/win/registry.cc base/win/registry.cc
-index 473f5fdc861ce..eb85a31611560 100644
+index 4b3c3d75a2bb4..2869b29a410b9 100644
 --- base/win/registry.cc
 +++ base/win/registry.cc
 @@ -13,6 +13,14 @@

patch/patches/base_test_4396276.patch

@@ -1,20 +1,20 @@
 diff --git base/test/BUILD.gn base/test/BUILD.gn
-index a0df3473186a6..02c859e2eca78 100644
+index 93d9c1e810bfb..5a3fdee5eb0dc 100644
 --- base/test/BUILD.gn
 +++ base/test/BUILD.gn
 @@ -177,11 +177,6 @@ static_library("test_support") {
-     if (!is_chromeos) {
-       # TODO(rasikan): Add to ios and chromeos when unblocked by the chromiumos
-       # change to add the shared lib to the chrome-binary-tests directory.
--      public_deps += [ ":test_trace_processor" ]
--      sources += [
--        "test_trace_processor.cc",
--        "test_trace_processor.h",
--      ]
-       if (is_ios) {
-         deps += [
-           ":test_trace_processor+bundle",
-@@ -496,7 +491,7 @@ if (enable_base_tracing) {
+ 
+   if (enable_base_tracing) {
+     public_deps += [ "//third_party/perfetto:perfetto_test_support" ]
+-    public_deps += [ ":test_trace_processor" ]
+-    sources += [
+-      "test_trace_processor.cc",
+-      "test_trace_processor.h",
+-    ]
+     if (is_ios) {
+       deps += [
+         ":test_trace_processor+bundle",
+@@ -527,7 +522,7 @@ if (enable_base_tracing) {
    # processor depends on dev_sqlite. The two share the same symbols but have
    # different implementations, so we need to hide dev_sqlite in this shared
    # library even in non-component builds to prevent duplicate symbols.
@@ -23,7 +23,7 @@ index a0df3473186a6..02c859e2eca78 100644
    if (is_ios) {
      _target_type = "ios_framework_bundle"
    }
-@@ -505,6 +500,8 @@ if (enable_base_tracing) {
+@@ -536,6 +531,8 @@ if (enable_base_tracing) {
      defines = [ "TEST_TRACE_PROCESSOR_IMPL" ]
      testonly = true
      sources = [
@@ -32,7 +32,7 @@ index a0df3473186a6..02c859e2eca78 100644
        "test_trace_processor_export.h",
        "test_trace_processor_impl.cc",
        "test_trace_processor_impl.h",
-@@ -522,33 +519,6 @@ if (enable_base_tracing) {
+@@ -553,33 +550,6 @@ if (enable_base_tracing) {
        output_name = "TestTraceProcessor"
        bundle_deps_filter = [ "//third_party/icu:icudata" ]
      }
@@ -88,10 +88,10 @@ index f5191b804bc07..aadb7d66ba4c3 100644
 +
  #endif  // BASE_TEST_TEST_TRACE_PROCESSOR_EXPORT_H_
 diff --git content/shell/BUILD.gn content/shell/BUILD.gn
-index 1e96da71a8437..2e1b48a4aa9c9 100644
+index 5d381713fe246..69da944902eb8 100644
 --- content/shell/BUILD.gn
 +++ content/shell/BUILD.gn
-@@ -831,7 +831,6 @@ if (is_mac) {
+@@ -833,7 +833,6 @@ if (is_mac) {
        # Specify a sensible install_name for static builds. The library is
        # dlopen()ed so this is not used to resolve the module.
        ldflags = [ "-Wl,-install_name,@executable_path/../Frameworks/$output_name.framework/$output_name" ]
@@ -99,19 +99,3 @@ index 1e96da71a8437..2e1b48a4aa9c9 100644
      } else {
        # Both the main :content_shell and :content_shell_helper_app executables
        # need to link the framework. Because they are at different directory
-diff --git gpu/BUILD.gn gpu/BUILD.gn
-index 5496a01184497..84a2fe181089f 100644
---- gpu/BUILD.gn
-+++ gpu/BUILD.gn
-@@ -735,10 +735,7 @@ test("gpu_unittests") {
-     "//url",
-   ]
- 
--  # Cronet disables tracing (crbug.com/1400235).
--  # TODO(rasikan): Remove when unblocked by chromiumos change to add shared lib
--  # to add the shared lib to the chrome-binary-tests directory.
--  if (enable_base_tracing && !is_cronet_build && is_chromeos) {
-+  if (enable_base_tracing) {
-     deps += [ "//base/test:test_trace_processor" ]
-     sources += [
-       "//base/test/test_trace_processor.cc",

patch/patches/browser_scheduler.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/scheduler/browser_task_executor.cc content/browser/scheduler/browser_task_executor.cc
-index 69f9daf8388e9..6f1bc7c9ab40b 100644
+index 0e9aa441e3298..d22508fe1965f 100644
 --- content/browser/scheduler/browser_task_executor.cc
 +++ content/browser/scheduler/browser_task_executor.cc
-@@ -201,7 +201,7 @@ BrowserTaskExecutor::OnUserInputStart() {
+@@ -208,7 +208,7 @@ BrowserTaskExecutor::OnUserInputStart() {
  
  // static
  void BrowserTaskExecutor::Shutdown() {

patch/patches/browser_security_policy_1081397.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/child_process_security_policy_impl.cc content/browser/child_process_security_policy_impl.cc
-index 38f318f9c0b45..0c8c86efedd07 100644
+index 2bfca65cd8d13..0a5b7a68fca46 100644
 --- content/browser/child_process_security_policy_impl.cc
 +++ content/browser/child_process_security_policy_impl.cc
-@@ -1815,6 +1815,16 @@ bool ChildProcessSecurityPolicyImpl::CanAccessDataForMaybeOpaqueOrigin(
+@@ -1860,6 +1860,16 @@ bool ChildProcessSecurityPolicyImpl::CanAccessDataForMaybeOpaqueOrigin(
              // DeclarativeApiTest.PersistRules.
              if (actual_process_lock.matches_scheme(url::kDataScheme))
                return true;
@@ -20,10 +20,10 @@ index 38f318f9c0b45..0c8c86efedd07 100644
  
            // Make an exception to allow most visited tiles to commit in
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index ad258abf7e17f..4d94f7144f5ce 100644
+index a09b5bc4973fc..3593dd66d977f 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
-@@ -7446,10 +7446,22 @@ NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(
+@@ -7301,10 +7301,22 @@ NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(
    bool use_opaque_origin =
        (sandbox_flags & network::mojom::WebSandboxFlags::kOrigin) ==
        network::mojom::WebSandboxFlags::kOrigin;
@@ -47,9 +47,9 @@ index ad258abf7e17f..4d94f7144f5ce 100644
    }
  
    return origin_and_debug_info;
-@@ -7479,6 +7491,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponseWithDebugInfo() {
-       GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(
-           SandboxFlagsToCommit());
+@@ -7408,6 +7420,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponseWithDebugInfo() {
+       DetermineInitiatorRelationship(initiator_rfh,
+                                      frame_tree_node_->current_frame_host()));
  
 +  if (origin_with_debug_info.first.opaque() &&
 +      origin_with_debug_info.second.find("cef_nonstandard") !=

patch/patches/browser_web_ui_controller_factory.patch

@@ -13,10 +13,10 @@ index 9d9c17ffd6474..4eb79c65369af 100644
  };
  
 diff --git content/public/browser/webui_config_map.h content/public/browser/webui_config_map.h
-index 19777632921fc..a22db4c49fd84 100644
+index a80034506bf45..4bda477df0558 100644
 --- content/public/browser/webui_config_map.h
 +++ content/public/browser/webui_config_map.h
-@@ -60,6 +60,10 @@ class CONTENT_EXPORT WebUIConfigMap {
+@@ -61,6 +61,10 @@ class CONTENT_EXPORT WebUIConfigMap {
    // Returns the size of the map, i.e. how many WebUIConfigs are registered.
    size_t GetSizeForTesting() { return configs_map_.size(); }
  

patch/patches/build.patch

@@ -1,8 +1,8 @@
 diff --git build/config/compiler/BUILD.gn build/config/compiler/BUILD.gn
-index 23a8da453c3d2..66ad9b2ab0ed6 100644
+index ae742b0b85a50..5bf9b34cd3e3b 100644
 --- build/config/compiler/BUILD.gn
 +++ build/config/compiler/BUILD.gn
-@@ -2015,8 +2015,6 @@ config("thin_archive") {
+@@ -2051,8 +2051,6 @@ config("thin_archive") {
    # confuses lldb.
    if ((is_posix && !is_nacl && !is_apple) || is_fuchsia) {
      arflags = [ "-T" ]

patch/patches/chrome_browser.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index 77d5dfbe1d547..29d9252d29739 100644
+index 01194da83fe3f..dd65ddd171c54 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
 @@ -11,6 +11,7 @@ import("//build/config/compiler/pgo/pgo.gni")
@@ -10,7 +10,7 @@ index 77d5dfbe1d547..29d9252d29739 100644
  import("//chrome/browser/buildflags.gni")
  import("//chrome/browser/downgrade/buildflags.gni")
  import("//chrome/common/features.gni")
-@@ -1957,6 +1958,7 @@ static_library("browser") {
+@@ -1969,6 +1970,7 @@ static_library("browser") {
      "//build/config/chromebox_for_meetings:buildflags",
      "//build/config/compiler:compiler_buildflags",
      "//cc",
@@ -18,7 +18,7 @@ index 77d5dfbe1d547..29d9252d29739 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -2547,6 +2549,10 @@ static_library("browser") {
+@@ -2564,6 +2566,10 @@ static_library("browser") {
      ]
    }
  

patch/patches/chrome_browser_background_mode_1100085.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/browser_process.h chrome/browser/browser_process.h
-index 6dc8016311847..851f866e388f5 100644
+index 9c5260579cf05..021b4bc3c5499 100644
 --- chrome/browser/browser_process.h
 +++ chrome/browser/browser_process.h
-@@ -214,9 +214,9 @@ class BrowserProcess {
+@@ -202,9 +202,9 @@ class BrowserProcess {
    virtual DownloadStatusUpdater* download_status_updater() = 0;
    virtual DownloadRequestLimiter* download_request_limiter() = 0;
  
@@ -14,10 +14,10 @@ index 6dc8016311847..851f866e388f5 100644
        std::unique_ptr<BackgroundModeManager> manager) = 0;
  #endif
 diff --git chrome/browser/browser_process_impl.cc chrome/browser/browser_process_impl.cc
-index ff0bfdce017a5..0971782184774 100644
+index 73dc09a7ee5af..f7ab03c788969 100644
 --- chrome/browser/browser_process_impl.cc
 +++ chrome/browser/browser_process_impl.cc
-@@ -1054,18 +1054,14 @@ DownloadRequestLimiter* BrowserProcessImpl::download_request_limiter() {
+@@ -1032,18 +1032,14 @@ DownloadRequestLimiter* BrowserProcessImpl::download_request_limiter() {
    return download_request_limiter_.get();
  }
  
@@ -38,10 +38,10 @@ index ff0bfdce017a5..0971782184774 100644
      std::unique_ptr<BackgroundModeManager> manager) {
    background_mode_manager_ = std::move(manager);
 diff --git chrome/browser/browser_process_impl.h chrome/browser/browser_process_impl.h
-index 0f98eece3c159..a261c43634870 100644
+index 701b6cc46045c..6ea15c988c15b 100644
 --- chrome/browser/browser_process_impl.h
 +++ chrome/browser/browser_process_impl.h
-@@ -187,8 +187,8 @@ class BrowserProcessImpl : public BrowserProcess,
+@@ -184,8 +184,8 @@ class BrowserProcessImpl : public BrowserProcess,
    void SetApplicationLocale(const std::string& actual_locale) override;
    DownloadStatusUpdater* download_status_updater() override;
    DownloadRequestLimiter* download_request_limiter() override;

patch/patches/chrome_browser_browser.patch

@@ -13,7 +13,7 @@ index 2480282a19d12..dbd1fbf8a15b5 100644
    return false;
  }
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index 9e536d6f48970..aeb659d55123c 100644
+index d7bb16c28835b..e5931106d9e05 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -9,6 +9,7 @@ import("//build/config/compiler/compiler.gni")
@@ -24,7 +24,7 @@ index 9e536d6f48970..aeb659d55123c 100644
  import("//chrome/browser/buildflags.gni")
  import("//chrome/common/features.gni")
  import("//chromeos/ash/components/assistant/assistant.gni")
-@@ -466,6 +467,10 @@ static_library("ui") {
+@@ -478,6 +479,10 @@ static_library("ui") {
      "//build/config/compiler:wexit_time_destructors",
    ]
  
@@ -35,15 +35,15 @@ index 9e536d6f48970..aeb659d55123c 100644
    # Since browser and browser_ui actually depend on each other,
    # we must omit the dependency from browser_ui to browser.
    # However, this means browser_ui and browser should more or less
-@@ -490,6 +495,7 @@ static_library("ui") {
+@@ -502,6 +507,7 @@ static_library("ui") {
      "//build:chromeos_buildflags",
      "//build/config/chromebox_for_meetings:buildflags",
      "//cc/paint",
 +    "//cef/libcef/features",
-     "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -2706,6 +2712,8 @@ static_library("ui") {
+     "//chrome/app:chrome_dll_resources",
+@@ -2727,6 +2733,8 @@ static_library("ui") {
        "views/apps/app_dialog/app_block_dialog_view.h",
        "views/apps/app_dialog/app_pause_dialog_view.cc",
        "views/apps/app_dialog/app_pause_dialog_view.h",
@@ -52,7 +52,7 @@ index 9e536d6f48970..aeb659d55123c 100644
        "views/apps/app_info_dialog/arc_app_info_links_panel.cc",
        "views/apps/app_info_dialog/arc_app_info_links_panel.h",
        "views/apps/chrome_app_window_client_views_chromeos.cc",
-@@ -4499,8 +4507,6 @@ static_library("ui") {
+@@ -4529,8 +4537,6 @@ static_library("ui") {
        "views/accessibility/theme_tracking_non_accessible_image_view.h",
        "views/apps/app_dialog/app_dialog_view.cc",
        "views/apps/app_dialog/app_dialog_view.h",
@@ -61,7 +61,7 @@ index 9e536d6f48970..aeb659d55123c 100644
        "views/apps/app_info_dialog/app_info_dialog_container.cc",
        "views/apps/app_info_dialog/app_info_dialog_container.h",
        "views/apps/app_info_dialog/app_info_dialog_views.cc",
-@@ -6082,6 +6088,7 @@ static_library("ui") {
+@@ -6141,6 +6147,7 @@ static_library("ui") {
    if (enable_printing) {
      deps += [
        "//components/printing/browser",
@@ -70,7 +70,7 @@ index 9e536d6f48970..aeb659d55123c 100644
      ]
    }
 diff --git chrome/browser/ui/browser.cc chrome/browser/ui/browser.cc
-index 71297e151bb62..8c642d031f3c1 100644
+index 9125b6d7e3e87..9140a9cf4ca7d 100644
 --- chrome/browser/ui/browser.cc
 +++ chrome/browser/ui/browser.cc
 @@ -264,6 +264,25 @@
@@ -113,7 +113,7 @@ index 71297e151bb62..8c642d031f3c1 100644
    location_bar_model_ = std::make_unique<LocationBarModelImpl>(
        location_bar_model_delegate_.get(), content::kMaxURLDisplayChars);
  
-@@ -650,6 +676,12 @@ Browser::~Browser() {
+@@ -651,6 +677,12 @@ Browser::~Browser() {
    // away so they don't try and call back to us.
    if (select_file_dialog_.get())
      select_file_dialog_->ListenerDestroyed();
@@ -126,7 +126,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  }
  
  ///////////////////////////////////////////////////////////////////////////////
-@@ -1379,6 +1411,14 @@ content::KeyboardEventProcessingResult Browser::PreHandleKeyboardEvent(
+@@ -1381,6 +1413,14 @@ content::KeyboardEventProcessingResult Browser::PreHandleKeyboardEvent(
    if (exclusive_access_manager_->HandleUserKeyEvent(event))
      return content::KeyboardEventProcessingResult::HANDLED;
  
@@ -141,7 +141,7 @@ index 71297e151bb62..8c642d031f3c1 100644
    return window()->PreHandleKeyboardEvent(event);
  }
  
-@@ -1386,8 +1426,18 @@ bool Browser::HandleKeyboardEvent(content::WebContents* source,
+@@ -1388,8 +1428,18 @@ bool Browser::HandleKeyboardEvent(content::WebContents* source,
                                    const NativeWebKeyboardEvent& event) {
    DevToolsWindow* devtools_window =
        DevToolsWindow::GetInstanceForInspectedWebContents(source);
@@ -162,7 +162,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  }
  
  bool Browser::TabsNeedBeforeUnloadFired() {
-@@ -1590,6 +1640,14 @@ WebContents* Browser::OpenURLFromTab(WebContents* source,
+@@ -1592,6 +1642,14 @@ WebContents* Browser::OpenURLFromTab(WebContents* source,
      return window->OpenURLFromTab(source, params);
    }
  
@@ -177,7 +177,7 @@ index 71297e151bb62..8c642d031f3c1 100644
    NavigateParams nav_params(this, params.url, params.transition);
    nav_params.FillNavigateParamsFromOpenURLParams(params);
    nav_params.source_contents = source;
-@@ -1747,6 +1805,8 @@ void Browser::LoadingStateChanged(WebContents* source,
+@@ -1749,6 +1807,8 @@ void Browser::LoadingStateChanged(WebContents* source,
                                    bool should_show_loading_ui) {
    ScheduleUIUpdate(source, content::INVALIDATE_TYPE_LOAD);
    UpdateWindowForLoadingStateChanged(source, should_show_loading_ui);
@@ -186,7 +186,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  }
  
  void Browser::CloseContents(WebContents* source) {
-@@ -1775,6 +1835,8 @@ void Browser::SetContentsBounds(WebContents* source, const gfx::Rect& bounds) {
+@@ -1777,6 +1837,8 @@ void Browser::SetContentsBounds(WebContents* source, const gfx::Rect& bounds) {
  }
  
  void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
@@ -195,7 +195,7 @@ index 71297e151bb62..8c642d031f3c1 100644
    if (!GetStatusBubble())
      return;
  
-@@ -1782,6 +1844,17 @@ void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
+@@ -1784,6 +1846,17 @@ void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
      GetStatusBubble()->SetURL(url);
  }
  
@@ -213,7 +213,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  void Browser::ContentsMouseEvent(WebContents* source,
                                   bool motion,
                                   bool exited) {
-@@ -1806,6 +1879,19 @@ bool Browser::TakeFocus(content::WebContents* source, bool reverse) {
+@@ -1808,6 +1881,19 @@ bool Browser::TakeFocus(content::WebContents* source, bool reverse) {
    return false;
  }
  
@@ -233,7 +233,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  void Browser::BeforeUnloadFired(WebContents* web_contents,
                                  bool proceed,
                                  bool* proceed_to_fire_unload) {
-@@ -1898,6 +1984,10 @@ void Browser::WebContentsCreated(WebContents* source_contents,
+@@ -1900,6 +1986,10 @@ void Browser::WebContentsCreated(WebContents* source_contents,
  
    // Make the tab show up in the task manager.
    task_manager::WebContentsTags::CreateForTabContents(new_contents);
@@ -244,7 +244,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  }
  
  void Browser::PortalWebContentsCreated(WebContents* portal_web_contents) {
-@@ -2009,11 +2099,15 @@ void Browser::EnterFullscreenModeForTab(
+@@ -2011,11 +2101,15 @@ void Browser::EnterFullscreenModeForTab(
      const blink::mojom::FullscreenOptions& options) {
    exclusive_access_manager_->fullscreen_controller()->EnterFullscreenModeForTab(
        requesting_frame, options.display_id);
@@ -260,7 +260,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  }
  
  bool Browser::IsFullscreenForTabOrPending(const WebContents* web_contents) {
-@@ -2203,6 +2297,15 @@ void Browser::RequestMediaAccessPermission(
+@@ -2205,6 +2299,15 @@ void Browser::RequestMediaAccessPermission(
      content::WebContents* web_contents,
      const content::MediaStreamRequest& request,
      content::MediaResponseCallback callback) {
@@ -276,7 +276,7 @@ index 71297e151bb62..8c642d031f3c1 100644
    const extensions::Extension* extension =
        GetExtensionForOrigin(profile_, request.security_origin);
    MediaCaptureDevicesDispatcher::GetInstance()->ProcessMediaAccessRequest(
-@@ -2743,13 +2846,20 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
+@@ -2753,13 +2856,20 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
  // Browser, Getters for UI (private):
  
  StatusBubble* Browser::GetStatusBubble() {
@@ -298,7 +298,7 @@ index 71297e151bb62..8c642d031f3c1 100644
    return window_ ? window_->GetStatusBubble() : nullptr;
  }
  
-@@ -2883,6 +2993,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
+@@ -2893,6 +3003,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
      BookmarkTabHelper::FromWebContents(web_contents)->RemoveObserver(this);
      web_contents_collection_.StopObserving(web_contents);
    }
@@ -308,7 +308,7 @@ index 71297e151bb62..8c642d031f3c1 100644
  
  void Browser::TabDetachedAtImpl(content::WebContents* contents,
 diff --git chrome/browser/ui/browser.h chrome/browser/ui/browser.h
-index 23a838ba30c68..52601ebdcc9bd 100644
+index 2cbbda0614965..976a9e8be44b6 100644
 --- chrome/browser/ui/browser.h
 +++ chrome/browser/ui/browser.h
 @@ -22,6 +22,7 @@
@@ -356,7 +356,7 @@ index 23a838ba30c68..52601ebdcc9bd 100644
    // Accessors ////////////////////////////////////////////////////////////////
  
    const CreateParams& create_params() const { return create_params_; }
-@@ -472,6 +489,12 @@ class Browser : public TabStripModelObserver,
+@@ -474,6 +491,12 @@ class Browser : public TabStripModelObserver,
  
    base::WeakPtr<Browser> AsWeakPtr();
  
@@ -369,7 +369,7 @@ index 23a838ba30c68..52601ebdcc9bd 100644
    // Get the FindBarController for this browser, creating it if it does not
    // yet exist.
    FindBarController* GetFindBarController();
-@@ -848,11 +871,19 @@ class Browser : public TabStripModelObserver,
+@@ -850,11 +873,19 @@ class Browser : public TabStripModelObserver,
    void SetContentsBounds(content::WebContents* source,
                           const gfx::Rect& bounds) override;
    void UpdateTargetURL(content::WebContents* source, const GURL& url) override;
@@ -389,7 +389,7 @@ index 23a838ba30c68..52601ebdcc9bd 100644
    void BeforeUnloadFired(content::WebContents* source,
                           bool proceed,
                           bool* proceed_to_fire_unload) override;
-@@ -1264,6 +1295,8 @@ class Browser : public TabStripModelObserver,
+@@ -1266,6 +1297,8 @@ class Browser : public TabStripModelObserver,
    const std::string initial_workspace_;
    bool initial_visible_on_all_workspaces_state_;
  
@@ -398,7 +398,7 @@ index 23a838ba30c68..52601ebdcc9bd 100644
    CreationSource creation_source_ = CreationSource::kUnknown;
  
    UnloadController unload_controller_;
-@@ -1328,6 +1361,10 @@ class Browser : public TabStripModelObserver,
+@@ -1330,6 +1363,10 @@ class Browser : public TabStripModelObserver,
        extension_browser_window_helper_;
  #endif
  
@@ -410,10 +410,10 @@ index 23a838ba30c68..52601ebdcc9bd 100644
  
    // The opener browser of the document picture-in-picture browser. Null if the
 diff --git chrome/browser/ui/browser_navigator.cc chrome/browser/ui/browser_navigator.cc
-index edf4d8c7933e9..9e7c236dbf16a 100644
+index d4f4ba7efd1be..4b0834aceed14 100644
 --- chrome/browser/ui/browser_navigator.cc
 +++ chrome/browser/ui/browser_navigator.cc
-@@ -555,6 +555,13 @@ std::unique_ptr<content::WebContents> CreateTargetContents(
+@@ -556,6 +556,13 @@ std::unique_ptr<content::WebContents> CreateTargetContents(
    std::unique_ptr<WebContents> target_contents =
        WebContents::Create(create_params);
  

patch/patches/chrome_browser_content_settings.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/content_settings/host_content_settings_map_factory.cc chrome/browser/content_settings/host_content_settings_map_factory.cc
-index 6bcdf281c430a..cee4d03ce296b 100644
+index a07ea61672f8d..e9d0666011add 100644
 --- chrome/browser/content_settings/host_content_settings_map_factory.cc
 +++ chrome/browser/content_settings/host_content_settings_map_factory.cc
 @@ -9,6 +9,7 @@

patch/patches/chrome_browser_context_menus.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/renderer_context_menu/render_view_context_menu.cc chrome/browser/renderer_context_menu/render_view_context_menu.cc
-index 7e25c4f0656fa..446075c9dfaf7 100644
+index 7f04636806afe..b08bd90bf0681 100644
 --- chrome/browser/renderer_context_menu/render_view_context_menu.cc
 +++ chrome/browser/renderer_context_menu/render_view_context_menu.cc
-@@ -322,6 +322,13 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {
+@@ -331,6 +331,13 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {
    return callback.get();
  }
  
@@ -16,7 +16,7 @@ index 7e25c4f0656fa..446075c9dfaf7 100644
  enum class UmaEnumIdLookupType {
    GeneralEnumId,
    ContextSpecificEnumId,
-@@ -568,6 +575,10 @@ int FindUMAEnumValueForCommand(int id, UmaEnumIdLookupType type) {
+@@ -580,6 +587,10 @@ int FindUMAEnumValueForCommand(int id, UmaEnumIdLookupType type) {
    if (ContextMenuMatcher::IsExtensionsCustomCommandId(id))
      return 1;
  
@@ -27,7 +27,7 @@ index 7e25c4f0656fa..446075c9dfaf7 100644
    id = CollapseCommandsForUMA(id);
    const auto& map = GetIdcToUmaMap(type);
    auto it = map.find(id);
-@@ -808,6 +819,14 @@ RenderViewContextMenu::RenderViewContextMenu(
+@@ -827,6 +838,14 @@ RenderViewContextMenu::RenderViewContextMenu(
  #if BUILDFLAG(ENABLE_SCREEN_AI_SERVICE)
    pdf_ocr_submenu_model_ = std::make_unique<ui::SimpleMenuModel>(this);
  #endif  // BUILDFLAG(ENABLE_SCREEN_AI_SERVICE)
@@ -42,10 +42,10 @@ index 7e25c4f0656fa..446075c9dfaf7 100644
  }
  
  RenderViewContextMenu::~RenderViewContextMenu() = default;
-@@ -1229,6 +1248,12 @@ void RenderViewContextMenu::InitMenu() {
-   // menu, meaning that each menu item added/removed in this function will cause
-   // it to visibly jump on the screen (see b/173569669).
-   AppendQuickAnswersItems();
+@@ -1263,6 +1282,12 @@ void RenderViewContextMenu::InitMenu() {
+           autofill::PopupHidingReason::kContextMenuOpened);
+     }
+   }
 +
 +  if (first_observer_) {
 +    // Do this last so that the observer can optionally modify previously
@@ -55,7 +55,7 @@ index 7e25c4f0656fa..446075c9dfaf7 100644
  }
  
  Profile* RenderViewContextMenu::GetProfile() const {
-@@ -3224,6 +3249,12 @@ void RenderViewContextMenu::RegisterExecutePluginActionCallbackForTesting(
+@@ -3302,6 +3327,12 @@ void RenderViewContextMenu::RegisterExecutePluginActionCallbackForTesting(
    execute_plugin_action_callback_ = std::move(cb);
  }
  
@@ -69,10 +69,10 @@ index 7e25c4f0656fa..446075c9dfaf7 100644
  RenderViewContextMenu::GetHandlersForLinkUrl() {
    custom_handlers::ProtocolHandlerRegistry::ProtocolHandlerList handlers =
 diff --git chrome/browser/renderer_context_menu/render_view_context_menu.h chrome/browser/renderer_context_menu/render_view_context_menu.h
-index d37c3a18df476..d5c84270f0680 100644
+index 0cbc7b7181130..8346c35242724 100644
 --- chrome/browser/renderer_context_menu/render_view_context_menu.h
 +++ chrome/browser/renderer_context_menu/render_view_context_menu.h
-@@ -142,6 +142,12 @@ class RenderViewContextMenu
+@@ -146,6 +146,12 @@ class RenderViewContextMenu
    }
  #endif
  
@@ -85,7 +85,7 @@ index d37c3a18df476..d5c84270f0680 100644
   protected:
    Profile* GetProfile() const;
  
-@@ -404,6 +410,9 @@ class RenderViewContextMenu
+@@ -415,6 +421,9 @@ class RenderViewContextMenu
    //   built.
    bool is_protocol_submenu_valid_ = false;
  

patch/patches/chrome_browser_dialogs_native.patch

@@ -139,7 +139,7 @@ index 1ee6c28cd47bc..62fd628dffd07 100644
        params->need_local_path ? ui::SelectFileDialog::FileTypeInfo::NATIVE_PATH
                                : ui::SelectFileDialog::FileTypeInfo::ANY_PATH;
 diff --git chrome/browser/file_select_helper.h chrome/browser/file_select_helper.h
-index d8d05b844383c..a18fe71e383d1 100644
+index e3a85080fd37d..2f3e8e64614d7 100644
 --- chrome/browser/file_select_helper.h
 +++ chrome/browser/file_select_helper.h
 @@ -61,7 +61,8 @@ class FileSelectHelper : public base::RefCountedThreadSafe<
@@ -238,10 +238,10 @@ index 101e91826023b..35456ffad43f3 100644
          paths.push_back(std::move(path));
        }
 diff --git ui/shell_dialogs/select_file_dialog.cc ui/shell_dialogs/select_file_dialog.cc
-index 4a67edd5e5ea0..dfbfd166fc33a 100644
+index e2c00b2ec1532..a2e8753766597 100644
 --- ui/shell_dialogs/select_file_dialog.cc
 +++ ui/shell_dialogs/select_file_dialog.cc
-@@ -87,8 +87,10 @@ void SelectFileDialog::SetFactory(ui::SelectFileDialogFactory* factory) {
+@@ -88,8 +88,10 @@ void SelectFileDialog::SetFactory(
  // static
  scoped_refptr<SelectFileDialog> SelectFileDialog::Create(
      Listener* listener,
@@ -255,10 +255,10 @@ index 4a67edd5e5ea0..dfbfd166fc33a 100644
    return CreateSelectFileDialog(listener, std::move(policy));
  }
 diff --git ui/shell_dialogs/select_file_dialog.h ui/shell_dialogs/select_file_dialog.h
-index ab71dd6c559ef..71899846eab4e 100644
+index 3f1db1a9c6fd3..1f0e4af378c78 100644
 --- ui/shell_dialogs/select_file_dialog.h
 +++ ui/shell_dialogs/select_file_dialog.h
-@@ -113,7 +113,8 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
+@@ -114,7 +114,8 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
    // is refcounted and uses a background thread.
    static scoped_refptr<SelectFileDialog> Create(
        Listener* listener,
@@ -268,7 +268,7 @@ index ab71dd6c559ef..71899846eab4e 100644
  
    SelectFileDialog(const SelectFileDialog&) = delete;
    SelectFileDialog& operator=(const SelectFileDialog&) = delete;
-@@ -210,6 +211,19 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
+@@ -211,6 +212,19 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
                    const GURL* caller = nullptr);
    bool HasMultipleFileTypeChoices();
  
@@ -288,7 +288,7 @@ index ab71dd6c559ef..71899846eab4e 100644
   protected:
    friend class base::RefCountedThreadSafe<SelectFileDialog>;
  
-@@ -235,6 +249,11 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
+@@ -236,6 +250,11 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
    // The listener to be notified of selection completion.
    raw_ptr<Listener, DanglingUntriaged> listener_;
  
@@ -300,7 +300,7 @@ index ab71dd6c559ef..71899846eab4e 100644
   private:
    // Tests if the file selection dialog can be displayed by
    // testing if the AllowFileSelectionDialogs-Policy is
-@@ -247,8 +266,6 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
+@@ -248,8 +267,6 @@ class SHELL_DIALOGS_EXPORT SelectFileDialog
  
    // Returns true if the dialog has multiple file type choices.
    virtual bool HasMultipleFileTypeChoicesImpl() = 0;

patch/patches/chrome_browser_dialogs_widget.patch

@@ -77,10 +77,10 @@ index dc648ad1ae595..70698ed848990 100644
      DCHECK_EQ(parent_view, host->GetHostView());
      ModalDialogHostObserver* dialog_host_observer =
 diff --git components/constrained_window/native_web_contents_modal_dialog_manager_views.cc components/constrained_window/native_web_contents_modal_dialog_manager_views.cc
-index 647391095306e..02aea9b01f59b 100644
+index 647391095306e..bd49316ac758e 100644
 --- components/constrained_window/native_web_contents_modal_dialog_manager_views.cc
 +++ components/constrained_window/native_web_contents_modal_dialog_manager_views.cc
-@@ -184,9 +184,12 @@ void NativeWebContentsModalDialogManagerViews::HostChanged(
+@@ -184,9 +184,20 @@ void NativeWebContentsModalDialogManagerViews::HostChanged(
    if (host_) {
      host_->AddObserver(this);
  
@@ -90,8 +90,16 @@ index 647391095306e..02aea9b01f59b 100644
 +    // |host_view| will be nullptr with CEF windowless rendering.
 +    if (auto host_view = host_->GetHostView()) {
 +      for (auto* widget : observed_widgets_) {
-+        views::Widget::ReparentNativeView(widget->GetNativeView(),
-+                                          host_view);
++#if defined(USE_AURA)
++        auto widget_view = widget->GetNativeView();
++        // Don't reparent between different root windows. Doing so causes
++        // issues with layout of dialogs containing Chrome browsers.
++        if (host_view->GetRootWindow() == widget_view->GetRootWindow()) {
++          views::Widget::ReparentNativeView(widget_view, host_view);
++        }
++#else
++        views::Widget::ReparentNativeView(widget->GetNativeView(), host_view);
++#endif
 +      }
      }
  
@@ -112,7 +120,7 @@ index 51ed6bcf6b540..9ae4737e0737e 100644
    virtual gfx::Point GetDialogPosition(const gfx::Size& size) = 0;
    // Returns whether a dialog currently about to be shown should be activated.
 diff --git ui/views/window/dialog_delegate.cc ui/views/window/dialog_delegate.cc
-index 938e6ab7ca8ee..ece420f09418e 100644
+index f8534ef8ee922..ca0c139d7ef1e 100644
 --- ui/views/window/dialog_delegate.cc
 +++ ui/views/window/dialog_delegate.cc
 @@ -53,10 +53,12 @@ DialogDelegate::DialogDelegate() {
@@ -181,7 +189,7 @@ index 938e6ab7ca8ee..ece420f09418e 100644
    // Web-modal (ui::MODAL_TYPE_CHILD) dialogs with parents are marked as child
    // widgets to prevent top-level window behavior (independent movement, etc).
 diff --git ui/views/window/dialog_delegate.h ui/views/window/dialog_delegate.h
-index fca669a962357..8a2a2acea788b 100644
+index ca8ef29878e8e..90b845c480505 100644
 --- ui/views/window/dialog_delegate.h
 +++ ui/views/window/dialog_delegate.h
 @@ -97,13 +97,18 @@ class VIEWS_EXPORT DialogDelegate : public WidgetDelegate {

patch/patches/chrome_browser_frame_mac.patch

@@ -33,7 +33,7 @@ index ab1d8fd9bfa84..77f65b44e591a 100644
    ~BrowserFrameMac() override;
  
 diff --git chrome/browser/ui/views/frame/browser_frame_mac.mm chrome/browser/ui/views/frame/browser_frame_mac.mm
-index eb1570b99202a..6f0e0ec08539f 100644
+index 55f9663efa82a..d0fabd2273a80 100644
 --- chrome/browser/ui/views/frame/browser_frame_mac.mm
 +++ chrome/browser/ui/views/frame/browser_frame_mac.mm
 @@ -181,7 +181,14 @@ void BrowserFrameMac::OnWindowFullscreenTransitionComplete() {

patch/patches/chrome_browser_permission_prompt.patch

@@ -44,7 +44,7 @@ index 16107572d4d0d..409e9ea870482 100644
        base::FeatureList::IsEnabled(
            features::kPeriodicSyncPermissionForDefaultSearchEngine) &&
 diff --git chrome/browser/permissions/chrome_permissions_client.cc chrome/browser/permissions/chrome_permissions_client.cc
-index dece5822d8899..855ab4273e916 100644
+index 18e2eec8f64ff..d36b3206aeb63 100644
 --- chrome/browser/permissions/chrome_permissions_client.cc
 +++ chrome/browser/permissions/chrome_permissions_client.cc
 @@ -14,6 +14,7 @@
@@ -65,7 +65,7 @@ index dece5822d8899..855ab4273e916 100644
    return site_engagement::SiteEngagementService::Get(
               Profile::FromBrowserContext(browser_context))
        ->GetScore(origin);
-@@ -332,8 +336,10 @@ ChromePermissionsClient::CreatePermissionUiSelectors(
+@@ -338,8 +342,10 @@ ChromePermissionsClient::CreatePermissionUiSelectors(
        std::make_unique<ContextualNotificationPermissionUiSelector>());
    selectors.emplace_back(std::make_unique<PrefNotificationPermissionUiSelector>(
        Profile::FromBrowserContext(browser_context)));
@@ -77,7 +77,7 @@ index dece5822d8899..855ab4273e916 100644
  }
  
 diff --git chrome/browser/permissions/permission_manager_factory.cc chrome/browser/permissions/permission_manager_factory.cc
-index e70f9fcc696e5..f61ee1548f8b0 100644
+index bac111192fab1..695c240875c31 100644
 --- chrome/browser/permissions/permission_manager_factory.cc
 +++ chrome/browser/permissions/permission_manager_factory.cc
 @@ -6,6 +6,7 @@
@@ -88,12 +88,12 @@ index e70f9fcc696e5..f61ee1548f8b0 100644
  #include "chrome/browser/background_fetch/background_fetch_permission_context.h"
  #include "chrome/browser/background_sync/periodic_background_sync_permission_context.h"
  #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
-@@ -59,8 +60,10 @@ permissions::PermissionManager::PermissionContextMap CreatePermissionContexts(
+@@ -56,8 +57,10 @@ permissions::PermissionManager::PermissionContextMap CreatePermissionContexts(
        std::make_unique<GeolocationPermissionContextDelegate>(profile);
  #endif  // BUILDFLAG(IS_ANDROID)
  #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_CHROMEOS)
 +  if (!cef::IsAlloyRuntimeEnabled()) {
-   delegates.geolocation_manager = g_browser_process->geolocation_manager();
+   delegates.geolocation_manager = device::GeolocationManager::GetInstance();
    DCHECK(delegates.geolocation_manager);
 +  }
  #endif

patch/patches/chrome_browser_profile_menu.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/ui/bookmarks/bookmark_stats.cc chrome/browser/ui/bookmarks/bookmark_stats.cc
-index 45f661faa6e0b..777a1f6c333b6 100644
+index 7ae18c5a960b0..d48ba838efe6f 100644
 --- chrome/browser/ui/bookmarks/bookmark_stats.cc
 +++ chrome/browser/ui/bookmarks/bookmark_stats.cc
 @@ -21,7 +21,9 @@ bool IsBookmarkBarLocation(BookmarkLaunchLocation location) {

patch/patches/chrome_browser_profiles.patch

@@ -52,10 +52,10 @@ index 6cffe941b26f9..3e6223ab0d423 100644
  Profile::OTRProfileID Profile::OTRProfileID::CreateUniqueForDevTools() {
    return CreateUnique(kDevToolsOTRProfileIDPrefix);
 diff --git chrome/browser/profiles/profile.h chrome/browser/profiles/profile.h
-index 8b08095a9b21e..71b14e1f876cf 100644
+index 946b9cb533714..80815f7feb8f8 100644
 --- chrome/browser/profiles/profile.h
 +++ chrome/browser/profiles/profile.h
-@@ -99,6 +99,10 @@ class Profile : public content::BrowserContext {
+@@ -104,6 +104,10 @@ class Profile : public content::BrowserContext {
      // be applicable to run. Please see crbug.com/1098697#c3 for more details.
      static OTRProfileID CreateUnique(const std::string& profile_id_prefix);
  
@@ -66,16 +66,16 @@ index 8b08095a9b21e..71b14e1f876cf 100644
      // Creates a unique OTR profile id to be used for DevTools browser contexts.
      static OTRProfileID CreateUniqueForDevTools();
  
-@@ -502,6 +506,8 @@ class Profile : public content::BrowserContext {
- 
-   base::WeakPtr<Profile> GetWeakPtr();
+@@ -529,6 +533,8 @@ class Profile : public content::BrowserContext {
+     return instant_service_;
+   }
  
 +  void NotifyOffTheRecordProfileCreated(Profile* off_the_record);
 +
   protected:
    // Creates an OffTheRecordProfile which points to this Profile.
    static std::unique_ptr<Profile> CreateOffTheRecordProfile(
-@@ -513,7 +519,6 @@ class Profile : public content::BrowserContext {
+@@ -540,7 +546,6 @@ class Profile : public content::BrowserContext {
    static PrefStore* CreateExtensionPrefStore(Profile*,
                                               bool incognito_pref_store);
  
@@ -99,7 +99,7 @@ index a3ee1846fcf77..13edaf1203d69 100644
    return raw_otr_profile;
  }
 diff --git chrome/browser/profiles/profile_manager.cc chrome/browser/profiles/profile_manager.cc
-index 80acbb1473fc7..9db21208f8e81 100644
+index 9eb766c7a5818..3a66b90b55dd6 100644
 --- chrome/browser/profiles/profile_manager.cc
 +++ chrome/browser/profiles/profile_manager.cc
 @@ -389,7 +389,7 @@ ProfileManager::ProfileManager(const base::FilePath& user_data_dir)
@@ -112,7 +112,7 @@ index 80acbb1473fc7..9db21208f8e81 100644
  
    zombie_metrics_timer_.Start(FROM_HERE, base::Minutes(30), this,
 diff --git chrome/browser/profiles/profile_manager.h chrome/browser/profiles/profile_manager.h
-index 60c9fd19fe15b..2a3e317d9c240 100644
+index 9bb7cd968c95d..bf16634f7dfe8 100644
 --- chrome/browser/profiles/profile_manager.h
 +++ chrome/browser/profiles/profile_manager.h
 @@ -130,7 +130,7 @@ class ProfileManager : public Profile::Delegate {
@@ -161,7 +161,7 @@ index 884e79cd54e0d..4e840df66756d 100644
  #if BUILDFLAG(IS_CHROMEOS_ASH)
    oauth2_login_manager_ =
 diff --git chrome/browser/profiles/renderer_updater_factory.cc chrome/browser/profiles/renderer_updater_factory.cc
-index 908a1c3615d70..462500925f05a 100644
+index 711f449323737..b277b4386c16a 100644
 --- chrome/browser/profiles/renderer_updater_factory.cc
 +++ chrome/browser/profiles/renderer_updater_factory.cc
 @@ -4,6 +4,7 @@

patch/patches/chrome_browser_safe_browsing.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/safe_browsing/BUILD.gn chrome/browser/safe_browsing/BUILD.gn
-index 3dce9f70a6cd1..39119ef60c61d 100644
+index 408c5117c7e92..ce620089a5616 100644
 --- chrome/browser/safe_browsing/BUILD.gn
 +++ chrome/browser/safe_browsing/BUILD.gn
 @@ -32,6 +32,7 @@ static_library("safe_browsing") {

patch/patches/chrome_browser_themes.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/themes/theme_service.cc chrome/browser/themes/theme_service.cc
-index 67dc4a2e0695e..16f819e133886 100644
+index b8cfd5d2daa3b..51b52a3f34409 100644
 --- chrome/browser/themes/theme_service.cc
 +++ chrome/browser/themes/theme_service.cc
 @@ -30,6 +30,7 @@
@@ -10,8 +10,8 @@ index 67dc4a2e0695e..16f819e133886 100644
  #include "chrome/browser/browser_features.h"
  #include "chrome/browser/extensions/extension_service.h"
  #include "chrome/browser/extensions/theme_installed_infobar_delegate.h"
-@@ -68,6 +69,10 @@
- #include "ui/color/color_provider.h"
+@@ -70,6 +71,10 @@
+ #include "ui/color/color_provider_manager.h"
  #include "ui/native_theme/native_theme.h"
  
 +#if BUILDFLAG(ENABLE_CEF)
@@ -21,7 +21,7 @@ index 67dc4a2e0695e..16f819e133886 100644
  #if BUILDFLAG(ENABLE_EXTENSIONS)
  #include "base/scoped_observation.h"
  #include "extensions/browser/extension_registry_observer.h"
-@@ -270,11 +275,19 @@ void ThemeService::Init() {
+@@ -272,11 +277,19 @@ void ThemeService::Init() {
    // OnExtensionServiceReady. Otherwise, the ThemeObserver won't be
    // constructed in time to observe the corresponding events.
  #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -42,18 +42,18 @@ index 67dc4a2e0695e..16f819e133886 100644
    theme_syncable_service_ =
        std::make_unique<ThemeSyncableService>(profile_, this);
 diff --git chrome/browser/themes/theme_service_factory.cc chrome/browser/themes/theme_service_factory.cc
-index c8382bbee253b..a48c7b52252db 100644
+index ebf3978910959..af00465d254a1 100644
 --- chrome/browser/themes/theme_service_factory.cc
 +++ chrome/browser/themes/theme_service_factory.cc
-@@ -7,6 +7,7 @@
- #include "base/no_destructor.h"
+@@ -9,6 +9,7 @@
+ #include "base/trace_event/trace_event.h"
  #include "build/build_config.h"
  #include "build/chromeos_buildflags.h"
 +#include "cef/libcef/features/runtime.h"
  #include "chrome/browser/extensions/extension_system_factory.h"
  #include "chrome/browser/profiles/profile.h"
  #include "chrome/browser/themes/theme_service.h"
-@@ -31,6 +32,10 @@
+@@ -34,6 +35,10 @@
  #include "ui/linux/linux_ui_factory.h"
  #endif
  
@@ -64,7 +64,7 @@ index c8382bbee253b..a48c7b52252db 100644
  namespace {
  
  const ThemeHelper& GetThemeHelper() {
-@@ -79,7 +84,15 @@ ThemeServiceFactory::ThemeServiceFactory()
+@@ -95,7 +100,15 @@ ThemeServiceFactory::ThemeServiceFactory()
                .Build()) {
    DependsOn(extensions::ExtensionRegistryFactory::GetInstance());
    DependsOn(extensions::ExtensionPrefsFactory::GetInstance());

patch/patches/chrome_plugins.patch

@@ -14,10 +14,10 @@ index 95cd290b601a3..89e8ab892e5ea 100644
        extensions::WebViewRendererState::GetInstance();
    std::string partition_id;
 diff --git chrome/browser/plugins/plugin_utils.cc chrome/browser/plugins/plugin_utils.cc
-index 8b3f569882aeb..afc8007a6228b 100644
+index 438276b719c2f..69635e429be78 100644
 --- chrome/browser/plugins/plugin_utils.cc
 +++ chrome/browser/plugins/plugin_utils.cc
-@@ -70,6 +70,13 @@ PluginUtils::GetMimeTypeToExtensionIdMap(
+@@ -68,6 +68,13 @@ PluginUtils::GetMimeTypeToExtensionIdMap(
      content::BrowserContext* browser_context) {
    base::flat_map<std::string, std::string> mime_type_to_extension_id_map;
  #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -31,7 +31,7 @@ index 8b3f569882aeb..afc8007a6228b 100644
    Profile* profile = Profile::FromBrowserContext(browser_context);
    if (extensions::ChromeContentBrowserClientExtensionsPart::
            AreExtensionsDisabledForProfile(profile)) {
-@@ -80,9 +87,6 @@ PluginUtils::GetMimeTypeToExtensionIdMap(
+@@ -78,9 +85,6 @@ PluginUtils::GetMimeTypeToExtensionIdMap(
        MimeTypesHandler::GetMIMETypeAllowlist();
    // Go through the allowed extensions and try to use them to intercept
    // the URL request.
@@ -42,7 +42,7 @@ index 8b3f569882aeb..afc8007a6228b 100644
      const extensions::Extension* extension =
          registry->enabled_extensions().GetByID(extension_id);
 diff --git chrome/renderer/chrome_content_renderer_client.cc chrome/renderer/chrome_content_renderer_client.cc
-index ada53df4386e9..c3d4ccb8394f0 100644
+index 43fc365662842..8aa6804c98fe1 100644
 --- chrome/renderer/chrome_content_renderer_client.cc
 +++ chrome/renderer/chrome_content_renderer_client.cc
 @@ -984,6 +984,7 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
@@ -53,7 +53,7 @@ index ada53df4386e9..c3d4ccb8394f0 100644
          content_settings_agent_delegate->IsPluginTemporarilyAllowed(
              identifier)) {
        status = chrome::mojom::PluginStatus::kAllowed;
-@@ -1151,7 +1152,8 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
+@@ -1141,7 +1142,8 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
          render_frame->GetRemoteAssociatedInterfaces()->GetInterface(
              plugin_auth_host.BindNewEndpointAndPassReceiver());
          plugin_auth_host->BlockedUnauthorizedPlugin(group_name, identifier);
@@ -63,7 +63,7 @@ index ada53df4386e9..c3d4ccb8394f0 100644
          break;
        }
        case chrome::mojom::PluginStatus::kBlocked: {
-@@ -1160,7 +1162,8 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
+@@ -1150,7 +1152,8 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
              l10n_util::GetStringFUTF16(IDS_PLUGIN_BLOCKED, group_name));
          placeholder->AllowLoading();
          RenderThread::Get()->RecordAction(UserMetricsAction("Plugin_Blocked"));
@@ -73,7 +73,7 @@ index ada53df4386e9..c3d4ccb8394f0 100644
          break;
        }
        case chrome::mojom::PluginStatus::kBlockedByPolicy: {
-@@ -1170,7 +1173,8 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
+@@ -1160,7 +1163,8 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
                                         group_name));
          RenderThread::Get()->RecordAction(
              UserMetricsAction("Plugin_BlockedByPolicy"));

patch/patches/chrome_renderer.patch

@@ -1,5 +1,5 @@
 diff --git chrome/renderer/BUILD.gn chrome/renderer/BUILD.gn
-index 8bb0cecdce072..308d4cd72b58e 100644
+index 76f0adaaa659d..ec6b3ac2bcd55 100644
 --- chrome/renderer/BUILD.gn
 +++ chrome/renderer/BUILD.gn
 @@ -5,6 +5,7 @@
@@ -18,7 +18,7 @@ index 8bb0cecdce072..308d4cd72b58e 100644
      "//chrome:resources",
      "//chrome:strings",
      "//chrome/common",
-@@ -234,6 +236,10 @@ static_library("renderer") {
+@@ -237,6 +239,10 @@ static_library("renderer") {
  
    configs += [ "//build/config/compiler:wexit_time_destructors" ]
  

patch/patches/chrome_runtime.patch

@@ -1,5 +1,5 @@
 diff --git chrome/app/chrome_main_delegate.cc chrome/app/chrome_main_delegate.cc
-index 0141f1f97e0b4..d7e1c98b68c4f 100644
+index d55fc46d9dc0a..0f4dd2b3e68f9 100644
 --- chrome/app/chrome_main_delegate.cc
 +++ chrome/app/chrome_main_delegate.cc
 @@ -40,6 +40,7 @@
@@ -10,7 +10,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  #include "chrome/browser/buildflags.h"
  #include "chrome/browser/chrome_content_browser_client.h"
  #include "chrome/browser/chrome_resource_bundle_helper.h"
-@@ -503,6 +504,8 @@ struct MainFunction {
+@@ -505,6 +506,8 @@ struct MainFunction {
  
  // Initializes the user data dir. Must be called before InitializeLocalState().
  void InitializeUserDataDir(base::CommandLine* command_line) {
@@ -19,7 +19,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  #if BUILDFLAG(IS_WIN)
    // Reach out to chrome_elf for the truth on the user data directory.
    // Note that in tests, this links to chrome_elf_test_stubs.
-@@ -652,6 +655,10 @@ ChromeMainDelegate::~ChromeMainDelegate() {
+@@ -654,6 +657,10 @@ ChromeMainDelegate::~ChromeMainDelegate() {
  ChromeMainDelegate::~ChromeMainDelegate() = default;
  #endif  // !BUILDFLAG(IS_ANDROID)
  
@@ -30,7 +30,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  absl::optional<int> ChromeMainDelegate::PostEarlyInitialization(
      InvokedIn invoked_in) {
    DCHECK(base::ThreadPoolInstance::Get());
-@@ -868,7 +875,8 @@ absl::optional<int> ChromeMainDelegate::PostEarlyInitialization(
+@@ -877,7 +884,8 @@ absl::optional<int> ChromeMainDelegate::PostEarlyInitialization(
  
    if (base::FeatureList::IsEnabled(
            features::kWriteBasicSystemProfileToPersistentHistogramsFile)) {
@@ -40,7 +40,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  #if BUILDFLAG(IS_ANDROID)
      record =
          base::FeatureList::IsEnabled(chrome::android::kUmaBackgroundSessions);
-@@ -1296,6 +1304,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
+@@ -1306,6 +1314,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
    std::string process_type =
        command_line.GetSwitchValueASCII(switches::kProcessType);
  
@@ -48,7 +48,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
    crash_reporter::InitializeCrashKeys();
  
  #if BUILDFLAG(IS_POSIX)
-@@ -1306,6 +1315,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
+@@ -1316,6 +1325,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
    InitMacCrashReporter(command_line, process_type);
    SetUpInstallerPreferences(command_line);
  #endif
@@ -56,7 +56,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  
  #if BUILDFLAG(IS_WIN)
    child_process_logging::Init();
-@@ -1500,6 +1510,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
+@@ -1510,6 +1520,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
      CHECK(!loaded_locale.empty()) << "Locale could not be found for " << locale;
    }
  
@@ -64,7 +64,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  #if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC)
    // Zygote needs to call InitCrashReporter() in RunZygote().
    if (process_type != switches::kZygoteProcess) {
-@@ -1543,6 +1554,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
+@@ -1553,6 +1564,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
    // After all the platform Breakpads have been initialized, store the command
    // line for crash reporting.
    crash_keys::SetCrashKeysFromCommandLine(command_line);
@@ -72,7 +72,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  
  #if BUILDFLAG(ENABLE_PDF)
    MaybePatchGdiGetFontData();
-@@ -1666,6 +1678,7 @@ void ChromeMainDelegate::ZygoteForked() {
+@@ -1672,6 +1684,7 @@ void ChromeMainDelegate::ZygoteForked() {
      SetUpProfilingShutdownHandler();
    }
  
@@ -80,7 +80,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
    // Needs to be called after we have chrome::DIR_USER_DATA.  BrowserMain sets
    // this up for the browser process in a different manner.
    const base::CommandLine* command_line =
-@@ -1688,6 +1701,7 @@ void ChromeMainDelegate::ZygoteForked() {
+@@ -1694,6 +1707,7 @@ void ChromeMainDelegate::ZygoteForked() {
  
    // Reset the command line for the newly spawned process.
    crash_keys::SetCrashKeysFromCommandLine(*command_line);
@@ -88,7 +88,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
  }
  
  #endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
-@@ -1785,6 +1799,7 @@ void ChromeMainDelegate::InitializeMemorySystem() {
+@@ -1791,6 +1805,7 @@ void ChromeMainDelegate::InitializeMemorySystem() {
                                channel == version_info::Channel::DEV);
    const bool gwp_asan_boost_sampling = is_canary_dev || is_browser_process;
  
@@ -96,7 +96,7 @@ index 0141f1f97e0b4..d7e1c98b68c4f 100644
    memory_system::Initializer()
        .SetGwpAsanParameters(gwp_asan_boost_sampling, process_type)
        .SetProfilingClientParameters(channel,
-@@ -1793,5 +1808,5 @@ void ChromeMainDelegate::InitializeMemorySystem() {
+@@ -1799,5 +1814,5 @@ void ChromeMainDelegate::InitializeMemorySystem() {
                                     PoissonAllocationSamplerInclusion::kEnforce,
                                 memory_system::DispatcherParameters::
                                     AllocationTraceRecorderInclusion::kDynamic)
@@ -126,7 +126,7 @@ index dad9f981d2e01..29baaf84465a0 100644
  #if BUILDFLAG(IS_CHROMEOS_LACROS)
    std::unique_ptr<chromeos::LacrosService> lacros_service_;
 diff --git chrome/browser/chrome_browser_main.cc chrome/browser/chrome_browser_main.cc
-index 91fe738fb59f1..10e7748c43a8f 100644
+index c54e44c41861a..cee906951e418 100644
 --- chrome/browser/chrome_browser_main.cc
 +++ chrome/browser/chrome_browser_main.cc
 @@ -51,6 +51,7 @@
@@ -137,7 +137,7 @@ index 91fe738fb59f1..10e7748c43a8f 100644
  #include "chrome/browser/about_flags.h"
  #include "chrome/browser/active_use_util.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -1518,7 +1519,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1554,7 +1555,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
    }
  #endif  // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH)
  
@@ -146,7 +146,7 @@ index 91fe738fb59f1..10e7748c43a8f 100644
    // Handle special early return paths (which couldn't be processed even earlier
    // as they require the process singleton to be held) first.
  
-@@ -1565,7 +1566,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1601,7 +1602,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
      return content::RESULT_CODE_NORMAL_EXIT;
  #endif  // BUILDFLAG(IS_WIN)
    }
@@ -155,7 +155,7 @@ index 91fe738fb59f1..10e7748c43a8f 100644
  
  #if BUILDFLAG(IS_WIN)
    // Check if there is any machine level Chrome installed on the current
-@@ -1620,12 +1621,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1656,12 +1657,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
          browser_process_->local_state());
    }
  
@@ -170,7 +170,7 @@ index 91fe738fb59f1..10e7748c43a8f 100644
  
  #if BUILDFLAG(IS_ANDROID)
    page_info::SetPageInfoClient(new ChromePageInfoClient());
-@@ -1771,6 +1774,10 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1807,6 +1810,10 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
    }
  #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
  
@@ -181,7 +181,7 @@ index 91fe738fb59f1..10e7748c43a8f 100644
    // This step is costly and is already measured in
    // Startup.StartupBrowserCreator_Start.
    // See the comment above for an explanation of |process_command_line|.
-@@ -1809,11 +1816,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1845,11 +1852,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
  
      // Create the RunLoop for MainMessageLoopRun() to use and transfer
      // ownership of the browser's lifetime to the BrowserProcess.
@@ -197,7 +197,7 @@ index 91fe738fb59f1..10e7748c43a8f 100644
  #endif  // !BUILDFLAG(IS_ANDROID)
  
 diff --git chrome/browser/chrome_browser_main_mac.mm chrome/browser/chrome_browser_main_mac.mm
-index 789d147f0b305..64a33cce013c5 100644
+index ad3976cb46454..b49f7467156ed 100644
 --- chrome/browser/chrome_browser_main_mac.mm
 +++ chrome/browser/chrome_browser_main_mac.mm
 @@ -17,6 +17,7 @@
@@ -208,15 +208,15 @@ index 789d147f0b305..64a33cce013c5 100644
  #import "chrome/browser/app_controller_mac.h"
  #include "chrome/browser/apps/app_shim/app_shim_listener.h"
  #include "chrome/browser/browser_process.h"
-@@ -114,6 +115,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+@@ -118,6 +119,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
    }
  #endif  // !BUILDFLAG(CHROME_FOR_TESTING)
  
 +#if !BUILDFLAG(ENABLE_CEF)
-   // Create the app delegate. This object is intentionally leaked as a global
-   // singleton. It is accessed through -[NSApp delegate].
-   AppController* app_controller = [[AppController alloc] init];
-@@ -122,6 +124,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+   // Create the app delegate by requesting the shared AppController.
+   CHECK_EQ(nil, NSApp.delegate);
+   AppController* app_controller = AppController.sharedController;
+@@ -126,6 +128,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
    chrome::BuildMainMenu(NSApp, app_controller,
                          l10n_util::GetStringUTF16(IDS_PRODUCT_NAME), false);
    [app_controller mainMenuCreated];
@@ -224,18 +224,16 @@ index 789d147f0b305..64a33cce013c5 100644
  
    ui::WarmScreenCapture();
  
-@@ -180,7 +183,9 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
+@@ -184,5 +187,7 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
  }
  
  void ChromeBrowserMainPartsMac::DidEndMainMessageLoop() {
 +#if !BUILDFLAG(ENABLE_CEF)
-   AppController* appController =
-       base::mac::ObjCCastStrict<AppController>([NSApp delegate]);
-   [appController didEndMainMessageLoop];
+   [AppController.sharedController didEndMainMessageLoop];
 +#endif
  }
 diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
-index 1b9db89f8dce3..980999042366a 100644
+index c9d9ffa8d77a3..43e1701c73f2b 100644
 --- chrome/browser/chrome_content_browser_client.cc
 +++ chrome/browser/chrome_content_browser_client.cc
 @@ -41,6 +41,7 @@
@@ -246,7 +244,7 @@ index 1b9db89f8dce3..980999042366a 100644
  #include "chrome/browser/accessibility/accessibility_labels_service.h"
  #include "chrome/browser/accessibility/accessibility_labels_service_factory.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -1538,6 +1539,8 @@ ChromeContentBrowserClient::GetPopupNavigationDelegateFactoryForTesting() {
+@@ -1535,6 +1536,8 @@ ChromeContentBrowserClient::GetPopupNavigationDelegateFactoryForTesting() {
  }
  
  ChromeContentBrowserClient::ChromeContentBrowserClient() {
@@ -255,7 +253,7 @@ index 1b9db89f8dce3..980999042366a 100644
  #if BUILDFLAG(ENABLE_PLUGINS)
    extra_parts_.push_back(
        std::make_unique<ChromeContentBrowserClientPluginsPart>());
-@@ -1570,6 +1573,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
+@@ -1567,6 +1570,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
    }
  }
  
@@ -267,7 +265,7 @@ index 1b9db89f8dce3..980999042366a 100644
  // static
  void ChromeContentBrowserClient::RegisterLocalStatePrefs(
      PrefRegistrySimple* registry) {
-@@ -4306,9 +4314,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
+@@ -4343,9 +4351,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
                            &search::HandleNewTabURLReverseRewrite);
  #endif  // BUILDFLAG(IS_ANDROID)
  
@@ -279,7 +277,7 @@ index 1b9db89f8dce3..980999042366a 100644
  }
  
  base::FilePath ChromeContentBrowserClient::GetDefaultDownloadDirectory() {
-@@ -6229,7 +6239,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
+@@ -6362,7 +6372,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
  #endif
  }
  
@@ -288,7 +286,7 @@ index 1b9db89f8dce3..980999042366a 100644
      content::BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -6247,6 +6257,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
+@@ -6380,6 +6390,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
      network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
      network_context_params->accept_language = GetApplicationLocale();
    }
@@ -297,7 +295,7 @@ index 1b9db89f8dce3..980999042366a 100644
  }
  
  std::vector<base::FilePath>
-@@ -7260,10 +7272,10 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
+@@ -7404,10 +7416,10 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
    const auto now = base::TimeTicks::Now();
    const auto timeout = GetKeepaliveTimerTimeout(context);
    keepalive_deadline_ = std::max(keepalive_deadline_, now + timeout);
@@ -310,7 +308,7 @@ index 1b9db89f8dce3..980999042366a 100644
          FROM_HERE, keepalive_deadline_ - now,
          base::BindOnce(
              &ChromeContentBrowserClient::OnKeepaliveTimerFired,
-@@ -7282,7 +7294,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
+@@ -7426,7 +7438,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
    --num_keepalive_requests_;
    if (num_keepalive_requests_ == 0) {
      DVLOG(1) << "Stopping the keepalive timer";
@@ -320,7 +318,7 @@ index 1b9db89f8dce3..980999042366a 100644
      // This deletes the keep alive handle attached to the timer function and
      // unblock the shutdown sequence.
    }
-@@ -7418,7 +7431,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
+@@ -7562,7 +7575,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
    const auto now = base::TimeTicks::Now();
    const auto then = keepalive_deadline_;
    if (now < then) {
@@ -330,10 +328,10 @@ index 1b9db89f8dce3..980999042366a 100644
          base::BindOnce(&ChromeContentBrowserClient::OnKeepaliveTimerFired,
                         weak_factory_.GetWeakPtr(),
 diff --git chrome/browser/chrome_content_browser_client.h chrome/browser/chrome_content_browser_client.h
-index 902dcaf5df1ca..d8e698886df54 100644
+index e162b2d33f7bd..864ffbffb9f0a 100644
 --- chrome/browser/chrome_content_browser_client.h
 +++ chrome/browser/chrome_content_browser_client.h
-@@ -135,6 +135,8 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+@@ -136,6 +136,8 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
  
    ~ChromeContentBrowserClient() override;
  
@@ -342,7 +340,7 @@ index 902dcaf5df1ca..d8e698886df54 100644
    // TODO(https://crbug.com/787567): This file is about calls from content/ out
    // to chrome/ to get values or notify about events, but both of these
    // functions are from chrome/ to chrome/ and don't involve content/ at all.
-@@ -617,7 +619,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+@@ -634,7 +636,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
        override;
    void OnNetworkServiceCreated(
        network::mojom::NetworkService* network_service) override;
@@ -351,7 +349,7 @@ index 902dcaf5df1ca..d8e698886df54 100644
        content::BrowserContext* context,
        bool in_memory,
        const base::FilePath& relative_partition_path,
-@@ -1010,7 +1012,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+@@ -1053,7 +1055,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
  
  #if !BUILDFLAG(IS_ANDROID)
    uint64_t num_keepalive_requests_ = 0;
@@ -361,7 +359,7 @@ index 902dcaf5df1ca..d8e698886df54 100644
  #endif
  
 diff --git chrome/browser/prefs/browser_prefs.cc chrome/browser/prefs/browser_prefs.cc
-index ffc921ad54a3e..590abcaf1b49d 100644
+index af2d036f0b354..a7f185904e1be 100644
 --- chrome/browser/prefs/browser_prefs.cc
 +++ chrome/browser/prefs/browser_prefs.cc
 @@ -13,6 +13,7 @@
@@ -372,7 +370,7 @@ index ffc921ad54a3e..590abcaf1b49d 100644
  #include "chrome/browser/about_flags.h"
  #include "chrome/browser/accessibility/accessibility_labels_service.h"
  #include "chrome/browser/accessibility/accessibility_ui.h"
-@@ -177,6 +178,10 @@
+@@ -179,6 +180,10 @@
  #include "chrome/browser/background/background_mode_manager.h"
  #endif
  
@@ -383,7 +381,7 @@ index ffc921ad54a3e..590abcaf1b49d 100644
  #if BUILDFLAG(ENABLE_EXTENSIONS)
  #include "chrome/browser/accessibility/animation_policy_prefs.h"
  #include "chrome/browser/apps/platform_apps/shortcut_manager.h"
-@@ -1439,6 +1444,11 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
+@@ -1538,6 +1543,11 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
  
    // This is intentionally last.
    RegisterLocalStatePrefsForMigration(registry);
@@ -395,7 +393,7 @@ index ffc921ad54a3e..590abcaf1b49d 100644
  }
  
  // Register prefs applicable to all profiles.
-@@ -1839,6 +1849,10 @@ void RegisterUserProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
+@@ -1939,6 +1949,10 @@ void RegisterUserProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
                                const std::string& locale) {
    RegisterProfilePrefs(registry, locale);
  

patch/patches/chrome_runtime_views.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/ui/browser_command_controller.cc chrome/browser/ui/browser_command_controller.cc
-index c1f28ebc372df..275657f54c517 100644
+index 405c0ac7c41ef..99abcefc0c061 100644
 --- chrome/browser/ui/browser_command_controller.cc
 +++ chrome/browser/ui/browser_command_controller.cc
-@@ -395,6 +395,7 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
+@@ -400,6 +400,7 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
    // choose to not implement CommandUpdaterDelegate inside this class and
    // therefore command_updater_ doesn't have the delegate set).
    if (!SupportsCommand(id) || !IsCommandEnabled(id)) {
@@ -10,7 +10,7 @@ index c1f28ebc372df..275657f54c517 100644
      return false;
    }
  
-@@ -411,6 +412,13 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
+@@ -416,6 +417,13 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
    DCHECK(command_updater_.IsCommandEnabled(id))
        << "Invalid/disabled command " << id;
  
@@ -24,7 +24,7 @@ index c1f28ebc372df..275657f54c517 100644
    // The order of commands in this switch statement must match the function
    // declaration order in browser.h!
    switch (id) {
-@@ -1102,11 +1110,13 @@ void BrowserCommandController::TabRestoreServiceLoaded(
+@@ -1147,11 +1155,13 @@ void BrowserCommandController::TabRestoreServiceLoaded(
  // BrowserCommandController, private:
  
  bool BrowserCommandController::IsShowingMainUI() {
@@ -41,10 +41,10 @@ index c1f28ebc372df..275657f54c517 100644
  
  bool BrowserCommandController::IsWebAppOrCustomTab() const {
 diff --git chrome/browser/ui/toolbar/app_menu_model.cc chrome/browser/ui/toolbar/app_menu_model.cc
-index f6c50fc75faf8..30b0f9fa68554 100644
+index ca8fd414586c1..820df2f729fba 100644
 --- chrome/browser/ui/toolbar/app_menu_model.cc
 +++ chrome/browser/ui/toolbar/app_menu_model.cc
-@@ -192,6 +192,57 @@ void SetCommandIcon(ui::SimpleMenuModel* model,
+@@ -585,6 +585,57 @@ SaveAndShareSubMenuModel::SaveAndShareSubMenuModel(
    }
  }
  
@@ -102,7 +102,7 @@ index f6c50fc75faf8..30b0f9fa68554 100644
  }  // namespace
  
  ////////////////////////////////////////////////////////////////////////////////
-@@ -960,7 +1011,7 @@ bool AppMenuModel::IsCommandIdChecked(int command_id) const {
+@@ -1303,7 +1354,7 @@ bool AppMenuModel::IsCommandIdChecked(int command_id) const {
    return false;
  }
  
@@ -111,16 +111,7 @@ index f6c50fc75faf8..30b0f9fa68554 100644
    GlobalError* error =
        GlobalErrorServiceFactory::GetForProfile(browser_->profile())
            ->GetGlobalErrorByMenuItemCommandID(command_id);
-@@ -975,7 +1026,7 @@ bool AppMenuModel::IsCommandIdEnabled(int command_id) const {
-   }
- }
- 
--bool AppMenuModel::IsCommandIdVisible(int command_id) const {
-+bool AppMenuModel::IsCommandIdVisibleInternal(int command_id) const {
-   switch (command_id) {
-     case IDC_PIN_TO_START_SCREEN:
-       return false;
-@@ -998,6 +1049,34 @@ bool AppMenuModel::IsCommandIdVisible(int command_id) const {
+@@ -1318,6 +1369,30 @@ bool AppMenuModel::IsCommandIdEnabled(int command_id) const {
    }
  }
  
@@ -139,10 +130,6 @@ index f6c50fc75faf8..30b0f9fa68554 100644
 +}
 +
 +bool AppMenuModel::IsCommandIdVisible(int command_id) const {
-+  if (!IsCommandIdVisibleInternal(command_id)) {
-+    return false;
-+  }
-+
 +#if BUILDFLAG(ENABLE_CEF)
 +  if (browser_->cef_delegate()) {
 +    return browser_->cef_delegate()->IsAppMenuItemVisible(command_id);
@@ -155,7 +142,7 @@ index f6c50fc75faf8..30b0f9fa68554 100644
  bool AppMenuModel::IsCommandIdAlerted(int command_id) const {
    if ((command_id == IDC_RECENT_TABS_MENU) ||
        (command_id == AppMenuModel::kMinRecentTabsCommandId)) {
-@@ -1148,11 +1227,15 @@ void AppMenuModel::Build() {
+@@ -1472,11 +1547,15 @@ void AppMenuModel::Build() {
      }
    }
  
@@ -176,7 +163,7 @@ index f6c50fc75faf8..30b0f9fa68554 100644
  
    AddItemWithStringId(IDC_PRINT, IDS_PRINT);
  
-@@ -1243,9 +1326,13 @@ void AppMenuModel::Build() {
+@@ -1549,9 +1628,13 @@ void AppMenuModel::Build() {
                           kMoreToolsMenuItem);
  
    if (!features::IsChromeRefresh2023()) {
@@ -193,7 +180,7 @@ index f6c50fc75faf8..30b0f9fa68554 100644
    }
  
    if (!features::IsChromeRefresh2023()) {
-@@ -1327,6 +1414,11 @@ void AppMenuModel::Build() {
+@@ -1633,6 +1716,11 @@ void AppMenuModel::Build() {
      SetCommandIcon(this, IDC_EXIT, kExitMenuIcon);
    }
  
@@ -206,15 +193,22 @@ index f6c50fc75faf8..30b0f9fa68554 100644
  }
  
 diff --git chrome/browser/ui/toolbar/app_menu_model.h chrome/browser/ui/toolbar/app_menu_model.h
-index 8648fccbe4a2e..386dee69b5eff 100644
+index 96c64caf86ef7..27d346fdbf5a5 100644
 --- chrome/browser/ui/toolbar/app_menu_model.h
 +++ chrome/browser/ui/toolbar/app_menu_model.h
-@@ -258,6 +258,9 @@ class AppMenuModel : public ui::SimpleMenuModel,
+@@ -194,6 +194,7 @@ class AppMenuModel : public ui::SimpleMenuModel,
+   void ExecuteCommand(int command_id, int event_flags) override;
+   bool IsCommandIdChecked(int command_id) const override;
+   bool IsCommandIdEnabled(int command_id) const override;
++  bool IsCommandIdVisible(int command_id) const override;
+   bool IsCommandIdAlerted(int command_id) const override;
+   bool GetAcceleratorForCommandId(int command_id,
+                                   ui::Accelerator* accelerator) const override;
+@@ -218,6 +219,8 @@ class AppMenuModel : public ui::SimpleMenuModel,
    // Appends a zoom menu (without separators).
    void CreateZoomMenu();
  
 +  bool IsCommandIdEnabledInternal(int command_id) const;
-+  bool IsCommandIdVisibleInternal(int command_id) const;
 +
   private:
    // Adds actionable global error menu items to the menu.
@@ -237,7 +231,7 @@ index 59024587ef6b7..0c30aa71768cf 100644
  
  void FindBarHost::RegisterAccelerators() {
 diff --git chrome/browser/ui/views/frame/browser_frame.cc chrome/browser/ui/views/frame/browser_frame.cc
-index 24b85357b90b8..67e1bacb8d518 100644
+index d9f30b0876f4a..c4675bf8b95b7 100644
 --- chrome/browser/ui/views/frame/browser_frame.cc
 +++ chrome/browser/ui/views/frame/browser_frame.cc
 @@ -75,15 +75,23 @@ bool IsUsingLinuxSystemTheme(Profile* profile) {
@@ -334,20 +328,10 @@ index 24b85357b90b8..67e1bacb8d518 100644
    auto key = Widget::GetColorProviderKey();
 +  if (!browser_view_)
 +    return key;
-   key.frame_type = UseCustomFrame()
-                        ? ui::ColorProviderManager::FrameType::kChromium
-                        : ui::ColorProviderManager::FrameType::kNative;
-@@ -420,6 +450,9 @@ ui::ColorProviderManager::Key BrowserFrame::GetColorProviderKey() const {
- }
  
- absl::optional<SkColor> BrowserFrame::GetUserColor() const {
-+  if (!browser_view_) {
-+    return absl::nullopt;
-+  }
- #if BUILDFLAG(IS_CHROMEOS_ASH)
-   // ChromeOS SystemWebApps use the OS theme all the time.
-   if (ash::IsSystemWebApp(browser_view_->browser())) {
-@@ -533,5 +566,8 @@ bool BrowserFrame::RegenerateFrameOnThemeChange(
+   // color_mode.
+   [this, &key]() {
+@@ -558,5 +588,8 @@ bool BrowserFrame::RegenerateFrameOnThemeChange(
  }
  
  bool BrowserFrame::IsIncognitoBrowser() const {
@@ -357,7 +341,7 @@ index 24b85357b90b8..67e1bacb8d518 100644
    return browser_view_->browser()->profile()->IsIncognitoProfile();
  }
 diff --git chrome/browser/ui/views/frame/browser_frame.h chrome/browser/ui/views/frame/browser_frame.h
-index 795f057fedc51..54b08509919af 100644
+index 965bd2525b212..6a637609b65e9 100644
 --- chrome/browser/ui/views/frame/browser_frame.h
 +++ chrome/browser/ui/views/frame/browser_frame.h
 @@ -61,7 +61,9 @@ enum class TabDragKind {
@@ -371,10 +355,10 @@ index 795f057fedc51..54b08509919af 100644
    BrowserFrame(const BrowserFrame&) = delete;
    BrowserFrame& operator=(const BrowserFrame&) = delete;
 diff --git chrome/browser/ui/views/frame/browser_view.cc chrome/browser/ui/views/frame/browser_view.cc
-index 39a1660cae03a..f7d7965989cf7 100644
+index 37850210f4b6e..7edd178950679 100644
 --- chrome/browser/ui/views/frame/browser_view.cc
 +++ chrome/browser/ui/views/frame/browser_view.cc
-@@ -314,11 +314,10 @@ using content::NativeWebKeyboardEvent;
+@@ -327,11 +327,10 @@ using content::NativeWebKeyboardEvent;
  using content::WebContents;
  using web_modal::WebContentsModalDialogHost;
  
@@ -389,7 +373,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
  
  #if BUILDFLAG(IS_CHROMEOS_ASH)
  // UMA histograms that record animation smoothness for tab loading animation.
-@@ -789,11 +788,22 @@ class BrowserView::AccessibilityModeObserver : public ui::AXModeObserver {
+@@ -800,11 +799,22 @@ class BrowserView::AccessibilityModeObserver : public ui::AXModeObserver {
  ///////////////////////////////////////////////////////////////////////////////
  // BrowserView, public:
  
@@ -413,7 +397,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
    SetShowIcon(
        ::ShouldShowWindowIcon(browser_.get(), AppUsesWindowControlsOverlay()));
  
-@@ -837,7 +847,6 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+@@ -848,7 +858,6 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
    }
  
    browser_->tab_strip_model()->AddObserver(this);
@@ -421,7 +405,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
  
    // Top container holds tab strip region and toolbar and lives at the front of
    // the view hierarchy.
-@@ -893,8 +902,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+@@ -904,8 +913,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
    contents_container->SetLayoutManager(std::make_unique<ContentsLayoutManager>(
        devtools_web_view_, contents_web_view_));
  
@@ -439,7 +423,24 @@ index 39a1660cae03a..f7d7965989cf7 100644
  
    contents_separator_ =
        top_container_->AddChildView(std::make_unique<ContentsSeparator>());
-@@ -1817,6 +1833,8 @@ bool BrowserView::ShouldHideUIForFullscreen() const {
+@@ -1093,12 +1109,14 @@ gfx::Size BrowserView::GetWebAppFrameToolbarPreferredSize() const {
+ 
+ #if BUILDFLAG(IS_MAC)
+ bool BrowserView::UsesImmersiveFullscreenMode() const {
++  if (!base::FeatureList::IsEnabled(features::kImmersiveFullscreen)) {
++    return false;
++  }
+   const bool is_pwa =
+       base::FeatureList::IsEnabled(features::kImmersiveFullscreenPWAs) &&
+       GetIsWebAppType();
+   const bool is_tabbed_window = GetSupportsTabStrip();
+-  return base::FeatureList::IsEnabled(features::kImmersiveFullscreen) &&
+-         (is_pwa || is_tabbed_window);
++  return is_pwa || is_tabbed_window;
+ }
+ 
+ bool BrowserView::UsesImmersiveFullscreenTabbedMode() const {
+@@ -1823,6 +1841,8 @@ bool BrowserView::ShouldHideUIForFullscreen() const {
    if (immersive_mode_controller_->IsEnabled())
      return false;
  
@@ -448,7 +449,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
    return frame_->GetFrameView()->ShouldHideTopUIForFullscreen();
  }
  
-@@ -2722,7 +2740,8 @@ DownloadShelf* BrowserView::GetDownloadShelf() {
+@@ -2821,7 +2841,8 @@ DownloadShelf* BrowserView::GetDownloadShelf() {
  }
  
  DownloadBubbleUIController* BrowserView::GetDownloadBubbleUIController() {
@@ -458,7 +459,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
    if (auto* download_button = toolbar_button_provider_->GetDownloadButton())
      return download_button->bubble_controller();
    return nullptr;
-@@ -3222,7 +3241,8 @@ void BrowserView::ReparentTopContainerForEndOfImmersive() {
+@@ -3357,7 +3378,8 @@ void BrowserView::ReparentTopContainerForEndOfImmersive() {
    if (top_container()->parent() == this)
      return;
  
@@ -468,7 +469,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
    top_container()->DestroyLayer();
    AddChildViewAt(top_container(), 0);
    EnsureFocusOrder();
-@@ -3776,8 +3796,10 @@ void BrowserView::Layout() {
+@@ -3914,8 +3936,10 @@ void BrowserView::Layout() {
  
    // TODO(jamescook): Why was this in the middle of layout code?
    toolbar_->location_bar()->omnibox_view()->SetFocusBehavior(
@@ -481,7 +482,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
  
    // Some of the situations when the BrowserView is laid out are:
    // - Enter/exit immersive fullscreen mode.
-@@ -3843,6 +3865,11 @@ void BrowserView::AddedToWidget() {
+@@ -3981,6 +4005,11 @@ void BrowserView::AddedToWidget() {
    SetThemeProfileForWindow(GetNativeWindow(), browser_->profile());
  #endif
  
@@ -493,7 +494,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
    toolbar_->Init();
  
    // TODO(pbos): Investigate whether the side panels should be creatable when
-@@ -3889,13 +3916,9 @@ void BrowserView::AddedToWidget() {
+@@ -4028,13 +4057,9 @@ void BrowserView::AddedToWidget() {
  
    EnsureFocusOrder();
  
@@ -509,7 +510,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
    using_native_frame_ = frame_->ShouldUseNativeFrame();
  
    MaybeInitializeWebUITabStrip();
-@@ -4300,7 +4323,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
+@@ -4439,7 +4464,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
    // Undo our anti-jankiness hacks and force a re-layout.
    in_process_fullscreen_ = false;
    ToolbarSizeChanged(false);
@@ -519,7 +520,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
  }
  
  bool BrowserView::ShouldUseImmersiveFullscreenForUrl(const GURL& url) const {
-@@ -4671,6 +4695,8 @@ Profile* BrowserView::GetProfile() {
+@@ -4810,6 +4836,8 @@ Profile* BrowserView::GetProfile() {
  }
  
  void BrowserView::UpdateUIForTabFullscreen() {
@@ -528,7 +529,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
    frame()->GetFrameView()->UpdateFullscreenTopUI();
  }
  
-@@ -4693,6 +4719,8 @@ void BrowserView::HideDownloadShelf() {
+@@ -4832,6 +4860,8 @@ void BrowserView::HideDownloadShelf() {
  }
  
  bool BrowserView::CanUserExitFullscreen() const {
@@ -538,7 +539,7 @@ index 39a1660cae03a..f7d7965989cf7 100644
  }
  
 diff --git chrome/browser/ui/views/frame/browser_view.h chrome/browser/ui/views/frame/browser_view.h
-index 3e812382f77e6..d821b03bfa510 100644
+index 7145cc6ad5d17..244541e471d2a 100644
 --- chrome/browser/ui/views/frame/browser_view.h
 +++ chrome/browser/ui/views/frame/browser_view.h
 @@ -124,11 +124,16 @@ class BrowserView : public BrowserWindow,
@@ -558,7 +559,7 @@ index 3e812382f77e6..d821b03bfa510 100644
    void set_frame(BrowserFrame* frame) {
      frame_ = frame;
      paint_as_active_subscription_ =
-@@ -783,6 +788,12 @@ class BrowserView : public BrowserWindow,
+@@ -784,6 +789,12 @@ class BrowserView : public BrowserWindow,
      return web_app_frame_toolbar();
    }
  
@@ -572,7 +573,7 @@ index 3e812382f77e6..d821b03bfa510 100644
    // Do not friend BrowserViewLayout. Use the BrowserViewLayoutDelegate
    // interface to keep these two classes decoupled and testable.
 diff --git chrome/browser/ui/views/frame/browser_view_layout.cc chrome/browser/ui/views/frame/browser_view_layout.cc
-index cf12bbd30e086..a227f64d8d5e9 100644
+index 25fa3e495f4b1..21ef37e0b2495 100644
 --- chrome/browser/ui/views/frame/browser_view_layout.cc
 +++ chrome/browser/ui/views/frame/browser_view_layout.cc
 @@ -47,6 +47,10 @@
@@ -586,7 +587,7 @@ index cf12bbd30e086..a227f64d8d5e9 100644
  using views::View;
  using web_modal::ModalDialogHostObserver;
  using web_modal::WebContentsModalDialogHost;
-@@ -560,6 +564,13 @@ int BrowserViewLayout::LayoutWebUITabStrip(int top) {
+@@ -569,6 +573,13 @@ int BrowserViewLayout::LayoutWebUITabStrip(int top) {
  
  int BrowserViewLayout::LayoutToolbar(int top) {
    TRACE_EVENT0("ui", "BrowserViewLayout::LayoutToolbar");
@@ -617,10 +618,10 @@ index 5e059b9878fc2..c1f6fbcd40ec4 100644
  
  ContentsWebView::~ContentsWebView() {
 diff --git chrome/browser/ui/views/page_action/page_action_icon_controller.cc chrome/browser/ui/views/page_action/page_action_icon_controller.cc
-index 85a3c9eec15fe..e9a8bc50532f8 100644
+index 09e828d1e079e..7f42618d67e77 100644
 --- chrome/browser/ui/views/page_action/page_action_icon_controller.cc
 +++ chrome/browser/ui/views/page_action/page_action_icon_controller.cc
-@@ -93,6 +93,12 @@ void PageActionIconController::Init(const PageActionIconParams& params,
+@@ -94,6 +94,12 @@ void PageActionIconController::Init(const PageActionIconParams& params,
    };
  
    for (PageActionIconType type : params.types_enabled) {
@@ -634,10 +635,10 @@ index 85a3c9eec15fe..e9a8bc50532f8 100644
        case PageActionIconType::kPaymentsOfferNotification:
          add_page_action_icon(
 diff --git chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
-index 2753a95f8ff35..9745477102917 100644
+index fb8bfdbcb2bd5..741d84ecba4ea 100644
 --- chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
 +++ chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
-@@ -559,33 +559,47 @@ gfx::Range BrowserTabStripController::ListTabsInGroup(
+@@ -559,29 +559,41 @@ gfx::Range BrowserTabStripController::ListTabsInGroup(
  }
  
  bool BrowserTabStripController::IsFrameCondensed() const {
@@ -659,12 +660,6 @@ index 2753a95f8ff35..9745477102917 100644
    return GetFrameView()->EverHasVisibleBackgroundTabShapes();
  }
  
- bool BrowserTabStripController::ShouldPaintAsActiveFrame() const {
-+  if (!GetFrameView())
-+    return false;
-   return GetFrameView()->ShouldPaintAsActive();
- }
- 
  bool BrowserTabStripController::CanDrawStrokes() const {
 +  if (!GetFrameView())
 +    return false;
@@ -686,10 +681,19 @@ index 2753a95f8ff35..9745477102917 100644
  }
  
 diff --git chrome/browser/ui/views/toolbar/toolbar_view.cc chrome/browser/ui/views/toolbar/toolbar_view.cc
-index 4682fa0f74996..099742d04102a 100644
+index c9e50271f2716..182d75fc96ab6 100644
 --- chrome/browser/ui/views/toolbar/toolbar_view.cc
 +++ chrome/browser/ui/views/toolbar/toolbar_view.cc
-@@ -175,12 +175,13 @@ constexpr int kBrowserAppMenuRefreshCollapsedMargin = 2;
+@@ -182,7 +182,7 @@ class TabstripLikeBackground : public views::Background {
+   void Paint(gfx::Canvas* canvas, views::View* view) const override {
+     bool painted = TopContainerBackground::PaintThemeCustomImage(
+         canvas, view, browser_view_, /*translate_view_coordinates=*/false);
+-    if (!painted) {
++    if (!painted && browser_view_->frame()->GetFrameView()) {
+       SkColor frame_color =
+           browser_view_->frame()->GetFrameView()->GetFrameColor(
+               BrowserFrameActiveState::kUseCurrent);
+@@ -208,12 +208,13 @@ class ToolbarView::ContainerView : public views::View {
  ////////////////////////////////////////////////////////////////////////////////
  // ToolbarView, public:
  
@@ -704,8 +708,8 @@ index 4682fa0f74996..099742d04102a 100644
 +      display_mode_(display_mode ? *display_mode : GetDisplayMode(browser)) {
    SetID(VIEW_ID_TOOLBAR);
  
-   if (display_mode_ == DisplayMode::NORMAL) {
-@@ -202,6 +203,19 @@ ToolbarView::~ToolbarView() {
+   container_view_ = AddChildView(std::make_unique<ContainerView>());
+@@ -238,6 +239,19 @@ ToolbarView::~ToolbarView() {
  }
  
  void ToolbarView::Init() {
@@ -725,8 +729,8 @@ index 4682fa0f74996..099742d04102a 100644
  #if defined(USE_AURA)
    // Avoid generating too many occlusion tracking calculation events before this
    // function returns. The occlusion status will be computed only once once this
-@@ -211,12 +225,13 @@ void ToolbarView::Init() {
- #endif
+@@ -262,12 +276,13 @@ void ToolbarView::Init() {
+ 
    auto location_bar = std::make_unique<LocationBarView>(
        browser_, browser_->profile(), browser_->command_controller(), this,
 -      display_mode_ != DisplayMode::NORMAL);
@@ -741,7 +745,7 @@ index 4682fa0f74996..099742d04102a 100644
      download_button =
          std::make_unique<DownloadToolbarButtonView>(browser_view_);
    }
-@@ -297,8 +312,10 @@ void ToolbarView::Init() {
+@@ -349,8 +364,10 @@ void ToolbarView::Init() {
      }
    }
    std::unique_ptr<media_router::CastToolbarButton> cast;
@@ -753,7 +757,7 @@ index 4682fa0f74996..099742d04102a 100644
  
    std::unique_ptr<MediaToolbarButtonView> media_button;
    if (base::FeatureList::IsEnabled(media::kGlobalMediaControls)) {
-@@ -308,7 +325,8 @@ void ToolbarView::Init() {
+@@ -360,7 +377,8 @@ void ToolbarView::Init() {
  
    std::unique_ptr<send_tab_to_self::SendTabToSelfToolbarIconView>
        send_tab_to_self_button;
@@ -763,17 +767,17 @@ index 4682fa0f74996..099742d04102a 100644
      send_tab_to_self_button =
          std::make_unique<send_tab_to_self::SendTabToSelfToolbarIconView>(
              browser_view_);
-@@ -316,7 +334,7 @@ void ToolbarView::Init() {
+@@ -368,7 +386,7 @@ void ToolbarView::Init() {
  
    std::unique_ptr<SidePanelToolbarButton> side_panel_button;
    std::unique_ptr<SidePanelToolbarContainer> side_panel_toolbar_container;
 -  if (browser_view_->unified_side_panel()) {
 +  if (browser_view_->unified_side_panel() && BUTTON_VISIBLE(kSidePanel)) {
-     if (base::FeatureList::IsEnabled(
-             companion::features::kSidePanelCompanion)) {
+     if (companion::IsCompanionFeatureEnabled()) {
        side_panel_toolbar_container =
+           std::make_unique<SidePanelToolbarContainer>(browser_view_);
 diff --git chrome/browser/ui/views/toolbar/toolbar_view.h chrome/browser/ui/views/toolbar/toolbar_view.h
-index c38f2b0545d21..fe9a92b2f610c 100644
+index be3bd96444563..96669547e3ccf 100644
 --- chrome/browser/ui/views/toolbar/toolbar_view.h
 +++ chrome/browser/ui/views/toolbar/toolbar_view.h
 @@ -89,7 +89,8 @@ class ToolbarView : public views::AccessiblePaneView,

patch/patches/component_build.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/devtools/devtools_instrumentation.h content/browser/devtools/devtools_instrumentation.h
-index e36b1e99fb93d..1b7c458666cea 100644
+index 7e32effcb4b8c..71bfd6c0f4c5c 100644
 --- content/browser/devtools/devtools_instrumentation.h
 +++ content/browser/devtools/devtools_instrumentation.h
-@@ -101,7 +101,7 @@ bool ApplyUserAgentMetadataOverrides(
+@@ -102,7 +102,7 @@ bool ApplyUserAgentMetadataOverrides(
      FrameTreeNode* frame_tree_node,
      absl::optional<blink::UserAgentMetadata>* override_out);
  

patch/patches/content_2015.patch

@@ -12,10 +12,10 @@ index f4f583be8fba9..a2ed253f3724d 100644
      version.Set("V8-Version", V8_VERSION_STRING);
      std::string host = info.GetHeaderValue("host");
 diff --git content/browser/loader/navigation_url_loader_impl.cc content/browser/loader/navigation_url_loader_impl.cc
-index 4438dea521489..987aa9714bd1c 100644
+index b8649b77e9a29..0d25d60e81b1a 100644
 --- content/browser/loader/navigation_url_loader_impl.cc
 +++ content/browser/loader/navigation_url_loader_impl.cc
-@@ -749,6 +749,17 @@ NavigationURLLoaderImpl::PrepareForNonInterceptedRequest() {
+@@ -751,6 +751,17 @@ NavigationURLLoaderImpl::PrepareForNonInterceptedRequest() {
            resource_request_->has_user_gesture, initiating_origin,
            initiator_document_.AsRenderFrameHostIfValid(), &loader_factory);
  
@@ -34,10 +34,10 @@ index 4438dea521489..987aa9714bd1c 100644
          factory = base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
              std::move(loader_factory));
 diff --git content/public/browser/content_browser_client.cc content/public/browser/content_browser_client.cc
-index a5ea7baed1f09..8f3f679aed305 100644
+index d7a8a6d628b79..9dd5a6f5992f4 100644
 --- content/public/browser/content_browser_client.cc
 +++ content/public/browser/content_browser_client.cc
-@@ -986,7 +986,7 @@ ContentBrowserClient::CreateURLLoaderHandlerForServiceWorkerNavigationPreload(
+@@ -1013,7 +1013,7 @@ ContentBrowserClient::CreateURLLoaderHandlerForServiceWorkerNavigationPreload(
  void ContentBrowserClient::OnNetworkServiceCreated(
      network::mojom::NetworkService* network_service) {}
  
@@ -46,7 +46,7 @@ index a5ea7baed1f09..8f3f679aed305 100644
      BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -995,6 +995,7 @@ void ContentBrowserClient::ConfigureNetworkContextParams(
+@@ -1022,6 +1022,7 @@ void ContentBrowserClient::ConfigureNetworkContextParams(
          cert_verifier_creation_params) {
    network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
    network_context_params->accept_language = "en-us,en";
@@ -55,18 +55,18 @@ index a5ea7baed1f09..8f3f679aed305 100644
  
  std::vector<base::FilePath>
 diff --git content/public/browser/content_browser_client.h content/public/browser/content_browser_client.h
-index 3db43fde00af4..1be6b3926fcd3 100644
+index fe0b1b96209c4..e62fd5d108b89 100644
 --- content/public/browser/content_browser_client.h
 +++ content/public/browser/content_browser_client.h
-@@ -37,6 +37,7 @@
- #include "content/public/browser/login_delegate.h"
+@@ -38,6 +38,7 @@
  #include "content/public/browser/mojo_binder_policy_map.h"
+ #include "content/public/browser/privacy_sandbox_invoking_api.h"
  #include "content/public/browser/storage_partition_config.h"
 +#include "content/public/browser/web_contents.h"
  #include "content/public/common/alternative_error_page_override_info.mojom-forward.h"
  #include "content/public/common/page_visibility_state.h"
  #include "content/public/common/window_container_type.mojom-forward.h"
-@@ -1815,7 +1816,7 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1878,7 +1879,7 @@ class CONTENT_EXPORT ContentBrowserClient {
    //
    // If |relative_partition_path| is the empty string, it means this needs to
    // create the default NetworkContext for the BrowserContext.
@@ -75,7 +75,7 @@ index 3db43fde00af4..1be6b3926fcd3 100644
        BrowserContext* context,
        bool in_memory,
        const base::FilePath& relative_partition_path,
-@@ -2023,6 +2024,19 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -2086,6 +2087,19 @@ class CONTENT_EXPORT ContentBrowserClient {
        RenderFrameHost* initiator_document,
        mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory);
  
@@ -95,7 +95,7 @@ index 3db43fde00af4..1be6b3926fcd3 100644
    // Creates an OverlayWindow to be used for video or Picture-in-Picture.
    // This window will house the content shown when in Picture-in-Picture mode.
    // This will return a new OverlayWindow.
-@@ -2079,6 +2093,10 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -2142,6 +2156,10 @@ class CONTENT_EXPORT ContentBrowserClient {
    // Used as part of the user agent string.
    virtual std::string GetProduct();
  
@@ -107,7 +107,7 @@ index 3db43fde00af4..1be6b3926fcd3 100644
    // on blink::features::kUserAgentReduction. Content may cache this value.
    virtual std::string GetUserAgent();
 diff --git content/public/renderer/content_renderer_client.h content/public/renderer/content_renderer_client.h
-index 834a07bb92d77..64e72df7a6abc 100644
+index a4130ad4dc815..b303f6c8768b7 100644
 --- content/public/renderer/content_renderer_client.h
 +++ content/public/renderer/content_renderer_client.h
 @@ -96,6 +96,9 @@ class CONTENT_EXPORT ContentRendererClient {
@@ -120,7 +120,7 @@ index 834a07bb92d77..64e72df7a6abc 100644
    // Notifies that a new RenderFrame has been created.
    virtual void RenderFrameCreated(RenderFrame* render_frame) {}
  
-@@ -313,6 +316,10 @@ class CONTENT_EXPORT ContentRendererClient {
+@@ -318,6 +321,10 @@ class CONTENT_EXPORT ContentRendererClient {
    // This method may invalidate the frame.
    virtual void RunScriptsAtDocumentIdle(RenderFrame* render_frame) {}
  
@@ -132,10 +132,10 @@ index 834a07bb92d77..64e72df7a6abc 100644
    // started.
    virtual void SetRuntimeFeaturesDefaultsBeforeBlinkInitialization() {}
 diff --git content/renderer/render_thread_impl.cc content/renderer/render_thread_impl.cc
-index 6b37ab029be69..d8d33d81ca246 100644
+index b1ad4bd6c6108..b2f6cef961faf 100644
 --- content/renderer/render_thread_impl.cc
 +++ content/renderer/render_thread_impl.cc
-@@ -626,6 +626,8 @@ void RenderThreadImpl::Init() {
+@@ -620,6 +620,8 @@ void RenderThreadImpl::Init() {
        GetContentClient()->renderer()->CreateURLLoaderThrottleProvider(
            blink::URLLoaderThrottleProviderType::kFrame);
  
@@ -145,10 +145,10 @@ index 6b37ab029be69..d8d33d81ca246 100644
        base::BindRepeating(&RenderThreadImpl::OnRendererInterfaceReceiver,
                            base::Unretained(this)));
 diff --git content/renderer/renderer_blink_platform_impl.cc content/renderer/renderer_blink_platform_impl.cc
-index 58caad274969f..1584a5b3ed0cb 100644
+index 134a4b1f1ce8f..c2de5eb620bf5 100644
 --- content/renderer/renderer_blink_platform_impl.cc
 +++ content/renderer/renderer_blink_platform_impl.cc
-@@ -961,6 +961,15 @@ SkBitmap* RendererBlinkPlatformImpl::GetSadPageBitmap() {
+@@ -943,6 +943,15 @@ SkBitmap* RendererBlinkPlatformImpl::GetSadPageBitmap() {
  
  //------------------------------------------------------------------------------
  
@@ -165,10 +165,10 @@ index 58caad274969f..1584a5b3ed0cb 100644
  RendererBlinkPlatformImpl::CreateWebV8ValueConverter() {
    return std::make_unique<V8ValueConverterImpl>();
 diff --git content/renderer/renderer_blink_platform_impl.h content/renderer/renderer_blink_platform_impl.h
-index 2a01122b62190..ad09cca7df98a 100644
+index 587565fa2fd5d..d68eeea7e842e 100644
 --- content/renderer/renderer_blink_platform_impl.h
 +++ content/renderer/renderer_blink_platform_impl.h
-@@ -228,6 +228,9 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
+@@ -224,6 +224,9 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
    InertAndMinimumIntervalOfUserLevelMemoryPressureSignal() override;
  #endif  // BUILDFLAG(IS_ANDROID)
  

patch/patches/content_main_654986.patch

@@ -94,7 +94,7 @@ index 3062f57603321..d8532c9c2eabb 100644
  }
  
 diff --git content/app/content_main_runner_impl.cc content/app/content_main_runner_impl.cc
-index fa26be0ffd110..f231ab04022e3 100644
+index ab6bc68812e36..1cd5ba7bd27f3 100644
 --- content/app/content_main_runner_impl.cc
 +++ content/app/content_main_runner_impl.cc
 @@ -46,6 +46,7 @@
@@ -105,13 +105,12 @@ index fa26be0ffd110..f231ab04022e3 100644
  #include "base/time/time.h"
  #include "base/trace_event/trace_event.h"
  #include "build/build_config.h"
-@@ -1324,6 +1325,12 @@ void ContentMainRunnerImpl::Shutdown() {
+@@ -1306,6 +1307,11 @@ void ContentMainRunnerImpl::Shutdown() {
    is_shutdown_ = true;
  }
  
 +void ContentMainRunnerImpl::ShutdownOnUIThread() {
 +  base::ScopedAllowBaseSyncPrimitivesForTesting allow_wait;
-+  unregister_thread_closure_.RunAndReset();
 +  discardable_shared_memory_manager_.reset();
 +}
 +
@@ -119,7 +118,7 @@ index fa26be0ffd110..f231ab04022e3 100644
  std::unique_ptr<ContentMainRunner> ContentMainRunner::Create() {
    return ContentMainRunnerImpl::Create();
 diff --git content/app/content_main_runner_impl.h content/app/content_main_runner_impl.h
-index 22173f344ae14..fe63790ef128f 100644
+index da60e9346b283..c36effdd7e5ee 100644
 --- content/app/content_main_runner_impl.h
 +++ content/app/content_main_runner_impl.h
 @@ -27,7 +27,7 @@ class DiscardableSharedMemoryManager;
@@ -154,7 +153,7 @@ index 283161145d792..9f3f635abdd1c 100644
    if (main_argv)
      setproctitle_init(main_argv);
 diff --git content/public/app/content_main.h content/public/app/content_main.h
-index baf8a17691bac..9e6b32c9c3692 100644
+index 9be99b20469c0..7d5095593b5fa 100644
 --- content/public/app/content_main.h
 +++ content/public/app/content_main.h
 @@ -96,6 +96,13 @@ struct CONTENT_EXPORT ContentMainParams {

patch/patches/embedder_product_override.patch

@@ -1,5 +1,5 @@
 diff --git components/embedder_support/user_agent_utils.cc components/embedder_support/user_agent_utils.cc
-index 13c7a8525dee2..450c496570bcc 100644
+index 456414fea977b..3bf7d939aaa50 100644
 --- components/embedder_support/user_agent_utils.cc
 +++ components/embedder_support/user_agent_utils.cc
 @@ -18,6 +18,7 @@
@@ -21,7 +21,7 @@ index 13c7a8525dee2..450c496570bcc 100644
  namespace embedder_support {
  
  namespace {
-@@ -350,6 +355,14 @@ std::string GetMajorVersionForUserAgentString(
+@@ -339,6 +344,14 @@ blink::UserAgentBrandList GetBrandFullVersionList(
  std::string GetProductAndVersion(
      ForceMajorVersionToMinorPosition force_major_to_minor,
      UserAgentReductionEnterprisePolicyState user_agent_reduction) {

patch/patches/extensions_1947.patch

@@ -198,10 +198,10 @@ index c3197eb4790fa..1e7ae767b0582 100644
  }
  
 diff --git extensions/browser/extensions_browser_client.h extensions/browser/extensions_browser_client.h
-index de61251db35b6..ad94482e2e7db 100644
+index fbef1f4fba931..1f98adb6b0bcb 100644
 --- extensions/browser/extensions_browser_client.h
 +++ extensions/browser/extensions_browser_client.h
-@@ -31,6 +31,7 @@
+@@ -32,6 +32,7 @@
  #include "url/gurl.h"
  
  class ExtensionFunctionRegistry;
@@ -209,7 +209,7 @@ index de61251db35b6..ad94482e2e7db 100644
  class PrefService;
  
  namespace base {
-@@ -75,6 +76,7 @@ class ComponentExtensionResourceManager;
+@@ -76,6 +77,7 @@ class ComponentExtensionResourceManager;
  class Extension;
  class ExtensionCache;
  class ExtensionError;
@@ -217,7 +217,7 @@ index de61251db35b6..ad94482e2e7db 100644
  class ExtensionHostDelegate;
  class ExtensionSet;
  class ExtensionSystem;
-@@ -247,6 +249,14 @@ class ExtensionsBrowserClient {
+@@ -248,6 +250,14 @@ class ExtensionsBrowserClient {
    virtual std::unique_ptr<ExtensionHostDelegate>
    CreateExtensionHostDelegate() = 0;
  
@@ -233,7 +233,7 @@ index de61251db35b6..ad94482e2e7db 100644
    // once each time the extensions system is loaded per browser_context. The
    // implementation may wish to use the BrowserContext to record the current
 diff --git extensions/browser/process_manager.cc extensions/browser/process_manager.cc
-index e885327697fb9..7dc4c91069762 100644
+index ac0da20879dc1..46e1eabeccab3 100644
 --- extensions/browser/process_manager.cc
 +++ extensions/browser/process_manager.cc
 @@ -377,9 +377,17 @@ bool ProcessManager::CreateBackgroundHost(const Extension* extension,

patch/patches/gn_config.patch

@@ -12,7 +12,7 @@ index a9b0a5a827fc8..9a0fd388756f3 100644
        # https://crbug.com/474506.
        "//clank/java/BUILD.gn",
 diff --git BUILD.gn BUILD.gn
-index ea3d57d093740..bad302160e7c9 100644
+index 9298bc0945ff2..eb3a9628785f4 100644
 --- BUILD.gn
 +++ BUILD.gn
 @@ -19,6 +19,7 @@ import("//build/config/sanitizers/sanitizers.gni")
@@ -89,7 +89,7 @@ index 60f573a736ba5..90dd6d0b37314 100644
 +_OBJC_METACLASS_$_UnderlayOpenGLHostingWindow
 +
 diff --git chrome/chrome_paks.gni chrome/chrome_paks.gni
-index 2254e8a56cda6..20ca93ea9fe32 100644
+index 7b939af86e260..4f89bcabf4d77 100644
 --- chrome/chrome_paks.gni
 +++ chrome/chrome_paks.gni
 @@ -6,6 +6,7 @@ import("//ash/ambient/resources/resources.gni")
@@ -99,8 +99,8 @@ index 2254e8a56cda6..20ca93ea9fe32 100644
 +import("//cef/libcef/features/features.gni")
  import("//chrome/browser/buildflags.gni")
  import("//chrome/common/features.gni")
- import("//extensions/buildflags/buildflags.gni")
-@@ -80,6 +81,10 @@ template("chrome_repack_percent") {
+ import("//components/signin/features.gni")
+@@ -81,6 +82,10 @@ template("chrome_repack_percent") {
          "//ui/chromeos/resources",
        ]
      }
@@ -135,7 +135,7 @@ index adc881122cb9c..cafa71386fad6 100644
        source_patterns +=
            [ "${root_gen_dir}/extensions/strings/extensions_strings_" ]
 diff --git chrome/installer/mini_installer/BUILD.gn chrome/installer/mini_installer/BUILD.gn
-index 4e6af9a522de5..b1851bc764355 100644
+index e9b34c78999b0..a1e06920636f6 100644
 --- chrome/installer/mini_installer/BUILD.gn
 +++ chrome/installer/mini_installer/BUILD.gn
 @@ -6,6 +6,7 @@ import("//build/config/compiler/compiler.gni")
@@ -146,7 +146,7 @@ index 4e6af9a522de5..b1851bc764355 100644
  import("//chrome/process_version_rc_template.gni")
  import("//components/nacl/features.gni")
  import("//third_party/ffmpeg/ffmpeg_options.gni")
-@@ -121,11 +122,13 @@ action("mini_installer_archive") {
+@@ -125,11 +126,13 @@ action("mini_installer_archive") {
    inputs = [
      "$root_out_dir/chrome.dll",
      "$root_out_dir/chrome.exe",