Fix dangling ResourceRequest* (fixes #3719 )

Add raw_ptr<network::ResourceRequest> to RequestState instead of passing ResourceRequest* as a bound parameter.
Allow dangling UnretainedWrapper for ResourceRequest* (fixes #3717 )
2024-06-21 16:57:10 -04:00 · 2024-06-21 13:00:52 -04:00 · 2024-06-21 13:00:52 -04:00 · 2024-06-21 15:11:46 +00:00
21 changed files with 104 additions and 103 deletions
--- a/CHROMIUM_BUILD_COMPATIBILITY.txt
+++ b/CHROMIUM_BUILD_COMPATIBILITY.txt
@ -7,5 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding

 {
-  'chromium_checkout': 'refs/tags/127.0.6533.5'
+  'chromium_checkout': 'refs/tags/127.0.6533.17'
 }
--- a/libcef/browser/alloy/alloy_browser_host_impl.cc
+++ b/libcef/browser/alloy/alloy_browser_host_impl.cc
@ -1138,8 +1138,8 @@ void AlloyBrowserHostImpl::GetCustomWebContentsView(
    const GURL& target_url,
    int opener_render_process_id,
    int opener_render_frame_id,
-    content::WebContentsView** view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::WebContentsView>* view,
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
  CefBrowserInfoManager::GetInstance()->GetCustomWebContentsView(
      target_url,
      frame_util::MakeGlobalId(opener_render_process_id,
--- a/libcef/browser/alloy/alloy_browser_host_impl.h
+++ b/libcef/browser/alloy/alloy_browser_host_impl.h
@ -237,8 +237,8 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
      const GURL& target_url,
      int opener_render_process_id,
      int opener_render_frame_id,
-      content::WebContentsView** view,
-      content::RenderViewHostDelegateView** delegate_view) override;
+      raw_ptr<content::WebContentsView>* view,
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view) override;
  void WebContentsCreated(content::WebContents* source_contents,
                          int opener_render_process_id,
                          int opener_render_frame_id,
--- a/libcef/browser/browser_info_manager.cc
+++ b/libcef/browser/browser_info_manager.cc
@ -228,8 +228,8 @@ bool CefBrowserInfoManager::CanCreateWindow(
 void CefBrowserInfoManager::GetCustomWebContentsView(
    const GURL& target_url,
    const content::GlobalRenderFrameHostId& opener_global_id,
-    content::WebContentsView** view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::WebContentsView>* view,
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
  CEF_REQUIRE_UIT();

  auto pending_popup = PopPendingPopup(PendingPopup::CAN_CREATE_WINDOW,
--- a/libcef/browser/browser_info_manager.h
+++ b/libcef/browser/browser_info_manager.h
@ -87,8 +87,8 @@ class CefBrowserInfoManager : public content::RenderProcessHostObserver {
  void GetCustomWebContentsView(
      const GURL& target_url,
      const content::GlobalRenderFrameHostId& opener_global_id,
-      content::WebContentsView** view,
-      content::RenderViewHostDelegateView** delegate_view);
+      raw_ptr<content::WebContentsView>* view,
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view);

  // Called from WebContentsDelegate::WebContentsCreated. See comments on
  // PendingPopup for more information.
--- a/libcef/browser/browser_platform_delegate.cc
+++ b/libcef/browser/browser_platform_delegate.cc
@ -85,8 +85,8 @@ content::WebContents* CefBrowserPlatformDelegate::CreateWebContents(
 }

 void CefBrowserPlatformDelegate::CreateViewForWebContents(
-    content::WebContentsView** view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::WebContentsView>* view,
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
  DCHECK(false);
 }

--- a/libcef/browser/browser_platform_delegate.h
+++ b/libcef/browser/browser_platform_delegate.h
@ -111,8 +111,8 @@ class CefBrowserPlatformDelegate {
  // called a single time per instance. May be called on multiple threads. Only
  // used with windowless rendering.
  virtual void CreateViewForWebContents(
-      content::WebContentsView** view,
-      content::RenderViewHostDelegateView** delegate_view);
+      raw_ptr<content::WebContentsView>* view,
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view);

  // Called after the WebContents for a browser has been created. |owned| will
  // be true if |web_contents| was created via CreateWebContents() and we should
--- a/libcef/browser/net_service/resource_request_handler_wrapper.cc
+++ b/libcef/browser/net_service/resource_request_handler_wrapper.cc
@ -95,14 +95,16 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {

    void Reset(CefRefPtr<CefResourceRequestHandler> handler,
               CefRefPtr<CefSchemeHandlerFactory> scheme_factory,
-               CefRefPtr<CefRequestImpl> request,
+               CefRefPtr<CefRequestImpl> pending_request,
+               network::ResourceRequest* request,
               bool request_was_redirected,
               CancelRequestCallback cancel_callback) {
      handler_ = handler;
      scheme_factory_ = scheme_factory;
      cookie_filter_ = nullptr;
-      pending_request_ = request;
+      pending_request_ = pending_request;
      pending_response_ = nullptr;
+      request_ = request;
      request_was_redirected_ = request_was_redirected;
      was_custom_handled_ = false;
      cancel_callback_ = std::move(cancel_callback);
@ -113,6 +115,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    CefRefPtr<CefCookieAccessFilter> cookie_filter_;
    CefRefPtr<CefRequestImpl> pending_request_;
    CefRefPtr<CefResponseImpl> pending_response_;
+    raw_ptr<network::ResourceRequest> request_;
    bool request_was_redirected_ = false;
    bool was_custom_handled_ = false;
    bool accept_language_added_ = false;
@ -569,8 +572,8 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    }

    // May have a handler and/or scheme factory.
-    state->Reset(handler, scheme_factory, requestPtr, request_was_redirected,
-                 std::move(cancel_callback));
+    state->Reset(handler, scheme_factory, requestPtr, request,
+                 request_was_redirected, std::move(cancel_callback));

    if (handler) {
      state->cookie_filter_ = handler->GetCookieAccessFilter(
@ -587,16 +590,15 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      return;
    }

-    MaybeLoadCookies(request_id, state, request, std::move(exec_callback));
+    MaybeLoadCookies(request_id, state, std::move(exec_callback));
  }

  void MaybeLoadCookies(int32_t request_id,
                        RequestState* state,
-                        network::ResourceRequest* request,
                        base::OnceClosure callback) {
    CEF_REQUIRE_IOT();

-    if (!cookie_helper::IsCookieableScheme(request->url,
+    if (!cookie_helper::IsCookieableScheme(state->request_->url,
                                           init_state_->cookieable_schemes_)) {
      // The scheme does not support cookies.
      std::move(callback).Run();
@ -614,10 +616,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
                  &InterceptedRequestHandlerWrapper::AllowCookieAlways);
    auto done_cookie_callback = base::BindOnce(
        &InterceptedRequestHandlerWrapper::ContinueWithLoadedCookies,
-        weak_ptr_factory_.GetWeakPtr(), request_id, request,
-        std::move(callback));
-    cookie_helper::LoadCookies(init_state_->browser_context_getter_, *request,
-                               allow_cookie_callback,
+        weak_ptr_factory_.GetWeakPtr(), request_id, std::move(callback));
+    cookie_helper::LoadCookies(init_state_->browser_context_getter_,
+                               *(state->request_), allow_cookie_callback,
                               std::move(done_cookie_callback));
  }

@ -649,7 +650,6 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
  }

  void ContinueWithLoadedCookies(int32_t request_id,
-                                 network::ResourceRequest* request,
                                 base::OnceClosure callback,
                                 int total_count,
                                 net::CookieList allowed_cookies) {
@ -666,13 +666,14 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      // Also add/save cookies ourselves for default-handled network requests
      // so that we can filter them. This will be a no-op for custom-handled
      // requests.
-      request->load_flags |= kLoadNoCookiesFlags;
+      state->request_->load_flags |= kLoadNoCookiesFlags;
    }

    if (!allowed_cookies.empty()) {
      const std::string& cookie_line =
          net::CanonicalCookie::BuildCookieLine(allowed_cookies);
-      request->headers.SetHeader(net::HttpRequestHeaders::kCookie, cookie_line);
+      state->request_->headers.SetHeader(net::HttpRequestHeaders::kCookie,
+                                         cookie_line);

      state->pending_request_->SetReadOnly(false);
      state->pending_request_->SetHeaderByName(net::HttpRequestHeaders::kCookie,
@ -708,8 +709,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      CefRefPtr<RequestCallbackWrapper> callbackPtr =
          new RequestCallbackWrapper(base::BindOnce(
              &InterceptedRequestHandlerWrapper::ContinueShouldInterceptRequest,
-              weak_ptr_factory_.GetWeakPtr(), request_id,
-              base::Unretained(request), std::move(callback)));
+              weak_ptr_factory_.GetWeakPtr(), request_id, std::move(callback)));

      cef_return_value_t retval = state->handler_->OnBeforeResourceLoad(
          init_state_->browser_, init_state_->frame_,
@ -725,14 +725,12 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      }
    } else {
      // The scheme factory may choose to handle it.
-      ContinueShouldInterceptRequest(request_id, request, std::move(callback),
-                                     true);
+      ContinueShouldInterceptRequest(request_id, std::move(callback), true);
    }
  }

  void ContinueShouldInterceptRequest(
      int32_t request_id,
-      network::ResourceRequest* request,
      ShouldInterceptRequestResultCallback callback,
      bool allow) {
    CEF_REQUIRE_IOT();
@ -751,7 +749,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    if (state->handler_) {
      if (allow) {
        // Apply any |requestPtr| changes to |request|.
-        state->pending_request_->Get(request, true /* changed_only */);
+        state->pending_request_->Get(state->request_, true /* changed_only */);
      }

      const bool redirect =
@ -790,8 +788,8 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    if (!resource_handler && state->scheme_factory_) {
      // Does the scheme factory want to handle the request?
      resource_handler = state->scheme_factory_->Create(
-          init_state_->browser_, init_state_->frame_, request->url.scheme(),
-          state->pending_request_.get());
+          init_state_->browser_, init_state_->frame_,
+          state->request_->url.scheme(), state->pending_request_.get());
    }

    std::unique_ptr<ResourceResponse> resource_response;
@ -803,7 +801,8 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      // The request will be handled by the NetworkService. Remove the
      // "Accept-Language" header here so that it can be re-added in
      // URLRequestHttpJob::AddExtraHeaders with correct ordering applied.
-      request->headers.RemoveHeader(net::HttpRequestHeaders::kAcceptLanguage);
+      state->request_->headers.RemoveHeader(
+          net::HttpRequestHeaders::kAcceptLanguage);
    }

    // Continue the request.
@ -860,7 +859,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    if (!state->handler_) {
      // Cookies may come from a scheme handler.
      MaybeSaveCookies(
-          request_id, state, request, headers,
+          request_id, state, headers,
          base::BindOnce(
              std::move(callback), ResponseMode::CONTINUE, nullptr,
              redirect_info.has_value() ? redirect_info->new_url : GURL()));
@ -871,16 +870,15 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    DCHECK(state->pending_response_);

    if (redirect_info.has_value()) {
-      HandleRedirect(request_id, state, request, headers, *redirect_info,
+      HandleRedirect(request_id, state, headers, *redirect_info,
                     std::move(callback));
    } else {
-      HandleResponse(request_id, state, request, headers, std::move(callback));
+      HandleResponse(request_id, state, headers, std::move(callback));
    }
  }

  void HandleRedirect(int32_t request_id,
                      RequestState* state,
-                      network::ResourceRequest* request,
                      net::HttpResponseHeaders* headers,
                      const net::RedirectInfo& redirect_info,
                      OnRequestResponseResultCallback callback) {
@ -911,13 +909,11 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    auto exec_callback = base::BindOnce(
        std::move(callback), ResponseMode::CONTINUE, nullptr, new_url);

-    MaybeSaveCookies(request_id, state, request, headers,
-                     std::move(exec_callback));
+    MaybeSaveCookies(request_id, state, headers, std::move(exec_callback));
  }

  void HandleResponse(int32_t request_id,
                      RequestState* state,
-                      network::ResourceRequest* request,
                      net::HttpResponseHeaders* headers,
                      OnRequestResponseResultCallback callback) {
    // The client may modify |pending_request_| in OnResourceResponse.
@ -933,7 +929,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      // The request may have been modified.
      const auto changes = state->pending_request_->GetChanges();
      if (changes) {
-        state->pending_request_->Get(request, true /* changed_only */);
+        state->pending_request_->Get(state->request_, true /* changed_only */);

        if (changes & CefRequestImpl::kChangedUrl) {
          // Redirect to the new URL.
@ -961,13 +957,11 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      return;
    }

-    MaybeSaveCookies(request_id, state, request, headers,
-                     std::move(exec_callback));
+    MaybeSaveCookies(request_id, state, headers, std::move(exec_callback));
  }

  void MaybeSaveCookies(int32_t request_id,
                        RequestState* state,
-                        network::ResourceRequest* request,
                        net::HttpResponseHeaders* headers,
                        base::OnceClosure callback) {
    CEF_REQUIRE_IOT();
@ -978,7 +972,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
      return;
    }

-    if (!cookie_helper::IsCookieableScheme(request->url,
+    if (!cookie_helper::IsCookieableScheme(state->request_->url,
                                           init_state_->cookieable_schemes_)) {
      // The scheme does not support cookies.
      std::move(callback).Run();
@ -997,9 +991,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    auto done_cookie_callback = base::BindOnce(
        &InterceptedRequestHandlerWrapper::ContinueWithSavedCookies,
        weak_ptr_factory_.GetWeakPtr(), request_id, std::move(callback));
-    cookie_helper::SaveCookies(init_state_->browser_context_getter_, *request,
-                               headers, allow_cookie_callback,
-                               std::move(done_cookie_callback));
+    cookie_helper::SaveCookies(
+        init_state_->browser_context_getter_, *(state->request_), headers,
+        allow_cookie_callback, std::move(done_cookie_callback));
  }

  void AllowCookieSave(int32_t request_id,
@ -1275,6 +1269,12 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
    for (auto& pair : request_map) {
      auto state = std::move(pair.second);
      if (state->cancel_callback_) {
+        // The cancel callback may trigger a call to OnRequestComplete followed
+        // by destruction of the InterceptedRequest that owns the
+        // ResourceRequest. We therefore need to clear the
+        // raw_ptr<ResourceRequest> first to avoid dangling pointer errors.
+        state->request_ = nullptr;
+
        std::move(state->cancel_callback_).Run(net::ERR_ABORTED);
      }
    }
--- a/libcef/browser/osr/browser_platform_delegate_osr.cc
+++ b/libcef/browser/osr/browser_platform_delegate_osr.cc
@ -31,8 +31,8 @@ CefBrowserPlatformDelegateOsr::CefBrowserPlatformDelegateOsr(
 }

 void CefBrowserPlatformDelegateOsr::CreateViewForWebContents(
-    content::WebContentsView** view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::WebContentsView>* view,
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
  DCHECK(!view_osr_);

  // Use the OSR view instead of the default platform view.
--- a/libcef/browser/osr/browser_platform_delegate_osr.h
+++ b/libcef/browser/osr/browser_platform_delegate_osr.h
@ -23,8 +23,8 @@ class CefBrowserPlatformDelegateOsr
 public:
  // CefBrowserPlatformDelegate methods:
  void CreateViewForWebContents(
-      content::WebContentsView** view,
-      content::RenderViewHostDelegateView** delegate_view) override;
+      raw_ptr<content::WebContentsView>* view,
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view) override;
  void WebContentsCreated(content::WebContents* web_contents,
                          bool owned) override;
  void WebContentsDestroyed(content::WebContents* web_contents) override;
--- a/libcef/common/request_impl.h
+++ b/libcef/common/request_impl.h
@ -258,7 +258,7 @@ class CefPostDataElementImpl : public CefPostDataElement {
  Type type_ = PDE_TYPE_EMPTY;
  union {
    struct {
-      void* bytes;
+      RAW_PTR_EXCLUSION void* bytes;
      size_t size;
    } bytes;
    cef_string_t filename;
--- a/libcef/renderer/blink_glue.cc
+++ b/libcef/renderer/blink_glue.cc
@ -282,6 +282,7 @@ void RegisterURLSchemeAsSupportingFetchAPI(const blink::WebString& scheme) {
 }

 struct CefScriptForbiddenScope::Impl {
+  STACK_ALLOCATED_IGNORE()
  blink::ScriptForbiddenScope scope_;
 };

--- a/patch/patches/base_thread_pool_5548577.patch
+++ b/patch/patches/base_thread_pool_5548577.patch
@ -1,5 +1,5 @@
 diff --git base/task/thread_pool/thread_pool_impl.cc base/task/thread_pool/thread_pool_impl.cc
-index 4ac5cea5f6c08..559593f1564c9 100644
+index 4ac5cea5f6c08..a9c1c152568f3 100644
 --- base/task/thread_pool/thread_pool_impl.cc
 +++ base/task/thread_pool/thread_pool_impl.cc
@@ -105,6 +105,10 @@ ThreadPoolImpl::ThreadPoolImpl(std::string_view histogram_label,
--- a/patch/patches/chrome_browser.patch
+++ b/patch/patches/chrome_browser.patch
@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index 8e3fde5e841e1..8adc42aea0836 100644
+index 26c825186ad85..821c5722ecabf 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
@@ -11,6 +11,7 @@ import("//build/config/compiler/pgo/pgo.gni")
@ -10,7 +10,7 @@ index 8e3fde5e841e1..8adc42aea0836 100644
 import("//chrome/browser/buildflags.gni")
 import("//chrome/browser/downgrade/buildflags.gni")
 import("//chrome/common/features.gni")
-@@ -2049,6 +2050,7 @@ static_library("browser") {
+@@ -2055,6 +2056,7 @@ static_library("browser") {
     "//build/config/chromebox_for_meetings:buildflags",
     "//build/config/compiler:compiler_buildflags",
     "//cc",
@ -18,7 +18,7 @@ index 8e3fde5e841e1..8adc42aea0836 100644
     "//chrome:extra_resources",
     "//chrome:resources",
     "//chrome:strings",
-@@ -2769,6 +2771,10 @@ static_library("browser") {
+@@ -2775,6 +2777,10 @@ static_library("browser") {
     ]
   }
 
--- a/patch/patches/chrome_browser_browser.patch
+++ b/patch/patches/chrome_browser_browser.patch
@ -140,7 +140,7 @@ index 74460ac479210..8cf70c80a87ad 100644
     ]
   }
 diff --git chrome/browser/ui/browser.cc chrome/browser/ui/browser.cc
-index 557abfcd71d85..fb64e93157148 100644
+index 4683794bedaa9..de933a524299d 100644
 --- chrome/browser/ui/browser.cc
 +++ chrome/browser/ui/browser.cc
@@ -272,6 +272,25 @@
@ -180,7 +180,7 @@ index 557abfcd71d85..fb64e93157148 100644
       tab_strip_model_delegate_(
           std::make_unique<chrome::BrowserTabStripModelDelegate>(this)),
       tab_strip_model_(std::make_unique<TabStripModel>(
-@@ -757,6 +780,12 @@ Browser::~Browser() {
+@@ -761,6 +784,12 @@ Browser::~Browser() {
   // away so they don't try and call back to us.
   if (select_file_dialog_.get())
     select_file_dialog_->ListenerDestroyed();
@ -193,7 +193,7 @@ index 557abfcd71d85..fb64e93157148 100644
 }
 
 ///////////////////////////////////////////////////////////////////////////////
-@@ -1217,6 +1246,8 @@ void Browser::WindowFullscreenStateChanged() {
+@@ -1221,6 +1250,8 @@ void Browser::WindowFullscreenStateChanged() {
       ->WindowFullscreenStateChanged();
   command_controller_->FullscreenStateChanged();
   UpdateBookmarkBarState(BOOKMARK_BAR_STATE_CHANGE_TOGGLE_FULLSCREEN);
@ -202,7 +202,7 @@ index 557abfcd71d85..fb64e93157148 100644
 }
 
 void Browser::FullscreenTopUIStateChanged() {
-@@ -1584,6 +1615,14 @@ content::KeyboardEventProcessingResult Browser::PreHandleKeyboardEvent(
+@@ -1594,6 +1625,14 @@ content::KeyboardEventProcessingResult Browser::PreHandleKeyboardEvent(
   if (exclusive_access_manager_->HandleUserKeyEvent(event))
     return content::KeyboardEventProcessingResult::HANDLED;
 
@ -217,7 +217,7 @@ index 557abfcd71d85..fb64e93157148 100644
   return window()->PreHandleKeyboardEvent(event);
 }
 
-@@ -1591,8 +1630,18 @@ bool Browser::HandleKeyboardEvent(content::WebContents* source,
+@@ -1601,8 +1640,18 @@ bool Browser::HandleKeyboardEvent(content::WebContents* source,
                                   const NativeWebKeyboardEvent& event) {
   DevToolsWindow* devtools_window =
       DevToolsWindow::GetInstanceForInspectedWebContents(source);
@ -238,7 +238,7 @@ index 557abfcd71d85..fb64e93157148 100644
 }
 
 bool Browser::TabsNeedBeforeUnloadFired() const {
-@@ -1768,6 +1817,16 @@ WebContents* Browser::OpenURLFromTab(
+@@ -1778,6 +1827,16 @@ WebContents* Browser::OpenURLFromTab(
   }
 #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
 
@ -255,7 +255,7 @@ index 557abfcd71d85..fb64e93157148 100644
   NavigateParams nav_params(this, params.url, params.transition);
   nav_params.FillNavigateParamsFromOpenURLParams(params);
   nav_params.source_contents = source;
-@@ -1930,6 +1989,8 @@ void Browser::LoadingStateChanged(WebContents* source,
+@@ -1940,6 +1999,8 @@ void Browser::LoadingStateChanged(WebContents* source,
                                   bool should_show_loading_ui) {
   ScheduleUIUpdate(source, content::INVALIDATE_TYPE_LOAD);
   UpdateWindowForLoadingStateChanged(source, should_show_loading_ui);
@ -264,7 +264,7 @@ index 557abfcd71d85..fb64e93157148 100644
 }
 
 void Browser::CloseContents(WebContents* source) {
-@@ -1958,6 +2019,8 @@ void Browser::SetContentsBounds(WebContents* source, const gfx::Rect& bounds) {
+@@ -1968,6 +2029,8 @@ void Browser::SetContentsBounds(WebContents* source, const gfx::Rect& bounds) {
 }
 
 void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
@ -273,7 +273,7 @@ index 557abfcd71d85..fb64e93157148 100644
   if (!GetStatusBubble())
     return;
 
-@@ -1965,6 +2028,17 @@ void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
+@@ -1975,6 +2038,17 @@ void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
     GetStatusBubble()->SetURL(url);
 }
 
@ -291,7 +291,7 @@ index 557abfcd71d85..fb64e93157148 100644
 void Browser::ContentsMouseEvent(WebContents* source, const ui::Event& event) {
   const ui::EventType type = event.type();
   const bool exited = type == ui::ET_MOUSE_EXITED;
-@@ -1992,6 +2066,19 @@ bool Browser::TakeFocus(content::WebContents* source, bool reverse) {
+@@ -2002,6 +2076,19 @@ bool Browser::TakeFocus(content::WebContents* source, bool reverse) {
   return false;
 }
 
@ -311,7 +311,7 @@ index 557abfcd71d85..fb64e93157148 100644
 void Browser::BeforeUnloadFired(WebContents* web_contents,
                                 bool proceed,
                                 bool* proceed_to_fire_unload) {
-@@ -2091,12 +2178,24 @@ void Browser::WebContentsCreated(WebContents* source_contents,
+@@ -2101,12 +2188,24 @@ void Browser::WebContentsCreated(WebContents* source_contents,
 
   // Make the tab show up in the task manager.
   task_manager::WebContentsTags::CreateForTabContents(new_contents);
@ -336,7 +336,7 @@ index 557abfcd71d85..fb64e93157148 100644
   // Don't show the page hung dialog when a HTML popup hangs because
   // the dialog will take the focus and immediately close the popup.
   RenderWidgetHostView* view = render_widget_host->GetView();
-@@ -2109,6 +2208,13 @@ void Browser::RendererUnresponsive(
+@@ -2119,6 +2218,13 @@ void Browser::RendererUnresponsive(
 void Browser::RendererResponsive(
     WebContents* source,
     content::RenderWidgetHost* render_widget_host) {
@ -350,7 +350,7 @@ index 557abfcd71d85..fb64e93157148 100644
   RenderWidgetHostView* view = render_widget_host->GetView();
   if (view && !render_widget_host->GetView()->IsHTMLFormPopup()) {
     TabDialogs::FromWebContents(source)->HideHungRendererDialog(
-@@ -2118,6 +2224,15 @@ void Browser::RendererResponsive(
+@@ -2128,6 +2234,15 @@ void Browser::RendererResponsive(
 
 content::JavaScriptDialogManager* Browser::GetJavaScriptDialogManager(
     WebContents* source) {
@ -366,7 +366,7 @@ index 557abfcd71d85..fb64e93157148 100644
   return javascript_dialogs::TabModalDialogManager::FromWebContents(source);
 }
 
-@@ -2153,6 +2268,11 @@ void Browser::DraggableRegionsChanged(
+@@ -2163,6 +2278,11 @@ void Browser::DraggableRegionsChanged(
   if (app_controller_) {
     app_controller_->DraggableRegionsChanged(regions, contents);
   }
@ -378,7 +378,7 @@ index 557abfcd71d85..fb64e93157148 100644
 }
 
 void Browser::DidFinishNavigation(
-@@ -2233,11 +2353,15 @@ void Browser::EnterFullscreenModeForTab(
+@@ -2243,11 +2363,15 @@ void Browser::EnterFullscreenModeForTab(
     const blink::mojom::FullscreenOptions& options) {
   exclusive_access_manager_->fullscreen_controller()->EnterFullscreenModeForTab(
       requesting_frame, options.display_id);
@ -394,7 +394,7 @@ index 557abfcd71d85..fb64e93157148 100644
 }
 
 bool Browser::IsFullscreenForTabOrPending(const WebContents* web_contents) {
-@@ -2437,6 +2561,15 @@ void Browser::RequestMediaAccessPermission(
+@@ -2447,6 +2571,15 @@ void Browser::RequestMediaAccessPermission(
     content::WebContents* web_contents,
     const content::MediaStreamRequest& request,
     content::MediaResponseCallback callback) {
@ -410,7 +410,7 @@ index 557abfcd71d85..fb64e93157148 100644
   const extensions::Extension* extension =
       GetExtensionForOrigin(profile_, request.security_origin);
   MediaCaptureDevicesDispatcher::GetInstance()->ProcessMediaAccessRequest(
-@@ -2981,9 +3114,11 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
+@@ -2991,9 +3124,11 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
 // Browser, Getters for UI (private):
 
 StatusBubble* Browser::GetStatusBubble() {
@ -423,7 +423,7 @@ index 557abfcd71d85..fb64e93157148 100644
   }
 
   // We hide the status bar for web apps windows as this matches native
-@@ -2991,6 +3126,12 @@ StatusBubble* Browser::GetStatusBubble() {
+@@ -3001,6 +3136,12 @@ StatusBubble* Browser::GetStatusBubble() {
   // mode, as the minimal browser UI includes the status bar.
   if (web_app::AppBrowserController::IsWebApp(this) &&
       !app_controller()->HasMinimalUiButtons()) {
@ -436,7 +436,7 @@ index 557abfcd71d85..fb64e93157148 100644
     return nullptr;
   }
 
-@@ -3140,6 +3281,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
+@@ -3150,6 +3291,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
     BookmarkTabHelper::FromWebContents(web_contents)->RemoveObserver(this);
     web_contents_collection_.StopObserving(web_contents);
   }
@ -445,7 +445,7 @@ index 557abfcd71d85..fb64e93157148 100644
 }
 
 void Browser::TabDetachedAtImpl(content::WebContents* contents,
-@@ -3294,6 +3437,14 @@ bool Browser::PictureInPictureBrowserSupportsWindowFeature(
+@@ -3304,6 +3447,14 @@ bool Browser::PictureInPictureBrowserSupportsWindowFeature(
 
 bool Browser::SupportsWindowFeatureImpl(WindowFeature feature,
                                         bool check_can_support) const {
--- a/patch/patches/chrome_browser_download.patch
+++ b/patch/patches/chrome_browser_download.patch
@ -1,8 +1,8 @@
 diff --git chrome/browser/download/chrome_download_manager_delegate.cc chrome/browser/download/chrome_download_manager_delegate.cc
-index 2628f1751cd14..cc2c330d8db5d 100644
+index bd2c41e30f01e..d87b8baf3de2b 100644
 --- chrome/browser/download/chrome_download_manager_delegate.cc
 +++ chrome/browser/download/chrome_download_manager_delegate.cc
-@@ -148,6 +148,10 @@
+@@ -150,6 +150,10 @@
 #include "chrome/browser/safe_browsing/download_protection/download_protection_util.h"
 #endif
 
@ -13,7 +13,7 @@ index 2628f1751cd14..cc2c330d8db5d 100644
 using content::BrowserThread;
 using content::DownloadManager;
 using download::DownloadItem;
-@@ -492,6 +496,11 @@ ChromeDownloadManagerDelegate::ChromeDownloadManagerDelegate(Profile* profile)
+@@ -500,6 +504,11 @@ ChromeDownloadManagerDelegate::ChromeDownloadManagerDelegate(Profile* profile)
   download_dialog_bridge_ = std::make_unique<DownloadDialogBridge>();
   download_message_bridge_ = std::make_unique<DownloadMessageBridge>();
 #endif
@ -25,7 +25,7 @@ index 2628f1751cd14..cc2c330d8db5d 100644
 }
 
 ChromeDownloadManagerDelegate::~ChromeDownloadManagerDelegate() {
-@@ -551,6 +560,9 @@ void ChromeDownloadManagerDelegate::Shutdown() {
+@@ -559,6 +568,9 @@ void ChromeDownloadManagerDelegate::Shutdown() {
     download_manager_->RemoveObserver(this);
     download_manager_ = nullptr;
   }
@ -35,7 +35,7 @@ index 2628f1751cd14..cc2c330d8db5d 100644
 }
 
 void ChromeDownloadManagerDelegate::OnDownloadCanceledAtShutdown(
-@@ -619,6 +631,12 @@ bool ChromeDownloadManagerDelegate::DetermineDownloadTarget(
+@@ -627,6 +639,12 @@ bool ChromeDownloadManagerDelegate::DetermineDownloadTarget(
     ReportPDFLoadStatus(PDFLoadStatus::kTriggeredNoGestureDriveByDownload);
   }
 
--- a/patch/patches/chrome_browser_profiles.patch
+++ b/patch/patches/chrome_browser_profiles.patch
@ -85,10 +85,10 @@ index 02454f4e780b5..4641f33c26f5f 100644
 
   // Returns whether the user has signed in this profile to an account.
 diff --git chrome/browser/profiles/profile_impl.cc chrome/browser/profiles/profile_impl.cc
-index 0909a332a46bf..163de8ef6a878 100644
+index 0d7b3e677f5d1..b2704259cdc43 100644
 --- chrome/browser/profiles/profile_impl.cc
 +++ chrome/browser/profiles/profile_impl.cc
-@@ -1030,7 +1030,9 @@ Profile* ProfileImpl::GetOffTheRecordProfile(const OTRProfileID& otr_profile_id,
+@@ -1033,7 +1033,9 @@ Profile* ProfileImpl::GetOffTheRecordProfile(const OTRProfileID& otr_profile_id,
 
   otr_profiles_[otr_profile_id] = std::move(otr_profile);
 
--- a/patch/patches/chrome_runtime.patch
+++ b/patch/patches/chrome_runtime.patch
@ -594,7 +594,7 @@ index 522c072575325..b63e9aacd1f0a 100644
 #endif
 
 diff --git chrome/browser/prefs/browser_prefs.cc chrome/browser/prefs/browser_prefs.cc
-index 7c9cd6b688f88..f66aa28081c37 100644
+index f48b25bb957d1..08ee4dd4b7e02 100644
 --- chrome/browser/prefs/browser_prefs.cc
 +++ chrome/browser/prefs/browser_prefs.cc
@@ -16,6 +16,7 @@
--- a/patch/patches/chrome_runtime_views.patch
+++ b/patch/patches/chrome_runtime_views.patch
@ -41,10 +41,10 @@ index e70c1340dd2ee..745b3982aa9ad 100644
 
 bool BrowserCommandController::IsWebAppOrCustomTab() const {
 diff --git chrome/browser/ui/toolbar/app_menu_model.cc chrome/browser/ui/toolbar/app_menu_model.cc
-index 2a1eb7cd0a644..b3e95b92b2951 100644
+index 4df6318daf016..8492d99fb42b2 100644
 --- chrome/browser/ui/toolbar/app_menu_model.cc
 +++ chrome/browser/ui/toolbar/app_menu_model.cc
-@@ -658,10 +658,12 @@ FindAndEditSubMenuModel::FindAndEditSubMenuModel(
+@@ -673,10 +673,12 @@ FindAndEditSubMenuModel::FindAndEditSubMenuModel(
     ui::SimpleMenuModel::Delegate* delegate)
     : SimpleMenuModel(delegate) {
   AddItemWithStringIdAndVectorIcon(this, IDC_FIND, IDS_FIND, kSearchMenuIcon);
@ -57,7 +57,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
 }
 
 class SaveAndShareSubMenuModel : public ui::SimpleMenuModel {
-@@ -736,6 +738,57 @@ SaveAndShareSubMenuModel::SaveAndShareSubMenuModel(
+@@ -751,6 +753,57 @@ SaveAndShareSubMenuModel::SaveAndShareSubMenuModel(
   }
 }
 
@ -115,7 +115,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
 }  // namespace
 
 ////////////////////////////////////////////////////////////////////////////////
-@@ -1596,7 +1649,7 @@ bool AppMenuModel::IsCommandIdChecked(int command_id) const {
+@@ -1632,7 +1685,7 @@ bool AppMenuModel::IsCommandIdChecked(int command_id) const {
   return false;
 }
 
@ -124,7 +124,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
   GlobalError* error =
       GlobalErrorServiceFactory::GetForProfile(browser_->profile())
           ->GetGlobalErrorByMenuItemCommandID(command_id);
-@@ -1611,6 +1664,30 @@ bool AppMenuModel::IsCommandIdEnabled(int command_id) const {
+@@ -1648,6 +1701,30 @@ bool AppMenuModel::IsCommandIdEnabled(int command_id) const {
   }
 }
 
@ -155,7 +155,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
 bool AppMenuModel::IsCommandIdAlerted(int command_id) const {
   if (command_id == IDC_VIEW_PASSWORDS ||
       command_id == IDC_SHOW_PASSWORD_MANAGER) {
-@@ -1773,8 +1850,10 @@ void AppMenuModel::Build() {
+@@ -1810,8 +1887,10 @@ void AppMenuModel::Build() {
                                    IDS_CLEAR_BROWSING_DATA,
                                    kTrashCanRefreshIcon);
 
@ -166,7 +166,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
   AddSeparator(ui::NORMAL_SEPARATOR);
 
   AddItemWithStringIdAndVectorIcon(this, IDC_PRINT, IDS_PRINT, kPrintMenuIcon);
-@@ -1896,6 +1975,11 @@ void AppMenuModel::Build() {
+@@ -1933,6 +2012,11 @@ void AppMenuModel::Build() {
   }
 #endif  // !BUILDFLAG(IS_CHROMEOS_ASH)
 
--- a/patch/patches/views_1749_2102_3330.patch
+++ b/patch/patches/views_1749_2102_3330.patch
@ -1,8 +1,8 @@
 diff --git chrome/browser/ui/views/toolbar/app_menu.cc chrome/browser/ui/views/toolbar/app_menu.cc
-index 7986c86012518..fa75795aa6c30 100644
+index 0645d841f604c..0f5aa54288f5c 100644
 --- chrome/browser/ui/views/toolbar/app_menu.cc
 +++ chrome/browser/ui/views/toolbar/app_menu.cc
-@@ -1025,7 +1025,9 @@ void AppMenu::RunMenu(views::MenuButtonController* host) {
+@@ -1037,7 +1037,9 @@ void AppMenu::RunMenu(views::MenuButtonController* host) {
       host->button()->GetWidget(), host,
       host->button()->GetAnchorBoundsInScreen(),
       views::MenuAnchorPosition::kTopRight, ui::MENU_SOURCE_NONE,
--- a/patch/patches/web_contents_1257_1565.patch
+++ b/patch/patches/web_contents_1257_1565.patch
@ -60,7 +60,7 @@ index 205a1bb692091..d5cf0a22b11b2 100644
 
 FrameTree* WebContentsImpl::GetOwnedPictureInPictureFrameTree() {
 diff --git content/public/browser/web_contents.h content/public/browser/web_contents.h
-index 1ee36913ac37c..19b13abaf0679 100644
+index 1ee36913ac37c..6dcca3c80ede2 100644
 --- content/public/browser/web_contents.h
 +++ content/public/browser/web_contents.h
@@ -105,10 +105,12 @@ class BrowserContext;
@ -81,14 +81,14 @@ index 1ee36913ac37c..19b13abaf0679 100644
         network::mojom::WebSandboxFlags::kNone;
 
 +    // Optionally specify the view and delegate view.
-+    content::WebContentsView* view = nullptr;
-+    content::RenderViewHostDelegateView* delegate_view = nullptr;
+    raw_ptr<content::WebContentsView> view = nullptr;
+    raw_ptr<content::RenderViewHostDelegateView> delegate_view = nullptr;
 +
     // Value used to set the last time the WebContents was made active, this is
     // the value that'll be returned by GetLastActiveTime(). If this is left
     // default initialized then the value is not passed on to the WebContents
 diff --git content/public/browser/web_contents_delegate.h content/public/browser/web_contents_delegate.h
-index fd851a9347dd6..82abe6dd2fd07 100644
+index fd851a9347dd6..dc77e13235743 100644
 --- content/public/browser/web_contents_delegate.h
 +++ content/public/browser/web_contents_delegate.h
@@ -63,9 +63,11 @@ class EyeDropperListener;
@ -112,8 +112,8 @@ index fd851a9347dd6..82abe6dd2fd07 100644
 +      const GURL& target_url,
 +      int opener_render_process_id,
 +      int opener_render_frame_id,
-+      content::WebContentsView** view,
-+      content::RenderViewHostDelegateView** delegate_view) {}
+      raw_ptr<content::WebContentsView>* view,
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {}
 +
   // Notifies the delegate about the creation of a new WebContents. This
   // typically happens when popups are created.
Author	SHA1	Message	Date
Marshall Greenblatt	bbc35eb30a	Fix dangling ResourceRequest* (fixes #3719 ) Add raw_ptr<network::ResourceRequest> to RequestState instead of passing ResourceRequest* as a bound parameter.	2024-06-21 16:57:10 -04:00
Marshall Greenblatt	b59a20ac7f	Allow dangling UnretainedWrapper for ResourceRequest* (fixes #3717 ) Change UnretainedWrapper traits from MayNotDangle (default) to MayDangleUntriaged as a short-term fix.	2024-06-21 13:00:52 -04:00
Yuta Sekiguchi	0c339dfc41	Rewrite raw pointers reported by clang plugin (see #3239 ) Found using a CEF build with clang_use_chrome_plugins=true and treat_warnings_as_errors=false. This change rewrites remaining raw pointers reported by chromium-rawptr checker and fixes a build error reported by StackAllocatedChecker.	2024-06-21 13:00:52 -04:00
Marshall Greenblatt	c741db0d1f	Update to Chromium version 127.0.6533.17	2024-06-21 15:11:46 +00:00