alloy: Disable ProxyErrorClient callbacks when extensions are disabled (fixes issue #2830)

Calling DetachToUserFree() on a CefString holding a reference should copy the
value instead of transferring ownership.

A new `StringTest.Ownership` test has been added for this behavior.

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,6 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/101.0.4951.0'
+  'chromium_checkout': 'refs/tags/101.0.4951.67',
+  'depot_tools_checkout': '7f02c0d981'
 }

cef_create_projects.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/gclient_hook.py
+python3 tools/gclient_hook.py

include/base/internal/cef_bind_internal.h

@@ -1189,7 +1189,11 @@ struct AssertBindArgsValidity<std::index_sequence<Ns...>,
                               TypeList<Args...>,
                               TypeList<Unwrapped...>,
                               TypeList<Params...>>
-    : AssertConstructible<Ns, Args, std::decay_t<Args>, Unwrapped, Params>... {
+    : AssertConstructible<static_cast<int>(Ns),
+                          Args,
+                          std::decay_t<Args>,
+                          Unwrapped,
+                          Params>... {
   static constexpr bool ok = true;
 };
 

include/internal/cef_string_wrappers.h

@@ -584,10 +584,16 @@ class CefStringBase {
       return NULL;
 
     userfree_struct_type str = traits::userfree_alloc();
-    memcpy(str, string_, sizeof(struct_type));
+    if (owner_) {
+      // Transfer ownership of the data to |str|.
+      memcpy(str, string_, sizeof(struct_type));
+      // Free this class' structure but not the data.
+      memset(string_, 0, sizeof(struct_type));
+    } else {
+      // Copy the data to |str|.
+      traits::set(string_->str, string_->length, str, /*copy=*/true);
+    }
 
-    // Free this class' structure but not the data.
-    memset(string_, 0, sizeof(struct_type));
     ClearAndFree();
 
     return str;

libcef/browser/alloy/browser_platform_delegate_alloy.cc

@@ -261,14 +261,11 @@ void CefBrowserPlatformDelegateAlloy::SendCaptureLostEvent() {
 
 #if BUILDFLAG(IS_WIN) || (BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC))
 void CefBrowserPlatformDelegateAlloy::NotifyMoveOrResizeStarted() {
-  if (!browser_)
+  if (!web_contents_)
     return;
 
   // Dismiss any existing popups.
-  auto frame = browser_->GetMainFrame();
-  if (frame && frame->IsValid()) {
-    static_cast<CefFrameHostImpl*>(frame.get())->NotifyMoveOrResizeStarted();
-  }
+  web_contents_->ClearFocusedElement();
 }
 #endif
 

libcef/browser/browser_contents_delegate.cc

@@ -421,6 +421,10 @@ void CefBrowserContentsDelegate::DidFinishNavigation(
     // history state).
     if (!navigation_handle->IsSameDocument()) {
       OnLoadStart(frame.get(), navigation_handle->GetPageTransition());
+      if (navigation_handle->IsServedFromBackForwardCache()) {
+        // We won't get an OnLoadEnd notification from anywhere else.
+        OnLoadEnd(frame.get(), navigation_handle->GetURL(), 0);
+      }
     }
 
     if (is_main_frame) {

libcef/browser/browser_info.cc

@@ -168,13 +168,10 @@ void CefBrowserInfo::FrameHostStateChanged(
            content::RenderFrameHost::LifecycleState::kInBackForwardCache) &&
       new_state == content::RenderFrameHost::LifecycleState::kActive) {
     if (auto frame = GetFrameForHost(host)) {
-      // Should only occur for the main frame.
-      CHECK(frame->IsMain());
-
       // Update the associated RFH, which may have changed.
       frame->MaybeReAttach(this, host);
 
-      {
+      if (frame->IsMain()) {
         // Update the main frame object.
         NotificationStateLock lock_scope(this);
         SetMainFrame(browser_, frame);

libcef/browser/frame_host_impl.cc

@@ -283,13 +283,6 @@ void CefFrameHostImpl::RefreshAttributes() {
   }
 }
 
-void CefFrameHostImpl::NotifyMoveOrResizeStarted() {
-  SendToRenderFrame(__FUNCTION__,
-                    base::BindOnce([](const RenderFrameType& render_frame) {
-                      render_frame->MoveOrResizeStarted();
-                    }));
-}
-
 void CefFrameHostImpl::LoadRequest(cef::mojom::RequestParamsPtr params) {
   if (!url_util::FixupGURL(params->url))
     return;

libcef/browser/frame_host_impl.h

@@ -82,10 +82,6 @@ class CefFrameHostImpl : public CefFrame, public cef::mojom::BrowserFrame {
   void SetFocused(bool focused);
   void RefreshAttributes();
 
-  // Notification that a move or resize of the renderer's containing window has
-  // started. Used on Windows and Linux with the Alloy runtime.
-  void NotifyMoveOrResizeStarted();
-
   // Load the specified request.
   void LoadRequest(cef::mojom::RequestParamsPtr params);
 

libcef/browser/native/cursor_util_win.cc

@@ -131,7 +131,8 @@ LPCWSTR ToCursorID(ui::mojom::CursorType type) {
 }
 
 bool IsSystemCursorID(LPCWSTR cursor_id) {
-  return cursor_id >= IDC_ARROW;  // See WinUser.h
+  // Check the range of values from WinUser.h.
+  return cursor_id >= IDC_ARROW && cursor_id <= IDC_HELP;
 }
 
 }  // namespace

libcef/browser/net_service/resource_request_handler_wrapper.cc

@@ -112,6 +112,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     CefRefPtr<CefResponseImpl> pending_response_;
     bool request_was_redirected_ = false;
     bool was_custom_handled_ = false;
+    bool accept_language_added_ = false;
     CancelRequestCallback cancel_callback_;
   };
 
@@ -514,9 +515,12 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     }
 
     // Add standard headers, if currently unspecified.
-    request->headers.SetHeaderIfMissing(
-        net::HttpRequestHeaders::kAcceptLanguage,
-        init_state_->accept_language_);
+    if (!request->headers.HasHeader(net::HttpRequestHeaders::kAcceptLanguage)) {
+      request->headers.SetHeaderIfMissing(
+          net::HttpRequestHeaders::kAcceptLanguage,
+          init_state_->accept_language_);
+      state->accept_language_added_ = true;
+    }
     request->headers.SetHeaderIfMissing(net::HttpRequestHeaders::kUserAgent,
                                         init_state_->user_agent_);
 
@@ -771,7 +775,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       resource_response = CreateResourceResponse(request_id, resource_handler);
       DCHECK(resource_response);
       state->was_custom_handled_ = true;
-    } else {
+    } else if (state->accept_language_added_) {
       // The request will be handled by the NetworkService. Remove the
       // "Accept-Language" header here so that it can be re-added in
       // URLRequestHttpJob::AddExtraHeaders with correct ordering applied.

libcef/browser/views/browser_view_view.h

@@ -16,7 +16,13 @@
 // CefViewView template.
 class WebViewEx : public views::WebView {
  public:
-  WebViewEx() : views::WebView(nullptr) {}
+  WebViewEx() : views::WebView(nullptr) {
+    // Mouse events on draggable regions will not be handled by the WebView.
+    // Avoid the resulting DCHECK in NativeViewHost::OnMousePressed by
+    // configuring the NativeViewHost not to process events via the view
+    // hierarchy.
+    holder()->SetCanProcessEventsWithinSubtree(false);
+  }
 };
 
 class CefBrowserViewView

libcef/browser/views/view_util.cc

@@ -217,12 +217,12 @@ display::Display GetDisplayMatchingBounds(const gfx::Rect& bounds,
   return display::Screen::GetScreen()->GetDisplayMatching(find_bounds);
 }
 
-void ConvertPointFromPixels(gfx::Point* point, int device_scale_factor) {
+void ConvertPointFromPixels(gfx::Point* point, float device_scale_factor) {
   *point = gfx::ToFlooredPoint(
       gfx::ScalePoint(gfx::PointF(*point), 1.0f / device_scale_factor));
 }
 
-void ConvertPointToPixels(gfx::Point* point, int device_scale_factor) {
+void ConvertPointToPixels(gfx::Point* point, float device_scale_factor) {
   *point = gfx::ToFlooredPoint(
       gfx::ScalePoint(gfx::PointF(*point), device_scale_factor));
 }

libcef/browser/views/view_util.h

@@ -84,11 +84,11 @@ display::Display GetDisplayMatchingBounds(const gfx::Rect& bounds,
 
 // Convert |point| from pixel coordinates to density independent pixels (DIP)
 // using |device_scale_factor|.
-void ConvertPointFromPixels(gfx::Point* point, int device_scale_factor);
+void ConvertPointFromPixels(gfx::Point* point, float device_scale_factor);
 
 // Convert |point| to pixel coordinates from density independent pixels (DIP)
 // using |device_scale_factor|.
-void ConvertPointToPixels(gfx::Point* point, int device_scale_factor);
+void ConvertPointToPixels(gfx::Point* point, float device_scale_factor);
 
 // Convert |point| from |view| to screen coordinates. If |output_pixel_coords|
 // is true then |point| will be output in pixel coordinates instead of density

libcef/common/mojom/cef.mojom

@@ -73,10 +73,6 @@ interface RenderFrame {
 
   // Loading has stopped.
   DidStopLoading();
-
-  // Move or resize of the renderer's containing window has started. Used on
-  // Windows and Linux with the Alloy runtime.
-  MoveOrResizeStarted();
 };
 
 // Interface for communicating with a frame in the browser process.

libcef/renderer/blink_glue.cc

@@ -22,6 +22,8 @@
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/dom/node.h"
 #include "third_party/blink/renderer/core/editing/serializers/serialization.h"
+#include "third_party/blink/renderer/core/execution_context/execution_context.h"
+#include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_state_observer.h"
 #include "third_party/blink/renderer/core/exported/web_view_impl.h"
 #include "third_party/blink/renderer/core/frame/frame_owner.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
@@ -220,6 +222,43 @@ bool IsScriptForbidden() {
   return blink::ScriptForbiddenScope::IsScriptForbidden();
 }
 
+std::unique_ptr<CefObserverRegistration>
+RegisterExecutionContextLifecycleStateObserver(
+    v8::Local<v8::Context> context,
+    CefExecutionContextLifecycleStateObserver* observer) {
+  class Observer : public blink::GarbageCollected<Observer>,
+                   public blink::ExecutionContextLifecycleStateObserver {
+   public:
+    Observer(blink::ExecutionContext* execution_context,
+             CefExecutionContextLifecycleStateObserver* observer)
+        : blink::ExecutionContextLifecycleStateObserver(execution_context),
+          observer_(observer) {
+      UpdateStateIfNeeded();
+    }
+
+    void ContextLifecycleStateChanged(
+        blink::mojom::blink::FrameLifecycleState state) override {
+      observer_->ContextLifecycleStateChanged(state);
+    }
+
+    void ContextDestroyed() override {}
+
+   private:
+    CefExecutionContextLifecycleStateObserver* observer_;
+  };
+
+  class Registration : public CefObserverRegistration {
+   public:
+    Registration(blink::Persistent<Observer> observer) : observer_(observer) {}
+
+   private:
+    blink::Persistent<Observer> observer_;
+  };
+
+  return std::make_unique<Registration>(blink::MakeGarbageCollected<Observer>(
+      blink::ExecutionContext::From(context), observer));
+}
+
 void RegisterURLSchemeAsSupportingFetchAPI(const blink::WebString& scheme) {
   blink::SchemeRegistry::RegisterURLSchemeAsSupportingFetchAPI(scheme);
 }

libcef/renderer/blink_glue.h

@@ -13,6 +13,7 @@
 
 #include "include/internal/cef_types.h"
 
+#include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "v8/include/v8.h"
 
@@ -72,6 +73,32 @@ BLINK_EXPORT v8::Local<v8::Value> ExecuteV8ScriptAndReturnValue(
 
 BLINK_EXPORT bool IsScriptForbidden();
 
+class BLINK_EXPORT CefObserverRegistration {
+ public:
+  CefObserverRegistration() = default;
+
+  CefObserverRegistration(const CefObserverRegistration&) = delete;
+  CefObserverRegistration& operator=(const CefObserverRegistration&) = delete;
+
+  virtual ~CefObserverRegistration() = default;
+};
+
+class BLINK_EXPORT CefExecutionContextLifecycleStateObserver {
+ public:
+  virtual void ContextLifecycleStateChanged(
+      blink::mojom::blink::FrameLifecycleState state) {}
+
+ protected:
+  virtual ~CefExecutionContextLifecycleStateObserver() = default;
+};
+
+// Register an ExecutionContextLifecycleStateObserver. Remains registered until
+// the returned object is destroyed.
+BLINK_EXPORT std::unique_ptr<CefObserverRegistration>
+RegisterExecutionContextLifecycleStateObserver(
+    v8::Local<v8::Context> context,
+    CefExecutionContextLifecycleStateObserver* observer);
+
 BLINK_EXPORT void RegisterURLSchemeAsSupportingFetchAPI(
     const blink::WebString& scheme);
 

libcef/renderer/browser_impl.cc

@@ -393,6 +393,19 @@ void CefBrowserImpl::OnLoadingStateChange(bool isLoading) {
           return;
         }
 
+        if (was_in_bfcache_) {
+          // Send the expected callbacks when exiting the BFCache.
+          DCHECK(!isLoading);
+          load_handler->OnLoadingStateChange(this, /*isLoading=*/true,
+                                             canGoBack, canGoForward);
+
+          auto main_frame = GetMainFrame();
+          load_handler->OnLoadStart(this, main_frame, TT_EXPLICIT);
+          load_handler->OnLoadEnd(this, main_frame, 0);
+
+          was_in_bfcache_ = false;
+        }
+
         load_handler->OnLoadingStateChange(this, isLoading, canGoBack,
                                            canGoForward);
         last_loading_state_.reset(
@@ -401,3 +414,10 @@ void CefBrowserImpl::OnLoadingStateChange(bool isLoading) {
     }
   }
 }
+
+void CefBrowserImpl::OnEnterBFCache() {
+  // Reset loading state so that notifications will be resent if/when exiting
+  // BFCache.
+  was_in_bfcache_ = true;
+  last_loading_state_.reset();
+}

libcef/renderer/browser_impl.h

@@ -92,6 +92,7 @@ class CefBrowserImpl : public CefBrowser, public blink::WebViewObserver {
   void FrameDetached(int64_t frame_id);
 
   void OnLoadingStateChange(bool isLoading);
+  void OnEnterBFCache();
 
  private:
   // ID of the browser that this RenderView is associated with. During loading
@@ -105,6 +106,9 @@ class CefBrowserImpl : public CefBrowser, public blink::WebViewObserver {
   using FrameMap = std::map<int64, CefRefPtr<CefFrameImpl>>;
   FrameMap frames_;
 
+  // True if the browser was in the BFCache.
+  bool was_in_bfcache_ = false;
+
   // Map of unique frame ids to CefTrackManager objects that need to be cleaned
   // up when the frame is deleted.
   using FrameObjectMap = std::map<int64, CefRefPtr<CefTrackManager>>;

libcef/renderer/frame_impl.cc

@@ -35,6 +35,7 @@
 #include "content/public/renderer/render_view.h"
 #include "content/renderer/render_frame_impl.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom-blink.h"
+#include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink.h"
 #include "third_party/blink/public/platform/web_back_forward_cache_loader_helper.h"
 #include "third_party/blink/public/platform/web_data.h"
 #include "third_party/blink/public/platform/web_string.h"
@@ -390,7 +391,7 @@ void CefFrameImpl::OnDraggableRegionsChanged() {
           std::move(regions_arg)));
 }
 
-void CefFrameImpl::OnContextCreated() {
+void CefFrameImpl::OnContextCreated(v8::Local<v8::Context> context) {
   context_created_ = true;
 
   CHECK(frame_);
@@ -399,6 +400,13 @@ void CefFrameImpl::OnContextCreated() {
     std::move(action.second).Run(frame_);
     queued_context_actions_.pop();
   }
+
+  execution_context_lifecycle_state_observer_ =
+      blink_glue::RegisterExecutionContextLifecycleStateObserver(context, this);
+}
+
+void CefFrameImpl::OnContextReleased() {
+  execution_context_lifecycle_state_observer_.reset();
 }
 
 void CefFrameImpl::OnDetached() {
@@ -676,11 +684,11 @@ void CefFrameImpl::DidStopLoading() {
   OnDraggableRegionsChanged();
 }
 
-void CefFrameImpl::MoveOrResizeStarted() {
-  if (frame_) {
-    auto web_view = frame_->View();
-    if (web_view)
-      web_view->CancelPagePopup();
+void CefFrameImpl::ContextLifecycleStateChanged(
+    blink::mojom::blink::FrameLifecycleState state) {
+  if (state == blink::mojom::FrameLifecycleState::kFrozen && IsMain() &&
+      blink_glue::IsInBackForwardCache(frame_)) {
+    browser_->OnEnterBFCache();
   }
 }
 

libcef/renderer/frame_impl.h

@@ -11,6 +11,7 @@
 
 #include "include/cef_frame.h"
 #include "include/cef_v8.h"
+#include "libcef/renderer/blink_glue.h"
 
 #include "base/memory/weak_ptr.h"
 #include "base/timer/timer.h"
@@ -37,7 +38,10 @@ class CefBrowserImpl;
 // Implementation of CefFrame. CefFrameImpl objects are owned by the
 // CefBrowerImpl and will be detached when the browser is notified that the
 // associated renderer WebFrame will close.
-class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
+class CefFrameImpl
+    : public CefFrame,
+      public cef::mojom::RenderFrame,
+      public blink_glue::CefExecutionContextLifecycleStateObserver {
  public:
   CefFrameImpl(CefBrowserImpl* browser,
                blink::WebLocalFrame* frame,
@@ -90,7 +94,8 @@ class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
   void OnWasShown();
   void OnDidFinishLoad();
   void OnDraggableRegionsChanged();
-  void OnContextCreated();
+  void OnContextCreated(v8::Local<v8::Context> context);
+  void OnContextReleased();
   void OnDetached();
 
   blink::WebLocalFrame* web_frame() const { return frame_; }
@@ -137,7 +142,10 @@ class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
                       int32_t startLine) override;
   void LoadRequest(cef::mojom::RequestParamsPtr params) override;
   void DidStopLoading() override;
-  void MoveOrResizeStarted() override;
+
+  // blink_glue::CefExecutionContextLifecycleStateObserver methods:
+  void ContextLifecycleStateChanged(
+      blink::mojom::blink::FrameLifecycleState state) override;
 
   CefBrowserImpl* browser_;
   blink::WebLocalFrame* frame_;
@@ -168,6 +176,9 @@ class CefFrameImpl : public CefFrame, public cef::mojom::RenderFrame {
 
   mojo::Remote<cef::mojom::BrowserFrame> browser_frame_;
 
+  std::unique_ptr<blink_glue::CefObserverRegistration>
+      execution_context_lifecycle_state_observer_;
+
   base::WeakPtrFactory<CefFrameImpl> weak_ptr_factory_{this};
 
   IMPLEMENT_REFCOUNTING(CefFrameImpl);

libcef/renderer/render_frame_observer.cc

@@ -148,7 +148,7 @@ void CefRenderFrameObserver::DidCreateScriptContext(
   }
 
   // Do this last, in case the client callback modified the window object.
-  framePtr->OnContextCreated();
+  framePtr->OnContextCreated(context);
 }
 
 void CefRenderFrameObserver::WillReleaseScriptContext(
@@ -157,31 +157,32 @@ void CefRenderFrameObserver::WillReleaseScriptContext(
   blink::WebLocalFrame* frame = render_frame()->GetWebFrame();
   CefRefPtr<CefBrowserImpl> browserPtr =
       CefBrowserImpl::GetBrowserForMainFrame(frame->Top());
-  if (browserPtr) {
-    CefRefPtr<CefApp> application = CefAppManager::Get()->GetApplication();
-    if (application) {
-      CefRefPtr<CefRenderProcessHandler> handler =
-          application->GetRenderProcessHandler();
-      if (handler) {
-        CefRefPtr<CefFrameImpl> framePtr = browserPtr->GetWebFrameImpl(frame);
+  if (!browserPtr)
+    return;
 
-        v8::Isolate* isolate = blink::MainThreadIsolate();
-        v8::HandleScope handle_scope(isolate);
+  CefRefPtr<CefRenderProcessHandler> handler;
+  CefRefPtr<CefApp> application = CefAppManager::Get()->GetApplication();
+  if (application)
+    handler = application->GetRenderProcessHandler();
 
-        // The released context should not be used for script execution.
-        // Depending on how the context is released this may or may not already
-        // be set.
-        blink_glue::CefScriptForbiddenScope forbidScript;
+  CefRefPtr<CefFrameImpl> framePtr = browserPtr->GetWebFrameImpl(frame);
 
-        CefRefPtr<CefV8Context> contextPtr(
-            new CefV8ContextImpl(isolate, context));
+  if (handler) {
+    v8::Isolate* isolate = blink::MainThreadIsolate();
+    v8::HandleScope handle_scope(isolate);
 
-        handler->OnContextReleased(browserPtr.get(), framePtr.get(),
-                                   contextPtr);
-      }
-    }
+    // The released context should not be used for script execution.
+    // Depending on how the context is released this may or may not already
+    // be set.
+    blink_glue::CefScriptForbiddenScope forbidScript;
+
+    CefRefPtr<CefV8Context> contextPtr(new CefV8ContextImpl(isolate, context));
+
+    handler->OnContextReleased(browserPtr.get(), framePtr.get(), contextPtr);
   }
 
+  framePtr->OnContextReleased();
+
   CefV8ReleaseContext(context);
 }
 

libcef/renderer/v8_impl.cc

@@ -1607,7 +1607,7 @@ v8::Local<v8::Value> CefV8ValueImpl::GetV8Value(bool should_persist) {
     case TYPE_INT:
       return v8::Int32::New(isolate_, int_value_);
     case TYPE_UINT:
-      return v8::Uint32::New(isolate_, uint_value_);
+      return v8::Uint32::NewFromUnsigned(isolate_, uint_value_);
     case TYPE_DOUBLE:
       return v8::Number::New(isolate_, double_value_);
     case TYPE_DATE:

patch/patch.cfg

@@ -220,7 +220,13 @@ patches = [
     'name': 'chrome_browser_extensions',
   },
   {
-    # Don't initialize ExtensionSystemFactory when extensions are disabled.
+    # alloy: Disable ProxyErrorClient callbacks when extensions are disabled.
+    # https://bitbucket.org/chromiumembedded/cef/issues/2830
+    'name': 'chrome_browser_net_proxy',
+  },
+  {
+    # alloy: Don't initialize ExtensionSystemFactory when extensions are
+    # disabled.
     # https://bitbucket.org/chromiumembedded/cef/issues/2852
     'name': 'chrome_browser_themes',
   },

patch/patches/base_sandbox_2743.patch

@@ -1,5 +1,5 @@
 diff --git base/BUILD.gn base/BUILD.gn
-index 29f74fb8bedaa..2608ea2a70aca 100644
+index 6c410103c3933..6305fdd791826 100644
 --- base/BUILD.gn
 +++ base/BUILD.gn
 @@ -37,6 +37,7 @@ import("//build/nocompile.gni")
@@ -10,7 +10,7 @@ index 29f74fb8bedaa..2608ea2a70aca 100644
  import("//testing/libfuzzer/fuzzer_test.gni")
  import("//testing/test.gni")
  import("//third_party/icu/config.gni")
-@@ -1896,7 +1897,11 @@ mixed_component("base") {
+@@ -1895,7 +1896,11 @@ mixed_component("base") {
      "hash/md5_constexpr_internal.h",
      "hash/sha1.h",
    ]
@@ -23,7 +23,7 @@ index 29f74fb8bedaa..2608ea2a70aca 100644
      sources += [
        "hash/md5_nacl.cc",
        "hash/md5_nacl.h",
-@@ -2150,6 +2155,12 @@ mixed_component("base") {
+@@ -2149,6 +2154,12 @@ mixed_component("base") {
        defines += [ "COM_INIT_CHECK_HOOK_DISABLED" ]
      }
  

patch/patches/browser_security_policy_1081397.patch

@@ -20,10 +20,10 @@ index f5b91aa9fc965..65319cceb358c 100644
  
            // TODO(wjmaclean): We should update the ProcessLock comparison API
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index dad72b675ef23..e5afb8080f074 100644
+index 72a902bbd2557..df1a8e009755a 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
-@@ -6053,6 +6053,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithoutFinalFrameHost(
+@@ -6069,6 +6069,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithoutFinalFrameHost(
      network::mojom::WebSandboxFlags sandbox_flags) {
    // Calculate an approximation of the origin. The sandbox/csp are ignored.
    url::Origin origin = GetOriginForURLLoaderFactoryUnchecked(this);
@@ -36,7 +36,7 @@ index dad72b675ef23..e5afb8080f074 100644
  
    // Apply sandbox flags.
    // See https://html.spec.whatwg.org/#sandboxed-origin-browsing-context-flag
-@@ -6086,6 +6092,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithFinalFrameHost() {
+@@ -6102,6 +6108,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryWithFinalFrameHost() {
    if (IsSameDocument() || IsPageActivation())
      return GetRenderFrameHost()->GetLastCommittedOrigin();
  

patch/patches/chrome_browser.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index fbceb85450c53..1141aa50698fe 100644
+index a9322c24ebaa8..627c60761cf6e 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
 @@ -12,6 +12,7 @@ import("//build/config/features.gni")
@@ -10,7 +10,7 @@ index fbceb85450c53..1141aa50698fe 100644
  import("//chrome/browser/buildflags.gni")
  import("//chrome/browser/downgrade/buildflags.gni")
  import("//chrome/common/features.gni")
-@@ -1916,6 +1917,7 @@ static_library("browser") {
+@@ -1925,6 +1926,7 @@ static_library("browser") {
      "//build:chromeos_buildflags",
      "//build/config/compiler:compiler_buildflags",
      "//cc",
@@ -18,7 +18,7 @@ index fbceb85450c53..1141aa50698fe 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -2572,6 +2574,10 @@ static_library("browser") {
+@@ -2582,6 +2584,10 @@ static_library("browser") {
      deps += [ "//chrome/browser/ui/webui/connectors_internals:mojo_bindings" ]
    }
  

patch/patches/chrome_browser_net_export.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index 936021a313995..2dd2554f8a7c5 100644
+index 3078935563b84..57fbdc93ae5ad 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -10,6 +10,7 @@ import("//build/config/features.gni")
@@ -29,7 +29,7 @@ index 936021a313995..2dd2554f8a7c5 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -5301,6 +5307,7 @@ static_library("ui") {
+@@ -5299,6 +5305,7 @@ static_library("ui") {
    if (enable_basic_printing) {
      deps += [
        "//components/printing/browser",

patch/patches/chrome_browser_net_proxy.patch

@@ -0,0 +1,33 @@
+diff --git chrome/browser/net/proxy_config_monitor.cc chrome/browser/net/proxy_config_monitor.cc
+index 88fad9811069e..9973245011e24 100644
+--- chrome/browser/net/proxy_config_monitor.cc
++++ chrome/browser/net/proxy_config_monitor.cc
+@@ -9,6 +9,7 @@
+ #include "base/strings/utf_string_conversions.h"
+ #include "build/build_config.h"
+ #include "build/chromeos_buildflags.h"
++#include "cef/libcef/features/runtime.h"
+ #include "chrome/browser/browser_process.h"
+ #include "chrome/browser/net/proxy_service_factory.h"
+ #include "chrome/browser/profiles/profile.h"
+@@ -21,6 +22,10 @@
+ #include "chrome/browser/ash/profiles/profile_helper.h"
+ #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
+ 
++#if BUILDFLAG(ENABLE_CEF)
++#include "cef/libcef/common/extensions/extensions_util.h"
++#endif
++
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
+ #include "chrome/browser/extensions/api/proxy/proxy_api.h"
+ #endif
+@@ -89,6 +94,9 @@ void ProxyConfigMonitor::AddToNetworkContextParams(
+                                .InitWithNewPipeAndPassReceiver());
+ 
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
++#if BUILDFLAG(ENABLE_CEF)
++  if (!cef::IsAlloyRuntimeEnabled() || extensions::ExtensionsEnabled())
++#endif
+   error_receiver_set_.Add(this, network_context_params->proxy_error_client
+                                     .InitWithNewPipeAndPassReceiver());
+ #endif

patch/patches/chrome_browser_themes.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/themes/theme_service.cc chrome/browser/themes/theme_service.cc
-index e921b7e8be8dc..414358c5191f1 100644
+index 79b8e30b8f584..507abacbdeb19 100644
 --- chrome/browser/themes/theme_service.cc
 +++ chrome/browser/themes/theme_service.cc
 @@ -32,6 +32,7 @@
@@ -21,7 +21,7 @@ index e921b7e8be8dc..414358c5191f1 100644
  #if BUILDFLAG(ENABLE_EXTENSIONS)
  #include "base/scoped_observation.h"
  #include "extensions/browser/extension_registry_observer.h"
-@@ -573,11 +578,19 @@ void ThemeService::Init() {
+@@ -571,11 +576,19 @@ void ThemeService::Init() {
    // OnExtensionServiceReady. Otherwise, the ThemeObserver won't be
    // constructed in time to observe the corresponding events.
  #if BUILDFLAG(ENABLE_EXTENSIONS)

patch/patches/chrome_runtime.patch

@@ -132,7 +132,7 @@ index 566535f74acf1..4b435553575b0 100644
          GetMainRunLoopInstance()->QuitWhenIdleClosure());
    }
 diff --git chrome/browser/chrome_browser_main_mac.mm chrome/browser/chrome_browser_main_mac.mm
-index 831d7173873d1..594aee58331a7 100644
+index 8bf722c61c059..ac755279227f2 100644
 --- chrome/browser/chrome_browser_main_mac.mm
 +++ chrome/browser/chrome_browser_main_mac.mm
 @@ -16,6 +16,7 @@
@@ -143,7 +143,7 @@ index 831d7173873d1..594aee58331a7 100644
  #import "chrome/browser/app_controller_mac.h"
  #include "chrome/browser/apps/app_shim/app_shim_listener.h"
  #include "chrome/browser/browser_process.h"
-@@ -111,6 +112,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+@@ -112,6 +113,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
      }
    }
  
@@ -151,15 +151,15 @@ index 831d7173873d1..594aee58331a7 100644
    // Create the app delegate. This object is intentionally leaked as a global
    // singleton. It is accessed through -[NSApp delegate].
    AppController* app_controller = [[AppController alloc] init];
-@@ -119,6 +121,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
+@@ -120,6 +122,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
    chrome::BuildMainMenu(NSApp, app_controller,
                          l10n_util::GetStringUTF16(IDS_PRODUCT_NAME), false);
    [app_controller mainMenuCreated];
 +#endif  // BUILDFLAG(ENABLE_CEF)
  
    chrome::DeveloperIDCertificateReauthorizeInApp();
- 
-@@ -180,7 +183,9 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
+   chrome::PurgeStaleScreenCapturePermission();
+@@ -182,7 +185,9 @@ void ChromeBrowserMainPartsMac::PostProfileInit(Profile* profile,
  }
  
  void ChromeBrowserMainPartsMac::DidEndMainMessageLoop() {
@@ -170,7 +170,7 @@ index 831d7173873d1..594aee58331a7 100644
 +#endif
  }
 diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
-index 019fd68040dc5..794765646efc7 100644
+index 6ec5a66dcba33..be011c0719138 100644
 --- chrome/browser/chrome_content_browser_client.cc
 +++ chrome/browser/chrome_content_browser_client.cc
 @@ -28,6 +28,7 @@
@@ -181,7 +181,7 @@ index 019fd68040dc5..794765646efc7 100644
  #include "chrome/browser/accessibility/accessibility_labels_service.h"
  #include "chrome/browser/accessibility/accessibility_labels_service_factory.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -1272,6 +1273,8 @@ bool IsTopChromeWebUIURL(const GURL& url) {
+@@ -1275,6 +1276,8 @@ bool IsTopChromeWebUIURL(const GURL& url) {
  }  // namespace
  
  ChromeContentBrowserClient::ChromeContentBrowserClient() {
@@ -190,7 +190,7 @@ index 019fd68040dc5..794765646efc7 100644
  #if BUILDFLAG(ENABLE_PLUGINS)
    extra_parts_.push_back(new ChromeContentBrowserClientPluginsPart);
  #endif
-@@ -1297,6 +1300,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
+@@ -1300,6 +1303,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
    extra_parts_.clear();
  }
  
@@ -202,7 +202,7 @@ index 019fd68040dc5..794765646efc7 100644
  // static
  void ChromeContentBrowserClient::RegisterLocalStatePrefs(
      PrefRegistrySimple* registry) {
-@@ -3725,9 +3733,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
+@@ -3743,9 +3751,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
                            &search::HandleNewTabURLReverseRewrite);
  #endif  // BUILDFLAG(IS_ANDROID)
  
@@ -214,7 +214,7 @@ index 019fd68040dc5..794765646efc7 100644
  }
  
  base::FilePath ChromeContentBrowserClient::GetDefaultDownloadDirectory() {
-@@ -5354,7 +5364,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
+@@ -5372,7 +5382,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
        network_service);
  }
  
@@ -223,7 +223,7 @@ index 019fd68040dc5..794765646efc7 100644
      content::BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -5372,6 +5382,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
+@@ -5390,6 +5400,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
      network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
      network_context_params->accept_language = GetApplicationLocale();
    }
@@ -232,7 +232,7 @@ index 019fd68040dc5..794765646efc7 100644
  }
  
  std::vector<base::FilePath>
-@@ -6212,10 +6224,10 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
+@@ -6271,10 +6283,10 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
    const auto now = base::TimeTicks::Now();
    const auto timeout = GetKeepaliveTimerTimeout(context);
    keepalive_deadline_ = std::max(keepalive_deadline_, now + timeout);
@@ -245,7 +245,7 @@ index 019fd68040dc5..794765646efc7 100644
          FROM_HERE, keepalive_deadline_ - now,
          base::BindOnce(
              &ChromeContentBrowserClient::OnKeepaliveTimerFired,
-@@ -6234,7 +6246,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
+@@ -6293,7 +6305,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
    --num_keepalive_requests_;
    if (num_keepalive_requests_ == 0) {
      DVLOG(1) << "Stopping the keepalive timer";
@@ -255,7 +255,7 @@ index 019fd68040dc5..794765646efc7 100644
      // This deletes the keep alive handle attached to the timer function and
      // unblock the shutdown sequence.
    }
-@@ -6342,7 +6355,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
+@@ -6401,7 +6414,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
    const auto now = base::TimeTicks::Now();
    const auto then = keepalive_deadline_;
    if (now < then) {
@@ -265,7 +265,7 @@ index 019fd68040dc5..794765646efc7 100644
          base::BindOnce(&ChromeContentBrowserClient::OnKeepaliveTimerFired,
                         weak_factory_.GetWeakPtr(),
 diff --git chrome/browser/chrome_content_browser_client.h chrome/browser/chrome_content_browser_client.h
-index 4aa99834bd6c7..cd932dd3cacf4 100644
+index e87e967efce09..5948dbc959683 100644
 --- chrome/browser/chrome_content_browser_client.h
 +++ chrome/browser/chrome_content_browser_client.h
 @@ -120,6 +120,8 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
@@ -286,7 +286,7 @@ index 4aa99834bd6c7..cd932dd3cacf4 100644
        content::BrowserContext* context,
        bool in_memory,
        const base::FilePath& relative_partition_path,
-@@ -913,7 +915,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+@@ -917,7 +919,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
  
  #if !BUILDFLAG(IS_ANDROID)
    uint64_t num_keepalive_requests_ = 0;
@@ -296,7 +296,7 @@ index 4aa99834bd6c7..cd932dd3cacf4 100644
  #endif
  
 diff --git chrome/browser/prefs/browser_prefs.cc chrome/browser/prefs/browser_prefs.cc
-index a265ff6d1cf43..cebf6e611c84d 100644
+index 095881e6bb92f..3c25e8af6f950 100644
 --- chrome/browser/prefs/browser_prefs.cc
 +++ chrome/browser/prefs/browser_prefs.cc
 @@ -11,6 +11,7 @@
@@ -318,7 +318,7 @@ index a265ff6d1cf43..cebf6e611c84d 100644
  #if BUILDFLAG(ENABLE_EXTENSIONS)
  #include "chrome/browser/accessibility/animation_policy_prefs.h"
  #include "chrome/browser/apps/platform_apps/shortcut_manager.h"
-@@ -1264,6 +1269,10 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
+@@ -1267,6 +1272,10 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
    SessionDataService::RegisterProfilePrefs(registry);
  #endif
  

patch/patches/chrome_runtime_views.patch

@@ -171,10 +171,10 @@ index d42661a633fcd..85b03452d4dc3 100644
    BrowserFrame(const BrowserFrame&) = delete;
    BrowserFrame& operator=(const BrowserFrame&) = delete;
 diff --git chrome/browser/ui/views/frame/browser_view.cc chrome/browser/ui/views/frame/browser_view.cc
-index 39cef285ed27c..e08ec72ba9c85 100644
+index f0303eb7fc215..e32d8a8d61001 100644
 --- chrome/browser/ui/views/frame/browser_view.cc
 +++ chrome/browser/ui/views/frame/browser_view.cc
-@@ -300,11 +300,10 @@ using content::WebContents;
+@@ -302,11 +302,10 @@ using content::WebContents;
  using views::ColumnSet;
  using web_modal::WebContentsModalDialogHost;
  
@@ -189,7 +189,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
  
  #if BUILDFLAG(IS_CHROMEOS_ASH)
  // UMA histograms that record animation smoothness for tab loading animation.
-@@ -689,11 +688,22 @@ class BrowserView::SidePanelButtonHighlighter : public views::ViewObserver {
+@@ -795,11 +794,22 @@ class BrowserView::SidePanelVisibilityController : public views::ViewObserver {
  ///////////////////////////////////////////////////////////////////////////////
  // BrowserView, public:
  
@@ -213,7 +213,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
    SetShowIcon(
        ::ShouldShowWindowIcon(browser_.get(), AppUsesWindowControlsOverlay()));
  
-@@ -728,7 +738,6 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+@@ -834,7 +844,6 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
    }
  
    browser_->tab_strip_model()->AddObserver(this);
@@ -221,7 +221,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
  
    // Top container holds tab strip region and toolbar and lives at the front of
    // the view hierarchy.
-@@ -771,8 +780,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+@@ -877,8 +886,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
    contents_container->SetLayoutManager(std::make_unique<ContentsLayoutManager>(
        devtools_web_view_, contents_web_view_));
  
@@ -239,7 +239,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
  
    contents_separator_ =
        top_container_->AddChildView(std::make_unique<ContentsSeparator>());
-@@ -1644,6 +1660,8 @@ bool BrowserView::ShouldHideUIForFullscreen() const {
+@@ -1763,6 +1779,8 @@ bool BrowserView::ShouldHideUIForFullscreen() const {
    if (immersive_mode_controller_->IsEnabled())
      return false;
  
@@ -248,7 +248,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
    return frame_->GetFrameView()->ShouldHideTopUIForFullscreen();
  }
  
-@@ -2814,7 +2832,8 @@ BrowserView::GetNativeViewHostsForTopControlsSlide() const {
+@@ -2934,7 +2952,8 @@ BrowserView::GetNativeViewHostsForTopControlsSlide() const {
  }
  
  void BrowserView::ReparentTopContainerForEndOfImmersive() {
@@ -258,7 +258,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
    top_container()->DestroyLayer();
    AddChildViewAt(top_container(), 0);
    EnsureFocusOrder();
-@@ -3334,8 +3353,10 @@ void BrowserView::Layout() {
+@@ -3475,8 +3494,10 @@ void BrowserView::Layout() {
  
    // TODO(jamescook): Why was this in the middle of layout code?
    toolbar_->location_bar()->omnibox_view()->SetFocusBehavior(
@@ -271,7 +271,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
  
    // Some of the situations when the BrowserView is laid out are:
    // - Enter/exit immersive fullscreen mode.
-@@ -3401,6 +3422,11 @@ void BrowserView::AddedToWidget() {
+@@ -3542,6 +3563,11 @@ void BrowserView::AddedToWidget() {
    SetThemeProfileForWindow(GetNativeWindow(), browser_->profile());
  #endif
  
@@ -283,7 +283,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
    toolbar_->Init();
  
    // TODO(pbos): Manage this either inside SidePanel or the corresponding button
-@@ -3459,13 +3485,9 @@ void BrowserView::AddedToWidget() {
+@@ -3605,13 +3631,9 @@ void BrowserView::AddedToWidget() {
  
    EnsureFocusOrder();
  
@@ -299,7 +299,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
    using_native_frame_ = frame_->ShouldUseNativeFrame();
  
    MaybeInitializeWebUITabStrip();
-@@ -3894,7 +3916,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
+@@ -4040,7 +4062,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
    // Undo our anti-jankiness hacks and force a re-layout.
    in_process_fullscreen_ = false;
    ToolbarSizeChanged(false);
@@ -309,7 +309,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
  }
  
  bool BrowserView::ShouldUseImmersiveFullscreenForUrl(const GURL& url) const {
-@@ -4221,6 +4244,8 @@ Profile* BrowserView::GetProfile() {
+@@ -4367,6 +4390,8 @@ Profile* BrowserView::GetProfile() {
  }
  
  void BrowserView::UpdateUIForTabFullscreen() {
@@ -318,7 +318,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
    frame()->GetFrameView()->UpdateFullscreenTopUI();
  }
  
-@@ -4243,6 +4268,8 @@ void BrowserView::HideDownloadShelf() {
+@@ -4389,6 +4414,8 @@ void BrowserView::HideDownloadShelf() {
  }
  
  bool BrowserView::CanUserExitFullscreen() const {
@@ -328,7 +328,7 @@ index 39cef285ed27c..e08ec72ba9c85 100644
  }
  
 diff --git chrome/browser/ui/views/frame/browser_view.h chrome/browser/ui/views/frame/browser_view.h
-index 69f92ec5228c4..b6100283f81d0 100644
+index 19ffaf7bb75ab..062dadf456efa 100644
 --- chrome/browser/ui/views/frame/browser_view.h
 +++ chrome/browser/ui/views/frame/browser_view.h
 @@ -127,11 +127,16 @@ class BrowserView : public BrowserWindow,
@@ -348,7 +348,7 @@ index 69f92ec5228c4..b6100283f81d0 100644
    void set_frame(BrowserFrame* frame) { frame_ = frame; }
    BrowserFrame* frame() const { return frame_; }
  
-@@ -732,6 +737,12 @@ class BrowserView : public BrowserWindow,
+@@ -741,6 +746,12 @@ class BrowserView : public BrowserWindow,
        const std::map<std::string, std::string>& extra_data) override;
  #endif
  
@@ -388,6 +388,22 @@ index a6f15f3436bef..5e2ab8373458b 100644
    int browser_view_width = vertical_layout_rect_.width();
    bool toolbar_visible = delegate_->IsToolbarVisible();
    int height = toolbar_visible ? toolbar_->GetPreferredSize().height() : 0;
+diff --git chrome/browser/ui/views/frame/contents_web_view.cc chrome/browser/ui/views/frame/contents_web_view.cc
+index 5f985efa03120..cd38b49974ecb 100644
+--- chrome/browser/ui/views/frame/contents_web_view.cc
++++ chrome/browser/ui/views/frame/contents_web_view.cc
+@@ -24,6 +24,11 @@
+ ContentsWebView::ContentsWebView(content::BrowserContext* browser_context)
+     : views::WebView(browser_context),
+       status_bubble_(nullptr) {
++  // Mouse events on draggable regions will not be handled by the WebView.
++  // Avoid the resulting DCHECK in NativeViewHost::OnMousePressed by
++  // configuring the NativeViewHost not to process events via the view
++  // hierarchy.
++  holder()->SetCanProcessEventsWithinSubtree(false);
+ }
+ 
+ ContentsWebView::~ContentsWebView() {
 diff --git chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
 index 7475765f4b514..25c59d942782b 100644
 --- chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
@@ -441,10 +457,10 @@ index 7475765f4b514..25c59d942782b 100644
  }
  
 diff --git chrome/browser/ui/views/toolbar/toolbar_view.cc chrome/browser/ui/views/toolbar/toolbar_view.cc
-index ef42774da13f6..840b7aa893ca8 100644
+index 9f76962e79146..0009632e9011c 100644
 --- chrome/browser/ui/views/toolbar/toolbar_view.cc
 +++ chrome/browser/ui/views/toolbar/toolbar_view.cc
-@@ -172,12 +172,13 @@ auto& GetViewCommandMap() {
+@@ -173,12 +173,13 @@ auto& GetViewCommandMap() {
  ////////////////////////////////////////////////////////////////////////////////
  // ToolbarView, public:
  
@@ -460,7 +476,7 @@ index ef42774da13f6..840b7aa893ca8 100644
    SetID(VIEW_ID_TOOLBAR);
  
    UpgradeDetector::GetInstance()->AddObserver(this);
-@@ -212,7 +213,7 @@ void ToolbarView::Init() {
+@@ -213,7 +214,7 @@ void ToolbarView::Init() {
  #endif
    auto location_bar = std::make_unique<LocationBarView>(
        browser_, browser_->profile(), browser_->command_controller(), this,

patch/patches/content_2015.patch

@@ -34,7 +34,7 @@ index 3f06e6b8cd335..257d3f20f92d7 100644
          factory = base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
              std::move(loader_factory));
 diff --git content/public/browser/content_browser_client.cc content/public/browser/content_browser_client.cc
-index 2ba5cc555c691..a092c6ba09112 100644
+index bf827fb6d8c2c..4a94f92d8b39e 100644
 --- content/public/browser/content_browser_client.cc
 +++ content/public/browser/content_browser_client.cc
 @@ -11,7 +11,7 @@
@@ -46,7 +46,7 @@ index 2ba5cc555c691..a092c6ba09112 100644
  
  #include <utility>
  
-@@ -892,7 +892,7 @@ ContentBrowserClient::CreateURLLoaderHandlerForServiceWorkerNavigationPreload(
+@@ -893,7 +893,7 @@ ContentBrowserClient::CreateURLLoaderHandlerForServiceWorkerNavigationPreload(
  void ContentBrowserClient::OnNetworkServiceCreated(
      network::mojom::NetworkService* network_service) {}
  
@@ -55,7 +55,7 @@ index 2ba5cc555c691..a092c6ba09112 100644
      BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -901,6 +901,7 @@ void ContentBrowserClient::ConfigureNetworkContextParams(
+@@ -902,6 +902,7 @@ void ContentBrowserClient::ConfigureNetworkContextParams(
          cert_verifier_creation_params) {
    network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
    network_context_params->accept_language = "en-us,en";
@@ -64,7 +64,7 @@ index 2ba5cc555c691..a092c6ba09112 100644
  
  std::vector<base::FilePath>
 diff --git content/public/browser/content_browser_client.h content/public/browser/content_browser_client.h
-index 5c757ff4b622d..1286b9c26f427 100644
+index de15701d1e8f3..446333c87152f 100644
 --- content/public/browser/content_browser_client.h
 +++ content/public/browser/content_browser_client.h
 @@ -34,6 +34,7 @@
@@ -75,7 +75,7 @@ index 5c757ff4b622d..1286b9c26f427 100644
  #include "content/public/browser/web_ui_browser_interface_broker_registry.h"
  #include "content/public/common/alternative_error_page_override_info.mojom.h"
  #include "content/public/common/main_function_params.h"
-@@ -1668,7 +1669,7 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1669,7 +1670,7 @@ class CONTENT_EXPORT ContentBrowserClient {
    //
    // If |relative_partition_path| is the empty string, it means this needs to
    // create the default NetworkContext for the BrowserContext.
@@ -84,7 +84,7 @@ index 5c757ff4b622d..1286b9c26f427 100644
        BrowserContext* context,
        bool in_memory,
        const base::FilePath& relative_partition_path,
-@@ -1875,6 +1876,19 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1876,6 +1877,19 @@ class CONTENT_EXPORT ContentBrowserClient {
        RenderFrameHost* initiator_document,
        mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory);
  
@@ -104,7 +104,7 @@ index 5c757ff4b622d..1286b9c26f427 100644
    // Creates an OverlayWindow to be used for video or document
    // Picture-in-Picture respectively. This window will house the content shown
    // when in Picture-in-Picture mode. This will return a new OverlayWindow.
-@@ -1936,6 +1950,10 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1937,6 +1951,10 @@ class CONTENT_EXPORT ContentBrowserClient {
    // Used as part of the user agent string.
    virtual std::string GetProduct();
  

patch/patches/crashpad_tp_1995.patch

@@ -40,10 +40,10 @@ index b80cf7a59103b..6318dd05e6eef 100644
    virtual ~PruneCondition() {}
  
 diff --git third_party/crashpad/crashpad/client/settings.cc third_party/crashpad/crashpad/client/settings.cc
-index 966481d6284e4..e0fa8394cb045 100644
+index 8fe578f92f3a3..9acab9404c885 100644
 --- third_party/crashpad/crashpad/client/settings.cc
 +++ third_party/crashpad/crashpad/client/settings.cc
-@@ -87,7 +87,7 @@ void ScopedLockedFileHandleTraits::Free(FileHandle handle) {
+@@ -111,7 +111,7 @@ void ScopedLockedFileHandleTraits::Free(FileHandle handle) {
  
  struct Settings::Data {
    static constexpr uint32_t kSettingsMagic = 'CPds';
@@ -52,7 +52,7 @@ index 966481d6284e4..e0fa8394cb045 100644
  
    enum Options : uint32_t {
      kUploadsEnabled = 1 << 0,
-@@ -98,6 +98,9 @@ struct Settings::Data {
+@@ -122,6 +122,9 @@ struct Settings::Data {
             options(0),
             padding_0(0),
             last_upload_attempt_time(0),
@@ -62,7 +62,7 @@ index 966481d6284e4..e0fa8394cb045 100644
             client_id() {}
  
    uint32_t magic;
-@@ -105,6 +108,9 @@ struct Settings::Data {
+@@ -129,6 +132,9 @@ struct Settings::Data {
    uint32_t options;
    uint32_t padding_0;
    int64_t last_upload_attempt_time;  // time_t
@@ -72,7 +72,7 @@ index 966481d6284e4..e0fa8394cb045 100644
    UUID client_id;
  };
  
-@@ -188,6 +194,56 @@ bool Settings::SetLastUploadAttemptTime(time_t time) {
+@@ -212,6 +218,56 @@ bool Settings::SetLastUploadAttemptTime(time_t time) {
    return WriteSettings(handle.get(), settings);
  }
  
@@ -130,10 +130,10 @@ index 966481d6284e4..e0fa8394cb045 100644
  Settings::ScopedLockedFileHandle Settings::MakeScopedLockedFileHandle(
      FileHandle file,
 diff --git third_party/crashpad/crashpad/client/settings.h third_party/crashpad/crashpad/client/settings.h
-index e476c60c3ba6b..ce8256c9f6d25 100644
+index aedf30cd874f7..ab798f00e0862 100644
 --- third_party/crashpad/crashpad/client/settings.h
 +++ third_party/crashpad/crashpad/client/settings.h
-@@ -116,6 +116,11 @@ class Settings {
+@@ -120,6 +120,11 @@ class Settings {
    //!     error logged.
    bool SetLastUploadAttemptTime(time_t time);
  
@@ -184,7 +184,7 @@ index 0fe4760db7fe2..042af7247712c 100644
  
    if (crashpad_is_win) {
 diff --git third_party/crashpad/crashpad/handler/crash_report_upload_thread.cc third_party/crashpad/crashpad/handler/crash_report_upload_thread.cc
-index efbeab7804c44..44fd31e58175c 100644
+index 138cf80026c98..d4af1f0c38d76 100644
 --- third_party/crashpad/crashpad/handler/crash_report_upload_thread.cc
 +++ third_party/crashpad/crashpad/handler/crash_report_upload_thread.cc
 @@ -269,6 +269,8 @@ CrashReportUploadThread::UploadResult CrashReportUploadThread::UploadReport(
@@ -197,7 +197,7 @@ index efbeab7804c44..44fd31e58175c 100644
  
    if (!reader->SeekSet(start_offset)) {
 diff --git third_party/crashpad/crashpad/handler/crash_report_upload_thread.h third_party/crashpad/crashpad/handler/crash_report_upload_thread.h
-index 70f1628354455..cd043a821e96d 100644
+index 2af958d7da9e5..6a67185a668af 100644
 --- third_party/crashpad/crashpad/handler/crash_report_upload_thread.h
 +++ third_party/crashpad/crashpad/handler/crash_report_upload_thread.h
 @@ -15,6 +15,7 @@
@@ -208,16 +208,16 @@ index 70f1628354455..cd043a821e96d 100644
  #include <memory>
  #include <string>
  #include <unordered_map>
-@@ -108,7 +109,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
-   //! It is expected to only be called from the same thread that called Start().
-   void Stop() override;
+@@ -111,7 +112,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
+   //! \return `true` if the thread is running, `false` if it is not.
+   bool is_running() const { return thread_.is_running(); }
  
 - private:
 + protected:
    //! \brief The result code from UploadReport().
    enum class UploadResult {
      //! \brief The crash report was uploaded successfully.
-@@ -136,7 +137,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
+@@ -139,7 +140,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
    //! object was constructed with \a watch_pending_reports, it will also scan
    //! the crash report database for other pending reports, and process those as
    //! well.
@@ -226,7 +226,7 @@ index 70f1628354455..cd043a821e96d 100644
  
    //! \brief Processes a single pending report from the database.
    //!
-@@ -150,7 +151,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
+@@ -153,7 +154,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
    //! remain in the “pending” state. If the upload fails and no more retries are
    //! desired, or report upload is disabled, it will be marked as “completed” in
    //! the database without ever having been uploaded.
@@ -235,7 +235,7 @@ index 70f1628354455..cd043a821e96d 100644
  
    //! \brief Attempts to upload a crash report.
    //!
-@@ -167,6 +168,11 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
+@@ -170,6 +171,11 @@ class CrashReportUploadThread : public WorkerThread::Delegate,
    UploadResult UploadReport(const CrashReportDatabase::UploadReport* report,
                              std::string* response_body);
  

patch/patches/embedder_product_override.patch

@@ -1,5 +1,5 @@
 diff --git components/embedder_support/user_agent_utils.cc components/embedder_support/user_agent_utils.cc
-index ca9de380c4a07..b893e1a0590fd 100644
+index 1df65185bdd1e..e0021ddb03d9d 100644
 --- components/embedder_support/user_agent_utils.cc
 +++ components/embedder_support/user_agent_utils.cc
 @@ -15,6 +15,7 @@

patch/patches/gn_config.patch

@@ -12,7 +12,7 @@ index 5356717746edd..6345b837a6ea6 100644
        # https://crbug.com/474506.
        "//clank/java/BUILD.gn",
 diff --git BUILD.gn BUILD.gn
-index f686fc6368936..37848e164aeb0 100644
+index de738745dfb85..e30d3dad0f717 100644
 --- BUILD.gn
 +++ BUILD.gn
 @@ -17,6 +17,7 @@ import("//build/config/sanitizers/sanitizers.gni")

patch/patches/print_preview_123.patch

@@ -136,7 +136,7 @@ index f6098966f5b34..da78289b66155 100644
  }
  
 diff --git chrome/browser/ui/webui/print_preview/pdf_printer_handler.cc chrome/browser/ui/webui/print_preview/pdf_printer_handler.cc
-index 86e16795ce43d..9053975ad42f6 100644
+index 77455a3f6a9c4..2b64a213f287d 100644
 --- chrome/browser/ui/webui/print_preview/pdf_printer_handler.cc
 +++ chrome/browser/ui/webui/print_preview/pdf_printer_handler.cc
 @@ -21,6 +21,7 @@
@@ -158,7 +158,7 @@ index 86e16795ce43d..9053975ad42f6 100644
  namespace printing {
  
  namespace {
-@@ -414,16 +419,18 @@ void PdfPrinterHandler::SelectFile(const base::FilePath& default_filename,
+@@ -416,16 +421,18 @@ void PdfPrinterHandler::SelectFile(const base::FilePath& default_filename,
      service->GetRemote<crosapi::mojom::DriveIntegrationService>()
          ->GetMountPointPath(
              base::BindOnce(&PdfPrinterHandler::OnSaveLocationReady,
@@ -179,7 +179,7 @@ index 86e16795ce43d..9053975ad42f6 100644
      const base::FilePath& default_filename,
      bool prompt_user,
      const base::FilePath& path) {
-@@ -441,10 +448,27 @@ void PdfPrinterHandler::OnSaveLocationReady(
+@@ -443,10 +450,27 @@ void PdfPrinterHandler::OnSaveLocationReady(
    // If the directory is empty there is no reason to create it or use the
    // default location.
    if (path.empty()) {
@@ -207,7 +207,7 @@ index 86e16795ce43d..9053975ad42f6 100644
    // Get default download directory. This will be used as a fallback if the
    // save directory does not exist.
    DownloadPrefs* download_prefs = DownloadPrefs::FromBrowserContext(profile_);
-@@ -452,8 +476,7 @@ void PdfPrinterHandler::OnSaveLocationReady(
+@@ -454,8 +478,7 @@ void PdfPrinterHandler::OnSaveLocationReady(
    base::ThreadPool::PostTaskAndReplyWithResult(
        FROM_HERE, {base::MayBlock(), base::TaskPriority::BEST_EFFORT},
        base::BindOnce(&SelectSaveDirectory, path, default_path),
@@ -217,7 +217,7 @@ index 86e16795ce43d..9053975ad42f6 100644
  }
  
  void PdfPrinterHandler::PostPrintToPdfTask() {
-@@ -499,6 +522,36 @@ void PdfPrinterHandler::OnDirectorySelected(const base::FilePath& filename,
+@@ -505,6 +528,36 @@ void PdfPrinterHandler::OnDirectorySelected(const base::FilePath& filename,
        platform_util::GetTopLevel(preview_web_contents_->GetNativeView()), NULL);
  }
  

patch/patches/services_network_2622.patch

@@ -123,10 +123,10 @@ index 49c53dc75789f..07c204a826877 100644
  
  void CookieManager::SetForceKeepSessionState() {
 diff --git services/network/network_context.cc services/network/network_context.cc
-index 6564e1dda47a9..d7d67a96a3a64 100644
+index 18fd482ea1c74..92a2a57a451e8 100644
 --- services/network/network_context.cc
 +++ services/network/network_context.cc
-@@ -2300,17 +2300,21 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
+@@ -2302,17 +2302,21 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
          network_service_->network_quality_estimator());
    }
  

patch/patches/viz_osr_2575.patch

@@ -214,7 +214,7 @@ index 6b7fbb6cf13dc..e2af75168cb91 100644
 +  Draw(gfx.mojom.Rect damage_rect) => ();
  };
 diff --git ui/compositor/compositor.h ui/compositor/compositor.h
-index b30b9460889b9..19d7967f4ef96 100644
+index 2696c864d5e32..e4e7a01d24534 100644
 --- ui/compositor/compositor.h
 +++ ui/compositor/compositor.h
 @@ -30,7 +30,9 @@
@@ -227,7 +227,7 @@ index b30b9460889b9..19d7967f4ef96 100644
  #include "mojo/public/cpp/bindings/pending_remote.h"
  #include "services/viz/privileged/mojom/compositing/vsync_parameter_observer.mojom-forward.h"
  #include "third_party/skia/include/core/SkColor.h"
-@@ -137,6 +139,14 @@ class COMPOSITOR_EXPORT ContextFactory {
+@@ -138,6 +140,14 @@ class COMPOSITOR_EXPORT ContextFactory {
    virtual viz::HostFrameSinkManager* GetHostFrameSinkManager() = 0;
  };
  
@@ -242,7 +242,7 @@ index b30b9460889b9..19d7967f4ef96 100644
  // Compositor object to take care of GPU painting.
  // A Browser compositor object is responsible for generating the final
  // displayable form of pixels comprising a single widget's contents. It draws an
-@@ -178,6 +188,9 @@ class COMPOSITOR_EXPORT Compositor : public base::PowerSuspendObserver,
+@@ -179,6 +189,9 @@ class COMPOSITOR_EXPORT Compositor : public base::PowerSuspendObserver,
    // Schedules a redraw of the layer tree associated with this compositor.
    void ScheduleDraw();
  
@@ -252,7 +252,7 @@ index b30b9460889b9..19d7967f4ef96 100644
    // Sets the root of the layer tree drawn by this Compositor. The root layer
    // must have no parent. The compositor's root layer is reset if the root layer
    // is destroyed. NULL can be passed to reset the root layer, in which case the
-@@ -466,6 +479,8 @@ class COMPOSITOR_EXPORT Compositor : public base::PowerSuspendObserver,
+@@ -469,6 +482,8 @@ class COMPOSITOR_EXPORT Compositor : public base::PowerSuspendObserver,
  
    std::unique_ptr<PendingBeginFrameArgs> pending_begin_frame_args_;
  

patch/patches/web_contents_1257_1565.patch

@@ -1,10 +1,10 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index 62818b1c709b7..43da09b31210c 100644
+index 9e1ad669a94b2..3db4063930733 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
-@@ -3030,6 +3030,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
+@@ -3039,6 +3039,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
        site_instance.get(), params.renderer_initiated_creation,
-       params.main_frame_name, GetOriginalOpener(), primary_main_frame_policy);
+       params.main_frame_name, GetOpener(), primary_main_frame_policy);
  
 +  if (params.view && params.delegate_view) {
 +    view_.reset(params.view);
@@ -15,7 +15,7 @@ index 62818b1c709b7..43da09b31210c 100644
    WebContentsViewDelegate* delegate =
        GetContentClient()->browser()->GetWebContentsViewDelegate(this);
  
-@@ -3040,6 +3046,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
+@@ -3049,6 +3055,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
      view_.reset(CreateWebContentsView(this, delegate,
                                        &render_view_host_delegate_view_));
    }
@@ -23,7 +23,7 @@ index 62818b1c709b7..43da09b31210c 100644
    CHECK(render_view_host_delegate_view_);
    CHECK(view_.get());
  
-@@ -3906,6 +3913,15 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -3915,6 +3922,15 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    // objects.
    create_params.renderer_initiated_creation = !is_new_browsing_instance;
  
@@ -39,7 +39,7 @@ index 62818b1c709b7..43da09b31210c 100644
    std::unique_ptr<WebContentsImpl> new_contents;
    if (!is_guest) {
      create_params.context = view_->GetNativeView();
-@@ -7733,6 +7749,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
+@@ -7742,6 +7758,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
      // frames).
      SetFocusedFrameTree(node->frame_tree());
    }
@@ -50,7 +50,7 @@ index 62818b1c709b7..43da09b31210c 100644
  
  void WebContentsImpl::DidCallFocus() {
 diff --git content/public/browser/web_contents.h content/public/browser/web_contents.h
-index cb672eb5276e8..0f2f8f9a57fcc 100644
+index c062c66f596f5..8c9d5cd4d9af9 100644
 --- content/public/browser/web_contents.h
 +++ content/public/browser/web_contents.h
 @@ -93,10 +93,12 @@ class BrowserContext;

tests/ceftests/frame_handler_unittest.cc

@@ -13,6 +13,7 @@
 #include "include/wrapper/cef_closure_task.h"
 #include "tests/ceftests/routing_test_handler.h"
 #include "tests/ceftests/test_handler.h"
+#include "tests/ceftests/test_util.h"
 #include "tests/gtest/include/gtest/gtest.h"
 
 // Set to 1 to enable verbose debugging info logging.
@@ -580,7 +581,7 @@ class OrderMainTestHandler : public RoutingTestHandler, public CefFrameHandler {
     // Messages for the old and new frames are interleaved during cross-origin
     // navigation.
     if (pending_main_frame_) {
-      EXPECT_TRUE(IsCrossOrigin());
+      EXPECT_TRUE(IsCrossOriginOrSameSiteBFCacheEnabled());
       pending_main_frame_->OnQuery(browser, frame, request);
     } else {
       EXPECT_TRUE(current_main_frame_);
@@ -602,7 +603,8 @@ class OrderMainTestHandler : public RoutingTestHandler, public CefFrameHandler {
     pending_main_frame_ = new FrameStatus(frame);
     pending_main_frame_->SetAdditionalDebugInfo(GetAdditionalDebugInfo());
     pending_main_frame_->SetIsFirstMain(!got_after_created_);
-    pending_main_frame_->SetIsLastMain(!IsCrossOrigin() || IsLastNavigation());
+    pending_main_frame_->SetIsLastMain(
+        !IsCrossOriginOrSameSiteBFCacheEnabled() || IsLastNavigation());
     pending_main_frame_->OnFrameCreated(browser, frame);
   }
 
@@ -614,7 +616,7 @@ class OrderMainTestHandler : public RoutingTestHandler, public CefFrameHandler {
     // May arrive before or after OnMainFrameChanged switches the frame (after
     // on initial browser creation, before on cross-origin navigation).
     if (pending_main_frame_) {
-      EXPECT_TRUE(IsCrossOrigin());
+      EXPECT_TRUE(IsCrossOriginOrSameSiteBFCacheEnabled());
       pending_main_frame_->OnFrameAttached(browser, frame);
     } else {
       EXPECT_TRUE(current_main_frame_);
@@ -665,7 +667,7 @@ class OrderMainTestHandler : public RoutingTestHandler, public CefFrameHandler {
 
     if (old_frame && new_frame) {
       // Main frame changed due to cross-origin navigation.
-      EXPECT_TRUE(IsCrossOrigin());
+      EXPECT_TRUE(IsCrossOriginOrSameSiteBFCacheEnabled());
       main_frame_changed_ct_++;
     }
 
@@ -687,6 +689,10 @@ class OrderMainTestHandler : public RoutingTestHandler, public CefFrameHandler {
   virtual bool IsLastNavigation() const { return true; }
   virtual bool IsCrossOrigin() const { return false; }
 
+  bool IsCrossOriginOrSameSiteBFCacheEnabled() const {
+    return IsCrossOrigin() || IsSameSiteBFCacheEnabled();
+  }
+
   virtual std::string GetAdditionalDebugInfo() const { return std::string(); }
 
   virtual bool AllQueriesDelivered(std::string* msg = nullptr) const {
@@ -720,7 +726,7 @@ class OrderMainTestHandler : public RoutingTestHandler, public CefFrameHandler {
 #endif
       const std::string& next_url = GetNextMainURL();
       if (!next_url.empty()) {
-        if (!IsCrossOrigin()) {
+        if (!IsCrossOriginOrSameSiteBFCacheEnabled()) {
           // Reusing the same main frame for same origin nav.
           current_main_frame_->ResetMainLoadStatus();
         }
@@ -790,12 +796,13 @@ const char kOrderMainUrlPrefix[] = "http://tests-frame-handler";
 class NavigateOrderMainTestHandler : public OrderMainTestHandler {
  public:
   NavigateOrderMainTestHandler(bool cross_origin, int additional_nav_ct = 2)
-      : cross_origin_(cross_origin), additional_nav_ct_(additional_nav_ct) {
-    // Once for each cross-origin LoadURL call.
-    expected_main_frame_changed_ct_ = cross_origin ? additional_nav_ct_ : 0;
-  }
+      : cross_origin_(cross_origin), additional_nav_ct_(additional_nav_ct) {}
 
   void RunTest() override {
+    // Once for each cross-origin LoadURL call.
+    expected_main_frame_changed_ct_ =
+        IsCrossOriginOrSameSiteBFCacheEnabled() ? additional_nav_ct_ : 0;
+
     // Resources for the 2nd+ navigation.
     for (int i = 1; i <= additional_nav_ct_; i++) {
       AddResource(GetURLForNav(i), GetMainHtmlForNav(i), "text/html");

tests/ceftests/message_router_unittest.cc

@@ -12,11 +12,16 @@
 #include "include/cef_v8.h"
 #include "include/wrapper/cef_closure_task.h"
 #include "tests/ceftests/routing_test_handler.h"
+#include "tests/ceftests/test_util.h"
 #include "tests/gtest/include/gtest/gtest.h"
 #include "tests/shared/renderer/client_app_renderer.h"
 
 using client::ClientAppRenderer;
 
+#define S1(N) #N
+#define S2(N) S1(N)
+#define LINESTR S2(__LINE__)
+
 namespace {
 
 const char kTestDomainRoot[] = "http://tests-mr";
@@ -65,10 +70,12 @@ class MRRenderDelegate : public ClientAppRenderer::Delegate {
         frame->SendProcessMessage(PID_BROWSER, message);
         return true;
       } else {
-        EXPECT_EQ(1U, arguments.size());
+        EXPECT_EQ(2U, arguments.size());
         EXPECT_TRUE(arguments[0]->IsInt());
+        EXPECT_TRUE(arguments[1]->IsInt());
 
-        const int expected_count = arguments[0]->GetIntValue();
+        const int line_no = arguments[0]->GetIntValue();
+        const int expected_count = arguments[1]->GetIntValue();
         int actual_count = -1;
 
         CefRefPtr<CefV8Context> context = CefV8Context::GetCurrentContext();
@@ -87,8 +94,8 @@ class MRRenderDelegate : public ClientAppRenderer::Delegate {
 
         if (expected_count != actual_count) {
           std::stringstream ss;
-          ss << message_name << " failed; expected " << expected_count
-             << ", got " << actual_count;
+          ss << message_name << " failed (line " << line_no << "); expected "
+             << expected_count << ", got " << actual_count;
           exception = ss.str();
         }
       }
@@ -329,9 +336,12 @@ class HarnessTestHandler : public SingleLoadTestHandler {
       html =
           "<html><body><script>\n"
           "var fail_ct = 0;\n"
-          "try { window.mrtAssertTotalCount(0); } catch (e) { fail_ct++; }\n"
-          "try { window.mrtAssertBrowserCount(0); } catch (e) { fail_ct++; }\n"
-          "try { window.mrtAssertContextCount(0); } catch (e) { fail_ct++; }\n"
+          "try { window.mrtAssertTotalCount(" LINESTR
+          ",0); } catch (e) { fail_ct++; }\n"
+          "try { window.mrtAssertBrowserCount(" LINESTR
+          ",0); } catch (e) { fail_ct++; }\n"
+          "try { window.mrtAssertContextCount(" LINESTR
+          ",0); } catch (e) { fail_ct++; }\n"
           "window.mrtNotify('' + (fail_ct == 0));"
           "</script></body></html>";
     } else {
@@ -339,9 +349,12 @@ class HarnessTestHandler : public SingleLoadTestHandler {
       html =
           "<html><body><script>\n"
           "var fail_ct = 0;\n"
-          "try { window.mrtAssertTotalCount(1); } catch (e) { fail_ct++; }\n"
-          "try { window.mrtAssertBrowserCount(1); } catch (e) { fail_ct++; }\n"
-          "try { window.mrtAssertContextCount(1); } catch (e) { fail_ct++; }\n"
+          "try { window.mrtAssertTotalCount(" LINESTR
+          ",1); } catch (e) { fail_ct++; }\n"
+          "try { window.mrtAssertBrowserCount(" LINESTR
+          ",1); } catch (e) { fail_ct++; }\n"
+          "try { window.mrtAssertContextCount(" LINESTR
+          ",1); } catch (e) { fail_ct++; }\n"
           "window.mrtNotify('' + (fail_ct == 3));"
           "</script></body></html>";
     }
@@ -414,9 +427,12 @@ class SingleQueryTestHandler : public SingleLoadTestHandler {
     html =
         "<html><body><script>\n"
         // No requests should exist.
-        "window.mrtAssertTotalCount(0);\n"
-        "window.mrtAssertBrowserCount(0);\n"
-        "window.mrtAssertContextCount(0);\n"
+        "window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         // Send the query.
         "var request_id = window.mrtQuery({\n"
         "  request: '" +
@@ -425,9 +441,12 @@ class SingleQueryTestHandler : public SingleLoadTestHandler {
         "  persistent: false,\n"
         "  onSuccess: function(response) {\n"
         // Request should be removed before callback is executed.
-        "    window.mrtAssertTotalCount(0);\n"
-        "    window.mrtAssertBrowserCount(0);\n"
-        "    window.mrtAssertContextCount(0);\n"
+        "    window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         "    if (response == '" +
         std::string(kSingleQueryResponse) +
         "')\n"
@@ -437,9 +456,12 @@ class SingleQueryTestHandler : public SingleLoadTestHandler {
         "  },\n"
         "  onFailure: function(error_code, error_message) {\n"
         // Request should be removed before callback is executed.
-        "    window.mrtAssertTotalCount(0);\n"
-        "    window.mrtAssertBrowserCount(0);\n"
-        "    window.mrtAssertContextCount(0);\n"
+        "    window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         "    if (error_code == " +
         errorCodeStr + " && error_message == '" +
         std::string(kSingleQueryErrorMessage) +
@@ -450,17 +472,22 @@ class SingleQueryTestHandler : public SingleLoadTestHandler {
         "  }\n"
         "});\n"
         // Request should exist.
-        "window.mrtAssertTotalCount(1);\n"
-        "window.mrtAssertBrowserCount(1);\n"
-        "window.mrtAssertContextCount(1);\n";
+        "window.mrtAssertTotalCount(" LINESTR
+        ",1);\n"
+        "window.mrtAssertBrowserCount(" LINESTR
+        ",1);\n"
+        "window.mrtAssertContextCount(" LINESTR ",1);\n";
 
     if (test_type_ == CANCEL) {
       html +=
           "window.mrtQueryCancel(request_id);\n"
           // Request should be removed immediately.
-          "window.mrtAssertTotalCount(0);\n"
-          "window.mrtAssertBrowserCount(0);\n"
-          "window.mrtAssertContextCount(0);\n"
+          "window.mrtAssertTotalCount(" LINESTR
+          ",0);\n"
+          "window.mrtAssertBrowserCount(" LINESTR
+          ",0);\n"
+          "window.mrtAssertContextCount(" LINESTR
+          ",0);\n"
           "window.mrtNotify('cancel');\n";
     }
 
@@ -652,9 +679,12 @@ class SinglePersistentQueryTestHandler : public SingleLoadTestHandler {
     html =
         "<html><body><script>\n"
         // No requests should exist.
-        "window.mrtAssertTotalCount(0);\n"
-        "window.mrtAssertBrowserCount(0);\n"
-        "window.mrtAssertContextCount(0);\n"
+        "window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         // Keep track of the number of responses.
         "var count = 0;\n"
         // Send the query.
@@ -665,9 +695,12 @@ class SinglePersistentQueryTestHandler : public SingleLoadTestHandler {
         "  persistent: true,\n"
         "  onSuccess: function(response) {\n"
         // Request should not be removed.
-        "    window.mrtAssertTotalCount(1);\n"
-        "    window.mrtAssertBrowserCount(1);\n"
-        "    window.mrtAssertContextCount(1);\n"
+        "    window.mrtAssertTotalCount(" LINESTR
+        ",1);\n"
+        "    window.mrtAssertBrowserCount(" LINESTR
+        ",1);\n"
+        "    window.mrtAssertContextCount(" LINESTR
+        ",1);\n"
         "    if (response == '" +
         std::string(kSingleQueryResponse) +
         "') {\n"
@@ -677,9 +710,12 @@ class SinglePersistentQueryTestHandler : public SingleLoadTestHandler {
         "        window.mrtNotify('success');\n"
         "        window.mrtQueryCancel(request_id);\n"
         // Request should be removed immediately.
-        "        window.mrtAssertTotalCount(0);\n"
-        "        window.mrtAssertBrowserCount(0);\n"
-        "        window.mrtAssertContextCount(0);\n"
+        "        window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "        window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "        window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         "      }\n"
         "    } else {\n"
         "      window.mrtNotify('error-onSuccess');\n"
@@ -687,9 +723,12 @@ class SinglePersistentQueryTestHandler : public SingleLoadTestHandler {
         "  },\n"
         "  onFailure: function(error_code, error_message) {\n"
         // Request should be removed before callback is executed.
-        "    window.mrtAssertTotalCount(0);\n"
-        "    window.mrtAssertBrowserCount(0);\n"
-        "    window.mrtAssertContextCount(0);\n"
+        "    window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         "    if (error_code == " +
         errorCodeStr + " && error_message == '" +
         std::string(kSingleQueryErrorMessage) +
@@ -701,9 +740,11 @@ class SinglePersistentQueryTestHandler : public SingleLoadTestHandler {
         "  }\n"
         "});\n"
         // Request should exist.
-        "window.mrtAssertTotalCount(1);\n"
-        "window.mrtAssertBrowserCount(1);\n"
-        "window.mrtAssertContextCount(1);\n";
+        "window.mrtAssertTotalCount(" LINESTR
+        ",1);\n"
+        "window.mrtAssertBrowserCount(" LINESTR
+        ",1);\n"
+        "window.mrtAssertContextCount(" LINESTR ",1);\n";
 
     html += "</script></body></html>";
     return html;
@@ -874,9 +915,12 @@ class SingleUnhandledQueryTestHandler : public SingleLoadTestHandler {
     html =
         "<html><body><script>\n"
         // No requests should exist.
-        "window.mrtAssertTotalCount(0);\n"
-        "window.mrtAssertBrowserCount(0);\n"
-        "window.mrtAssertContextCount(0);\n"
+        "window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         // Keep track of the number of responses.
         "var count = 0;\n"
         // Send the query.
@@ -890,9 +934,12 @@ class SingleUnhandledQueryTestHandler : public SingleLoadTestHandler {
         "  },\n"
         "  onFailure: function(error_code, error_message) {\n"
         // Request should be removed before callback is executed.
-        "    window.mrtAssertTotalCount(0);\n"
-        "    window.mrtAssertBrowserCount(0);\n"
-        "    window.mrtAssertContextCount(0);\n"
+        "    window.mrtAssertTotalCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertBrowserCount(" LINESTR
+        ",0);\n"
+        "    window.mrtAssertContextCount(" LINESTR
+        ",0);\n"
         "    if (error_code == -1 && "
         "error_message == 'The query has been canceled') {\n"
         "      window.mrtNotify('failure');\n"
@@ -902,9 +949,11 @@ class SingleUnhandledQueryTestHandler : public SingleLoadTestHandler {
         "  }\n"
         "});\n"
         // Request should exist.
-        "window.mrtAssertTotalCount(1);\n"
-        "window.mrtAssertBrowserCount(1);\n"
-        "window.mrtAssertContextCount(1);\n";
+        "window.mrtAssertTotalCount(" LINESTR
+        ",1);\n"
+        "window.mrtAssertBrowserCount(" LINESTR
+        ",1);\n"
+        "window.mrtAssertContextCount(" LINESTR ",1);\n";
 
     html += "</script></body></html>";
     return html;
@@ -1088,10 +1137,10 @@ class MultiQueryManager : public CefMessageRouterBrowserSide::Handler {
 
     // No requests should exist.
     if (assert_total)
-      html += "window.mrtAssertTotalCount(0);\n";
+      html += "window.mrtAssertTotalCount(" LINESTR ",0);\n";
     if (assert_browser)
-      html += "window.mrtAssertBrowserCount(0);\n";
-    html += "window.mrtAssertContextCount(0);\n";
+      html += "window.mrtAssertBrowserCount(" LINESTR ",0);\n";
+    html += "window.mrtAssertContextCount(" LINESTR ",0);\n";
 
     if (synchronous_) {
       // Run all of the queries synchronously. None will complete before the
@@ -1106,10 +1155,11 @@ class MultiQueryManager : public CefMessageRouterBrowserSide::Handler {
       // Pending requests should match the total created.
       const std::string& total_val = GetIntString(total_ct);
       if (assert_total)
-        html += "window.mrtAssertTotalCount(" + total_val + ");\n";
+        html += "window.mrtAssertTotalCount(" LINESTR "," + total_val + ");\n";
       if (assert_browser)
-        html += "window.mrtAssertBrowserCount(" + total_val + ");\n";
-      html += "window.mrtAssertContextCount(" + total_val + ");\n";
+        html +=
+            "window.mrtAssertBrowserCount(" LINESTR "," + total_val + ");\n";
+      html += "window.mrtAssertContextCount(" LINESTR "," + total_val + ");\n";
 
       int cancel_ct = 0;
 
@@ -1126,10 +1176,13 @@ class MultiQueryManager : public CefMessageRouterBrowserSide::Handler {
         // Pending requests should match the total not canceled.
         const std::string& cancel_val = GetIntString(total_ct - cancel_ct);
         if (assert_total)
-          html += "window.mrtAssertTotalCount(" + cancel_val + ");\n";
+          html +=
+              "window.mrtAssertTotalCount(" LINESTR "," + cancel_val + ");\n";
         if (assert_browser)
-          html += "window.mrtAssertBrowserCount(" + cancel_val + ");\n";
-        html += "window.mrtAssertContextCount(" + cancel_val + ");\n";
+          html +=
+              "window.mrtAssertBrowserCount(" LINESTR "," + cancel_val + ");\n";
+        html +=
+            "window.mrtAssertContextCount(" LINESTR "," + cancel_val + ");\n";
       }
     } else {
       // Run all of the queries asynchronously. Some may complete before
@@ -2876,9 +2929,13 @@ class MultiQueryMultiNavigateTestHandler
     url3_ = std::string(same_origin_ ? kTestDomain1 : kTestDomain3) +
             "browser3.html";
 
-    AddManagedResource(url1_, true, true);
-    AddManagedResource(url2_, true, true);
-    AddManagedResource(url3_, true, true);
+    // With same-site BFCache enabled a new browser will be created for each
+    // same-site navigation in the renderer process, resulting in "total count"
+    // values that potentially span multiple navigations.
+    const bool should_assert = !(same_origin_ && IsSameSiteBFCacheEnabled());
+    AddManagedResource(url1_, should_assert, should_assert);
+    AddManagedResource(url2_, should_assert, should_assert);
+    AddManagedResource(url3_, should_assert, should_assert);
     Finalize();
 
     // 1. Load the 1st url.

tests/ceftests/navigation_unittest.cc

@@ -15,6 +15,9 @@
 #include "tests/shared/browser/client_app_browser.h"
 #include "tests/shared/renderer/client_app_renderer.h"
 
+// Set to 1 to enable verbose debugging info logging.
+#define VERBOSE_DEBUGGING 0
+
 using client::ClientAppBrowser;
 using client::ClientAppRenderer;
 
@@ -34,7 +37,28 @@ const cef_transition_type_t kTransitionExplicitForwardBack =
     static_cast<cef_transition_type_t>(kTransitionExplicitLoad |
                                        TT_FORWARD_BACK_FLAG);
 
-enum NavAction { NA_LOAD = 1, NA_BACK, NA_FORWARD, NA_CLEAR };
+enum NavAction { NA_LOAD = 1, NA_BACK, NA_FORWARD };
+
+#if VERBOSE_DEBUGGING
+const char* NavActionString(NavAction action) {
+  switch (action) {
+    case NA_LOAD:
+      return "LOAD";
+    case NA_BACK:
+      return "BACK";
+    case NA_FORWARD:
+      return "FORWARD";
+  }
+  return "INVALID";
+}
+#endif  // VERBOSE_DEBUGGING
+
+bool ExpectResourceLoadEvents(NavAction action) {
+  if (IsSameSiteBFCacheEnabled()) {
+    return action == NA_LOAD;
+  }
+  return true;
+}
 
 typedef struct {
   NavAction action;     // What to do
@@ -52,8 +76,6 @@ static NavListItem kHNavList[] = {
     {NA_FORWARD, kHNav2, true, false},  //   .        X
     {NA_LOAD, kHNav3, true, false},     //   .        .        X
     {NA_BACK, kHNav2, true, true},      //   .        X        .
-    // TODO(cef): Enable once ClearHistory is implemented
-    // {NA_CLEAR, kHNav2, false, false},   //            X
 };
 
 #define NAV_LIST_SIZE() (sizeof(kHNavList) / sizeof(NavListItem))
@@ -83,6 +105,10 @@ class HistoryNavRendererTest : public ClientAppRenderer::Delegate,
                             bool canGoBack,
                             bool canGoForward) override {
     const NavListItem& item = kHNavList[nav_];
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "render nav=" << nav_ << " " << NavActionString(item.action)
+              << " OnLoadingStateChange isLoading=" << isLoading;
+#endif
 
     const std::string& url = browser->GetMainFrame()->GetURL();
     EXPECT_STREQ(item.target, url.c_str());
@@ -97,8 +123,10 @@ class HistoryNavRendererTest : public ClientAppRenderer::Delegate,
         << "nav: " << nav_ << " isLoading: " << isLoading;
 
     if (isLoading) {
+      EXPECT_FALSE(got_loading_state_start_);
       got_loading_state_start_.yes();
     } else {
+      EXPECT_FALSE(got_loading_state_end_);
       got_loading_state_end_.yes();
       SendTestResultsIfDone(browser, browser->GetMainFrame());
     }
@@ -108,7 +136,12 @@ class HistoryNavRendererTest : public ClientAppRenderer::Delegate,
                    CefRefPtr<CefFrame> frame,
                    TransitionType transition_type) override {
     const NavListItem& item = kHNavList[nav_];
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "render nav=" << nav_ << " " << NavActionString(item.action)
+              << " OnLoadStart";
+#endif
 
+    EXPECT_FALSE(got_load_start_);
     got_load_start_.yes();
 
     const std::string& url = frame->GetURL();
@@ -124,7 +157,12 @@ class HistoryNavRendererTest : public ClientAppRenderer::Delegate,
                  CefRefPtr<CefFrame> frame,
                  int httpStatusCode) override {
     const NavListItem& item = kHNavList[nav_];
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "render nav=" << nav_ << " " << NavActionString(item.action)
+              << " OnLoadEnd";
+#endif
 
+    EXPECT_FALSE(got_load_end_);
     got_load_end_.yes();
 
     const std::string& url = frame->GetURL();
@@ -146,6 +184,12 @@ class HistoryNavRendererTest : public ClientAppRenderer::Delegate,
   // Send the test results.
   void SendTestResults(CefRefPtr<CefBrowser> browser,
                        CefRefPtr<CefFrame> frame) {
+#if VERBOSE_DEBUGGING
+    const NavListItem& item = kHNavList[nav_];
+    LOG(INFO) << "render nav=" << nav_ << " " << NavActionString(item.action)
+              << " SendTestResults";
+#endif
+
     EXPECT_TRUE(got_loading_state_start_);
     EXPECT_TRUE(got_loading_state_end_);
     EXPECT_TRUE(got_load_start_);
@@ -273,11 +317,7 @@ class NavigationEntryVisitor : public CefNavigationEntryVisitor {
 // Browser side.
 class HistoryNavTestHandler : public TestHandler {
  public:
-  HistoryNavTestHandler()
-      : nav_(0),
-        load_end_confirmation_(false),
-        load_state_change_loaded_confirmation_(false),
-        renderer_confirmation_(false) {}
+  HistoryNavTestHandler() = default;
 
   void RunTest() override {
     // Add the resources that we will navigate to/from.
@@ -322,19 +362,20 @@ class HistoryNavTestHandler : public TestHandler {
       case NA_FORWARD:
         browser->GoForward();
         break;
-      case NA_CLEAR:
-        // TODO(cef): Enable once ClearHistory is implemented
-        // browser->GetHost()->ClearHistory();
-        // Not really a navigation action so go to the next one.
-        nav_++;
-        RunNav(browser);
-        break;
       default:
         break;
     }
   }
 
   void RunNextNavIfReady(CefRefPtr<CefBrowser> browser) {
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "browser nav=" << nav_
+              << " load_end_confirmation_=" << load_end_confirmation_
+              << " load_state_change_loaded_confirmation_="
+              << load_state_change_loaded_confirmation_
+              << " renderer_confirmation_=" << renderer_confirmation_;
+#endif
+
     if (load_end_confirmation_ && load_state_change_loaded_confirmation_ &&
         renderer_confirmation_) {
       load_end_confirmation_ = false;
@@ -358,6 +399,12 @@ class HistoryNavTestHandler : public TestHandler {
                       bool is_redirect) override {
     const NavListItem& item = kHNavList[nav_];
 
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "browser nav=" << nav_ << " " << NavActionString(item.action)
+              << " OnBeforeBrowse";
+#endif
+
+    EXPECT_FALSE(got_before_browse_[nav_]);
     got_before_browse_[nav_].yes();
 
     std::string url = request->GetURL();
@@ -409,6 +456,7 @@ class HistoryNavTestHandler : public TestHandler {
           << "nav=" << nav_ << " url=" << url;
     }
 
+    EXPECT_FALSE(got_before_resource_load_[nav_]);
     got_before_resource_load_[nav_].yes();
 
     if (url == item.target)
@@ -421,12 +469,21 @@ class HistoryNavTestHandler : public TestHandler {
                             bool isLoading,
                             bool canGoBack,
                             bool canGoForward) override {
-    if (isLoading)
-      return;
-
     const NavListItem& item = kHNavList[nav_];
 
-    got_loading_state_change_[nav_].yes();
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "browser nav=" << nav_ << " " << NavActionString(item.action)
+              << " OnLoadingStateChange isLoading=" << isLoading;
+#endif
+
+    if (isLoading) {
+      EXPECT_FALSE(got_loading_state_change_loading_[nav_]);
+      got_loading_state_change_loading_[nav_].yes();
+      return;
+    }
+
+    EXPECT_FALSE(got_loading_state_change_loaded_[nav_]);
+    got_loading_state_change_loaded_[nav_].yes();
 
     if (item.can_go_back == canGoBack)
       got_correct_can_go_back_[nav_].yes();
@@ -445,6 +502,12 @@ class HistoryNavTestHandler : public TestHandler {
 
     const NavListItem& item = kHNavList[nav_];
 
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "browser nav=" << nav_ << " " << NavActionString(item.action)
+              << " OnLoadStart";
+#endif
+
+    EXPECT_FALSE(got_load_start_[nav_]);
     got_load_start_[nav_].yes();
 
     if (item.action == NA_LOAD) {
@@ -467,6 +530,12 @@ class HistoryNavTestHandler : public TestHandler {
 
     const NavListItem& item = kHNavList[nav_];
 
+#if VERBOSE_DEBUGGING
+    LOG(INFO) << "browser nav=" << nav_ << " " << NavActionString(item.action)
+              << " OnLoadEnd";
+#endif
+
+    EXPECT_FALSE(got_load_end_[nav_]);
     got_load_end_[nav_].yes();
 
     // Test that navigation entries are correct.
@@ -489,6 +558,7 @@ class HistoryNavTestHandler : public TestHandler {
                                 CefProcessId source_process,
                                 CefRefPtr<CefProcessMessage> message) override {
     if (message->GetName().ToString() == kHistoryNavMsg) {
+      EXPECT_FALSE(got_before_navigation_[nav_]);
       got_before_navigation_[nav_].yes();
 
       // Test that the renderer side succeeded.
@@ -506,16 +576,17 @@ class HistoryNavTestHandler : public TestHandler {
     return false;
   }
 
-  int nav_;
-  bool load_end_confirmation_;
-  bool load_state_change_loaded_confirmation_;
-  bool renderer_confirmation_;
+  int nav_ = 0;
+  bool load_end_confirmation_ = false;
+  bool load_state_change_loaded_confirmation_ = false;
+  bool renderer_confirmation_ = false;
 
   TrackCallback got_before_browse_[NAV_LIST_SIZE()];
   TrackCallback got_before_navigation_[NAV_LIST_SIZE()];
   TrackCallback got_before_resource_load_[NAV_LIST_SIZE()];
   TrackCallback got_correct_target_[NAV_LIST_SIZE()];
-  TrackCallback got_loading_state_change_[NAV_LIST_SIZE()];
+  TrackCallback got_loading_state_change_loading_[NAV_LIST_SIZE()];
+  TrackCallback got_loading_state_change_loaded_[NAV_LIST_SIZE()];
   TrackCallback got_correct_can_go_back_[NAV_LIST_SIZE()];
   TrackCallback got_correct_can_go_forward_[NAV_LIST_SIZE()];
   TrackCallback got_load_start_[NAV_LIST_SIZE()];
@@ -535,24 +606,27 @@ TEST(NavigationTest, History) {
   handler->ExecuteTest();
 
   for (size_t i = 0; i < NAV_LIST_SIZE(); ++i) {
-    if (kHNavList[i].action != NA_CLEAR) {
-      ASSERT_TRUE(handler->got_before_browse_[i]) << "i = " << i;
-      ASSERT_TRUE(handler->got_before_navigation_[i]) << "i = " << i;
-      ASSERT_TRUE(handler->got_before_resource_load_[i]) << "i = " << i;
-      ASSERT_TRUE(handler->got_correct_target_[i]) << "i = " << i;
-      ASSERT_TRUE(handler->got_load_start_[i]) << "i = " << i;
-      ASSERT_TRUE(handler->got_correct_load_start_url_[i]) << "i = " << i;
+    if (ExpectResourceLoadEvents(kHNavList[i].action)) {
+      EXPECT_TRUE(handler->got_before_browse_[i]) << "i = " << i;
+      EXPECT_TRUE(handler->got_before_resource_load_[i]) << "i = " << i;
+      EXPECT_TRUE(handler->got_correct_target_[i]) << "i = " << i;
+    } else {
+      EXPECT_FALSE(handler->got_before_browse_[i]) << "i = " << i;
+      EXPECT_FALSE(handler->got_before_resource_load_[i]) << "i = " << i;
+      EXPECT_FALSE(handler->got_correct_target_[i]) << "i = " << i;
     }
 
-    ASSERT_TRUE(handler->got_loading_state_change_[i]) << "i = " << i;
-    ASSERT_TRUE(handler->got_correct_can_go_back_[i]) << "i = " << i;
-    ASSERT_TRUE(handler->got_correct_can_go_forward_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_before_navigation_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_load_start_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_correct_load_start_url_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_load_end_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_correct_load_end_url_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_correct_history_[i]) << "i = " << i;
 
-    if (kHNavList[i].action != NA_CLEAR) {
-      ASSERT_TRUE(handler->got_load_end_[i]) << "i = " << i;
-      ASSERT_TRUE(handler->got_correct_history_[i]) << "i = " << i;
-      ASSERT_TRUE(handler->got_correct_load_end_url_[i]) << "i = " << i;
-    }
+    EXPECT_TRUE(handler->got_loading_state_change_loading_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_loading_state_change_loaded_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_correct_can_go_back_[i]) << "i = " << i;
+    EXPECT_TRUE(handler->got_correct_can_go_forward_[i]) << "i = " << i;
   }
 
   ReleaseAndWaitForDestructor(handler);
@@ -1004,22 +1078,22 @@ TEST(NavigationTest, Redirect) {
   CefClearSchemeHandlerFactories();
   WaitForIOThread();
 
-  ASSERT_TRUE(handler->got_nav1_before_resource_load_);
-  ASSERT_TRUE(handler->got_nav3_before_resource_load_);
-  ASSERT_TRUE(handler->got_nav4_before_resource_load_);
-  ASSERT_FALSE(handler->got_invalid_before_resource_load_);
-  ASSERT_TRUE(handler->got_nav4_load_start_);
-  ASSERT_FALSE(handler->got_invalid_load_start_);
-  ASSERT_TRUE(handler->got_nav4_load_end_);
-  ASSERT_FALSE(handler->got_invalid_load_end_);
-  ASSERT_TRUE(handler->got_nav1_redirect_);
-  ASSERT_FALSE(handler->got_nav2_redirect_);
-  ASSERT_TRUE(handler->got_nav3_redirect_);
-  ASSERT_FALSE(handler->got_invalid_redirect_);
-  ASSERT_TRUE(g_got_nav1_request);
-  ASSERT_TRUE(g_got_nav3_request);
-  ASSERT_TRUE(g_got_nav4_request);
-  ASSERT_FALSE(g_got_invalid_request);
+  EXPECT_TRUE(handler->got_nav1_before_resource_load_);
+  EXPECT_TRUE(handler->got_nav3_before_resource_load_);
+  EXPECT_TRUE(handler->got_nav4_before_resource_load_);
+  EXPECT_FALSE(handler->got_invalid_before_resource_load_);
+  EXPECT_TRUE(handler->got_nav4_load_start_);
+  EXPECT_FALSE(handler->got_invalid_load_start_);
+  EXPECT_TRUE(handler->got_nav4_load_end_);
+  EXPECT_FALSE(handler->got_invalid_load_end_);
+  EXPECT_TRUE(handler->got_nav1_redirect_);
+  EXPECT_FALSE(handler->got_nav2_redirect_);
+  EXPECT_TRUE(handler->got_nav3_redirect_);
+  EXPECT_FALSE(handler->got_invalid_redirect_);
+  EXPECT_TRUE(g_got_nav1_request);
+  EXPECT_TRUE(g_got_nav3_request);
+  EXPECT_TRUE(g_got_nav4_request);
+  EXPECT_FALSE(g_got_invalid_request);
 
   ReleaseAndWaitForDestructor(handler);
 }
@@ -1038,11 +1112,11 @@ TEST(NavigationTest, RedirectDestroy) {
   CefClearSchemeHandlerFactories();
   WaitForIOThread();
 
-  ASSERT_TRUE(handler->got_nav1_redirect_);
-  ASSERT_TRUE(g_got_nav1_request);
-  ASSERT_FALSE(g_got_nav3_request);
-  ASSERT_FALSE(g_got_nav4_request);
-  ASSERT_FALSE(g_got_invalid_request);
+  EXPECT_TRUE(handler->got_nav1_redirect_);
+  EXPECT_TRUE(g_got_nav1_request);
+  EXPECT_FALSE(g_got_nav3_request);
+  EXPECT_FALSE(g_got_nav4_request);
+  EXPECT_FALSE(g_got_invalid_request);
 
   ReleaseAndWaitForDestructor(handler);
 }
@@ -1613,8 +1687,7 @@ const char kLoadNavTestCmdKey[] = "nav-load-test";
 class LoadNavRendererTest : public ClientAppRenderer::Delegate,
                             public CefLoadHandler {
  public:
-  LoadNavRendererTest() : run_test_(false), browser_id_(0), load_ct_(0) {}
-  ~LoadNavRendererTest() override { EXPECT_EQ(0, browser_id_); }
+  LoadNavRendererTest() = default;
 
   void OnBrowserCreated(CefRefPtr<ClientAppRenderer> app,
                         CefRefPtr<CefBrowser> browser,
@@ -1623,10 +1696,16 @@ class LoadNavRendererTest : public ClientAppRenderer::Delegate,
     if (!run_test_)
       return;
 
-    EXPECT_EQ(0, browser_id_);
-    browser_id_ = browser->GetIdentifier();
-    EXPECT_GT(browser_id_, 0);
-    got_browser_created_.yes();
+    // We'll get multiple calls to OnBrowserCreated for same-site navigations
+    // with same-site BFCache enabled.
+    const int new_browser_id = browser->GetIdentifier();
+    if (browser_id_ != 0) {
+      EXPECT_EQ(browser_id_, new_browser_id);
+    } else {
+      browser_id_ = new_browser_id;
+      EXPECT_GT(browser_id_, 0);
+    }
+    browser_created_ct_++;
   }
 
   void OnBrowserDestroyed(CefRefPtr<ClientAppRenderer> app,
@@ -1634,11 +1713,9 @@ class LoadNavRendererTest : public ClientAppRenderer::Delegate,
     if (!run_test_)
       return;
 
-    EXPECT_TRUE(got_browser_created_);
-    EXPECT_TRUE(got_loading_state_end_);
-
+    EXPECT_GT(load_ct_, 0);
+    EXPECT_GT(browser_created_ct_, 0);
     EXPECT_EQ(browser_id_, browser->GetIdentifier());
-    browser_id_ = 0;
   }
 
   CefRefPtr<CefLoadHandler> GetLoadHandler(
@@ -1654,10 +1731,7 @@ class LoadNavRendererTest : public ClientAppRenderer::Delegate,
                             bool canGoBack,
                             bool canGoForward) override {
     if (!isLoading) {
-      EXPECT_TRUE(got_browser_created_);
-
-      got_loading_state_end_.yes();
-
+      EXPECT_GT(browser_created_ct_, 0);
       EXPECT_EQ(browser_id_, browser->GetIdentifier());
 
       load_ct_++;
@@ -1679,16 +1753,16 @@ class LoadNavRendererTest : public ClientAppRenderer::Delegate,
     EXPECT_TRUE(args.get());
     EXPECT_TRUE(args->SetBool(0, result));
     EXPECT_TRUE(args->SetInt(1, browser->GetIdentifier()));
-    EXPECT_TRUE(args->SetInt(2, load_ct_));
+    EXPECT_TRUE(args->SetInt(2, browser_created_ct_));
+    EXPECT_TRUE(args->SetInt(3, load_ct_));
     frame->SendProcessMessage(PID_BROWSER, return_msg);
   }
 
-  bool run_test_;
+  bool run_test_ = false;
 
-  int browser_id_;
-  int load_ct_;
-  TrackCallback got_browser_created_;
-  TrackCallback got_loading_state_end_;
+  int browser_id_ = 0;
+  int load_ct_ = 0;
+  int browser_created_ct_ = 0;
 
   IMPLEMENT_REFCOUNTING(LoadNavRendererTest);
 };
@@ -1708,9 +1782,7 @@ class LoadNavTestHandler : public TestHandler {
                      bool cancel_in_open_url = false)
       : mode_(mode),
         same_origin_(same_origin),
-        cancel_in_open_url_(cancel_in_open_url),
-        browser_id_current_(0),
-        renderer_load_ct_(0) {}
+        cancel_in_open_url_(cancel_in_open_url) {}
 
   std::string GetURL2() const {
     return same_origin_ ? kLoadNavSameOrigin2 : kLoadNavCrossOrigin2;
@@ -1961,7 +2033,9 @@ class LoadNavTestHandler : public TestHandler {
 
       EXPECT_EQ(browser_id_current_, args->GetInt(1));
 
-      renderer_load_ct_ = args->GetInt(2);
+      renderer_browser_created_ct_ = args->GetInt(2);
+      EXPECT_GE(renderer_browser_created_ct_, 1);
+      renderer_load_ct_ = args->GetInt(3);
       EXPECT_GE(renderer_load_ct_, 1);
 
       // Continue with the test.
@@ -1985,6 +2059,7 @@ class LoadNavTestHandler : public TestHandler {
 
       // We should only navigate a single time if the 2nd load is canceled.
       EXPECT_EQ(1, renderer_load_ct_);
+      EXPECT_EQ(1, renderer_browser_created_ct_);
     } else {
       EXPECT_TRUE(got_before_browse_);
       EXPECT_TRUE(got_before_resource_load_);
@@ -1995,9 +2070,17 @@ class LoadNavTestHandler : public TestHandler {
       if (same_origin_) {
         // The renderer process should always be reused.
         EXPECT_EQ(2, renderer_load_ct_);
+        if (IsSameSiteBFCacheEnabled()) {
+          // We expect multiple calls to OnBrowserCreated for same-site
+          // navigations with same-site BFCache enabled.
+          EXPECT_EQ(2, renderer_browser_created_ct_);
+        } else {
+          EXPECT_EQ(1, renderer_browser_created_ct_);
+        }
       } else {
         // Each renderer process is only used for a single navigation.
         EXPECT_EQ(1, renderer_load_ct_);
+        EXPECT_EQ(1, renderer_browser_created_ct_);
       }
     }
 
@@ -2014,8 +2097,9 @@ class LoadNavTestHandler : public TestHandler {
   const bool same_origin_;
   const bool cancel_in_open_url_;
 
-  int browser_id_current_;
-  int renderer_load_ct_;
+  int browser_id_current_ = 0;
+  int renderer_browser_created_ct_ = 0;
+  int renderer_load_ct_ = 0;
 
   TrackCallback got_before_browse_;
   TrackCallback got_open_url_from_tab_;

tests/ceftests/string_unittest.cc

@@ -362,3 +362,123 @@ TEST(StringTest, Multimap) {
 
   cef_string_multimap_free(mapPtr);
 }
+
+// Test that CefString ownership behaves as expected.
+TEST(StringTest, Ownership) {
+  const char* test_cstr = "Test string";
+
+  // Initial owner makes a copy of |test_cstr|.
+  CefStringUTF8 str(test_cstr);
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  const char* str_str = str.c_str();
+  const auto str_struct = str.GetStruct();
+  EXPECT_NE(test_cstr, str_str);
+
+  // REFERENCE CREATION
+
+  // Take a reference (requires explicit use of GetStruct).
+  CefStringUTF8 str_ref(str.GetStruct());
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str_ref| has the same value.
+  EXPECT_FALSE(str_ref.IsOwner());
+  EXPECT_STREQ(test_cstr, str_ref.c_str());
+  // Referencing the same structure and string.
+  EXPECT_EQ(str.GetStruct(), str_ref.GetStruct());
+  EXPECT_EQ(str.c_str(), str_ref.c_str());
+
+  // REFERENCE DETACH/ATTACH
+
+  // DetachToUserFree. |str_ref| loses its reference.
+  auto userfree = str_ref.DetachToUserFree();
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str_ref| is now empty.
+  EXPECT_FALSE(str_ref.IsOwner());
+  EXPECT_TRUE(str_ref.empty());
+  EXPECT_EQ(nullptr, str_ref.GetStruct());
+
+  // AttachToUserFree. |str2| becomes an owner of the copy.
+  CefStringUTF8 str2;
+  str2.AttachToUserFree(userfree);
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str2| is now an owner of a copy.
+  EXPECT_TRUE(str2.IsOwner());
+  EXPECT_STREQ(test_cstr, str2.c_str());
+  // Not referencing the same structure or string.
+  EXPECT_NE(str.GetStruct(), str2.GetStruct());
+  EXPECT_NE(str.c_str(), str2.c_str());
+
+  // |str_ref| is still empty.
+  EXPECT_FALSE(str_ref.IsOwner());
+  EXPECT_TRUE(str_ref.empty());
+  EXPECT_EQ(nullptr, str_ref.GetStruct());
+
+  // OWNER COPY CREATION
+
+  // Making a copy (default copy constructor behavior).
+  CefStringUTF8 str3(str);
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str3| is now an owner of a copy.
+  EXPECT_TRUE(str3.IsOwner());
+  EXPECT_STREQ(test_cstr, str3.c_str());
+  // Not referencing the same structure or string.
+  EXPECT_NE(str.GetStruct(), str3.GetStruct());
+  EXPECT_NE(str.c_str(), str3.c_str());
+
+  // OWNER DETACH/ATTACH
+
+  // DetachToUserFree. |str3| loses its ownership.
+  const char* str3_str = str3.c_str();
+  auto userfree3 = str3.DetachToUserFree();
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str3| is now empty.
+  EXPECT_FALSE(str3.IsOwner());
+  EXPECT_TRUE(str3.empty());
+  EXPECT_EQ(nullptr, str3.GetStruct());
+
+  // AttachToUserFree. |str3| regains its ownership.
+  str3.AttachToUserFree(userfree3);
+
+  // Nothing changes with |str|.
+  EXPECT_TRUE(str.IsOwner());
+  EXPECT_STREQ(test_cstr, str.c_str());
+  EXPECT_EQ(str.GetStruct(), str_struct);
+  EXPECT_EQ(str.c_str(), str_str);
+
+  // |str3| is now an owner of the same string that it had previously.
+  // The structure will also be re-allocated, but we don't test that because
+  // the same address might be reused.
+  EXPECT_TRUE(str3.IsOwner());
+  EXPECT_STREQ(test_cstr, str3.c_str());
+  EXPECT_EQ(str3_str, str3.c_str());
+}

tests/ceftests/test_util.cc

@@ -294,6 +294,28 @@ bool IsChromeRuntimeEnabled() {
   return state ? true : false;
 }
 
+bool IsBFCacheEnabled() {
+  // Supported by the Chrome runtime only, see issue #3237.
+  if (!IsChromeRuntimeEnabled())
+    return false;
+
+  // Enabled by default starting in M96.
+  static int state = -1;
+  if (state == -1) {
+    CefRefPtr<CefCommandLine> command_line =
+        CefCommandLine::GetGlobalCommandLine();
+    const std::string& value = command_line->GetSwitchValue("disable-features");
+    state = value.find("BackForwardCache") == std::string::npos ? 1 : 0;
+  }
+  return state ? true : false;
+}
+
+bool IsSameSiteBFCacheEnabled() {
+  // Same-site BFCache is enabled by default starting in M101 and does not have
+  // a separate configuration flag.
+  return IsBFCacheEnabled();
+}
+
 bool IgnoreURL(const std::string& url) {
   return IsChromeRuntimeEnabled() &&
          url.find("/favicon.ico") != std::string::npos;

tests/ceftests/test_util.h

@@ -84,6 +84,12 @@ bool TestOldResourceAPI();
 // Returns true if the Chrome runtime is enabled.
 bool IsChromeRuntimeEnabled();
 
+// Returns true if BFCache is enabled.
+bool IsBFCacheEnabled();
+
+// Returns true if same-site BFCache is enabled.
+bool IsSameSiteBFCacheEnabled();
+
 // Returns true if requests for |url| should be ignored by tests.
 bool IgnoreURL(const std::string& url);
 

tools/fix_style.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/fix_style.py $@
+python3 tools/fix_style.py $@

tools/make_distrib.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python make_distrib.py --output-dir ../binary_distrib/ $@
+python3 make_distrib.py --output-dir ../binary_distrib/ $@

tools/make_version_header.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/make_version_header.py include/cef_version.h
+python3 tools/make_version_header.py include/cef_version.h

tools/patch.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/patcher.py
+python3 tools/patcher.py

tools/patch_updater.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python tools/patch_updater.py $@
+python3 tools/patch_updater.py $@

tools/translator.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-python translator.py --root-dir .. $@
+python3 translator.py --root-dir .. $@