Fix assertions with Save As dialog

Fixes some issues introduced by 8e79307a62 (see #3314) and
6354d8daf1 (see #3239).

To test:
- Run `cefclient --url=chrome://net-export`
- Click the "Start Logging to Disk" button
- Exit cefclient; get no debug assertions

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/126.0.6478.62'
+  'chromium_checkout': 'refs/tags/126.0.6478.115'
 }

libcef/browser/file_dialog_manager.cc

@@ -146,7 +146,8 @@ FileChooserParams SelectFileToFileChooserParams(
     // |extensions| is a list of allowed extensions. For example, it might be
     //   { { "htm", "html" }, { "txt" } }
     for (size_t i = 0; i < file_types->extensions.size(); ++i) {
-      if (!file_types->extension_mimetypes[i].empty()) {
+      if (file_types->extension_mimetypes.size() > i &&
+          !file_types->extension_mimetypes[i].empty()) {
         // Use the original mime type.
         params.accept_types.push_back(file_types->extension_mimetypes[i]);
       } else if (file_types->extensions[i].size() == 1) {
@@ -273,7 +274,8 @@ CefFileDialogManager::~CefFileDialogManager() = default;
 void CefFileDialogManager::Destroy() {
   if (dialog_listener_) {
     // Cancel the listener and delete related objects.
-    SelectFileDoneByListenerCallback(/*listener_destroyed=*/false);
+    SelectFileDoneByListenerCallback(/*listener=*/nullptr,
+                                     /*listener_destroyed=*/false);
   }
   DCHECK(!dialog_);
   DCHECK(!dialog_listener_);
@@ -424,7 +426,8 @@ void CefFileDialogManager::RunSelectFile(
       listener, params,
       base::BindOnce(&CefFileDialogManager::SelectFileDoneByListenerCallback,
                      weak_ptr_factory_.GetWeakPtr(),
-                     /*listener_destroyed=*/false));
+                     /*listener=*/listener,
+                     /*listener_destroyed=*/true));
 
   // This call will not be intercepted by CefSelectFileDialogFactory due to the
   // |run_from_cef=true| flag.
@@ -449,9 +452,9 @@ void CefFileDialogManager::SelectFileListenerDestroyed(
 
   // This notification will arrive from whomever owns |listener|, so we don't
   // want to execute any |listener| methods after this point.
-  if (dialog_listener_ && listener == dialog_listener_->listener()) {
+  if (dialog_listener_) {
     // Cancel the currently active dialog.
-    SelectFileDoneByListenerCallback(/*listener_destroyed=*/true);
+    SelectFileDoneByListenerCallback(listener, /*listener_destroyed=*/true);
   } else {
     // Any future SelectFileDoneByDelegateCallback call for |listener| becomes a
     // no-op.
@@ -570,9 +573,14 @@ void CefFileDialogManager::SelectFileDoneByDelegateCallback(
 }
 
 void CefFileDialogManager::SelectFileDoneByListenerCallback(
+    ui::SelectFileDialog::Listener* listener,
     bool listener_destroyed) {
   CEF_REQUIRE_UIT();
 
+  // |listener| will be provided iff |listener_destroyed=true|, as
+  // |dialog_listener_->listener()| will return nullptr at this point.
+  DCHECK(!listener || listener_destroyed);
+
   // Avoid re-entrancy of this method. CefSelectFileDialogListener callbacks to
   // the delegated listener may result in an immediate call to
   // SelectFileListenerDestroyed() while |dialog_listener_| is still on the
@@ -587,7 +595,7 @@ void CefFileDialogManager::SelectFileDoneByListenerCallback(
   DCHECK(dialog_);
   DCHECK(dialog_listener_);
 
-  active_listeners_.erase(dialog_listener_->listener());
+  active_listeners_.erase(listener ? listener : dialog_listener_->listener());
 
   // Clear |dialog_listener_| before calling Cancel() to avoid re-entrancy.
   auto dialog_listener = dialog_listener_;

libcef/browser/file_dialog_manager.h

@@ -85,7 +85,9 @@ class CefFileDialogManager {
       ui::SelectFileDialog::Listener* listener,
       void* params,
       const std::vector<base::FilePath>& paths);
-  void SelectFileDoneByListenerCallback(bool listener_destroyed);
+  void SelectFileDoneByListenerCallback(
+      ui::SelectFileDialog::Listener* listener,
+      bool listener_destroyed);
 
   // CefBrowserHostBase pointer is guaranteed to outlive this object.
   const raw_ptr<CefBrowserHostBase> browser_;

libcef/browser/file_dialog_runner.cc

@@ -39,6 +39,8 @@ class CefSelectFileDialogFactory final : public ui::SelectFileDialogFactory {
 // Delegates the running of the dialog to CefFileDialogManager.
 class CefSelectFileDialog final : public ui::SelectFileDialog {
  public:
+  // |listener| is not owned by this object. It will remain valid until
+  // ListenerDestroyed() is called.
   CefSelectFileDialog(ui::SelectFileDialog::Listener* listener,
                       std::unique_ptr<ui::SelectFilePolicy> policy)
       : ui::SelectFileDialog(listener, std::move(policy)) {

patch/patches/DEPS.patch

@@ -1,5 +1,5 @@
 diff --git DEPS DEPS
-index 03652696e2e40..b684b58db41ff 100644
+index 912065d31f140..5ad90457499d3 100644
 --- DEPS
 +++ DEPS
 @@ -2102,16 +2102,16 @@ deps = {

patch/patches/browser_security_policy_1081397.patch

@@ -20,10 +20,10 @@ index 7822aeab4826a..fa72112bfee98 100644
  
            // Make an exception to allow most visited tiles to commit in
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index f62d0f627536a..02e5d50e4afe8 100644
+index 77ee94a9c99b6..524828a13d762 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
-@@ -7953,10 +7953,22 @@ NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(
+@@ -7974,10 +7974,22 @@ NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(
    bool use_opaque_origin =
        (sandbox_flags & network::mojom::WebSandboxFlags::kOrigin) ==
        network::mojom::WebSandboxFlags::kOrigin;
@@ -47,7 +47,7 @@ index f62d0f627536a..02e5d50e4afe8 100644
    }
  
    return origin_and_debug_info;
-@@ -8064,6 +8076,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponseWithDebugInfo() {
+@@ -8085,6 +8097,15 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponseWithDebugInfo() {
        DetermineInitiatorRelationship(initiator_rfh,
                                       frame_tree_node_->current_frame_host()));
  

patch/patches/views_widget.patch

@@ -259,10 +259,10 @@ index 2cf9330a4e24b..4bf0890ae000b 100644
  
  // Specifies which edges of the window are tiled.
 diff --git ui/ozone/platform/x11/x11_window.cc ui/ozone/platform/x11/x11_window.cc
-index f1c5f06fb2966..649a206664a00 100644
+index 94dc1654c3540..37f78f3f240b4 100644
 --- ui/ozone/platform/x11/x11_window.cc
 +++ ui/ozone/platform/x11/x11_window.cc
-@@ -1862,7 +1862,8 @@ void X11Window::CreateXWindow(const PlatformWindowInitProperties& properties) {
+@@ -1865,7 +1865,8 @@ void X11Window::CreateXWindow(const PlatformWindowInitProperties& properties) {
    req.border_pixel = 0;
  
    bounds_in_pixels_ = SanitizeBounds(bounds);