cefclient: Allow download with --hide-controls (fixes #3742)

The InterceptedRequestHandlerWrapper object may be deleted (likely via
~InterceptedRequest) while the task to call
InterceptedRequestHandlerWrapper:ContinueCreateURLLoaderNetworkObserver
is still pending. That binding holds a
WeakPtr<InterceptedRequestHandlerWrapper> (which is now nullptr)
resulting in the bound std::unique_ptr<PendingRequest> being deleted
while still holding a raw_ptr<network::ResourceRequest> to the
already-deleted object. This is always safe (raw_ptr will never be
dereferenced) because of the WeakPtr check.

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/127.0.6533.0'
+  'chromium_checkout': 'refs/tags/127.0.6533.43'
 }

libcef/browser/alloy/alloy_browser_host_impl.cc

@@ -1138,8 +1138,8 @@ void AlloyBrowserHostImpl::GetCustomWebContentsView(
     const GURL& target_url,
     int opener_render_process_id,
     int opener_render_frame_id,
-    content::WebContentsView** view,
+    raw_ptr<content::WebContentsView>* view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
   CefBrowserInfoManager::GetInstance()->GetCustomWebContentsView(
       target_url,
       frame_util::MakeGlobalId(opener_render_process_id,

libcef/browser/alloy/alloy_browser_host_impl.h

@@ -237,8 +237,8 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
       const GURL& target_url,
       int opener_render_process_id,
       int opener_render_frame_id,
-      content::WebContentsView** view,
+      raw_ptr<content::WebContentsView>* view,
-      content::RenderViewHostDelegateView** delegate_view) override;
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view) override;
   void WebContentsCreated(content::WebContents* source_contents,
                           int opener_render_process_id,
                           int opener_render_frame_id,

libcef/browser/browser_info_manager.cc

@@ -228,8 +228,8 @@ bool CefBrowserInfoManager::CanCreateWindow(
 void CefBrowserInfoManager::GetCustomWebContentsView(
     const GURL& target_url,
     const content::GlobalRenderFrameHostId& opener_global_id,
-    content::WebContentsView** view,
+    raw_ptr<content::WebContentsView>* view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
   CEF_REQUIRE_UIT();
 
   auto pending_popup = PopPendingPopup(PendingPopup::CAN_CREATE_WINDOW,

libcef/browser/browser_info_manager.h

@@ -87,8 +87,8 @@ class CefBrowserInfoManager : public content::RenderProcessHostObserver {
   void GetCustomWebContentsView(
       const GURL& target_url,
       const content::GlobalRenderFrameHostId& opener_global_id,
-      content::WebContentsView** view,
+      raw_ptr<content::WebContentsView>* view,
-      content::RenderViewHostDelegateView** delegate_view);
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view);
 
   // Called from WebContentsDelegate::WebContentsCreated. See comments on
   // PendingPopup for more information.

libcef/browser/browser_platform_delegate.cc

@@ -85,8 +85,8 @@ content::WebContents* CefBrowserPlatformDelegate::CreateWebContents(
 }
 
 void CefBrowserPlatformDelegate::CreateViewForWebContents(
-    content::WebContentsView** view,
+    raw_ptr<content::WebContentsView>* view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
   DCHECK(false);
 }
 

libcef/browser/browser_platform_delegate.h

@@ -111,8 +111,8 @@ class CefBrowserPlatformDelegate {
   // called a single time per instance. May be called on multiple threads. Only
   // used with windowless rendering.
   virtual void CreateViewForWebContents(
-      content::WebContentsView** view,
+      raw_ptr<content::WebContentsView>* view,
-      content::RenderViewHostDelegateView** delegate_view);
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view);
 
   // Called after the WebContents for a browser has been created. |owned| will
   // be true if |web_contents| was created via CreateWebContents() and we should

libcef/browser/file_dialog_manager.cc

@@ -146,7 +146,8 @@ FileChooserParams SelectFileToFileChooserParams(
     // |extensions| is a list of allowed extensions. For example, it might be
     //   { { "htm", "html" }, { "txt" } }
     for (size_t i = 0; i < file_types->extensions.size(); ++i) {
-      if (!file_types->extension_mimetypes[i].empty()) {
+      if (file_types->extension_mimetypes.size() > i &&
+          !file_types->extension_mimetypes[i].empty()) {
         // Use the original mime type.
         params.accept_types.push_back(file_types->extension_mimetypes[i]);
       } else if (file_types->extensions[i].size() == 1) {
@@ -273,7 +274,8 @@ CefFileDialogManager::~CefFileDialogManager() = default;
 void CefFileDialogManager::Destroy() {
   if (dialog_listener_) {
     // Cancel the listener and delete related objects.
-    SelectFileDoneByListenerCallback(/*listener_destroyed=*/false);
+    SelectFileDoneByListenerCallback(/*listener=*/nullptr,
+                                     /*listener_destroyed=*/false);
   }
   DCHECK(!dialog_);
   DCHECK(!dialog_listener_);
@@ -386,8 +388,8 @@ void CefFileDialogManager::RunSelectFile(
       SelectFileToFileChooserParams(type, title, default_path, file_types);
   auto callback =
       base::BindOnce(&CefFileDialogManager::SelectFileDoneByDelegateCallback,
-                     weak_ptr_factory_.GetWeakPtr(), base::Unretained(listener),
+                     weak_ptr_factory_.GetWeakPtr(),
-                     base::Unretained(params));
+                     base::UnsafeDangling(listener), base::Unretained(params));
   callback = MaybeRunDelegate(chooser_params, file_types->extensions,
                               file_types->extension_description_overrides,
                               std::move(callback));
@@ -424,7 +426,8 @@ void CefFileDialogManager::RunSelectFile(
       listener, params,
       base::BindOnce(&CefFileDialogManager::SelectFileDoneByListenerCallback,
                      weak_ptr_factory_.GetWeakPtr(),
-                     /*listener_destroyed=*/false));
+                     base::UnsafeDangling(listener),
+                     /*listener_destroyed=*/true));
 
   // This call will not be intercepted by CefSelectFileDialogFactory due to the
   // |run_from_cef=true| flag.
@@ -449,9 +452,9 @@ void CefFileDialogManager::SelectFileListenerDestroyed(
 
   // This notification will arrive from whomever owns |listener|, so we don't
   // want to execute any |listener| methods after this point.
-  if (dialog_listener_ && listener == dialog_listener_->listener()) {
+  if (dialog_listener_) {
     // Cancel the currently active dialog.
-    SelectFileDoneByListenerCallback(/*listener_destroyed=*/true);
+    SelectFileDoneByListenerCallback(listener, /*listener_destroyed=*/true);
   } else {
     // Any future SelectFileDoneByDelegateCallback call for |listener| becomes a
     // no-op.
@@ -545,7 +548,7 @@ CefFileDialogManager::MaybeRunDelegate(
 }
 
 void CefFileDialogManager::SelectFileDoneByDelegateCallback(
-    ui::SelectFileDialog::Listener* listener,
+    MayBeDangling<ui::SelectFileDialog::Listener> listener,
     void* params,
     const std::vector<base::FilePath>& paths) {
   CEF_REQUIRE_UIT();
@@ -556,7 +559,7 @@ void CefFileDialogManager::SelectFileDoneByDelegateCallback(
     return;
   }
 
-  active_listeners_.erase(listener);
+  active_listeners_.erase(listener.get());
 
   if (paths.empty()) {
     listener->FileSelectionCanceled(params);
@@ -570,9 +573,14 @@ void CefFileDialogManager::SelectFileDoneByDelegateCallback(
 }
 
 void CefFileDialogManager::SelectFileDoneByListenerCallback(
+    MayBeDangling<ui::SelectFileDialog::Listener> listener,
     bool listener_destroyed) {
   CEF_REQUIRE_UIT();
 
+  // |listener| will be provided iff |listener_destroyed=true|, as
+  // |dialog_listener_->listener()| will return nullptr at this point.
+  DCHECK(!listener || listener_destroyed);
+
   // Avoid re-entrancy of this method. CefSelectFileDialogListener callbacks to
   // the delegated listener may result in an immediate call to
   // SelectFileListenerDestroyed() while |dialog_listener_| is still on the
@@ -587,7 +595,8 @@ void CefFileDialogManager::SelectFileDoneByListenerCallback(
   DCHECK(dialog_);
   DCHECK(dialog_listener_);
 
-  active_listeners_.erase(dialog_listener_->listener());
+  active_listeners_.erase(listener ? listener.get()
+                                   : dialog_listener_->listener());
 
   // Clear |dialog_listener_| before calling Cancel() to avoid re-entrancy.
   auto dialog_listener = dialog_listener_;

libcef/browser/file_dialog_manager.h

@@ -82,10 +82,12 @@ class CefFileDialogManager {
       RunFileChooserCallback callback);
 
   void SelectFileDoneByDelegateCallback(
-      ui::SelectFileDialog::Listener* listener,
+      MayBeDangling<ui::SelectFileDialog::Listener> listener,
       void* params,
       const std::vector<base::FilePath>& paths);
-  void SelectFileDoneByListenerCallback(bool listener_destroyed);
+  void SelectFileDoneByListenerCallback(
+      MayBeDangling<ui::SelectFileDialog::Listener> listener,
+      bool listener_destroyed);
 
   // CefBrowserHostBase pointer is guaranteed to outlive this object.
   const raw_ptr<CefBrowserHostBase> browser_;

libcef/browser/file_dialog_runner.cc

@@ -39,6 +39,8 @@ class CefSelectFileDialogFactory final : public ui::SelectFileDialogFactory {
 // Delegates the running of the dialog to CefFileDialogManager.
 class CefSelectFileDialog final : public ui::SelectFileDialog {
  public:
+  // |listener| is not owned by this object. It will remain valid until
+  // ListenerDestroyed() is called.
   CefSelectFileDialog(ui::SelectFileDialog::Listener* listener,
                       std::unique_ptr<ui::SelectFilePolicy> policy)
       : ui::SelectFileDialog(listener, std::move(policy)) {

libcef/browser/net_service/resource_request_handler_wrapper.cc

@@ -95,14 +95,16 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
 
     void Reset(CefRefPtr<CefResourceRequestHandler> handler,
                CefRefPtr<CefSchemeHandlerFactory> scheme_factory,
-               CefRefPtr<CefRequestImpl> request,
+               CefRefPtr<CefRequestImpl> pending_request,
+               network::ResourceRequest* request,
                bool request_was_redirected,
                CancelRequestCallback cancel_callback) {
       handler_ = handler;
       scheme_factory_ = scheme_factory;
       cookie_filter_ = nullptr;
-      pending_request_ = request;
+      pending_request_ = pending_request;
       pending_response_ = nullptr;
+      request_ = request;
       request_was_redirected_ = request_was_redirected;
       was_custom_handled_ = false;
       cancel_callback_ = std::move(cancel_callback);
@@ -113,6 +115,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     CefRefPtr<CefCookieAccessFilter> cookie_filter_;
     CefRefPtr<CefRequestImpl> pending_request_;
     CefRefPtr<CefResponseImpl> pending_response_;
+    raw_ptr<network::ResourceRequest> request_;
     bool request_was_redirected_ = false;
     bool was_custom_handled_ = false;
     bool accept_language_added_ = false;
@@ -144,7 +147,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     }
 
     const int32_t id_;
-    raw_ptr<network::ResourceRequest> request_;
+    raw_ptr<network::ResourceRequest, DisableDanglingPtrDetection> request_;
     const bool request_was_redirected_;
     OnBeforeRequestResultCallback callback_;
     CancelRequestCallback cancel_callback_;
@@ -569,8 +572,8 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     }
 
     // May have a handler and/or scheme factory.
-    state->Reset(handler, scheme_factory, requestPtr, request_was_redirected,
+    state->Reset(handler, scheme_factory, requestPtr, request,
-                 std::move(cancel_callback));
+                 request_was_redirected, std::move(cancel_callback));
 
     if (handler) {
       state->cookie_filter_ = handler->GetCookieAccessFilter(
@@ -587,16 +590,15 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       return;
     }
 
-    MaybeLoadCookies(request_id, state, request, std::move(exec_callback));
+    MaybeLoadCookies(request_id, state, std::move(exec_callback));
   }
 
   void MaybeLoadCookies(int32_t request_id,
                         RequestState* state,
-                        network::ResourceRequest* request,
                         base::OnceClosure callback) {
     CEF_REQUIRE_IOT();
 
-    if (!cookie_helper::IsCookieableScheme(request->url,
+    if (!cookie_helper::IsCookieableScheme(state->request_->url,
                                            init_state_->cookieable_schemes_)) {
       // The scheme does not support cookies.
       std::move(callback).Run();
@@ -614,10 +616,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
                   &InterceptedRequestHandlerWrapper::AllowCookieAlways);
     auto done_cookie_callback = base::BindOnce(
         &InterceptedRequestHandlerWrapper::ContinueWithLoadedCookies,
-        weak_ptr_factory_.GetWeakPtr(), request_id, request,
+        weak_ptr_factory_.GetWeakPtr(), request_id, std::move(callback));
-        std::move(callback));
+    cookie_helper::LoadCookies(init_state_->browser_context_getter_,
-    cookie_helper::LoadCookies(init_state_->browser_context_getter_, *request,
+                               *(state->request_), allow_cookie_callback,
-                               allow_cookie_callback,
                                std::move(done_cookie_callback));
   }
 
@@ -649,7 +650,6 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
   }
 
   void ContinueWithLoadedCookies(int32_t request_id,
-                                 network::ResourceRequest* request,
                                  base::OnceClosure callback,
                                  int total_count,
                                  net::CookieList allowed_cookies) {
@@ -666,13 +666,14 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       // Also add/save cookies ourselves for default-handled network requests
       // so that we can filter them. This will be a no-op for custom-handled
       // requests.
-      request->load_flags |= kLoadNoCookiesFlags;
+      state->request_->load_flags |= kLoadNoCookiesFlags;
     }
 
     if (!allowed_cookies.empty()) {
       const std::string& cookie_line =
           net::CanonicalCookie::BuildCookieLine(allowed_cookies);
-      request->headers.SetHeader(net::HttpRequestHeaders::kCookie, cookie_line);
+      state->request_->headers.SetHeader(net::HttpRequestHeaders::kCookie,
+                                         cookie_line);
 
       state->pending_request_->SetReadOnly(false);
       state->pending_request_->SetHeaderByName(net::HttpRequestHeaders::kCookie,
@@ -708,8 +709,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       CefRefPtr<RequestCallbackWrapper> callbackPtr =
           new RequestCallbackWrapper(base::BindOnce(
               &InterceptedRequestHandlerWrapper::ContinueShouldInterceptRequest,
-              weak_ptr_factory_.GetWeakPtr(), request_id,
+              weak_ptr_factory_.GetWeakPtr(), request_id, std::move(callback)));
-              base::Unretained(request), std::move(callback)));
 
       cef_return_value_t retval = state->handler_->OnBeforeResourceLoad(
           init_state_->browser_, init_state_->frame_,
@@ -725,14 +725,12 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       }
     } else {
       // The scheme factory may choose to handle it.
-      ContinueShouldInterceptRequest(request_id, request, std::move(callback),
+      ContinueShouldInterceptRequest(request_id, std::move(callback), true);
-                                     true);
     }
   }
 
   void ContinueShouldInterceptRequest(
       int32_t request_id,
-      network::ResourceRequest* request,
       ShouldInterceptRequestResultCallback callback,
       bool allow) {
     CEF_REQUIRE_IOT();
@@ -751,7 +749,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     if (state->handler_) {
       if (allow) {
         // Apply any |requestPtr| changes to |request|.
-        state->pending_request_->Get(request, true /* changed_only */);
+        state->pending_request_->Get(state->request_, true /* changed_only */);
       }
 
       const bool redirect =
@@ -790,8 +788,8 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     if (!resource_handler && state->scheme_factory_) {
       // Does the scheme factory want to handle the request?
       resource_handler = state->scheme_factory_->Create(
-          init_state_->browser_, init_state_->frame_, request->url.scheme(),
+          init_state_->browser_, init_state_->frame_,
-          state->pending_request_.get());
+          state->request_->url.scheme(), state->pending_request_.get());
     }
 
     std::unique_ptr<ResourceResponse> resource_response;
@@ -803,7 +801,8 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       // The request will be handled by the NetworkService. Remove the
       // "Accept-Language" header here so that it can be re-added in
       // URLRequestHttpJob::AddExtraHeaders with correct ordering applied.
-      request->headers.RemoveHeader(net::HttpRequestHeaders::kAcceptLanguage);
+      state->request_->headers.RemoveHeader(
+          net::HttpRequestHeaders::kAcceptLanguage);
     }
 
     // Continue the request.
@@ -860,7 +859,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     if (!state->handler_) {
       // Cookies may come from a scheme handler.
       MaybeSaveCookies(
-          request_id, state, request, headers,
+          request_id, state, headers,
           base::BindOnce(
               std::move(callback), ResponseMode::CONTINUE, nullptr,
               redirect_info.has_value() ? redirect_info->new_url : GURL()));
@@ -871,16 +870,15 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     DCHECK(state->pending_response_);
 
     if (redirect_info.has_value()) {
-      HandleRedirect(request_id, state, request, headers, *redirect_info,
+      HandleRedirect(request_id, state, headers, *redirect_info,
                      std::move(callback));
     } else {
-      HandleResponse(request_id, state, request, headers, std::move(callback));
+      HandleResponse(request_id, state, headers, std::move(callback));
     }
   }
 
   void HandleRedirect(int32_t request_id,
                       RequestState* state,
-                      network::ResourceRequest* request,
                       net::HttpResponseHeaders* headers,
                       const net::RedirectInfo& redirect_info,
                       OnRequestResponseResultCallback callback) {
@@ -911,13 +909,11 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     auto exec_callback = base::BindOnce(
         std::move(callback), ResponseMode::CONTINUE, nullptr, new_url);
 
-    MaybeSaveCookies(request_id, state, request, headers,
+    MaybeSaveCookies(request_id, state, headers, std::move(exec_callback));
-                     std::move(exec_callback));
   }
 
   void HandleResponse(int32_t request_id,
                       RequestState* state,
-                      network::ResourceRequest* request,
                       net::HttpResponseHeaders* headers,
                       OnRequestResponseResultCallback callback) {
     // The client may modify |pending_request_| in OnResourceResponse.
@@ -933,7 +929,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       // The request may have been modified.
       const auto changes = state->pending_request_->GetChanges();
       if (changes) {
-        state->pending_request_->Get(request, true /* changed_only */);
+        state->pending_request_->Get(state->request_, true /* changed_only */);
 
         if (changes & CefRequestImpl::kChangedUrl) {
           // Redirect to the new URL.
@@ -961,13 +957,11 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       return;
     }
 
-    MaybeSaveCookies(request_id, state, request, headers,
+    MaybeSaveCookies(request_id, state, headers, std::move(exec_callback));
-                     std::move(exec_callback));
   }
 
   void MaybeSaveCookies(int32_t request_id,
                         RequestState* state,
-                        network::ResourceRequest* request,
                         net::HttpResponseHeaders* headers,
                         base::OnceClosure callback) {
     CEF_REQUIRE_IOT();
@@ -978,7 +972,7 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
       return;
     }
 
-    if (!cookie_helper::IsCookieableScheme(request->url,
+    if (!cookie_helper::IsCookieableScheme(state->request_->url,
                                            init_state_->cookieable_schemes_)) {
       // The scheme does not support cookies.
       std::move(callback).Run();
@@ -997,9 +991,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     auto done_cookie_callback = base::BindOnce(
         &InterceptedRequestHandlerWrapper::ContinueWithSavedCookies,
         weak_ptr_factory_.GetWeakPtr(), request_id, std::move(callback));
-    cookie_helper::SaveCookies(init_state_->browser_context_getter_, *request,
+    cookie_helper::SaveCookies(
-                               headers, allow_cookie_callback,
+        init_state_->browser_context_getter_, *(state->request_), headers,
-                               std::move(done_cookie_callback));
+        allow_cookie_callback, std::move(done_cookie_callback));
   }
 
   void AllowCookieSave(int32_t request_id,
@@ -1275,6 +1269,12 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     for (auto& pair : request_map) {
       auto state = std::move(pair.second);
       if (state->cancel_callback_) {
+        // The cancel callback may trigger a call to OnRequestComplete followed
+        // by destruction of the InterceptedRequest that owns the
+        // ResourceRequest. We therefore need to clear the
+        // raw_ptr<ResourceRequest> first to avoid dangling pointer errors.
+        state->request_ = nullptr;
+
         std::move(state->cancel_callback_).Run(net::ERR_ABORTED);
       }
     }

libcef/browser/osr/browser_platform_delegate_osr.cc

@@ -31,8 +31,8 @@ CefBrowserPlatformDelegateOsr::CefBrowserPlatformDelegateOsr(
 }
 
 void CefBrowserPlatformDelegateOsr::CreateViewForWebContents(
-    content::WebContentsView** view,
+    raw_ptr<content::WebContentsView>* view,
-    content::RenderViewHostDelegateView** delegate_view) {
+    raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {
   DCHECK(!view_osr_);
 
   // Use the OSR view instead of the default platform view.

libcef/browser/osr/browser_platform_delegate_osr.h

@@ -23,8 +23,8 @@ class CefBrowserPlatformDelegateOsr
  public:
   // CefBrowserPlatformDelegate methods:
   void CreateViewForWebContents(
-      content::WebContentsView** view,
+      raw_ptr<content::WebContentsView>* view,
-      content::RenderViewHostDelegateView** delegate_view) override;
+      raw_ptr<content::RenderViewHostDelegateView>* delegate_view) override;
   void WebContentsCreated(content::WebContents* web_contents,
                           bool owned) override;
   void WebContentsDestroyed(content::WebContents* web_contents) override;

libcef/common/request_impl.h

@@ -258,7 +258,7 @@ class CefPostDataElementImpl : public CefPostDataElement {
   Type type_ = PDE_TYPE_EMPTY;
   union {
     struct {
-      void* bytes;
+      RAW_PTR_EXCLUSION void* bytes;
       size_t size;
     } bytes;
     cef_string_t filename;

libcef/renderer/blink_glue.cc

@@ -282,6 +282,7 @@ void RegisterURLSchemeAsSupportingFetchAPI(const blink::WebString& scheme) {
 }
 
 struct CefScriptForbiddenScope::Impl {
+  STACK_ALLOCATED_IGNORE()
   blink::ScriptForbiddenScope scope_;
 };
 

libcef_dll/libcef_dll.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=bc230d77e2985959bc5a6a2af80b500eec070384$
+// $hash=4a4490df4b9440aeb853d6625fddb7de5741f5b0$
 //
 
 #include "include/capi/cef_app_capi.h"
@@ -131,12 +131,12 @@ CEF_EXPORT int cef_get_exit_code() {
 CEF_EXPORT void cef_shutdown() {
   // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
 
+  // Execute
+  CefShutdown();
+
 #if DCHECK_IS_ON()
   shutdown_checker::SetIsShutdown();
 #endif
-
-  // Execute
-  CefShutdown();
 }
 
 CEF_EXPORT void cef_do_message_loop_work() {

libcef_dll/wrapper/libcef_dll_wrapper.cc

@@ -9,7 +9,7 @@
 // implementations. See the translator.README.txt file in the tools directory
 // for more information.
 //
-// $hash=16d4e51ecbe1fd8eb6915d951a84f707f73dfb1a$
+// $hash=e9099c29c9695cabcedfde25b85c1f77f14cb516$
 //
 
 #include "include/capi/cef_app_capi.h"
@@ -119,12 +119,12 @@ NO_SANITIZE("cfi-icall") CEF_GLOBAL int CefGetExitCode() {
 NO_SANITIZE("cfi-icall") CEF_GLOBAL void CefShutdown() {
   // AUTO-GENERATED CONTENT - DELETE THIS COMMENT BEFORE MODIFYING
 
+  // Execute
+  cef_shutdown();
+
 #if DCHECK_IS_ON()
   shutdown_checker::SetIsShutdown();
 #endif
-
-  // Execute
-  cef_shutdown();
 }
 
 NO_SANITIZE("cfi-icall") CEF_GLOBAL void CefDoMessageLoopWork() {

patch/patch.cfg

@@ -236,6 +236,10 @@ patches = [
     #
     # Linux: Fix duplicate symbol error for window_frame_util.cc
     # https://issuetracker.google.com/issues/343037853#comment3
+    #
+    # Avoid duplicate window from DevTools when CEF handles the open via
+    # OnOpenURLFromTab.
+    # https://github.com/chromiumembedded/cef/issues/3735
     'name': 'chrome_browser_browser',
   },
   {
@@ -818,8 +822,9 @@ patches = [
     'name': 'base_thread_pool_5548577'
   },
   {
-    # Linux: Fix ARM build broken by build_tflite_with_xnnpack change.
+    # Fix DCHECK in SimpleMenuModel::AddSeparator when adding a separator with
-    # https://issues.chromium.org/issues/348117454
+    # hidden menu items.
-    'name': 'linux_tflite_348117454'
+    # https://github.com/chromiumembedded/cef/issues/3577
+    'name': 'ui_menu_model_3577'
   }
 ]

patch/patches/base_thread_pool_5548577.patch

@@ -1,5 +1,5 @@
 diff --git base/task/thread_pool/thread_pool_impl.cc base/task/thread_pool/thread_pool_impl.cc
-index 4ac5cea5f6c08..559593f1564c9 100644
+index 4ac5cea5f6c08..a9c1c152568f3 100644
 --- base/task/thread_pool/thread_pool_impl.cc
 +++ base/task/thread_pool/thread_pool_impl.cc
 @@ -105,6 +105,10 @@ ThreadPoolImpl::ThreadPoolImpl(std::string_view histogram_label,

patch/patches/browser_security_policy_1081397.patch

@@ -20,7 +20,7 @@ index 26fbdc7e7db0c..ac02e60276e5c 100644
  
            // Make an exception to allow most visited tiles to commit in
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index 87db8bec18603..22c7d3fb838ab 100644
+index eaed2976e16ac..f4a67c2447e69 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
 @@ -8057,10 +8057,22 @@ NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(

patch/patches/chrome_browser.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index 8e3fde5e841e1..8adc42aea0836 100644
+index e06cdcd322877..7c0382fd1948a 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
 @@ -11,6 +11,7 @@ import("//build/config/compiler/pgo/pgo.gni")
@@ -10,7 +10,7 @@ index 8e3fde5e841e1..8adc42aea0836 100644
  import("//chrome/browser/buildflags.gni")
  import("//chrome/browser/downgrade/buildflags.gni")
  import("//chrome/common/features.gni")
-@@ -2049,6 +2050,7 @@ static_library("browser") {
+@@ -2055,6 +2056,7 @@ static_library("browser") {
      "//build/config/chromebox_for_meetings:buildflags",
      "//build/config/compiler:compiler_buildflags",
      "//cc",
@@ -18,7 +18,7 @@ index 8e3fde5e841e1..8adc42aea0836 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -2769,6 +2771,10 @@ static_library("browser") {
+@@ -2777,6 +2779,10 @@ static_library("browser") {
      ]
    }
  

patch/patches/chrome_browser_browser.patch

@@ -13,7 +13,7 @@ index 2480282a19d12..dbd1fbf8a15b5 100644
    return false;
  }
 diff --git chrome/browser/devtools/devtools_window.cc chrome/browser/devtools/devtools_window.cc
-index 02ff1e580d3a7..7f51115896049 100644
+index 02ff1e580d3a7..e2e232c424029 100644
 --- chrome/browser/devtools/devtools_window.cc
 +++ chrome/browser/devtools/devtools_window.cc
 @@ -37,6 +37,7 @@
@@ -38,7 +38,21 @@ index 02ff1e580d3a7..7f51115896049 100644
    }
  
    // Create WebContents with devtools.
-@@ -1919,12 +1927,28 @@ void DevToolsWindow::CreateDevToolsBrowser() {
+@@ -1754,9 +1762,13 @@ void DevToolsWindow::OpenInNewTab(const GURL& url) {
+   if (!inspected_web_contents ||
+       !inspected_web_contents->OpenURL(params,
+                                        /*navigation_handle_callback=*/{})) {
++#if !BUILDFLAG(ENABLE_CEF)
++    // Remove default behavior when CEF handles the open via OnOpenURLFromTab.
++    // See CEF issue #3735.
+     chrome::ScopedTabbedBrowserDisplayer displayer(profile_);
+     chrome::AddSelectedTabWithURL(displayer.browser(), fixed_url,
+                                   ui::PAGE_TRANSITION_LINK);
++#endif
+   }
+ }
+ 
+@@ -1919,12 +1931,28 @@ void DevToolsWindow::CreateDevToolsBrowser() {
        Browser::CreationStatus::kOk) {
      return;
    }
@@ -74,7 +88,7 @@ index 02ff1e580d3a7..7f51115896049 100644
  }
  
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index 74460ac479210..8cf70c80a87ad 100644
+index 49e6bdcbd55a6..0425eb49c4296 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -8,6 +8,7 @@ import("//build/config/compiler/compiler.gni")
@@ -104,7 +118,7 @@ index 74460ac479210..8cf70c80a87ad 100644
      "//chrome:resources",
      "//chrome:strings",
      "//chrome/app:chrome_dll_resources",
-@@ -3040,6 +3046,8 @@ static_library("ui") {
+@@ -3045,6 +3051,8 @@ static_library("ui") {
        "views/apps/app_dialog/app_local_block_dialog_view.h",
        "views/apps/app_dialog/app_pause_dialog_view.cc",
        "views/apps/app_dialog/app_pause_dialog_view.h",
@@ -113,7 +127,7 @@ index 74460ac479210..8cf70c80a87ad 100644
        "views/apps/app_info_dialog/arc_app_info_links_panel.cc",
        "views/apps/app_info_dialog/arc_app_info_links_panel.h",
        "views/apps/chrome_app_window_client_views_chromeos.cc",
-@@ -4249,8 +4257,6 @@ static_library("ui") {
+@@ -4254,8 +4262,6 @@ static_library("ui") {
        "autofill/payments/webauthn_dialog_model.h",
        "autofill/payments/webauthn_dialog_model_observer.h",
        "autofill/payments/webauthn_dialog_state.h",
@@ -122,7 +136,7 @@ index 74460ac479210..8cf70c80a87ad 100644
        "incognito_clear_browsing_data_dialog_interface.h",
        "signin/signin_modal_dialog.cc",
        "signin/signin_modal_dialog.h",
-@@ -5125,8 +5131,6 @@ static_library("ui") {
+@@ -5130,8 +5136,6 @@ static_library("ui") {
        "views/accessibility/theme_tracking_non_accessible_image_view.h",
        "views/apps/app_dialog/app_dialog_view.cc",
        "views/apps/app_dialog/app_dialog_view.h",
@@ -131,7 +145,7 @@ index 74460ac479210..8cf70c80a87ad 100644
        "views/apps/app_info_dialog/app_info_dialog_container.cc",
        "views/apps/app_info_dialog/app_info_dialog_container.h",
        "views/apps/app_info_dialog/app_info_dialog_views.cc",
-@@ -6908,6 +6912,7 @@ static_library("ui") {
+@@ -6913,6 +6917,7 @@ static_library("ui") {
    if (enable_printing) {
      deps += [
        "//components/printing/browser",
@@ -140,7 +154,7 @@ index 74460ac479210..8cf70c80a87ad 100644
      ]
    }
 diff --git chrome/browser/ui/browser.cc chrome/browser/ui/browser.cc
-index 557abfcd71d85..fb64e93157148 100644
+index b4eadfdbfcfac..8ee3f0f988f6d 100644
 --- chrome/browser/ui/browser.cc
 +++ chrome/browser/ui/browser.cc
 @@ -272,6 +272,25 @@
@@ -180,7 +194,7 @@ index 557abfcd71d85..fb64e93157148 100644
        tab_strip_model_delegate_(
            std::make_unique<chrome::BrowserTabStripModelDelegate>(this)),
        tab_strip_model_(std::make_unique<TabStripModel>(
-@@ -757,6 +780,12 @@ Browser::~Browser() {
+@@ -759,6 +782,12 @@ Browser::~Browser() {
    // away so they don't try and call back to us.
    if (select_file_dialog_.get())
      select_file_dialog_->ListenerDestroyed();
@@ -193,7 +207,7 @@ index 557abfcd71d85..fb64e93157148 100644
  }
  
  ///////////////////////////////////////////////////////////////////////////////
-@@ -1217,6 +1246,8 @@ void Browser::WindowFullscreenStateChanged() {
+@@ -1219,6 +1248,8 @@ void Browser::WindowFullscreenStateChanged() {
        ->WindowFullscreenStateChanged();
    command_controller_->FullscreenStateChanged();
    UpdateBookmarkBarState(BOOKMARK_BAR_STATE_CHANGE_TOGGLE_FULLSCREEN);
@@ -202,7 +216,7 @@ index 557abfcd71d85..fb64e93157148 100644
  }
  
  void Browser::FullscreenTopUIStateChanged() {
-@@ -1584,6 +1615,14 @@ content::KeyboardEventProcessingResult Browser::PreHandleKeyboardEvent(
+@@ -1592,6 +1623,14 @@ content::KeyboardEventProcessingResult Browser::PreHandleKeyboardEvent(
    if (exclusive_access_manager_->HandleUserKeyEvent(event))
      return content::KeyboardEventProcessingResult::HANDLED;
  
@@ -217,7 +231,7 @@ index 557abfcd71d85..fb64e93157148 100644
    return window()->PreHandleKeyboardEvent(event);
  }
  
-@@ -1591,8 +1630,18 @@ bool Browser::HandleKeyboardEvent(content::WebContents* source,
+@@ -1599,8 +1638,18 @@ bool Browser::HandleKeyboardEvent(content::WebContents* source,
                                    const NativeWebKeyboardEvent& event) {
    DevToolsWindow* devtools_window =
        DevToolsWindow::GetInstanceForInspectedWebContents(source);
@@ -238,7 +252,7 @@ index 557abfcd71d85..fb64e93157148 100644
  }
  
  bool Browser::TabsNeedBeforeUnloadFired() const {
-@@ -1768,6 +1817,16 @@ WebContents* Browser::OpenURLFromTab(
+@@ -1776,6 +1825,16 @@ WebContents* Browser::OpenURLFromTab(
    }
  #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
  
@@ -255,7 +269,7 @@ index 557abfcd71d85..fb64e93157148 100644
    NavigateParams nav_params(this, params.url, params.transition);
    nav_params.FillNavigateParamsFromOpenURLParams(params);
    nav_params.source_contents = source;
-@@ -1930,6 +1989,8 @@ void Browser::LoadingStateChanged(WebContents* source,
+@@ -1938,6 +1997,8 @@ void Browser::LoadingStateChanged(WebContents* source,
                                    bool should_show_loading_ui) {
    ScheduleUIUpdate(source, content::INVALIDATE_TYPE_LOAD);
    UpdateWindowForLoadingStateChanged(source, should_show_loading_ui);
@@ -264,7 +278,7 @@ index 557abfcd71d85..fb64e93157148 100644
  }
  
  void Browser::CloseContents(WebContents* source) {
-@@ -1958,6 +2019,8 @@ void Browser::SetContentsBounds(WebContents* source, const gfx::Rect& bounds) {
+@@ -1966,6 +2027,8 @@ void Browser::SetContentsBounds(WebContents* source, const gfx::Rect& bounds) {
  }
  
  void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
@@ -273,7 +287,7 @@ index 557abfcd71d85..fb64e93157148 100644
    if (!GetStatusBubble())
      return;
  
-@@ -1965,6 +2028,17 @@ void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
+@@ -1973,6 +2036,17 @@ void Browser::UpdateTargetURL(WebContents* source, const GURL& url) {
      GetStatusBubble()->SetURL(url);
  }
  
@@ -291,7 +305,7 @@ index 557abfcd71d85..fb64e93157148 100644
  void Browser::ContentsMouseEvent(WebContents* source, const ui::Event& event) {
    const ui::EventType type = event.type();
    const bool exited = type == ui::ET_MOUSE_EXITED;
-@@ -1992,6 +2066,19 @@ bool Browser::TakeFocus(content::WebContents* source, bool reverse) {
+@@ -2000,6 +2074,19 @@ bool Browser::TakeFocus(content::WebContents* source, bool reverse) {
    return false;
  }
  
@@ -311,7 +325,7 @@ index 557abfcd71d85..fb64e93157148 100644
  void Browser::BeforeUnloadFired(WebContents* web_contents,
                                  bool proceed,
                                  bool* proceed_to_fire_unload) {
-@@ -2091,12 +2178,24 @@ void Browser::WebContentsCreated(WebContents* source_contents,
+@@ -2099,12 +2186,24 @@ void Browser::WebContentsCreated(WebContents* source_contents,
  
    // Make the tab show up in the task manager.
    task_manager::WebContentsTags::CreateForTabContents(new_contents);
@@ -336,7 +350,7 @@ index 557abfcd71d85..fb64e93157148 100644
    // Don't show the page hung dialog when a HTML popup hangs because
    // the dialog will take the focus and immediately close the popup.
    RenderWidgetHostView* view = render_widget_host->GetView();
-@@ -2109,6 +2208,13 @@ void Browser::RendererUnresponsive(
+@@ -2117,6 +2216,13 @@ void Browser::RendererUnresponsive(
  void Browser::RendererResponsive(
      WebContents* source,
      content::RenderWidgetHost* render_widget_host) {
@@ -350,7 +364,7 @@ index 557abfcd71d85..fb64e93157148 100644
    RenderWidgetHostView* view = render_widget_host->GetView();
    if (view && !render_widget_host->GetView()->IsHTMLFormPopup()) {
      TabDialogs::FromWebContents(source)->HideHungRendererDialog(
-@@ -2118,6 +2224,15 @@ void Browser::RendererResponsive(
+@@ -2126,6 +2232,15 @@ void Browser::RendererResponsive(
  
  content::JavaScriptDialogManager* Browser::GetJavaScriptDialogManager(
      WebContents* source) {
@@ -366,7 +380,7 @@ index 557abfcd71d85..fb64e93157148 100644
    return javascript_dialogs::TabModalDialogManager::FromWebContents(source);
  }
  
-@@ -2153,6 +2268,11 @@ void Browser::DraggableRegionsChanged(
+@@ -2161,6 +2276,11 @@ void Browser::DraggableRegionsChanged(
    if (app_controller_) {
      app_controller_->DraggableRegionsChanged(regions, contents);
    }
@@ -378,7 +392,7 @@ index 557abfcd71d85..fb64e93157148 100644
  }
  
  void Browser::DidFinishNavigation(
-@@ -2233,11 +2353,15 @@ void Browser::EnterFullscreenModeForTab(
+@@ -2241,11 +2361,15 @@ void Browser::EnterFullscreenModeForTab(
      const blink::mojom::FullscreenOptions& options) {
    exclusive_access_manager_->fullscreen_controller()->EnterFullscreenModeForTab(
        requesting_frame, options.display_id);
@@ -394,7 +408,7 @@ index 557abfcd71d85..fb64e93157148 100644
  }
  
  bool Browser::IsFullscreenForTabOrPending(const WebContents* web_contents) {
-@@ -2437,6 +2561,15 @@ void Browser::RequestMediaAccessPermission(
+@@ -2445,6 +2569,15 @@ void Browser::RequestMediaAccessPermission(
      content::WebContents* web_contents,
      const content::MediaStreamRequest& request,
      content::MediaResponseCallback callback) {
@@ -410,7 +424,7 @@ index 557abfcd71d85..fb64e93157148 100644
    const extensions::Extension* extension =
        GetExtensionForOrigin(profile_, request.security_origin);
    MediaCaptureDevicesDispatcher::GetInstance()->ProcessMediaAccessRequest(
-@@ -2981,9 +3114,11 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
+@@ -2989,9 +3122,11 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
  // Browser, Getters for UI (private):
  
  StatusBubble* Browser::GetStatusBubble() {
@@ -423,7 +437,7 @@ index 557abfcd71d85..fb64e93157148 100644
    }
  
    // We hide the status bar for web apps windows as this matches native
-@@ -2991,6 +3126,12 @@ StatusBubble* Browser::GetStatusBubble() {
+@@ -2999,6 +3134,12 @@ StatusBubble* Browser::GetStatusBubble() {
    // mode, as the minimal browser UI includes the status bar.
    if (web_app::AppBrowserController::IsWebApp(this) &&
        !app_controller()->HasMinimalUiButtons()) {
@@ -436,7 +450,7 @@ index 557abfcd71d85..fb64e93157148 100644
      return nullptr;
    }
  
-@@ -3140,6 +3281,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
+@@ -3148,6 +3289,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
      BookmarkTabHelper::FromWebContents(web_contents)->RemoveObserver(this);
      web_contents_collection_.StopObserving(web_contents);
    }
@@ -445,7 +459,7 @@ index 557abfcd71d85..fb64e93157148 100644
  }
  
  void Browser::TabDetachedAtImpl(content::WebContents* contents,
-@@ -3294,6 +3437,14 @@ bool Browser::PictureInPictureBrowserSupportsWindowFeature(
+@@ -3302,6 +3445,14 @@ bool Browser::PictureInPictureBrowserSupportsWindowFeature(
  
  bool Browser::SupportsWindowFeatureImpl(WindowFeature feature,
                                          bool check_can_support) const {
@@ -461,10 +475,10 @@ index 557abfcd71d85..fb64e93157148 100644
      case TYPE_NORMAL:
        return NormalBrowserSupportsWindowFeature(feature, check_can_support);
 diff --git chrome/browser/ui/browser.h chrome/browser/ui/browser.h
-index 69f2c9c0ff003..3cae24a0e42d2 100644
+index b6d47818d7648..9265c6ffdee64 100644
 --- chrome/browser/ui/browser.h
 +++ chrome/browser/ui/browser.h
-@@ -22,6 +22,7 @@
+@@ -24,6 +24,7 @@
  #include "base/timer/elapsed_timer.h"
  #include "build/build_config.h"
  #include "build/chromeos_buildflags.h"
@@ -472,7 +486,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
  #include "chrome/browser/tab_contents/web_contents_collection.h"
  #include "chrome/browser/themes/theme_service_observer.h"
  #include "chrome/browser/ui/bookmarks/bookmark_bar.h"
-@@ -51,6 +52,10 @@
+@@ -53,6 +54,10 @@
  #include "ui/gfx/geometry/rect.h"
  #include "ui/shell_dialogs/select_file_dialog.h"
  
@@ -483,7 +497,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
  #if BUILDFLAG(IS_ANDROID)
  #error This file should only be included on desktop.
  #endif
-@@ -370,6 +375,15 @@ class Browser : public TabStripModelObserver,
+@@ -373,6 +378,15 @@ class Browser : public TabStripModelObserver,
      // Document Picture in Picture options, specific to TYPE_PICTURE_IN_PICTURE.
      std::optional<blink::mojom::PictureInPictureWindowOptions> pip_options;
  
@@ -499,7 +513,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
     private:
      friend class Browser;
      friend class WindowSizerChromeOSTest;
-@@ -451,6 +465,13 @@ class Browser : public TabStripModelObserver,
+@@ -454,6 +468,13 @@ class Browser : public TabStripModelObserver,
      update_ui_immediately_for_testing_ = true;
    }
  
@@ -513,7 +527,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
    // Accessors ////////////////////////////////////////////////////////////////
  
    const CreateParams& create_params() const { return create_params_; }
-@@ -546,6 +567,12 @@ class Browser : public TabStripModelObserver,
+@@ -549,6 +570,12 @@ class Browser : public TabStripModelObserver,
    base::WeakPtr<Browser> AsWeakPtr();
    base::WeakPtr<const Browser> AsWeakPtr() const;
  
@@ -526,7 +540,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
    // Get the FindBarController for this browser, creating it if it does not
    // yet exist.
    FindBarController* GetFindBarController();
-@@ -959,10 +986,18 @@ class Browser : public TabStripModelObserver,
+@@ -962,10 +989,18 @@ class Browser : public TabStripModelObserver,
    void SetContentsBounds(content::WebContents* source,
                           const gfx::Rect& bounds) override;
    void UpdateTargetURL(content::WebContents* source, const GURL& url) override;
@@ -545,7 +559,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
    void BeforeUnloadFired(content::WebContents* source,
                           bool proceed,
                           bool* proceed_to_fire_unload) override;
-@@ -1297,6 +1332,10 @@ class Browser : public TabStripModelObserver,
+@@ -1300,6 +1335,10 @@ class Browser : public TabStripModelObserver,
    // This Browser's window.
    raw_ptr<BrowserWindow, DanglingUntriaged> window_;
  
@@ -556,7 +570,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
    std::unique_ptr<TabStripModelDelegate> const tab_strip_model_delegate_;
    std::unique_ptr<TabStripModel> const tab_strip_model_;
  
-@@ -1363,6 +1402,8 @@ class Browser : public TabStripModelObserver,
+@@ -1366,6 +1405,8 @@ class Browser : public TabStripModelObserver,
    const std::string initial_workspace_;
    bool initial_visible_on_all_workspaces_state_;
  
@@ -566,7 +580,7 @@ index 69f2c9c0ff003..3cae24a0e42d2 100644
  
    UnloadController unload_controller_;
 diff --git chrome/browser/ui/browser_navigator.cc chrome/browser/ui/browser_navigator.cc
-index ec2ca0cefeb4a..66b480f50f72d 100644
+index de008a12ca355..abfe1d6dda667 100644
 --- chrome/browser/ui/browser_navigator.cc
 +++ chrome/browser/ui/browser_navigator.cc
 @@ -313,6 +313,10 @@ std::pair<Browser*, int> GetBrowserAndTabForDisposition(

patch/patches/chrome_browser_context_menus.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/renderer_context_menu/render_view_context_menu.cc chrome/browser/renderer_context_menu/render_view_context_menu.cc
-index b3908e6711f3e..58db1ed6e1e8a 100644
+index ee4c942790296..f451d56cf929b 100644
 --- chrome/browser/renderer_context_menu/render_view_context_menu.cc
 +++ chrome/browser/renderer_context_menu/render_view_context_menu.cc
 @@ -356,6 +356,18 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {
@@ -32,7 +32,7 @@ index b3908e6711f3e..58db1ed6e1e8a 100644
    id = CollapseCommandsForUMA(id);
    const auto& map = GetIdcToUmaMap(type);
    auto it = map.find(id);
-@@ -882,6 +898,14 @@ RenderViewContextMenu::RenderViewContextMenu(
+@@ -884,6 +900,14 @@ RenderViewContextMenu::RenderViewContextMenu(
                      : nullptr;
  #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
  
@@ -47,7 +47,7 @@ index b3908e6711f3e..58db1ed6e1e8a 100644
    observers_.AddObserver(&autofill_context_menu_manager_);
  }
  
-@@ -1350,6 +1374,12 @@ void RenderViewContextMenu::InitMenu() {
+@@ -1352,6 +1376,12 @@ void RenderViewContextMenu::InitMenu() {
      autofill_client->HideAutofillSuggestions(
          autofill::SuggestionHidingReason::kContextMenuOpened);
    }
@@ -60,7 +60,7 @@ index b3908e6711f3e..58db1ed6e1e8a 100644
  }
  
  Profile* RenderViewContextMenu::GetProfile() const {
-@@ -3596,6 +3626,26 @@ void RenderViewContextMenu::RegisterExecutePluginActionCallbackForTesting(
+@@ -3621,6 +3651,26 @@ void RenderViewContextMenu::RegisterExecutePluginActionCallbackForTesting(
    execute_plugin_action_callback_ = std::move(cb);
  }
  
@@ -88,10 +88,10 @@ index b3908e6711f3e..58db1ed6e1e8a 100644
  RenderViewContextMenu::GetHandlersForLinkUrl() {
    custom_handlers::ProtocolHandlerRegistry::ProtocolHandlerList handlers =
 diff --git chrome/browser/renderer_context_menu/render_view_context_menu.h chrome/browser/renderer_context_menu/render_view_context_menu.h
-index 8f0e62fe84ff2..77bf0875db2b2 100644
+index db2108a4fa3ca..3520d8364e2a1 100644
 --- chrome/browser/renderer_context_menu/render_view_context_menu.h
 +++ chrome/browser/renderer_context_menu/render_view_context_menu.h
-@@ -153,7 +153,21 @@ class RenderViewContextMenu
+@@ -154,7 +154,21 @@ class RenderViewContextMenu
    }
  #endif
  
@@ -113,7 +113,7 @@ index 8f0e62fe84ff2..77bf0875db2b2 100644
    Profile* GetProfile() const;
  
    // This may return nullptr (e.g. for WebUI dialogs). Virtual to allow tests to
-@@ -475,6 +489,9 @@ class RenderViewContextMenu
+@@ -477,6 +491,9 @@ class RenderViewContextMenu
    //   built.
    bool is_protocol_submenu_valid_ = false;
  

patch/patches/chrome_browser_dialogs_widget.patch

@@ -12,7 +12,7 @@ index b169371e4d42f..509e4bda85b47 100644
      // on the screen, we can't actually attach to it.
      parent_window = nullptr;
 diff --git components/constrained_window/constrained_window_views.cc components/constrained_window/constrained_window_views.cc
-index 0ffc333329d4d..91b7567c123ac 100644
+index bff9ae7b67f41..fac9ee139d181 100644
 --- components/constrained_window/constrained_window_views.cc
 +++ components/constrained_window/constrained_window_views.cc
 @@ -101,10 +101,17 @@ class WidgetModalDialogHostObserverViews : public views::WidgetObserver,
@@ -121,7 +121,7 @@ index 0ffc333329d4d..91b7567c123ac 100644
      return;
    }
  
-@@ -284,8 +279,13 @@ views::Widget* CreateBrowserModalDialogViews(views::DialogDelegate* dialog,
+@@ -292,8 +287,13 @@ views::Widget* CreateBrowserModalDialogViews(views::DialogDelegate* dialog,
  
    gfx::NativeView parent_view =
        parent ? CurrentClient()->GetDialogHostView(parent) : nullptr;
@@ -136,7 +136,7 @@ index 0ffc333329d4d..91b7567c123ac 100644
    widget->SetNativeWindowProperty(
        views::kWidgetIdentifierKey,
        const_cast<void*>(kConstrainedWindowWidgetIdentifier));
-@@ -301,8 +301,7 @@ views::Widget* CreateBrowserModalDialogViews(views::DialogDelegate* dialog,
+@@ -309,8 +309,7 @@ views::Widget* CreateBrowserModalDialogViews(views::DialogDelegate* dialog,
    if (!requires_positioning)
      return widget;
  
@@ -146,7 +146,7 @@ index 0ffc333329d4d..91b7567c123ac 100644
    if (host) {
      DCHECK_EQ(parent_view, host->GetHostView());
      ModalDialogHostObserver* dialog_host_observer =
-@@ -315,10 +314,17 @@ views::Widget* CreateBrowserModalDialogViews(views::DialogDelegate* dialog,
+@@ -325,10 +324,17 @@ views::Widget* CreateBrowserModalDialogViews(views::DialogDelegate* dialog,
  
  views::Widget* ShowBrowserModal(std::unique_ptr<ui::DialogModel> dialog_model,
                                  gfx::NativeWindow parent) {

patch/patches/chrome_browser_download.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/download/chrome_download_manager_delegate.cc chrome/browser/download/chrome_download_manager_delegate.cc
-index 2628f1751cd14..cc2c330d8db5d 100644
+index bd2c41e30f01e..d87b8baf3de2b 100644
 --- chrome/browser/download/chrome_download_manager_delegate.cc
 +++ chrome/browser/download/chrome_download_manager_delegate.cc
-@@ -148,6 +148,10 @@
+@@ -150,6 +150,10 @@
  #include "chrome/browser/safe_browsing/download_protection/download_protection_util.h"
  #endif
  
@@ -13,7 +13,7 @@ index 2628f1751cd14..cc2c330d8db5d 100644
  using content::BrowserThread;
  using content::DownloadManager;
  using download::DownloadItem;
-@@ -492,6 +496,11 @@ ChromeDownloadManagerDelegate::ChromeDownloadManagerDelegate(Profile* profile)
+@@ -500,6 +504,11 @@ ChromeDownloadManagerDelegate::ChromeDownloadManagerDelegate(Profile* profile)
    download_dialog_bridge_ = std::make_unique<DownloadDialogBridge>();
    download_message_bridge_ = std::make_unique<DownloadMessageBridge>();
  #endif
@@ -25,7 +25,7 @@ index 2628f1751cd14..cc2c330d8db5d 100644
  }
  
  ChromeDownloadManagerDelegate::~ChromeDownloadManagerDelegate() {
-@@ -551,6 +560,9 @@ void ChromeDownloadManagerDelegate::Shutdown() {
+@@ -559,6 +568,9 @@ void ChromeDownloadManagerDelegate::Shutdown() {
      download_manager_->RemoveObserver(this);
      download_manager_ = nullptr;
    }
@@ -35,7 +35,7 @@ index 2628f1751cd14..cc2c330d8db5d 100644
  }
  
  void ChromeDownloadManagerDelegate::OnDownloadCanceledAtShutdown(
-@@ -619,6 +631,12 @@ bool ChromeDownloadManagerDelegate::DetermineDownloadTarget(
+@@ -627,6 +639,12 @@ bool ChromeDownloadManagerDelegate::DetermineDownloadTarget(
      ReportPDFLoadStatus(PDFLoadStatus::kTriggeredNoGestureDriveByDownload);
    }
  

patch/patches/chrome_browser_frame_mac.patch

@@ -33,10 +33,10 @@ index decd0b51ddc3d..17fce2da6ad0e 100644
    ~BrowserFrameMac() override;
  
 diff --git chrome/browser/ui/views/frame/browser_frame_mac.mm chrome/browser/ui/views/frame/browser_frame_mac.mm
-index 0d7f72e291a14..b0fb3eae5eab6 100644
+index 7b52e844d31d1..38862163b6698 100644
 --- chrome/browser/ui/views/frame/browser_frame_mac.mm
 +++ chrome/browser/ui/views/frame/browser_frame_mac.mm
-@@ -182,7 +182,14 @@ void BrowserFrameMac::OnWindowFullscreenTransitionComplete() {
+@@ -184,7 +184,14 @@ void BrowserFrameMac::OnWindowFullscreenTransitionComplete() {
  void BrowserFrameMac::ValidateUserInterfaceItem(
      int32_t tag,
      remote_cocoa::mojom::ValidateUserInterfaceItemResult* result) {
@@ -52,7 +52,7 @@ index 0d7f72e291a14..b0fb3eae5eab6 100644
    if (!chrome::SupportsCommand(browser, tag)) {
      result->enable = false;
      return;
-@@ -294,8 +301,16 @@ bool BrowserFrameMac::WillExecuteCommand(
+@@ -305,8 +312,16 @@ bool BrowserFrameMac::WillExecuteCommand(
      int32_t command,
      WindowOpenDisposition window_open_disposition,
      bool is_before_first_responder) {
@@ -70,7 +70,7 @@ index 0d7f72e291a14..b0fb3eae5eab6 100644
    if (is_before_first_responder) {
      // The specification for this private extensions API is incredibly vague.
      // For now, we avoid triggering chrome commands prior to giving the
-@@ -326,11 +341,20 @@ bool BrowserFrameMac::ExecuteCommand(
+@@ -337,11 +352,20 @@ bool BrowserFrameMac::ExecuteCommand(
      int32_t command,
      WindowOpenDisposition window_open_disposition,
      bool is_before_first_responder) {

patch/patches/chrome_browser_profiles.patch

@@ -85,10 +85,10 @@ index 02454f4e780b5..4641f33c26f5f 100644
  
    // Returns whether the user has signed in this profile to an account.
 diff --git chrome/browser/profiles/profile_impl.cc chrome/browser/profiles/profile_impl.cc
-index 0909a332a46bf..163de8ef6a878 100644
+index a7d35836cb9da..a73eca3fc66d0 100644
 --- chrome/browser/profiles/profile_impl.cc
 +++ chrome/browser/profiles/profile_impl.cc
-@@ -1030,7 +1030,9 @@ Profile* ProfileImpl::GetOffTheRecordProfile(const OTRProfileID& otr_profile_id,
+@@ -1036,7 +1036,9 @@ Profile* ProfileImpl::GetOffTheRecordProfile(const OTRProfileID& otr_profile_id,
  
    otr_profiles_[otr_profile_id] = std::move(otr_profile);
  

patch/patches/chrome_plugins.patch

@@ -64,7 +64,7 @@ index 00dd9a34cd3fb..89d4588bdbe4e 100644
      const extensions::Extension* extension =
          registry->enabled_extensions().GetByID(extension_id);
 diff --git chrome/renderer/chrome_content_renderer_client.cc chrome/renderer/chrome_content_renderer_client.cc
-index 120ec8af72623..012f7b602cf40 100644
+index a88d69d5d4369..fb64754b50156 100644
 --- chrome/renderer/chrome_content_renderer_client.cc
 +++ chrome/renderer/chrome_content_renderer_client.cc
 @@ -996,6 +996,7 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(

patch/patches/chrome_renderer.patch

@@ -1,5 +1,5 @@
 diff --git chrome/renderer/BUILD.gn chrome/renderer/BUILD.gn
-index 3108e12b92e7f..18cc9062a4cd0 100644
+index 2e8cad63df85b..a4065dd237107 100644
 --- chrome/renderer/BUILD.gn
 +++ chrome/renderer/BUILD.gn
 @@ -5,6 +5,7 @@
@@ -18,7 +18,7 @@ index 3108e12b92e7f..18cc9062a4cd0 100644
      "//chrome:resources",
      "//chrome:strings",
      "//chrome/common",
-@@ -246,6 +248,10 @@ static_library("renderer") {
+@@ -247,6 +249,10 @@ static_library("renderer") {
  
    configs += [ "//build/config/compiler:wexit_time_destructors" ]
  

patch/patches/chrome_runtime.patch

@@ -422,7 +422,7 @@ index 6b27cf7037fce..70fd49bb873ff 100644
 +#endif
  }
 diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
-index d81a2b75f4c6c..4c29ef42b4576 100644
+index c6fb861755332..8f2c467018d05 100644
 --- chrome/browser/chrome_content_browser_client.cc
 +++ chrome/browser/chrome_content_browser_client.cc
 @@ -46,6 +46,7 @@
@@ -433,7 +433,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
  #include "chrome/browser/after_startup_task_utils.h"
  #include "chrome/browser/ai/ai_manager_impl.h"
  #include "chrome/browser/app_mode/app_mode_utils.h"
-@@ -1486,6 +1487,8 @@ ChromeContentBrowserClient::GetPopupNavigationDelegateFactoryForTesting() {
+@@ -1488,6 +1489,8 @@ ChromeContentBrowserClient::GetPopupNavigationDelegateFactoryForTesting() {
  }
  
  ChromeContentBrowserClient::ChromeContentBrowserClient() {
@@ -442,7 +442,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
  #if BUILDFLAG(ENABLE_PLUGINS)
    extra_parts_.push_back(
        std::make_unique<ChromeContentBrowserClientPluginsPart>());
-@@ -1523,6 +1526,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
+@@ -1525,6 +1528,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
    }
  }
  
@@ -454,7 +454,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
  // static
  void ChromeContentBrowserClient::RegisterLocalStatePrefs(
      PrefRegistrySimple* registry) {
-@@ -3744,28 +3752,25 @@ bool UpdatePreferredColorScheme(WebPreferences* web_prefs,
+@@ -3746,28 +3754,25 @@ bool UpdatePreferredColorScheme(WebPreferences* web_prefs,
          web_prefs->preferred_color_scheme;
    }
  #else
@@ -500,7 +500,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
  #endif  // BUILDFLAG(IS_ANDROID)
  
    // Reauth WebUI doesn't support dark mode yet because it shares the dialog
-@@ -4506,9 +4511,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
+@@ -4508,9 +4513,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
                            &search::HandleNewTabURLReverseRewrite);
  #endif  // BUILDFLAG(IS_ANDROID)
  
@@ -512,7 +512,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
  }
  
  base::FilePath ChromeContentBrowserClient::GetDefaultDownloadDirectory() {
-@@ -6627,7 +6634,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
+@@ -6637,7 +6644,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
  #endif
  }
  
@@ -521,7 +521,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
      content::BrowserContext* context,
      bool in_memory,
      const base::FilePath& relative_partition_path,
-@@ -6645,6 +6652,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
+@@ -6655,6 +6662,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
      network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
      network_context_params->accept_language = GetApplicationLocale();
    }
@@ -530,7 +530,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
  }
  
  std::vector<base::FilePath>
-@@ -7767,10 +7776,10 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
+@@ -7777,10 +7786,10 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
    const auto now = base::TimeTicks::Now();
    const auto timeout = GetKeepaliveTimerTimeout(context);
    keepalive_deadline_ = std::max(keepalive_deadline_, now + timeout);
@@ -543,7 +543,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
          FROM_HERE, keepalive_deadline_ - now,
          base::BindOnce(
              &ChromeContentBrowserClient::OnKeepaliveTimerFired,
-@@ -7789,7 +7798,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
+@@ -7799,7 +7808,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
    --num_keepalive_requests_;
    if (num_keepalive_requests_ == 0) {
      DVLOG(1) << "Stopping the keepalive timer";
@@ -553,7 +553,7 @@ index d81a2b75f4c6c..4c29ef42b4576 100644
      // This deletes the keep alive handle attached to the timer function and
      // unblock the shutdown sequence.
    }
-@@ -7968,7 +7978,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
+@@ -7978,7 +7988,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
    const auto now = base::TimeTicks::Now();
    const auto then = keepalive_deadline_;
    if (now < then) {
@@ -594,7 +594,7 @@ index 522c072575325..b63e9aacd1f0a 100644
  #endif
  
 diff --git chrome/browser/prefs/browser_prefs.cc chrome/browser/prefs/browser_prefs.cc
-index 7c9cd6b688f88..f66aa28081c37 100644
+index 3b6ce83dd7579..bcaa68b901656 100644
 --- chrome/browser/prefs/browser_prefs.cc
 +++ chrome/browser/prefs/browser_prefs.cc
 @@ -16,6 +16,7 @@
@@ -605,7 +605,7 @@ index 7c9cd6b688f88..f66aa28081c37 100644
  #include "chrome/browser/about_flags.h"
  #include "chrome/browser/accessibility/accessibility_labels_service.h"
  #include "chrome/browser/accessibility/invert_bubble_prefs.h"
-@@ -198,6 +199,10 @@
+@@ -199,6 +200,10 @@
  #include "chrome/browser/background/background_mode_manager.h"
  #endif
  
@@ -616,7 +616,7 @@ index 7c9cd6b688f88..f66aa28081c37 100644
  #if BUILDFLAG(ENABLE_EXTENSIONS)
  #include "chrome/browser/accessibility/animation_policy_prefs.h"
  #include "chrome/browser/apps/platform_apps/shortcut_manager.h"
-@@ -1917,7 +1922,8 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
+@@ -1919,7 +1924,8 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
  #endif  // BUILDFLAG(GOOGLE_CHROME_BRANDING)
  #endif  // BUILDFLAG(IS_WIN)
  
@@ -626,7 +626,7 @@ index 7c9cd6b688f88..f66aa28081c37 100644
    downgrade::RegisterPrefs(registry);
  #endif
  
-@@ -1961,6 +1967,11 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
+@@ -1963,6 +1969,11 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
  
    // This is intentionally last.
    RegisterLocalStatePrefsForMigration(registry);
@@ -638,7 +638,7 @@ index 7c9cd6b688f88..f66aa28081c37 100644
  }
  
  // Register prefs applicable to all profiles.
-@@ -2411,6 +2422,10 @@ void RegisterUserProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
+@@ -2416,6 +2427,10 @@ void RegisterUserProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
                                const std::string& locale) {
    RegisterProfilePrefs(registry, locale);
  

patch/patches/chrome_runtime_views.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/ui/browser_command_controller.cc chrome/browser/ui/browser_command_controller.cc
-index e70c1340dd2ee..745b3982aa9ad 100644
+index 963362357f5ff..1e90afe4b6542 100644
 --- chrome/browser/ui/browser_command_controller.cc
 +++ chrome/browser/ui/browser_command_controller.cc
-@@ -411,6 +411,7 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
+@@ -412,6 +412,7 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
    // choose to not implement CommandUpdaterDelegate inside this class and
    // therefore command_updater_ doesn't have the delegate set).
    if (!SupportsCommand(id) || !IsCommandEnabled(id)) {
@@ -10,7 +10,7 @@ index e70c1340dd2ee..745b3982aa9ad 100644
      return false;
    }
  
-@@ -427,6 +428,13 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
+@@ -428,6 +429,13 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
    DCHECK(command_updater_.IsCommandEnabled(id))
        << "Invalid/disabled command " << id;
  
@@ -24,7 +24,7 @@ index e70c1340dd2ee..745b3982aa9ad 100644
    // The order of commands in this switch statement must match the function
    // declaration order in browser.h!
    switch (id) {
-@@ -1215,11 +1223,13 @@ void BrowserCommandController::TabRestoreServiceLoaded(
+@@ -1219,11 +1227,13 @@ void BrowserCommandController::TabRestoreServiceLoaded(
  // BrowserCommandController, private:
  
  bool BrowserCommandController::IsShowingMainUI() {
@@ -41,10 +41,10 @@ index e70c1340dd2ee..745b3982aa9ad 100644
  
  bool BrowserCommandController::IsWebAppOrCustomTab() const {
 diff --git chrome/browser/ui/toolbar/app_menu_model.cc chrome/browser/ui/toolbar/app_menu_model.cc
-index 2a1eb7cd0a644..b3e95b92b2951 100644
+index 51a97fd92beb4..8e726f5d18f75 100644
 --- chrome/browser/ui/toolbar/app_menu_model.cc
 +++ chrome/browser/ui/toolbar/app_menu_model.cc
-@@ -658,10 +658,12 @@ FindAndEditSubMenuModel::FindAndEditSubMenuModel(
+@@ -663,10 +663,12 @@ FindAndEditSubMenuModel::FindAndEditSubMenuModel(
      ui::SimpleMenuModel::Delegate* delegate)
      : SimpleMenuModel(delegate) {
    AddItemWithStringIdAndVectorIcon(this, IDC_FIND, IDS_FIND, kSearchMenuIcon);
@@ -57,7 +57,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
  }
  
  class SaveAndShareSubMenuModel : public ui::SimpleMenuModel {
-@@ -736,6 +738,57 @@ SaveAndShareSubMenuModel::SaveAndShareSubMenuModel(
+@@ -741,6 +743,57 @@ SaveAndShareSubMenuModel::SaveAndShareSubMenuModel(
    }
  }
  
@@ -115,7 +115,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
  }  // namespace
  
  ////////////////////////////////////////////////////////////////////////////////
-@@ -1596,7 +1649,7 @@ bool AppMenuModel::IsCommandIdChecked(int command_id) const {
+@@ -1622,7 +1675,7 @@ bool AppMenuModel::IsCommandIdChecked(int command_id) const {
    return false;
  }
  
@@ -124,7 +124,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
    GlobalError* error =
        GlobalErrorServiceFactory::GetForProfile(browser_->profile())
            ->GetGlobalErrorByMenuItemCommandID(command_id);
-@@ -1611,6 +1664,30 @@ bool AppMenuModel::IsCommandIdEnabled(int command_id) const {
+@@ -1638,6 +1691,30 @@ bool AppMenuModel::IsCommandIdEnabled(int command_id) const {
    }
  }
  
@@ -155,7 +155,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
  bool AppMenuModel::IsCommandIdAlerted(int command_id) const {
    if (command_id == IDC_VIEW_PASSWORDS ||
        command_id == IDC_SHOW_PASSWORD_MANAGER) {
-@@ -1773,8 +1850,10 @@ void AppMenuModel::Build() {
+@@ -1800,8 +1877,10 @@ void AppMenuModel::Build() {
                                     IDS_CLEAR_BROWSING_DATA,
                                     kTrashCanRefreshIcon);
  
@@ -166,7 +166,7 @@ index 2a1eb7cd0a644..b3e95b92b2951 100644
    AddSeparator(ui::NORMAL_SEPARATOR);
  
    AddItemWithStringIdAndVectorIcon(this, IDC_PRINT, IDS_PRINT, kPrintMenuIcon);
-@@ -1896,6 +1975,11 @@ void AppMenuModel::Build() {
+@@ -1923,6 +2002,11 @@ void AppMenuModel::Build() {
    }
  #endif  // !BUILDFLAG(IS_CHROMEOS_ASH)
  
@@ -397,10 +397,10 @@ index 14a8a70d853f6..bf81594947886 100644
    // regenerated.
    bool RegenerateFrameOnThemeChange(BrowserThemeChangeType theme_change_type);
 diff --git chrome/browser/ui/views/frame/browser_view.cc chrome/browser/ui/views/frame/browser_view.cc
-index 1142fec7a138c..71e381f04adcc 100644
+index 05a0dd22ce010..3a9a8d6c839fb 100644
 --- chrome/browser/ui/views/frame/browser_view.cc
 +++ chrome/browser/ui/views/frame/browser_view.cc
-@@ -350,11 +350,10 @@ using content::WebContents;
+@@ -351,11 +351,10 @@ using content::WebContents;
  using input::NativeWebKeyboardEvent;
  using web_modal::WebContentsModalDialogHost;
  
@@ -415,7 +415,7 @@ index 1142fec7a138c..71e381f04adcc 100644
  
  #if BUILDFLAG(IS_CHROMEOS_ASH)
  // UMA histograms that record animation smoothness for tab loading animation.
-@@ -694,6 +693,14 @@ class BrowserViewLayoutDelegateImpl : public BrowserViewLayoutDelegate {
+@@ -695,6 +694,14 @@ class BrowserViewLayoutDelegateImpl : public BrowserViewLayoutDelegate {
      return browser_view_->frame()->GetTopInset() - browser_view_->y();
    }
  
@@ -430,7 +430,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    bool IsToolbarVisible() const override {
      return browser_view_->IsToolbarVisible();
    }
-@@ -845,11 +852,21 @@ class BrowserView::AccessibilityModeObserver : public ui::AXModeObserver {
+@@ -846,11 +853,21 @@ class BrowserView::AccessibilityModeObserver : public ui::AXModeObserver {
  ///////////////////////////////////////////////////////////////////////////////
  // BrowserView, public:
  
@@ -453,7 +453,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    SetShowIcon(
        ::ShouldShowWindowIcon(browser_.get(), AppUsesWindowControlsOverlay()));
  
-@@ -944,8 +961,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+@@ -945,8 +962,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
    contents_container->SetLayoutManager(std::make_unique<ContentsLayoutManager>(
        devtools_web_view_, contents_web_view_, watermark_view_));
  
@@ -471,7 +471,17 @@ index 1142fec7a138c..71e381f04adcc 100644
  
    contents_separator_ =
        top_container_->AddChildView(std::make_unique<ContentsSeparator>());
-@@ -1019,7 +1043,9 @@ BrowserView::~BrowserView() {
+@@ -1013,7 +1037,9 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+ }
+ 
+ BrowserView::~BrowserView() {
++  if (browser_) {
+   browser_->GetFeatures().TearDownPreBrowserViewDestruction();
++  }
+ 
+   // Destroy the top controls slide controller first as it depends on the
+   // tabstrip model and the browser frame.
+@@ -1021,7 +1047,9 @@ BrowserView::~BrowserView() {
  
    // All the tabs should have been destroyed already. If we were closed by the
    // OS with some tabs than the NativeBrowserFrame should have destroyed them.
@@ -481,7 +491,7 @@ index 1142fec7a138c..71e381f04adcc 100644
  
    // Stop the animation timer explicitly here to avoid running it in a nested
    // message loop, which may run by Browser destructor.
-@@ -1028,17 +1054,18 @@ BrowserView::~BrowserView() {
+@@ -1030,17 +1058,18 @@ BrowserView::~BrowserView() {
    // Immersive mode may need to reparent views before they are removed/deleted.
    immersive_mode_controller_.reset();
  
@@ -504,17 +514,7 @@ index 1142fec7a138c..71e381f04adcc 100644
  
    // The TabStrip attaches a listener to the model. Make sure we shut down the
    // TabStrip first so that it can cleanly remove the listener.
-@@ -1062,7 +1089,9 @@ BrowserView::~BrowserView() {
+@@ -1616,6 +1645,13 @@ gfx::Point BrowserView::GetThemeOffsetFromBrowserView() const {
- 
-   // `SidePanelUI::RemoveSidePanelUIForBrowser()` deletes the
-   // SidePanelCoordinator.
-+  if (browser()) {
-   SidePanelUI::RemoveSidePanelUIForBrowser(browser());
-+  }
- }
- 
- // static
-@@ -1618,6 +1647,13 @@ gfx::Point BrowserView::GetThemeOffsetFromBrowserView() const {
        ThemeProperties::kFrameHeightAboveTabs - browser_view_origin.y());
  }
  
@@ -528,7 +528,7 @@ index 1142fec7a138c..71e381f04adcc 100644
  // static:
  BrowserView::DevToolsDockedPlacement BrowserView::GetDevToolsDockedPlacement(
      const gfx::Rect& contents_webview_bounds,
-@@ -2021,9 +2057,14 @@ void BrowserView::OnExclusiveAccessUserInput() {
+@@ -2019,9 +2055,14 @@ void BrowserView::OnExclusiveAccessUserInput() {
  
  bool BrowserView::ShouldHideUIForFullscreen() const {
    // Immersive mode needs UI for the slide-down top panel.
@@ -544,7 +544,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    return frame_->GetFrameView()->ShouldHideTopUIForFullscreen();
  }
  
-@@ -3185,7 +3226,8 @@ DownloadShelf* BrowserView::GetDownloadShelf() {
+@@ -3183,7 +3224,8 @@ DownloadShelf* BrowserView::GetDownloadShelf() {
  }
  
  DownloadBubbleUIController* BrowserView::GetDownloadBubbleUIController() {
@@ -554,7 +554,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    if (auto* download_button = toolbar_button_provider_->GetDownloadButton())
      return download_button->bubble_controller();
    return nullptr;
-@@ -3740,7 +3782,8 @@ void BrowserView::ReparentTopContainerForEndOfImmersive() {
+@@ -3738,7 +3780,8 @@ void BrowserView::ReparentTopContainerForEndOfImmersive() {
    if (top_container()->parent() == this)
      return;
  
@@ -564,7 +564,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    top_container()->DestroyLayer();
    AddChildViewAt(top_container(), 0);
    EnsureFocusOrder();
-@@ -4223,11 +4266,38 @@ void BrowserView::GetAccessiblePanes(std::vector<views::View*>* panes) {
+@@ -4221,11 +4264,38 @@ void BrowserView::GetAccessiblePanes(std::vector<views::View*>* panes) {
  bool BrowserView::ShouldDescendIntoChildForEventHandling(
      gfx::NativeView child,
      const gfx::Point& location) {
@@ -605,7 +605,7 @@ index 1142fec7a138c..71e381f04adcc 100644
      // Draggable regions are defined relative to the web contents.
      gfx::Point point_in_contents_web_view_coords(location);
      views::View::ConvertPointToTarget(GetWidget()->GetRootView(),
-@@ -4236,7 +4306,7 @@ bool BrowserView::ShouldDescendIntoChildForEventHandling(
+@@ -4234,7 +4304,7 @@ bool BrowserView::ShouldDescendIntoChildForEventHandling(
  
      // Draggable regions should be ignored for clicks into any browser view's
      // owned widgets, for example alerts, permission prompts or find bar.
@@ -614,7 +614,7 @@ index 1142fec7a138c..71e381f04adcc 100644
                 point_in_contents_web_view_coords.x(),
                 point_in_contents_web_view_coords.y()) ||
             WidgetOwnedByAnchorContainsPoint(point_in_contents_web_view_coords);
-@@ -4347,8 +4417,10 @@ void BrowserView::Layout(PassKey) {
+@@ -4345,8 +4415,10 @@ void BrowserView::Layout(PassKey) {
  
    // TODO(jamescook): Why was this in the middle of layout code?
    toolbar_->location_bar()->omnibox_view()->SetFocusBehavior(
@@ -627,7 +627,7 @@ index 1142fec7a138c..71e381f04adcc 100644
  
    // Some of the situations when the BrowserView is laid out are:
    // - Enter/exit immersive fullscreen mode.
-@@ -4414,6 +4486,11 @@ void BrowserView::AddedToWidget() {
+@@ -4412,6 +4484,11 @@ void BrowserView::AddedToWidget() {
    SetThemeProfileForWindow(GetNativeWindow(), browser_->profile());
  #endif
  
@@ -639,7 +639,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    toolbar_->Init();
  
    // TODO(pbos): Investigate whether the side panels should be creatable when
-@@ -4455,13 +4532,9 @@ void BrowserView::AddedToWidget() {
+@@ -4453,13 +4530,9 @@ void BrowserView::AddedToWidget() {
  
    EnsureFocusOrder();
  
@@ -655,7 +655,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    using_native_frame_ = frame_->ShouldUseNativeFrame();
  
    MaybeInitializeWebUITabStrip();
-@@ -4821,7 +4894,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
+@@ -4819,7 +4892,8 @@ void BrowserView::ProcessFullscreen(bool fullscreen,
    // Undo our anti-jankiness hacks and force a re-layout.
    in_process_fullscreen_ = false;
    ToolbarSizeChanged(false);
@@ -665,7 +665,7 @@ index 1142fec7a138c..71e381f04adcc 100644
  }
  
  void BrowserView::RequestFullscreen(bool fullscreen, int64_t display_id) {
-@@ -5294,6 +5368,8 @@ Profile* BrowserView::GetProfile() {
+@@ -5292,6 +5366,8 @@ Profile* BrowserView::GetProfile() {
  }
  
  void BrowserView::UpdateUIForTabFullscreen() {
@@ -674,7 +674,7 @@ index 1142fec7a138c..71e381f04adcc 100644
    frame()->GetFrameView()->UpdateFullscreenTopUI();
  }
  
-@@ -5316,6 +5392,8 @@ void BrowserView::HideDownloadShelf() {
+@@ -5314,6 +5390,8 @@ void BrowserView::HideDownloadShelf() {
  }
  
  bool BrowserView::CanUserExitFullscreen() const {
@@ -961,7 +961,7 @@ index 04639b0a2f603..f4cfc16f6b4de 100644
        case PageActionIconType::kPaymentsOfferNotification:
          add_page_action_icon(
 diff --git chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
-index 9ba58b49d613e..90749dcd2d945 100644
+index 5a2e3899a8a15..38d609b83fe75 100644
 --- chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
 +++ chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc
 @@ -605,29 +605,41 @@ gfx::Range BrowserTabStripController::ListTabsInGroup(

patch/patches/extensions_1947.patch

@@ -238,11 +238,11 @@ index 8b515b7b8c353..f8e4106ac26d4 100644
    // once each time the extensions system is loaded per browser_context. The
    // implementation may wish to use the BrowserContext to record the current
 diff --git extensions/browser/process_manager.cc extensions/browser/process_manager.cc
-index 8e512cd3c826e..0cfda0e69be23 100644
+index bd6ee1176e306..621204ecdce81 100644
 --- extensions/browser/process_manager.cc
 +++ extensions/browser/process_manager.cc
-@@ -353,9 +353,17 @@ bool ProcessManager::CreateBackgroundHost(const Extension* extension,
+@@ -358,9 +358,17 @@ bool ProcessManager::CreateBackgroundHost(const Extension* extension,
-     return true;  // TODO(kalman): return false here? It might break things...
+   }
  
    DVLOG(1) << "CreateBackgroundHost " << extension->id();
 -  ExtensionHost* host =

patch/patches/linux_tflite_348117454.patch

@@ -1,17 +0,0 @@
-diff --git third_party/tflite/features.gni third_party/tflite/features.gni
-index 2466577542552..d94d80cda02d6 100644
---- third_party/tflite/features.gni
-+++ third_party/tflite/features.gni
-@@ -7,9 +7,9 @@ import("//build/config/chrome_build.gni")
- declare_args() {
-   # This enables building TFLite with XNNPACK. Currently only available for
-   # Linux, macOS and Windows arm64/x64/x86 targets and ChromeOS non-ARM targets.
--  build_tflite_with_xnnpack =
--      is_win || is_mac || is_linux ||
--      (is_chromeos && target_cpu != "arm64" && target_cpu != "arm")
-+  build_tflite_with_xnnpack = (is_win || is_mac || is_linux ||
-+      (is_chromeos && current_cpu != "arm64" && current_cpu != "arm")) &&
-+      (current_cpu == "arm64" || current_cpu == "x64" || current_cpu == "x86")
- 
-   # Turns on TFLITE_WITH_RUY, using ruy as the gemm backend instead of gemmlowp.
-   build_tflite_with_ruy = true

patch/patches/rfh_navigation_4829483.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/renderer_host/render_frame_host_impl.cc content/browser/renderer_host/render_frame_host_impl.cc
-index 9c8b401d00136..f1b9050b55bc3 100644
+index 6c2d3a422cb49..6fe875b4f714f 100644
 --- content/browser/renderer_host/render_frame_host_impl.cc
 +++ content/browser/renderer_host/render_frame_host_impl.cc
 @@ -10880,6 +10880,7 @@ void RenderFrameHostImpl::CommitNavigation(

patch/patches/ui_menu_model_3577.patch

@@ -0,0 +1,23 @@
+diff --git ui/base/models/simple_menu_model.cc ui/base/models/simple_menu_model.cc
+index 88e27362452e5..9c18ac5c77544 100644
+--- ui/base/models/simple_menu_model.cc
++++ ui/base/models/simple_menu_model.cc
+@@ -10,6 +10,7 @@
+ #include "base/functional/bind.h"
+ #include "base/location.h"
+ #include "base/task/single_thread_task_runner.h"
++#include "cef/libcef/features/features.h"
+ #include "ui/base/l10n/l10n_util.h"
+ #include "ui/base/models/image_model.h"
+ #include "ui/gfx/image/image.h"
+@@ -170,8 +171,10 @@ void SimpleMenuModel::AddSeparator(MenuSeparatorType separator_type) {
+     }
+ 
+     if (items_.at(last_visible_item).type == TYPE_SEPARATOR) {
++#if !BUILDFLAG(ENABLE_CEF)
+       DCHECK_EQ(NORMAL_SEPARATOR, separator_type);
+       DCHECK_EQ(NORMAL_SEPARATOR, items_.at(last_visible_item).separator_type);
++#endif
+       // The last item is already a separator. Don't add another.
+       return;
+     }

patch/patches/views_1749_2102_3330.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/ui/views/toolbar/app_menu.cc chrome/browser/ui/views/toolbar/app_menu.cc
-index 7986c86012518..fa75795aa6c30 100644
+index 0645d841f604c..0f5aa54288f5c 100644
 --- chrome/browser/ui/views/toolbar/app_menu.cc
 +++ chrome/browser/ui/views/toolbar/app_menu.cc
-@@ -1025,7 +1025,9 @@ void AppMenu::RunMenu(views::MenuButtonController* host) {
+@@ -1037,7 +1037,9 @@ void AppMenu::RunMenu(views::MenuButtonController* host) {
        host->button()->GetWidget(), host,
        host->button()->GetAnchorBoundsInScreen(),
        views::MenuAnchorPosition::kTopRight, ui::MENU_SOURCE_NONE,

patch/patches/views_widget.patch

@@ -61,7 +61,7 @@ index 791fc1874851e..db58beed440f8 100644
      case ui::SHOW_STATE_MAXIMIZED:
        return kSerializedShowStateMaximized;
 diff --git content/browser/renderer_host/render_widget_host_view_base.cc content/browser/renderer_host/render_widget_host_view_base.cc
-index c9b1737f91452..7231c79be3bdc 100644
+index ee8a71a213cf3..bd56c6f84cb3a 100644
 --- content/browser/renderer_host/render_widget_host_view_base.cc
 +++ content/browser/renderer_host/render_widget_host_view_base.cc
 @@ -677,6 +677,14 @@ float RenderWidgetHostViewBase::GetScaleOverrideForCapture() const {
@@ -80,7 +80,7 @@ index c9b1737f91452..7231c79be3bdc 100644
    if (!GetMouseWheelPhaseHandler())
      return;
 diff --git content/browser/renderer_host/render_widget_host_view_base.h content/browser/renderer_host/render_widget_host_view_base.h
-index 1a7932a580836..7ceb1b03ce36c 100644
+index 76612bc5e9760..636f61739e9f3 100644
 --- content/browser/renderer_host/render_widget_host_view_base.h
 +++ content/browser/renderer_host/render_widget_host_view_base.h
 @@ -72,6 +72,7 @@ class CursorManager;
@@ -125,7 +125,7 @@ index 1a7932a580836..7ceb1b03ce36c 100644
    // Indicates whether the page has finished loading.
    virtual void SetIsLoading(bool is_loading) = 0;
  
-@@ -649,6 +663,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -646,6 +660,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    // to all displays.
    gfx::Size system_cursor_size_;
  
@@ -136,7 +136,7 @@ index 1a7932a580836..7ceb1b03ce36c 100644
   private:
    FRIEND_TEST_ALL_PREFIXES(
        BrowserSideFlingBrowserTest,
-@@ -670,10 +688,6 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -667,10 +685,6 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
  
    void SynchronizeVisualProperties();
  
@@ -259,10 +259,10 @@ index 2cf9330a4e24b..4bf0890ae000b 100644
  
  // Specifies which edges of the window are tiled.
 diff --git ui/ozone/platform/x11/x11_window.cc ui/ozone/platform/x11/x11_window.cc
-index 4907de4e24cea..9824c17378207 100644
+index b11e5604f0d5d..415fe672ba8d4 100644
 --- ui/ozone/platform/x11/x11_window.cc
 +++ ui/ozone/platform/x11/x11_window.cc
-@@ -1864,7 +1864,8 @@ void X11Window::CreateXWindow(const PlatformWindowInitProperties& properties) {
+@@ -1867,7 +1867,8 @@ void X11Window::CreateXWindow(const PlatformWindowInitProperties& properties) {
    req.border_pixel = 0;
  
    bounds_in_pixels_ = SanitizeBounds(bounds);
@@ -350,7 +350,7 @@ index e698f71577c51..8a6e28128564d 100644
    base::WeakPtrFactory<DesktopWindowTreeHostLinux> weak_factory_{this};
  };
 diff --git ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
-index 30781b584b649..6edaa60e652ab 100644
+index 74016f5663952..8c7171639f979 100644
 --- ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
 +++ ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
 @@ -281,8 +281,8 @@ void DesktopWindowTreeHostPlatform::Init(const Widget::InitParams& params) {

patch/patches/web_contents_1257_1565.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index 205a1bb692091..d5cf0a22b11b2 100644
+index 8033e5e15ac1d..1658f658a9441 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
 @@ -3610,6 +3610,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
@@ -60,7 +60,7 @@ index 205a1bb692091..d5cf0a22b11b2 100644
  
  FrameTree* WebContentsImpl::GetOwnedPictureInPictureFrameTree() {
 diff --git content/public/browser/web_contents.h content/public/browser/web_contents.h
-index 1ee36913ac37c..19b13abaf0679 100644
+index 1ee36913ac37c..6dcca3c80ede2 100644
 --- content/public/browser/web_contents.h
 +++ content/public/browser/web_contents.h
 @@ -105,10 +105,12 @@ class BrowserContext;
@@ -81,14 +81,14 @@ index 1ee36913ac37c..19b13abaf0679 100644
          network::mojom::WebSandboxFlags::kNone;
  
 +    // Optionally specify the view and delegate view.
-+    content::WebContentsView* view = nullptr;
++    raw_ptr<content::WebContentsView> view = nullptr;
-+    content::RenderViewHostDelegateView* delegate_view = nullptr;
++    raw_ptr<content::RenderViewHostDelegateView> delegate_view = nullptr;
 +
      // Value used to set the last time the WebContents was made active, this is
      // the value that'll be returned by GetLastActiveTime(). If this is left
      // default initialized then the value is not passed on to the WebContents
 diff --git content/public/browser/web_contents_delegate.h content/public/browser/web_contents_delegate.h
-index fd851a9347dd6..82abe6dd2fd07 100644
+index fd851a9347dd6..dc77e13235743 100644
 --- content/public/browser/web_contents_delegate.h
 +++ content/public/browser/web_contents_delegate.h
 @@ -63,9 +63,11 @@ class EyeDropperListener;
@@ -112,8 +112,8 @@ index fd851a9347dd6..82abe6dd2fd07 100644
 +      const GURL& target_url,
 +      int opener_render_process_id,
 +      int opener_render_frame_id,
-+      content::WebContentsView** view,
++      raw_ptr<content::WebContentsView>* view,
-+      content::RenderViewHostDelegateView** delegate_view) {}
++      raw_ptr<content::RenderViewHostDelegateView>* delegate_view) {}
 +
    // Notifies the delegate about the creation of a new WebContents. This
    // typically happens when popups are created.

tests/cefclient/browser/client_handler.cc

@@ -850,12 +850,6 @@ bool ClientHandler::CanDownload(CefRefPtr<CefBrowser> browser,
                                 const CefString& request_method) {
   CEF_REQUIRE_UI_THREAD();
 
-  if (!with_controls_) {
-    // Block the download.
-    LOG(INFO) << "Blocking download";
-    return false;
-  }
-
   // Allow the download.
   return true;
 }

tests/cefclient/browser/root_window_manager.cc

@@ -147,8 +147,9 @@ scoped_refptr<RootWindow> RootWindowManager::CreateRootWindowAsPopup(
 
   SanityCheckWindowConfig(is_devtools, use_views, use_alloy_style, with_osr);
 
-  if (!temp_window_) {
+  if (!temp_window_ && !use_views) {
-    // TempWindow must be created on the UI thread.
+    // TempWindow must be created on the UI thread. It is only used with
+    // native (non-Views) parent windows.
     temp_window_.reset(new TempWindow());
   }
 

tests/cefclient/browser/temp_window_mac.mm

@@ -29,7 +29,7 @@ class TempWindowMacImpl {
   }
   ~TempWindowMacImpl() {
     DCHECK(window_);
-    [window_ close];
+    window_ = nil;
   }
 
  private:

tools/automate/automate-git.py

@@ -461,6 +461,7 @@ def check_pattern_matches(output_file=None):
       # Don't continue when we know the build will be wrong.
       sys.exit(1)
 
+
 def invalid_options_combination(a, b):
   print("Invalid combination of options: '%s' and '%s'" % (a, b))
   parser.print_help(sys.stderr)
@@ -767,6 +768,18 @@ parser.add_option(
     dest='sandboxdistribonly',
     default=False,
     help='Create a cef_sandbox static library distribution only.')
+parser.add_option(
+    '--tools-distrib',
+    action='store_true',
+    dest='toolsdistrib',
+    default=False,
+    help='Create a tools distribution.')
+parser.add_option(
+    '--tools-distrib-only',
+    action='store_true',
+    dest='toolsdistribonly',
+    default=False,
+    help='Create a tools distribution only.')
 parser.add_option(
     '--no-distrib-docs',
     action='store_true',
@@ -814,22 +827,22 @@ if options.runtests:
   options.buildtests = True
 
 if (options.nochromiumupdate and options.forceupdate):
-    invalid_options_combination('--no-chromium-update', '--force-update')
+  invalid_options_combination('--no-chromium-update', '--force-update')
 if (options.nocefupdate and options.forceupdate):
-    invalid_options_combination('--no-cef-update', '--force-update')
+  invalid_options_combination('--no-cef-update', '--force-update')
 if (options.nobuild and options.forcebuild):
-    invalid_options_combination('--no-build', '--force-build')
+  invalid_options_combination('--no-build', '--force-build')
 if (options.nodistrib and options.forcedistrib):
-    invalid_options_combination('--no-distrib', '--force-distrib')
+  invalid_options_combination('--no-distrib', '--force-distrib')
 if (options.forceclean and options.fastupdate):
-    invalid_options_combination('--force-clean', '--fast-update')
+  invalid_options_combination('--force-clean', '--fast-update')
 if (options.forcecleandeps and options.fastupdate):
-    invalid_options_combination('--force-clean-deps', '--fast-update')
+  invalid_options_combination('--force-clean-deps', '--fast-update')
 
 if (options.noreleasebuild and \
      (options.minimaldistrib or options.minimaldistribonly or \
       options.clientdistrib or options.clientdistribonly)) or \
-   (options.minimaldistribonly + options.clientdistribonly + options.sandboxdistribonly > 1):
+   (options.minimaldistribonly + options.clientdistribonly + options.sandboxdistribonly + options.toolsdistribonly > 1):
   print('Invalid combination of options.')
   parser.print_help(sys.stderr)
   sys.exit(1)
@@ -1450,6 +1463,8 @@ if not options.nodistrib and (chromium_checkout_changed or \
     distrib_types.append('client')
   elif options.sandboxdistribonly:
     distrib_types.append('sandbox')
+  elif options.toolsdistribonly:
+    distrib_types.append('tools')
   else:
     distrib_types.append('standard')
     if options.minimaldistrib:
@@ -1458,6 +1473,8 @@ if not options.nodistrib and (chromium_checkout_changed or \
       distrib_types.append('client')
     if options.sandboxdistrib:
       distrib_types.append('sandbox')
+    if options.toolsdistrib:
+      distrib_types.append('tools')
 
   cef_tools_dir = os.path.join(cef_src_dir, 'tools')
 
@@ -1482,6 +1499,8 @@ if not options.nodistrib and (chromium_checkout_changed or \
       path += ' --client'
     elif type == 'sandbox':
       path += ' --sandbox'
+    elif type == 'tools':
+      path += ' --tools'
 
     if first_type:
       if options.nodistribdocs:

tools/distrib/README.tools.txt

@@ -0,0 +1,58 @@
+CONTENTS
+--------
+
+Debug       Contains the Debug build of tools.
+
+Release     Contains the Release build of tools.
+
+
+IMPORTANT NOTE
+--------------
+
+CEF/Chromium builds are created using the following host architectures:
+
+- Linux:   x86-64 (Intel/AMD)
+- Windows: x86-64 (Intel/AMD)
+- MacOS:   ARM64 (Apple Silicon)
+
+Binaries in this tools package must be run on the supported host OS/architecture
+even in cases where the output targets a different architecture.
+
+For example, files targeting a MacOS 64-bit (Intel) application must be created
+on a MacOS ARM64 (Apple Silicon) host system using the MacOS 64-bit (Intel)
+tools distribution.
+
+
+USAGE
+-----
+
+Start with the required host system and the tools distribution that matches your
+application's target OS/architecture and CEF version.
+
+Custom V8 Snapshots
+
+Custom startup snapshots [https://v8.dev/blog/custom-startup-snapshots] can be
+used to speed up V8/JavaScript load time in the renderer process. With CEF this
+works as follows:
+
+1. Generate a single JavaScript file that contains custom startup data. For
+   example, using https://github.com/atom/electron-link.
+
+2. Execute the `run_mksnapshot` script to create a `v8_context_snapshot.bin`
+   file containing the custom data in addition to the default V8 data.
+
+   Example:
+   % run_mksnapshot Release /path/to/snapshot.js
+
+   Note that bin file names include an architecture component on MacOS
+   (e.g. `v8_context_snapshot.[arm64|x86_64].bin`)
+
+3. Replace the existing `v8_context_snapshot.bin` file in the installation
+   folder or app bundle.
+
+4. Run the application and verify in DevTools that the custom startup data
+   exists. For example, electron-link adds a global `snapshotResult` object.
+
+Please visit the CEF Website for additional usage information.
+
+https://bitbucket.org/chromiumembedded/cef/

tools/distrib/tools/run_mksnapshot.bat

@@ -0,0 +1,66 @@
+@echo off
+:: Copyright (c) 2024 The Chromium Embedded Framework Authors. All rights
+:: reserved. Use of this source code is governed by a BSD-style license
+:: that can be found in the LICENSE file.
+
+set RC=
+
+setlocal
+
+if not "%1" == "Debug" (
+  if not "%1" == "Release" (
+    echo Usage: run_mksnapshot.bat [Debug^|Release] path\to\snapshot.js
+    set ERRORLEVEL=1
+    goto end
+  )
+)
+
+set SCRIPT_DIR=%~dp0
+set BIN_DIR=%SCRIPT_DIR%%~1
+
+if not exist "%BIN_DIR%" (
+  echo %BIN_DIR% directory not found
+  set ERRORLEVEL=1
+  goto end
+)
+
+set CMD_FILE=mksnapshot_cmd.txt
+
+if not exist "%BIN_DIR%\%CMD_FILE%" (
+  echo %BIN_DIR%\%CMD_FILE% file not found
+  set ERRORLEVEL=1
+  goto end
+)
+
+cd "%BIN_DIR%"
+
+:: Read %CMD_FILE% into a local variable.
+set /p CMDLINE=<%CMD_FILE%
+
+:: Generate snapshot_blob.bin.
+echo Running mksnapshot...
+call mksnapshot %CMDLINE% %2
+
+set OUT_FILE=v8_context_snapshot.bin
+
+:: Generate v8_context_snapshot.bin.
+echo Running v8_context_snapshot_generator...
+call v8_context_snapshot_generator --output_file=%OUT_FILE%
+
+if not exist "%BIN_DIR%\%OUT_FILE%" (
+  echo Failed
+  set ERRORLEVEL=1
+  goto end
+)
+
+echo Success! Created %BIN_DIR%\%OUT_FILE%
+
+:end
+endlocal & set RC=%ERRORLEVEL%
+goto omega
+
+:returncode
+exit /B %RC%
+
+:omega
+call :returncode %RC%

tools/distrib/tools/run_mksnapshot.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+# Copyright (c) 2024 The Chromium Embedded Framework Authors. All rights
+# reserved. Use of this source code is governed by a BSD-style license
+# that can be found in the LICENSE file.
+
+if [ "$1" != "Debug" ] && [ "$1" != "Release" ]; then
+  echo 'Usage: run_mksnapshot.sh [Debug|Release] /path/to/snapshot.js'
+  exit 1
+fi
+
+SCRIPT_DIR="$( cd "$( dirname "$0" )" && pwd )"
+BIN_DIR=$SCRIPT_DIR/$1
+
+if [ ! -d "$BIN_DIR" ]; then
+  echo "$BIN_DIR directory not found."
+  exit 1
+fi
+
+CMD_FILE=mksnapshot_cmd.txt
+
+if [ ! -f "$BIN_DIR/$CMD_FILE" ]; then
+  echo "$BIN_DIR/$CMD_FILE file not found."
+  exit 1
+fi
+
+pushd "$BIN_DIR" > /dev/null
+
+# Read $CMD_FILE into an argument array.
+IFS=' ' read -r -a args < $CMD_FILE
+
+if [ "$(uname)" == "Darwin" ]; then
+  # Execution of tools binaries downloaded on MacOS may be blocked
+  # by Apple Security settings with a message like "<binary> can't
+  # be opened because Apple cannot check it for malicious software."
+  # Remove that block here.
+  xattr -c ./mksnapshot
+  xattr -c ./v8_context_snapshot_generator
+fi
+
+# Generate snapshot_blob.bin.
+echo 'Running mksnapshot...'
+./mksnapshot "${args[@]}" "${@:2}"
+
+# Determine the architecture suffix, if any.
+suffix=''
+if [ "$(uname)" == "Darwin" ]; then
+  value='--target_arch=arm64'
+  if [[ " ${args[*]} " =~ [[:space:]]${value}[[:space:]] ]]; then
+    suffix='.arm64'
+  else
+    suffix='.x86_64'
+  fi
+fi
+
+OUT_FILE=v8_context_snapshot${suffix}.bin
+
+# Generate v8_context_snapshot.bin.
+echo 'Running v8_context_snapshot_generator...'
+./v8_context_snapshot_generator --output_file=$OUT_FILE
+
+popd > /dev/null
+
+if [ -f "$BIN_DIR/$OUT_FILE" ]; then
+  echo "Success! Created $BIN_DIR/$OUT_FILE"
+else
+  echo "Failed"
+  exit 1
+fi

tools/make_colorids_header.py

@@ -64,7 +64,7 @@ def MakeFile(output, input):
     segments += MakeFileSegment(file)
 
   # Extract the unique names of all defines.
-  p = re.compile('#define\s([A-Za-z0-9_]{1,})\s')
+  p = re.compile(r'#define\s([A-Za-z0-9_]{1,})\s')
   all_defines = sorted(set(p.findall(segments)))
 
   undefines = "\n".join(["#undef %s" % define for define in all_defines])

tools/make_cpptoc_impl.py

@@ -320,11 +320,6 @@ def make_cpptoc_function_impl_new(cls, name, func, defined_names, base_scoped):
     result += '\n'
   result_len = len(result)
 
-  if is_cef_shutdown:
-    result += '\n\n#if DCHECK_IS_ON()'\
-              '\n  shutdown_checker::SetIsShutdown();'\
-              '\n#endif\n'
-
   # execution
   result += '\n  // Execute\n  '
 
@@ -355,6 +350,11 @@ def make_cpptoc_function_impl_new(cls, name, func, defined_names, base_scoped):
 
   result += ');\n'
 
+  if is_cef_shutdown:
+    result += '\n\n#if DCHECK_IS_ON()'\
+              '\n  shutdown_checker::SetIsShutdown();'\
+              '\n#endif\n'
+
   result_len = len(result)
 
   # parameter restoration

tools/make_ctocpp_impl.py

@@ -335,11 +335,6 @@ def make_ctocpp_function_impl_new(clsname, name, func, base_scoped):
     result += '\n'
   result_len = len(result)
 
-  if is_cef_shutdown:
-    result += '\n\n#if DCHECK_IS_ON()'\
-              '\n  shutdown_checker::SetIsShutdown();'\
-              '\n#endif\n'
-
   # execution
   result += '\n  // Execute\n  '
 
@@ -369,6 +364,11 @@ def make_ctocpp_function_impl_new(clsname, name, func, base_scoped):
 
   result += ');\n'
 
+  if is_cef_shutdown:
+    result += '\n\n#if DCHECK_IS_ON()'\
+              '\n  shutdown_checker::SetIsShutdown();'\
+              '\n#endif\n'
+
   result_len = len(result)
 
   # parameter restoration

tools/make_distrib.py

@@ -122,7 +122,7 @@ def create_readme():
 
   # format the file
   data = header_data + '\n\n' + mode_data
-  if mode != 'sandbox':
+  if mode != 'sandbox' and mode != 'tools':
     data += '\n\n' + redistrib_data
   data += '\n\n' + footer_data
   data = data.replace('$CEF_URL$', cef_url)
@@ -165,6 +165,9 @@ def create_readme():
     distrib_type = 'Sandbox'
     distrib_desc = 'This distribution contains only the cef_sandbox static library. Please see\n' \
                    'the LICENSING section of this document for licensing terms and conditions.'
+  elif mode == 'tools':
+    distrib_type = 'Tools'
+    distrib_desc = 'This distribution contains additional tools for building CEF-based applications.'
 
   data = data.replace('$DISTRIB_TYPE$', distrib_type)
   data = data.replace('$DISTRIB_DESC$', distrib_desc)
@@ -232,6 +235,128 @@ def transfer_gypi_files(src_dir, gypi_paths, gypi_path_prefix, dst_dir, quiet):
     copy_file(src, dst, quiet)
 
 
+def extract_toolchain_cmd(build_dir,
+                          exe_name,
+                          require_toolchain,
+                          require_cmd=True):
+  """ Extract a toolchain command from the ninja configuration file. """
+  toolchain_ninja = os.path.join(build_dir, 'toolchain.ninja')
+  if not os.path.isfile(toolchain_ninja):
+    if not require_toolchain:
+      return None, None
+    raise Exception('Missing file: %s' % toolchain_ninja)
+
+  data = read_file(toolchain_ninja)
+
+  cmd = None
+  path = None
+
+  # Looking for a value like:
+  #   command = python3 ../../v8/tools/run.py ./exe_name --arg1 --arg2
+  # OR (for cross-compile):
+  #   command = python3 ../../v8/tools/run.py ./clang_arch1_arch2/exe_name --arg1 --arg2
+  findstr = '/%s ' % exe_name
+  start = data.find(findstr)
+  if start >= 0:
+    # Extract the command-line arguments.
+    after_start = start + len(findstr)
+    end = data.find('\n', after_start)
+    if end >= after_start:
+      cmd = data[after_start:end].strip()
+      print('%s command:' % exe_name, cmd)
+      if cmd != '' and not re.match(r"^[0-9a-zA-Z\_\- ./=]{1,}$", cmd):
+        cmd = None
+
+    # Extract the relative file path.
+    dot = start - 1
+    while data[dot].isalnum() or data[dot] == '_':
+      dot -= 1
+    path = data[dot + 1:start]
+    print('%s path:' % exe_name, path)
+    if path != '' and not re.match(r"^(win_)?clang_[0-9a-z_]{1,}$", path):
+      path = None
+
+  if require_cmd and (cmd is None or path is None):
+    raise Exception('Failed to extract %s command from %s' % (exe_name,
+                                                              toolchain_ninja))
+
+  return cmd, path
+
+
+def get_exe_name(exe_name):
+  return exe_name + ('.exe' if platform == 'windows' else '')
+
+
+def get_script_name(script_name):
+  return script_name + ('.bat' if platform == 'windows' else '.sh')
+
+
+def transfer_tools_files(script_dir, build_dirs, output_dir):
+  for build_dir in build_dirs:
+    is_debug = build_dir.find('Debug') >= 0
+    dst_dir_name = 'Debug' if is_debug else 'Release'
+    dst_dir = os.path.join(output_dir, dst_dir_name)
+
+    # Retrieve the binary path and command-line arguments.
+    # See issue #3734 for the expected format.
+    mksnapshot_name = 'mksnapshot'
+    tool_cmd, tool_dir = extract_toolchain_cmd(
+        build_dir, mksnapshot_name, require_toolchain=not options.allowpartial)
+    if tool_cmd is None:
+      sys.stdout.write("No %s build toolchain for %s.\n" % (dst_dir_name,
+                                                            mksnapshot_name))
+      continue
+
+    if options.allowpartial and not path_exists(
+        os.path.join(build_dir, tool_dir, get_exe_name(mksnapshot_name))):
+      sys.stdout.write("No %s build of %s.\n" % (dst_dir_name, mksnapshot_name))
+      continue
+
+    # yapf: disable
+    binaries = [
+        {'path': get_exe_name(mksnapshot_name)},
+        {'path': get_exe_name('v8_context_snapshot_generator')},
+    ]
+    # yapf: disable
+
+    # Transfer binaries.
+    copy_files_list(os.path.join(build_dir, tool_dir), dst_dir, binaries)
+
+    # Evaluate command-line arguments and remove relative paths. Copy any input files
+    # into the distribution.
+    # - Example input path : ../../v8/tools/builtins-pgo/profiles/x64-rl.profile
+    # - Example output path: gen/v8/embedded.S
+    parsed_cmd = []
+    for cmd in tool_cmd.split(' '):
+      if cmd.find('/') > 0:
+        file_name = os.path.split(cmd)[1]
+        if len(file_name) == 0:
+          raise Exception('Failed to parse %s command component: %s' % (mksnapshot_name, cmd))
+        if cmd.startswith('../../'):
+          file_path = os.path.realpath(os.path.join(build_dir, cmd))
+          # Validate input file/path.
+          if not file_path.startswith(src_dir):
+            raise Exception('Invalid %s command input file: %s' % (mksnapshot_name, file_path))
+          if not os.path.isfile(file_path):
+            raise Exception('Missing %s command input file: %s' % (mksnapshot_name, file_path))
+          # Transfer input file.
+          copy_file(file_path, os.path.join(dst_dir, file_name), options.quiet)
+        cmd = file_name
+      parsed_cmd.append(cmd)
+
+    # Write command-line arguments file.
+    write_file(os.path.join(dst_dir, 'mksnapshot_cmd.txt'), ' '.join(parsed_cmd))
+
+  # yapf: disable
+  files = [
+      {'path': get_script_name('run_mksnapshot')},
+  ]
+  # yapf: disable
+
+  # Transfer other tools files.
+  copy_files_list(os.path.join(script_dir, 'distrib', 'tools'), output_dir, files)
+
+
 def normalize_headers(file, new_path=''):
   """ Normalize headers post-processing. Remove the path component from any
       project include directives. """
@@ -540,6 +665,12 @@ parser.add_option(
     dest='sandbox',
     default=False,
     help='include only the cef_sandbox static library (macOS and Windows only)')
+parser.add_option(
+    '--tools',
+    action='store_true',
+    dest='tools',
+    default=False,
+    help='include only the tools')
 parser.add_option(
     '--ozone',
     action='store_true',
@@ -597,10 +728,10 @@ if options.ozone and platform != 'linux':
 script_dir = os.path.dirname(__file__)
 
 # CEF root directory
-cef_dir = os.path.abspath(os.path.join(script_dir, os.pardir))
+cef_dir = os.path.realpath(os.path.join(script_dir, os.pardir))
 
 # src directory
-src_dir = os.path.abspath(os.path.join(cef_dir, os.pardir))
+src_dir = os.path.realpath(os.path.join(cef_dir, os.pardir))
 
 if not git.is_checkout(cef_dir):
   raise Exception('Not a valid checkout: %s' % (cef_dir))
@@ -665,6 +796,9 @@ elif options.client:
 elif options.sandbox:
   mode = 'sandbox'
   output_dir_name = output_dir_name + '_sandbox'
+elif options.tools:
+  mode = 'tools'
+  output_dir_name = output_dir_name + '_tools'
 else:
   mode = 'standard'
 
@@ -882,10 +1016,11 @@ if not options.nodocs:
   else:
     sys.stdout.write("ERROR: No docs generated.\n")
 
-if platform == 'windows':
+if mode == 'tools':
+  transfer_tools_files(script_dir, (build_dir_debug, build_dir_release),
+                       output_dir)
+elif platform == 'windows':
   libcef_dll = 'libcef.dll'
-  libcef_dll_lib = '%s.lib' % libcef_dll
-  libcef_dll_pdb = '%s.pdb' % libcef_dll
   # yapf: disable
   binaries = [
       {'path': 'chrome_elf.dll'},
@@ -901,6 +1036,15 @@ if platform == 'windows':
       {'path': 'vk_swiftshader_icd.json'},
       {'path': 'vulkan-1.dll'},
   ]
+  pdb_files = [
+      {'path': 'chrome_elf.dll.pdb'},
+      {'path': 'dxcompiler.dll.pdb', 'conditional': True},
+      {'path': '%s.pdb' % libcef_dll},
+      {'path': 'libEGL.dll.pdb'},
+      {'path': 'libGLESv2.dll.pdb'},
+      {'path': 'vk_swiftshader.dll.pdb'},
+      {'path': 'vulkan-1.dll.pdb'},
+  ]
   # yapf: enable
 
   if mode == 'client':
@@ -908,7 +1052,7 @@ if platform == 'windows':
         'path': 'cefsimple.exe' if platform_arch == 'arm64' else 'cefclient.exe'
     })
   else:
-    binaries.append({'path': libcef_dll_lib, 'out_path': 'libcef.lib'})
+    binaries.append({'path': '%s.lib' % libcef_dll, 'out_path': 'libcef.lib'})
 
   # yapf: disable
   resources = [
@@ -925,7 +1069,6 @@ if platform == 'windows':
       'obj\\base\\base.lib',
       'obj\\base\\base_static.lib',
       'obj\\base\\third_party\\double_conversion\\double_conversion.lib',
-      'obj\\base\\third_party\\dynamic_annotations\\dynamic_annotations.lib',
       'obj\\base\\win\\pe_image.lib',
       cef_sandbox_lib,
       'obj\\sandbox\\common\\*.obj',
@@ -971,9 +1114,7 @@ if platform == 'windows':
         symbol_output_dir = create_output_dir(
             output_dir_name + '_debug_symbols', options.outputdir)
         # transfer contents
-        copy_file(
+        copy_files_list(build_dir, symbol_output_dir, pdb_files)
-            os.path.join(build_dir, libcef_dll_pdb), symbol_output_dir,
-            options.quiet)
     else:
       sys.stdout.write("No Debug build files.\n")
 
@@ -991,9 +1132,7 @@ if platform == 'windows':
         symbol_output_dir = create_output_dir(
             output_dir_name + '_release_symbols', options.outputdir)
         # transfer contents
-        copy_file(
+        copy_files_list(build_dir, symbol_output_dir, pdb_files)
-            os.path.join(build_dir, libcef_dll_pdb), symbol_output_dir,
-            options.quiet)
     else:
       sys.stdout.write("No Release build files.\n")
 
@@ -1042,7 +1181,6 @@ if platform == 'windows':
 
 elif platform == 'mac':
   framework_name = 'Chromium Embedded Framework'
-  framework_dsym = '%s.dSYM' % framework_name
   cefclient_app = 'cefclient.app'
 
   cef_sandbox_lib = 'obj/cef/libcef_sandbox.a'
@@ -1054,6 +1192,12 @@ elif platform == 'mac':
       'obj/buildtools/third_party/libc++/libc++/*.o',
       'obj/buildtools/third_party/libc++abi/libc++abi/*.o',
   ]
+  dsym_dirs = [
+      '%s.dSYM' % framework_name,
+      'libEGL.dylib.dSYM',
+      'libGLESv2.dylib.dSYM',
+      'libvk_swiftshader.dylib.dSYM',
+  ]
 
   # Generate the cef_sandbox.a merged library. A separate *_sandbox build
   # should exist when GN is_official_build=true.
@@ -1095,9 +1239,10 @@ elif platform == 'mac':
         # The real dSYM already exists, just copy it to the output directory.
         # dSYMs are only generated when is_official_build=true or enable_dsyms=true.
         # See //build/config/mac/symbols.gni.
-        copy_dir(
+        for dsym in dsym_dirs:
-            os.path.join(build_dir, framework_dsym),
+          copy_dir(
-            os.path.join(symbol_output_dir, framework_dsym), options.quiet)
+              os.path.join(build_dir, dsym),
+              os.path.join(symbol_output_dir, dsym), options.quiet)
     else:
       sys.stdout.write("No Debug build files.\n")
 
@@ -1134,9 +1279,10 @@ elif platform == 'mac':
         # The real dSYM already exists, just copy it to the output directory.
         # dSYMs are only generated when is_official_build=true or enable_dsyms=true.
         # See //build/config/mac/symbols.gni.
-        copy_dir(
+        for dsym in dsym_dirs:
-            os.path.join(build_dir, framework_dsym),
+          copy_dir(
-            os.path.join(symbol_output_dir, framework_dsym), options.quiet)
+              os.path.join(build_dir, dsym),
+              os.path.join(symbol_output_dir, dsym), options.quiet)
     else:
       sys.stdout.write("No Release build files.\n")