Fix potential dangling PendingRequest::request_ (see #3239)

See https://magpcss.org/ceforum/viewtopic.php?f=6&t=19802 for error.

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,6 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/126.0.6478.26',
-  'depot_tools_checkout': '7d95eb2eb0'
+  'chromium_checkout': 'refs/tags/126.0.6478.26'
 }

libcef/browser/alloy/alloy_browser_host_impl.cc

@@ -1210,11 +1210,7 @@ void AlloyBrowserHostImpl::RendererResponsive(
 
 content::JavaScriptDialogManager*
 AlloyBrowserHostImpl::GetJavaScriptDialogManager(content::WebContents* source) {
-  if (!javascript_dialog_manager_) {
-    javascript_dialog_manager_ =
-        std::make_unique<CefJavaScriptDialogManager>(this);
-  }
-  return javascript_dialog_manager_.get();
+  return CefBrowserHostBase::GetJavaScriptDialogManager();
 }
 
 void AlloyBrowserHostImpl::RunFileChooser(

libcef/browser/alloy/alloy_browser_host_impl.h

@@ -18,7 +18,6 @@
 #include "cef/libcef/browser/browser_host_base.h"
 #include "cef/libcef/browser/browser_info.h"
 #include "cef/libcef/browser/frame_host_impl.h"
-#include "cef/libcef/browser/javascript_dialog_manager.h"
 #include "cef/libcef/browser/menu_manager.h"
 #include "cef/libcef/browser/request_context_impl.h"
 #include "content/public/browser/web_contents.h"
@@ -363,9 +362,6 @@ class AlloyBrowserHostImpl : public CefBrowserHostBase,
   // on the UI thread.
   bool window_destroyed_ = false;
 
-  // Used for creating and managing JavaScript dialogs.
-  std::unique_ptr<CefJavaScriptDialogManager> javascript_dialog_manager_;
-
   // Used for creating and managing context menus.
   std::unique_ptr<CefMenuManager> menu_manager_;
 

libcef/browser/browser_host_base.cc

@@ -287,6 +287,10 @@ void CefBrowserHostBase::DestroyWebContents(
   devtools_protocol_manager_.reset();
   devtools_window_runner_.reset();
   context_menu_observer_ = nullptr;
+  if (javascript_dialog_manager_) {
+    javascript_dialog_manager_->Destroy();
+    javascript_dialog_manager_.reset();
+  }
 
   browser_info_->WebContentsDestroyed();
   platform_delegate_->WebContentsDestroyed(web_contents);
@@ -1283,6 +1287,15 @@ void CefBrowserHostBase::SelectFileListenerDestroyed(
   }
 }
 
+content::JavaScriptDialogManager*
+CefBrowserHostBase::GetJavaScriptDialogManager() {
+  if (!javascript_dialog_manager_) {
+    javascript_dialog_manager_ =
+        std::make_unique<CefJavaScriptDialogManager>(this);
+  }
+  return javascript_dialog_manager_.get();
+}
+
 bool CefBrowserHostBase::MaybeAllowNavigation(
     content::RenderFrameHost* opener,
     const content::OpenURLParams& params) {

libcef/browser/browser_host_base.h

@@ -20,6 +20,7 @@
 #include "cef/libcef/browser/devtools/devtools_window_runner.h"
 #include "cef/libcef/browser/file_dialog_manager.h"
 #include "cef/libcef/browser/frame_host_impl.h"
+#include "cef/libcef/browser/javascript_dialog_manager.h"
 #include "cef/libcef/browser/media_stream_registrar.h"
 #include "cef/libcef/browser/request_context_impl.h"
 #include "cef/libcef/features/features.h"
@@ -357,6 +358,10 @@ class CefBrowserHostBase : public CefBrowserHost,
                      void* params);
   void SelectFileListenerDestroyed(ui::SelectFileDialog::Listener* listener);
 
+  // Called from AlloyBrowserHostImpl::GetJavaScriptDialogManager and
+  // ChromeBrowserDelegate::GetJavaScriptDialogManager.
+  content::JavaScriptDialogManager* GetJavaScriptDialogManager();
+
   // Called from CefBrowserInfoManager::MaybeAllowNavigation.
   virtual bool MaybeAllowNavigation(content::RenderFrameHost* opener,
                                     const content::OpenURLParams& params);
@@ -471,6 +476,9 @@ class CefBrowserHostBase : public CefBrowserHost,
   // Used for creating and managing file dialogs.
   std::unique_ptr<CefFileDialogManager> file_dialog_manager_;
 
+  // Used for creating and managing JavaScript dialogs.
+  std::unique_ptr<CefJavaScriptDialogManager> javascript_dialog_manager_;
+
   // Volatile state accessed from multiple threads. All access must be protected
   // by |state_lock_|.
   base::Lock state_lock_;

libcef/browser/chrome/chrome_browser_delegate.cc

@@ -619,6 +619,16 @@ void ChromeBrowserDelegate::CanDownload(
   std::move(callback).Run(true);
 }
 
+content::JavaScriptDialogManager*
+ChromeBrowserDelegate::GetJavaScriptDialogManager(
+    content::WebContents* source) {
+  auto browser_host = ChromeBrowserHostImpl::GetBrowserForContents(source);
+  if (browser_host) {
+    return browser_host->GetJavaScriptDialogManager();
+  }
+  return nullptr;
+}
+
 KeyboardEventProcessingResult ChromeBrowserDelegate::PreHandleKeyboardEvent(
     content::WebContents* source,
     const content::NativeWebKeyboardEvent& event) {

libcef/browser/chrome/chrome_browser_delegate.h

@@ -118,6 +118,8 @@ class ChromeBrowserDelegate : public cef::BrowserDelegate {
   void CanDownload(const GURL& url,
                    const std::string& request_method,
                    base::OnceCallback<void(bool)> callback) override;
+  content::JavaScriptDialogManager* GetJavaScriptDialogManager(
+      content::WebContents* source) override;
   content::KeyboardEventProcessingResult PreHandleKeyboardEvent(
       content::WebContents* source,
       const content::NativeWebKeyboardEvent& event) override;

libcef/browser/javascript_dialog_manager.cc

@@ -182,13 +182,6 @@ void CefJavaScriptDialogManager::RunBeforeUnloadDialog(
     content::RenderFrameHost* render_frame_host,
     bool is_reload,
     DialogClosedCallback callback) {
-  if (browser_->WillBeDestroyed()) {
-    // Currently destroying the browser. Accept the unload without showing
-    // the prompt.
-    std::move(callback).Run(true, std::u16string());
-    return;
-  }
-
   const std::u16string& message_text = u"Is it OK to leave/reload this page?";
 
   // Always call DialogClosed().

libcef/browser/net_service/resource_request_handler_wrapper.cc

@@ -140,10 +140,11 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
     void Run(InterceptedRequestHandlerWrapper* self) {
       self->OnBeforeRequest(id_, request_, request_was_redirected_,
                             std::move(callback_), std::move(cancel_callback_));
+      request_ = nullptr;
     }
 
     const int32_t id_;
-    const raw_ptr<network::ResourceRequest> request_;
+    raw_ptr<network::ResourceRequest> request_;
     const bool request_was_redirected_;
     OnBeforeRequestResultCallback callback_;
     CancelRequestCallback cancel_callback_;

libcef/common/chrome/chrome_main_delegate_cef.cc

@@ -35,8 +35,6 @@
 #include "cef/libcef/common/util_mac.h"
 #elif BUILDFLAG(IS_POSIX)
 #include "cef/libcef/common/util_linux.h"
-#elif BUILDFLAG(IS_WIN)
-#include "sandbox/policy/features.h"
 #endif
 
 namespace {
@@ -324,15 +322,6 @@ std::optional<int> ChromeMainDelegateCef::BasicStartupComplete() {
       disable_features.push_back(base::kEnableHangWatcher.name);
     }
 
-#if BUILDFLAG(IS_WIN) && (defined(COMPONENT_BUILD) || !defined(NDEBUG))
-    // Disable WinSboxNoFakeGdiInit for component and Debug builds. It causes
-    // renderer processes to crash with STATUS_DLL_INIT_FAILED. This is
-    // currently enabled via a field trial for non-Official builds.
-    // See https://crbug.com/326277735#comment37.
-    disable_features.push_back(
-        sandbox::policy::features::kWinSboxNoFakeGdiInit.name);
-#endif
-
     if (!disable_features.empty()) {
       DCHECK(!base::FeatureList::GetInstance());
       std::string disable_features_str =

patch/patch.cfg

@@ -814,5 +814,16 @@ patches = [
     # RequestContextTest.PopupNavDestroyParentAfterCreationRCGlobal.
     # https://issues.chromium.org/issues/323753235#comment11
     'name': 'content_initiator_policy_323753235'
+  },
+  {
+    # Move test_fonts into their own directory.
+    # https://issues.chromium.org/issues/343199633
+    'name': 'DEPS'
+  },
+  {
+    # win: Fix undefined std::_Literal_zero_is_expected() when building
+    # cef_sandbox with VS 17.9.2 version of MSVC STL.
+    # https://github.com/chromiumembedded/cef/issues/3708
+    'name': 'win_sandbox_op3way_3708'
   }
 ]

patch/patches/DEPS.patch

@@ -0,0 +1,26 @@
+diff --git DEPS DEPS
+index 5183762f9cedc..c691198319e88 100644
+--- DEPS
++++ DEPS
+@@ -2102,16 +2102,16 @@ deps = {
+       'dep_type': 'cipd',
+   },
+ 
+-  'src/third_party/test_fonts': {
++  'src/third_party/test_fonts/test_fonts': {
+       'dep_type': 'gcs',
+       'condition': 'non_git_source',
+       'bucket': 'chromium-fonts',
+       'objects': [
+           {
+-              'object_name': '336e775eec536b2d785cc80eff6ac39051931286',
+-              'sha256sum': 'a2ca2962daf482a8f943163541e1c73ba4b2694fabcd2510981f2db4eda493c8',
+-              'size_bytes': 32624734,
+-              'generation': 1647440500943755,
++              'object_name': 'f26f29c9d3bfae588207bbc9762de8d142e58935c62a86f67332819b15203b35',
++              'sha256sum': 'f26f29c9d3bfae588207bbc9762de8d142e58935c62a86f67332819b15203b35',
++              'size_bytes': 32750602,
++              'generation': 1717109450425063,
+           },
+       ],
+   },

patch/patches/chrome_browser_browser.patch

@@ -131,7 +131,7 @@ index e4c38df62e93e..6956a4a6e19ca 100644
      ]
    }
 diff --git chrome/browser/ui/browser.cc chrome/browser/ui/browser.cc
-index f6302e83d3b00..c617cc4a4a640 100644
+index f6302e83d3b00..ce0d6010d4b5c 100644
 --- chrome/browser/ui/browser.cc
 +++ chrome/browser/ui/browser.cc
 @@ -269,6 +269,25 @@
@@ -341,7 +341,23 @@ index f6302e83d3b00..c617cc4a4a640 100644
    RenderWidgetHostView* view = render_widget_host->GetView();
    if (view && !render_widget_host->GetView()->IsHTMLFormPopup()) {
      TabDialogs::FromWebContents(source)->HideHungRendererDialog(
-@@ -2093,6 +2199,11 @@ void Browser::DraggableRegionsChanged(
+@@ -2049,6 +2155,15 @@ void Browser::RendererResponsive(
+ 
+ content::JavaScriptDialogManager* Browser::GetJavaScriptDialogManager(
+     WebContents* source) {
++#if BUILDFLAG(ENABLE_CEF)
++  if (cef_browser_delegate_) {
++    auto* cef_js_dialog_manager =
++        cef_browser_delegate_->GetJavaScriptDialogManager(source);
++    if (cef_js_dialog_manager) {
++      return cef_js_dialog_manager;
++    }
++  }
++#endif
+   return javascript_dialogs::TabModalDialogManager::FromWebContents(source);
+ }
+ 
+@@ -2093,6 +2208,11 @@ void Browser::DraggableRegionsChanged(
    if (app_controller_) {
      app_controller_->DraggableRegionsChanged(regions, contents);
    }
@@ -353,7 +369,7 @@ index f6302e83d3b00..c617cc4a4a640 100644
  }
  
  void Browser::DidFinishNavigation(
-@@ -2173,11 +2284,15 @@ void Browser::EnterFullscreenModeForTab(
+@@ -2173,11 +2293,15 @@ void Browser::EnterFullscreenModeForTab(
      const blink::mojom::FullscreenOptions& options) {
    exclusive_access_manager_->fullscreen_controller()->EnterFullscreenModeForTab(
        requesting_frame, options.display_id);
@@ -369,7 +385,7 @@ index f6302e83d3b00..c617cc4a4a640 100644
  }
  
  bool Browser::IsFullscreenForTabOrPending(const WebContents* web_contents) {
-@@ -2377,6 +2492,15 @@ void Browser::RequestMediaAccessPermission(
+@@ -2377,6 +2501,15 @@ void Browser::RequestMediaAccessPermission(
      content::WebContents* web_contents,
      const content::MediaStreamRequest& request,
      content::MediaResponseCallback callback) {
@@ -385,7 +401,7 @@ index f6302e83d3b00..c617cc4a4a640 100644
    const extensions::Extension* extension =
        GetExtensionForOrigin(profile_, request.security_origin);
    MediaCaptureDevicesDispatcher::GetInstance()->ProcessMediaAccessRequest(
-@@ -2921,9 +3045,11 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
+@@ -2921,9 +3054,11 @@ void Browser::RemoveScheduledUpdatesFor(WebContents* contents) {
  // Browser, Getters for UI (private):
  
  StatusBubble* Browser::GetStatusBubble() {
@@ -398,7 +414,7 @@ index f6302e83d3b00..c617cc4a4a640 100644
    }
  
    // We hide the status bar for web apps windows as this matches native
-@@ -2931,6 +3057,12 @@ StatusBubble* Browser::GetStatusBubble() {
+@@ -2931,6 +3066,12 @@ StatusBubble* Browser::GetStatusBubble() {
    // mode, as the minimal browser UI includes the status bar.
    if (web_app::AppBrowserController::IsWebApp(this) &&
        !app_controller()->HasMinimalUiButtons()) {
@@ -411,7 +427,7 @@ index f6302e83d3b00..c617cc4a4a640 100644
      return nullptr;
    }
  
-@@ -3080,6 +3212,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
+@@ -3080,6 +3221,8 @@ void Browser::SetAsDelegate(WebContents* web_contents, bool set_delegate) {
      BookmarkTabHelper::FromWebContents(web_contents)->RemoveObserver(this);
      web_contents_collection_.StopObserving(web_contents);
    }
@@ -420,7 +436,7 @@ index f6302e83d3b00..c617cc4a4a640 100644
  }
  
  void Browser::TabDetachedAtImpl(content::WebContents* contents,
-@@ -3234,6 +3368,14 @@ bool Browser::PictureInPictureBrowserSupportsWindowFeature(
+@@ -3234,6 +3377,14 @@ bool Browser::PictureInPictureBrowserSupportsWindowFeature(
  
  bool Browser::SupportsWindowFeatureImpl(WindowFeature feature,
                                          bool check_can_support) const {

patch/patches/win_sandbox_op3way_3708.patch

@@ -0,0 +1,54 @@
+diff --git base/time/time.h base/time/time.h
+index 0efbea85491f4..17f9fe92ef78c 100644
+--- base/time/time.h
++++ base/time/time.h
+@@ -134,6 +134,13 @@ constexpr bool isnan(double d) {
+ 
+ }
+ 
++// Clang compiler is unable to eliminate a "dead" function call to an undefined
++// `std::_Literal_zero_is_expected()` function that MSVC uses to allow
++// comparisons with literal zero without warning.
++#define MSVC_OPERATOR_3WAY_BROKEN \
++    BUILDFLAG(IS_WIN) && (__cplusplus >= 202002L || _MSVC_LANG >= 202002L) && \
++    _MSVC_STL_VERSION >= 143 && _MSVC_STL_UPDATE >= 202303
++
+ // TimeDelta ------------------------------------------------------------------
+ 
+ class BASE_EXPORT TimeDelta {
+@@ -320,8 +327,17 @@ class BASE_EXPORT TimeDelta {
+ 
+   // Comparison operators.
+   friend constexpr bool operator==(TimeDelta, TimeDelta) = default;
++#if MSVC_OPERATOR_3WAY_BROKEN
++  friend constexpr std::strong_ordering operator<=>(TimeDelta lhs,
++                                                    TimeDelta rhs) {
++    if(lhs.delta_ == rhs.delta_) return std::strong_ordering::equal;
++    if(lhs.delta_ < rhs.delta_) return std::strong_ordering::less;
++    return std::strong_ordering::greater;
++  }
++#else
+   friend constexpr std::strong_ordering operator<=>(TimeDelta,
+                                                     TimeDelta) = default;
++#endif
+ 
+   // Returns this delta, ceiled/floored/rounded-away-from-zero to the nearest
+   // multiple of |interval|.
+@@ -472,8 +488,17 @@ class TimeBase {
+ 
+   // Comparison operators
+   friend constexpr bool operator==(const TimeBase&, const TimeBase&) = default;
++#if MSVC_OPERATOR_3WAY_BROKEN
++  friend constexpr std::strong_ordering operator<=>(TimeBase lhs,
++                                                    TimeBase rhs) {
++    if(lhs.us_ == rhs.us_) return std::strong_ordering::equal;
++    if(lhs.us_ < rhs.us_) return std::strong_ordering::less;
++    return std::strong_ordering::greater;
++  }
++#else
+   friend constexpr std::strong_ordering operator<=>(const TimeBase&,
+                                                     const TimeBase&) = default;
++#endif
+ 
+  protected:
+   constexpr explicit TimeBase(int64_t us) : us_(us) {}

tests/cefclient/browser/dialog_handler_gtk.cc

@@ -175,7 +175,7 @@ bool ClientDialogHandlerGtk::OnFileDialog(
     const std::vector<CefString>& accept_descriptions,
     CefRefPtr<CefFileDialogCallback> callback) {
   CEF_REQUIRE_UI_THREAD();
-  DCHECK(accept_filters.size() == accept_extensions.size() ==
+  DCHECK((accept_filters.size() == accept_extensions.size()) ==
          accept_descriptions.size());
 
   if (MissingMimeTypeData(accept_filters, accept_extensions)) {