Fix read of crash reporting env vars

Match the current logic for chrome.exe.

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/137.0.7151.0'
+  'chromium_checkout': 'refs/tags/137.0.7151.69'
 }

cef_paths2.gypi

@@ -528,6 +528,7 @@
       'tests/ceftests/permission_prompt_unittest.cc',
       'tests/ceftests/preference_unittest.cc',
       'tests/ceftests/print_unittest.cc',
+      'tests/ceftests/print_to_pdf_unittest.cc',
       'tests/ceftests/process_message_unittest.cc',
       'tests/ceftests/request_context_unittest.cc',
       'tests/ceftests/request_handler_unittest.cc',

libcef/browser/main_runner.cc

@@ -18,6 +18,7 @@
 #include "cef/libcef/common/cef_switches.h"
 #include "chrome/browser/browser_process_impl.h"
 #include "chrome/browser/chrome_process_singleton.h"
+#include "chrome/chrome_elf/chrome_elf_main.h"
 #include "chrome/common/chrome_result_codes.h"
 #include "components/crash/core/app/crash_switches.h"
 #include "components/keep_alive_registry/keep_alive_types.h"
@@ -35,6 +36,8 @@
 #include <memory>
 
 #include "content/public/app/sandbox_helper_win.h"
+#include "sandbox/policy/mojom/sandbox.mojom.h"
+#include "sandbox/policy/sandbox_type.h"
 #include "sandbox/win/src/sandbox_types.h"
 #endif
 
@@ -241,9 +244,29 @@ int CefMainRunner::RunAsHelperProcess(const CefMainArgs& args,
   // Execute the secondary process.
   content::ContentMainParams main_params(main_delegate.get());
 #if BUILDFLAG(IS_WIN)
+  // Initialize the sandbox services.
+  // Match the logic in MainDllLoader::Launch.
   sandbox::SandboxInterfaceInfo sandbox_info = {nullptr};
-  if (windows_sandbox_info == nullptr) {
-    content::InitializeSandboxInfo(&sandbox_info);
+
+  // IsUnsandboxedSandboxType() can't be used here because its result can be
+  // gated behind a feature flag, which are not yet initialized.
+  const bool is_sandboxed =
+      sandbox::policy::SandboxTypeFromCommandLine(command_line) !=
+      sandbox::mojom::Sandbox::kNoSandbox;
+
+  // When using cef_sandbox_info_create() the sandbox info will always be
+  // initialized. This is incorrect for cases where the sandbox is disabled, and
+  // we adjust for that here.
+  if (!is_sandboxed || windows_sandbox_info == nullptr) {
+    if (is_sandboxed) {
+      // For child processes that are running as --no-sandbox, don't
+      // initialize the sandbox info, otherwise they'll be treated as brokers
+      // (as if they were the browser).
+      content::InitializeSandboxInfo(
+          &sandbox_info, IsExtensionPointDisableSet()
+                             ? sandbox::MITIGATION_EXTENSION_POINT_DISABLE
+                             : 0);
+    }
     windows_sandbox_info = &sandbox_info;
   }
 

libcef/common/crash_reporter_client.cc

@@ -548,14 +548,12 @@ bool CefCrashReporterClient::ReadCrashConfigFile() {
   // Allow override of some values via environment variables.
   {
     std::unique_ptr<base::Environment> env(base::Environment::Create());
-    std::string val_str;
-
     if (const auto& var_str = env->GetVar("CEF_CRASH_REPORTER_SERVER_URL")) {
-      ParseURL(val_str, &server_url_);
+      ParseURL(*var_str, &server_url_);
     }
     if (const auto& var_str =
             env->GetVar("CEF_CRASH_REPORTER_RATE_LIMIT_ENABLED")) {
-      rate_limit_ = ParseBool(val_str);
+      rate_limit_ = ParseBool(*var_str);
     }
   }
 

patch/patch.cfg

@@ -270,6 +270,9 @@ patches = [
     # Fix usage of JavaScript tab modal dialogs with Alloy style browsers.
     # Modifies the logic added in https://crrev.com/78ce55cbc0.
     # https://github.com/chromiumembedded/cef/issues/3818
+    #
+    # Fix crash with OSR browsers on Linux.
+    # https://github.com/chromiumembedded/cef/issues/3921
     'name': 'chrome_browser_dialogs_jsmodal',
   },
   {

patch/patches/browser_security_policy_1081397.patch

@@ -20,10 +20,10 @@ index 53a73d6c75b7a..05290de4c03a0 100644
  
        // Make an exception to allow most visited tiles to commit in third-party
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index 4c78563c29ce9..029b8c5c30ef4 100644
+index ac9fd53f8fc22..3624ea2a10a3e 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
-@@ -8557,10 +8557,22 @@ NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(
+@@ -8622,10 +8622,22 @@ NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponseWithDebugInfo(
    bool use_opaque_origin =
        (sandbox_flags & network::mojom::WebSandboxFlags::kOrigin) ==
        network::mojom::WebSandboxFlags::kOrigin;
@@ -47,7 +47,7 @@ index 4c78563c29ce9..029b8c5c30ef4 100644
    }
  
    return origin_and_debug_info;
-@@ -8668,11 +8680,20 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponseWithDebugInfo() {
+@@ -8733,11 +8745,20 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponseWithDebugInfo() {
        DetermineInitiatorRelationship(initiator_rfh,
                                       frame_tree_node_->current_frame_host()));
  

patch/patches/chrome_browser_browser.patch

@@ -83,7 +83,7 @@ index 720839ed7b796..0d14fe57d841d 100644
    OverrideAndSyncDevToolsRendererPrefs();
  }
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index b24f97d12db79..55ed091b2c91c 100644
+index 93096ad92c1a3..9f6ad01bb1cc6 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -7,6 +7,7 @@ import("//build/config/compiler/compiler.gni")
@@ -684,10 +684,10 @@ index 83a510defbda5..f4305701c5f5a 100644
    params.source_contents = source_contents;
    params.url = target_url;
 diff --git chrome/browser/ui/browser_window/browser_window_features.cc chrome/browser/ui/browser_window/browser_window_features.cc
-index 7b158e39c965a..dc4d385a2c1a9 100644
+index db33c12d1d71b..af0c2f5203e0d 100644
 --- chrome/browser/ui/browser_window/browser_window_features.cc
 +++ chrome/browser/ui/browser_window/browser_window_features.cc
-@@ -100,6 +100,15 @@ BrowserWindowFeatures::CreateBrowserWindowFeatures() {
+@@ -99,6 +99,15 @@ BrowserWindowFeatures::CreateBrowserWindowFeatures() {
  
  BrowserWindowFeatures::~BrowserWindowFeatures() = default;
  
@@ -703,7 +703,7 @@ index 7b158e39c965a..dc4d385a2c1a9 100644
  // static
  void BrowserWindowFeatures::ReplaceBrowserWindowFeaturesForTesting(
      BrowserWindowFeaturesFactory factory) {
-@@ -190,10 +199,12 @@ void BrowserWindowFeatures::Init(BrowserWindowInterface* browser) {
+@@ -189,10 +198,12 @@ void BrowserWindowFeatures::Init(BrowserWindowInterface* browser) {
  }
  
  void BrowserWindowFeatures::InitPostWindowConstruction(Browser* browser) {
@@ -717,7 +717,7 @@ index 7b158e39c965a..dc4d385a2c1a9 100644
      if (IsChromeLabsEnabled()) {
        chrome_labs_coordinator_ =
            std::make_unique<ChromeLabsCoordinator>(browser);
-@@ -235,7 +246,7 @@ void BrowserWindowFeatures::InitPostWindowConstruction(Browser* browser) {
+@@ -234,7 +245,7 @@ void BrowserWindowFeatures::InitPostWindowConstruction(Browser* browser) {
      }
    }
  
@@ -726,7 +726,7 @@ index 7b158e39c965a..dc4d385a2c1a9 100644
        base::FeatureList::IsEnabled(toast_features::kToastFramework)) {
      toast_service_ = std::make_unique<ToastService>(browser);
    }
-@@ -277,10 +288,12 @@ void BrowserWindowFeatures::InitPostBrowserViewConstruction(
+@@ -267,10 +278,12 @@ void BrowserWindowFeatures::InitPostBrowserViewConstruction(
            browser_view->browser(),
            side_panel_coordinator_->GetWindowRegistry());
  
@@ -741,10 +741,10 @@ index 7b158e39c965a..dc4d385a2c1a9 100644
      if (glic::GlicEnabling::IsProfileEligible(
              browser_view->browser()->profile())) {
 diff --git chrome/browser/ui/browser_window/public/browser_window_features.h chrome/browser/ui/browser_window/public/browser_window_features.h
-index 5ba81ee463c84..c56a89c8d1911 100644
+index 0da8c64756ee2..2566fff471c8e 100644
 --- chrome/browser/ui/browser_window/public/browser_window_features.h
 +++ chrome/browser/ui/browser_window/public/browser_window_features.h
-@@ -91,6 +91,8 @@ class BrowserWindowFeatures {
+@@ -90,6 +90,8 @@ class BrowserWindowFeatures {
    static std::unique_ptr<BrowserWindowFeatures> CreateBrowserWindowFeatures();
    virtual ~BrowserWindowFeatures();
  

patch/patches/chrome_browser_context_menus.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/renderer_context_menu/render_view_context_menu.cc chrome/browser/renderer_context_menu/render_view_context_menu.cc
-index a333dcbe56bd2..cf34318b16f04 100644
+index 49c051ea6eabc..b98a2bfc2d131 100644
 --- chrome/browser/renderer_context_menu/render_view_context_menu.cc
 +++ chrome/browser/renderer_context_menu/render_view_context_menu.cc
-@@ -351,6 +351,18 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {
+@@ -352,6 +352,18 @@ base::OnceCallback<void(RenderViewContextMenu*)>* GetMenuShownCallback() {
    return callback.get();
  }
  
@@ -21,7 +21,7 @@ index a333dcbe56bd2..cf34318b16f04 100644
  enum class UmaEnumIdLookupType {
    GeneralEnumId,
    ContextSpecificEnumId,
-@@ -623,6 +635,10 @@ int FindUMAEnumValueForCommand(int id, UmaEnumIdLookupType type) {
+@@ -624,6 +636,10 @@ int FindUMAEnumValueForCommand(int id, UmaEnumIdLookupType type) {
      return 1;
    }
  
@@ -32,7 +32,7 @@ index a333dcbe56bd2..cf34318b16f04 100644
    id = CollapseCommandsForUMA(id);
    const auto& map = GetIdcToUmaMap(type);
    auto it = map.find(id);
-@@ -894,6 +910,14 @@ RenderViewContextMenu::RenderViewContextMenu(
+@@ -895,6 +911,14 @@ RenderViewContextMenu::RenderViewContextMenu(
                      : nullptr;
  #endif  // BUILDFLAG(IS_CHROMEOS)
  
@@ -47,7 +47,7 @@ index a333dcbe56bd2..cf34318b16f04 100644
    observers_.AddObserver(&autofill_context_menu_manager_);
  }
  
-@@ -1352,6 +1376,12 @@ void RenderViewContextMenu::InitMenu() {
+@@ -1353,6 +1377,12 @@ void RenderViewContextMenu::InitMenu() {
      autofill_client->HideAutofillSuggestions(
          autofill::SuggestionHidingReason::kContextMenuOpened);
    }
@@ -60,7 +60,7 @@ index a333dcbe56bd2..cf34318b16f04 100644
  }
  
  Profile* RenderViewContextMenu::GetProfile() const {
-@@ -3648,6 +3678,26 @@ void RenderViewContextMenu::RemoveObserverForTesting(
+@@ -3649,6 +3679,26 @@ void RenderViewContextMenu::RemoveObserverForTesting(
    observers_.RemoveObserver(observer);
  }
  

patch/patches/chrome_browser_dialogs_jsmodal.patch

@@ -57,10 +57,27 @@ index 8c06a19a64e5d..2b9429f7b2bab 100644
  }
  
 diff --git chrome/browser/ui/views/javascript_tab_modal_dialog_view_views.cc chrome/browser/ui/views/javascript_tab_modal_dialog_view_views.cc
-index e0c7c6df6f415..171f042d712e4 100644
+index e0c7c6df6f415..106cf8d8b998a 100644
 --- chrome/browser/ui/views/javascript_tab_modal_dialog_view_views.cc
 +++ chrome/browser/ui/views/javascript_tab_modal_dialog_view_views.cc
-@@ -79,10 +79,13 @@ JavaScriptTabModalDialogViewViews::JavaScriptTabModalDialogViewViews(
+@@ -49,9 +49,13 @@ views::View* JavaScriptTabModalDialogViewViews::GetInitiallyFocusedView() {
+ }
+ 
+ void JavaScriptTabModalDialogViewViews::AddedToWidget() {
+-  auto* bubble_frame_view = static_cast<views::BubbleFrameView*>(
+-      GetWidget()->non_client_view()->frame_view());
+-  bubble_frame_view->SetTitleView(CreateTitleOriginLabel(GetWindowTitle()));
++  auto* frame_view = GetWidget()->non_client_view()->frame_view();
++  // With CEF OSR this may be a NativeFrameView, in which case HasWindowTitle()
++  // will return false.
++  if (frame_view->HasWindowTitle()) {
++    auto* bubble_frame_view = static_cast<views::BubbleFrameView*>(frame_view);
++    bubble_frame_view->SetTitleView(CreateTitleOriginLabel(GetWindowTitle()));
++  }
+   if (!message_text_.empty()) {
+     GetWidget()->GetRootView()->GetViewAccessibility().SetDescription(
+         message_text_);
+@@ -79,10 +83,13 @@ JavaScriptTabModalDialogViewViews::JavaScriptTabModalDialogViewViews(
        default_prompt_text_(default_prompt_text),
        dialog_callback_(std::move(dialog_callback)),
        dialog_force_closed_callback_(std::move(dialog_force_closed_callback)) {

patch/patches/chrome_browser_safe_browsing.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/safe_browsing/BUILD.gn chrome/browser/safe_browsing/BUILD.gn
-index 7b88f06c0d08a..b5ff530eae6fa 100644
+index 4e2ad1d175829..ba6a3262dade2 100644
 --- chrome/browser/safe_browsing/BUILD.gn
 +++ chrome/browser/safe_browsing/BUILD.gn
 @@ -37,6 +37,7 @@ static_library("safe_browsing") {
@@ -10,11 +10,3 @@ index 7b88f06c0d08a..b5ff530eae6fa 100644
      "//components/keyed_service/content",
      "//components/language/core/browser",
      "//components/no_state_prefetch/browser",
-@@ -217,6 +218,7 @@ static_library("safe_browsing") {
-       "//chrome/browser/content_settings:content_settings_factory",
-       "//chrome/browser/download",
-       "//chrome/browser/enterprise/connectors/analysis:features",
-+      "//chrome/browser/permissions:permissions_proto",
-       "//chrome/browser/profiles:profile",
-       "//chrome/browser/ui/safety_hub",
-       "//chrome/common/safe_browsing:archive_analyzer_results",

patch/patches/chrome_browser_webui_license.patch

@@ -105,7 +105,7 @@ index e5e724a22d015..fcb15d234483f 100644
  #if !BUILDFLAG(IS_ANDROID)
        kChromeUIManagementHost,
 diff --git chrome/common/webui_url_constants.h chrome/common/webui_url_constants.h
-index af2bad4318c92..fa4fe8b87386d 100644
+index d2e895dbc4a16..abe7ba3d26f50 100644
 --- chrome/common/webui_url_constants.h
 +++ chrome/common/webui_url_constants.h
 @@ -18,6 +18,7 @@

patch/patches/chrome_runtime_views.patch

@@ -1,8 +1,8 @@
 diff --git chrome/browser/ui/browser_command_controller.cc chrome/browser/ui/browser_command_controller.cc
-index d5e652efef5df..a4cc11790658c 100644
+index 6f2feda3e7920..83650e01ce8a2 100644
 --- chrome/browser/ui/browser_command_controller.cc
 +++ chrome/browser/ui/browser_command_controller.cc
-@@ -442,6 +442,7 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
+@@ -458,6 +458,7 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
    // choose to not implement CommandUpdaterDelegate inside this class and
    // therefore command_updater_ doesn't have the delegate set).
    if (!SupportsCommand(id) || !IsCommandEnabled(id)) {
@@ -10,7 +10,7 @@ index d5e652efef5df..a4cc11790658c 100644
      return false;
    }
  
-@@ -459,6 +460,13 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
+@@ -475,6 +476,13 @@ bool BrowserCommandController::ExecuteCommandWithDisposition(
    DCHECK(command_updater_.IsCommandEnabled(id))
        << "Invalid/disabled command " << id;
  
@@ -24,7 +24,7 @@ index d5e652efef5df..a4cc11790658c 100644
    // The order of commands in this switch statement must match the function
    // declaration order in browser.h!
    switch (id) {
-@@ -1297,11 +1305,13 @@ void BrowserCommandController::TabRestoreServiceLoaded(
+@@ -1313,11 +1321,13 @@ void BrowserCommandController::TabRestoreServiceLoaded(
  // BrowserCommandController, private:
  
  bool BrowserCommandController::IsShowingMainUI() {
@@ -397,10 +397,10 @@ index 3d8a15049d4d2..66c4789581fe1 100644
    // regenerated.
    bool RegenerateFrameOnThemeChange(BrowserThemeChangeType theme_change_type);
 diff --git chrome/browser/ui/views/frame/browser_view.cc chrome/browser/ui/views/frame/browser_view.cc
-index 43650702e865b..4f814d29ef136 100644
+index 3c0e53b5ade77..d7ca16e2c41cc 100644
 --- chrome/browser/ui/views/frame/browser_view.cc
 +++ chrome/browser/ui/views/frame/browser_view.cc
-@@ -366,10 +366,6 @@ using web_modal::WebContentsModalDialogHost;
+@@ -368,10 +368,6 @@ using web_modal::WebContentsModalDialogHost;
  
  namespace {
  
@@ -411,7 +411,7 @@ index 43650702e865b..4f814d29ef136 100644
  // The visible height of the shadow above the tabs. Clicks in this area are
  // treated as clicks to the frame, rather than clicks to the tab.
  const int kTabShadowSize = 2;
-@@ -811,6 +807,14 @@ class BrowserViewLayoutDelegateImpl : public BrowserViewLayoutDelegate {
+@@ -813,6 +809,14 @@ class BrowserViewLayoutDelegateImpl : public BrowserViewLayoutDelegate {
      return browser_view_->frame()->GetTopInset() - browser_view_->y();
    }
  
@@ -426,7 +426,7 @@ index 43650702e865b..4f814d29ef136 100644
    bool IsToolbarVisible() const override {
      return browser_view_->IsToolbarVisible();
    }
-@@ -935,11 +939,21 @@ class BrowserView::AccessibilityModeObserver : public ui::AXModeObserver {
+@@ -937,11 +941,21 @@ class BrowserView::AccessibilityModeObserver : public ui::AXModeObserver {
  ///////////////////////////////////////////////////////////////////////////////
  // BrowserView, public:
  
@@ -449,7 +449,7 @@ index 43650702e865b..4f814d29ef136 100644
    SetShowIcon(::ShouldShowWindowIcon(
        browser_.get(), AppUsesWindowControlsOverlay(), AppUsesTabbed()));
  
-@@ -1089,8 +1103,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+@@ -1091,8 +1105,15 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
        lens_overlay_view_, contents_scrim_view_, nullptr, watermark_view_));
  #endif
  
@@ -467,7 +467,7 @@ index 43650702e865b..4f814d29ef136 100644
  
    contents_separator_ =
        top_container_->AddChildView(std::make_unique<ContentsSeparator>());
-@@ -1156,18 +1177,22 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
+@@ -1158,18 +1179,22 @@ BrowserView::BrowserView(std::unique_ptr<Browser> browser)
  }
  
  BrowserView::~BrowserView() {
@@ -490,7 +490,7 @@ index 43650702e865b..4f814d29ef136 100644
  
    tab_search_bubble_host_.reset();
  
-@@ -1175,9 +1200,11 @@ BrowserView::~BrowserView() {
+@@ -1177,9 +1202,11 @@ BrowserView::~BrowserView() {
    // tabstrip model and the browser frame.
    top_controls_slide_controller_.reset();
  
@@ -502,7 +502,7 @@ index 43650702e865b..4f814d29ef136 100644
  
    // Stop the animation timer explicitly here to avoid running it in a nested
    // message loop, which may run by Browser destructor.
-@@ -1186,17 +1213,18 @@ BrowserView::~BrowserView() {
+@@ -1188,17 +1215,18 @@ BrowserView::~BrowserView() {
    // Immersive mode may need to reparent views before they are removed/deleted.
    immersive_mode_controller_.reset();
  
@@ -525,7 +525,7 @@ index 43650702e865b..4f814d29ef136 100644
  
    // These are raw pointers to child views, so they need to be set to null
    // before `RemoveAllChildViews()` is called to avoid dangling.
-@@ -1897,6 +1925,28 @@ gfx::Point BrowserView::GetThemeOffsetFromBrowserView() const {
+@@ -1899,6 +1927,28 @@ gfx::Point BrowserView::GetThemeOffsetFromBrowserView() const {
        ThemeProperties::kFrameHeightAboveTabs - browser_view_origin.y());
  }
  
@@ -554,7 +554,7 @@ index 43650702e865b..4f814d29ef136 100644
  // static:
  BrowserView::DevToolsDockedPlacement BrowserView::GetDevToolsDockedPlacement(
      const gfx::Rect& contents_webview_bounds,
-@@ -2343,7 +2393,13 @@ void BrowserView::OnExclusiveAccessUserInput() {
+@@ -2345,7 +2395,13 @@ void BrowserView::OnExclusiveAccessUserInput() {
  
  bool BrowserView::ShouldHideUIForFullscreen() const {
    // Immersive mode needs UI for the slide-down top panel.
@@ -569,7 +569,7 @@ index 43650702e865b..4f814d29ef136 100644
      return false;
    }
  
-@@ -3574,6 +3630,9 @@ views::View* BrowserView::GetLensOverlayView() {
+@@ -3576,6 +3632,9 @@ views::View* BrowserView::GetLensOverlayView() {
  }
  
  DownloadBubbleUIController* BrowserView::GetDownloadBubbleUIController() {
@@ -579,7 +579,7 @@ index 43650702e865b..4f814d29ef136 100644
      if (auto* download_controller =
              browser_->GetFeatures().download_toolbar_ui_controller()) {
        return download_controller->bubble_controller();
-@@ -4319,7 +4378,9 @@ void BrowserView::ReparentTopContainerForEndOfImmersive() {
+@@ -4341,7 +4400,9 @@ void BrowserView::ReparentTopContainerForEndOfImmersive() {
      return;
    }
  
@@ -589,7 +589,7 @@ index 43650702e865b..4f814d29ef136 100644
    top_container()->DestroyLayer();
    AddChildViewAt(top_container(), 0);
    EnsureFocusOrder();
-@@ -4860,11 +4921,38 @@ void BrowserView::GetAccessiblePanes(std::vector<views::View*>* panes) {
+@@ -4882,11 +4943,38 @@ void BrowserView::GetAccessiblePanes(std::vector<views::View*>* panes) {
  bool BrowserView::ShouldDescendIntoChildForEventHandling(
      gfx::NativeView child,
      const gfx::Point& location) {
@@ -630,7 +630,7 @@ index 43650702e865b..4f814d29ef136 100644
      // Draggable regions are defined relative to the web contents.
      gfx::Point point_in_contents_web_view_coords(location);
      views::View::ConvertPointToTarget(GetWidget()->GetRootView(),
-@@ -4873,7 +4961,7 @@ bool BrowserView::ShouldDescendIntoChildForEventHandling(
+@@ -4895,7 +4983,7 @@ bool BrowserView::ShouldDescendIntoChildForEventHandling(
  
      // Draggable regions should be ignored for clicks into any browser view's
      // owned widgets, for example alerts, permission prompts or find bar.
@@ -639,7 +639,7 @@ index 43650702e865b..4f814d29ef136 100644
                 point_in_contents_web_view_coords.x(),
                 point_in_contents_web_view_coords.y()) ||
             WidgetOwnedByAnchorContainsPoint(point_in_contents_web_view_coords);
-@@ -5105,8 +5193,11 @@ void BrowserView::Layout(PassKey) {
+@@ -5127,8 +5215,11 @@ void BrowserView::Layout(PassKey) {
  
    // TODO(jamescook): Why was this in the middle of layout code?
    toolbar_->location_bar()->omnibox_view()->SetFocusBehavior(
@@ -652,7 +652,7 @@ index 43650702e865b..4f814d29ef136 100644
  
    // Some of the situations when the BrowserView is laid out are:
    // - Enter/exit immersive fullscreen mode.
-@@ -5173,6 +5264,12 @@ void BrowserView::AddedToWidget() {
+@@ -5195,6 +5286,12 @@ void BrowserView::AddedToWidget() {
    SetThemeProfileForWindow(GetNativeWindow(), browser_->profile());
  #endif
  
@@ -665,7 +665,7 @@ index 43650702e865b..4f814d29ef136 100644
    toolbar_->Init();
  
    if (GetIsNormalType()) {
-@@ -5232,12 +5329,6 @@ void BrowserView::AddedToWidget() {
+@@ -5254,12 +5351,6 @@ void BrowserView::AddedToWidget() {
  
    EnsureFocusOrder();
  
@@ -678,7 +678,7 @@ index 43650702e865b..4f814d29ef136 100644
    if (download::IsDownloadBubbleEnabled()) {
      browser_->GetFeatures().download_toolbar_ui_controller()->Init();
    }
-@@ -5248,7 +5339,9 @@ void BrowserView::AddedToWidget() {
+@@ -5270,7 +5361,9 @@ void BrowserView::AddedToWidget() {
    }
  
    frame_->OnBrowserViewInitViewsComplete();
@@ -688,7 +688,7 @@ index 43650702e865b..4f814d29ef136 100644
    using_native_frame_ = frame_->ShouldUseNativeFrame();
  
    MaybeInitializeWebUITabStrip();
-@@ -5670,7 +5763,9 @@ void BrowserView::ProcessFullscreen(bool fullscreen, const int64_t display_id) {
+@@ -5692,7 +5785,9 @@ void BrowserView::ProcessFullscreen(bool fullscreen, const int64_t display_id) {
    // Undo our anti-jankiness hacks and force a re-layout.
    in_process_fullscreen_ = false;
    ToolbarSizeChanged(false);
@@ -698,7 +698,7 @@ index 43650702e865b..4f814d29ef136 100644
  }
  
  void BrowserView::RequestFullscreen(bool fullscreen, int64_t display_id) {
-@@ -6182,7 +6277,9 @@ Profile* BrowserView::GetProfile() {
+@@ -6204,7 +6299,9 @@ Profile* BrowserView::GetProfile() {
  }
  
  void BrowserView::UpdateUIForTabFullscreen() {
@@ -708,7 +708,7 @@ index 43650702e865b..4f814d29ef136 100644
  }
  
  WebContents* BrowserView::GetWebContentsForExclusiveAccess() {
-@@ -6211,6 +6308,9 @@ bool BrowserView::CanUserEnterFullscreen() const {
+@@ -6233,6 +6330,9 @@ bool BrowserView::CanUserEnterFullscreen() const {
  }
  
  bool BrowserView::CanUserExitFullscreen() const {

patch/patches/content_2015.patch

@@ -12,7 +12,7 @@ index a28237bf93ef4..9a01b185e76f4 100644
      version.Set("V8-Version", V8_VERSION_STRING);
      std::string host = info.GetHeaderValue("host");
 diff --git content/browser/loader/navigation_url_loader_impl.cc content/browser/loader/navigation_url_loader_impl.cc
-index a65b70e7ac2e1..9b11bf620cdbd 100644
+index 1a800194b97da..b92a789494fea 100644
 --- content/browser/loader/navigation_url_loader_impl.cc
 +++ content/browser/loader/navigation_url_loader_impl.cc
 @@ -978,7 +978,7 @@ NavigationURLLoaderImpl::CreateNonNetworkLoaderFactory(

patch/patches/mac_render_widget_3680.patch

@@ -1,5 +1,5 @@
 diff --git content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
-index a6b6917ee2c02..3033900be5c83 100644
+index 1b458cd3bfc44..4a82829c4d0dd 100644
 --- content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
 +++ content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
 @@ -172,6 +172,13 @@ void ExtractUnderlines(NSAttributedString* string,
@@ -16,7 +16,7 @@ index a6b6917ee2c02..3033900be5c83 100644
  // Private methods:
  @interface RenderWidgetHostViewCocoa ()
  
-@@ -774,6 +781,15 @@ void ExtractUnderlines(NSAttributedString* string,
+@@ -783,6 +790,15 @@ void ExtractUnderlines(NSAttributedString* string,
  }
  
  - (BOOL)acceptsFirstMouse:(NSEvent*)theEvent {

patch/patches/net_cookie_flags.patch

@@ -10,10 +10,10 @@ index aeb79b46f5d21..bd57e874c1240 100644
 +// This load will not send any cookies. For CEF usage.
 +LOAD_FLAG(DO_NOT_SEND_COOKIES, 1 << 20)
 diff --git net/url_request/url_request_http_job.cc net/url_request/url_request_http_job.cc
-index 125529ce550ca..095da663062e9 100644
+index 1824c17bc464a..e80d50b7b6952 100644
 --- net/url_request/url_request_http_job.cc
 +++ net/url_request/url_request_http_job.cc
-@@ -2136,7 +2136,8 @@ bool URLRequestHttpJob::ShouldAddCookieHeader() const {
+@@ -2139,7 +2139,8 @@ bool URLRequestHttpJob::ShouldAddCookieHeader() const {
    // Read cookies whenever allow_credentials() is true, even if the PrivacyMode
    // is being overridden by NetworkDelegate and will eventually block them, as
    // blocked cookies still need to be logged in that case.

patch/patches/osr_fling_2745.patch

@@ -58,7 +58,7 @@ index 477389a1cb1d3..b7b7edbfbdf5d 100644
      return nullptr;
    }
 diff --git content/browser/renderer_host/render_widget_host_impl.cc content/browser/renderer_host/render_widget_host_impl.cc
-index 7b11077760d2a..1f67d3ccbe94d 100644
+index d3d209c23724a..be1c2d4c5239c 100644
 --- content/browser/renderer_host/render_widget_host_impl.cc
 +++ content/browser/renderer_host/render_widget_host_impl.cc
 @@ -3727,6 +3727,11 @@ void RenderWidgetHostImpl::StopFling() {
@@ -74,10 +74,10 @@ index 7b11077760d2a..1f67d3ccbe94d 100644
      uint16_t angle,
      display::mojom::ScreenOrientation type) {
 diff --git content/browser/renderer_host/render_widget_host_impl.h content/browser/renderer_host/render_widget_host_impl.h
-index c11b7183397d2..61a20efe04f7a 100644
+index 33e3a9fbbbcf6..b23a70ebe737a 100644
 --- content/browser/renderer_host/render_widget_host_impl.h
 +++ content/browser/renderer_host/render_widget_host_impl.h
-@@ -844,6 +844,7 @@ class CONTENT_EXPORT RenderWidgetHostImpl
+@@ -848,6 +848,7 @@ class CONTENT_EXPORT RenderWidgetHostImpl
  
    void ProgressFlingIfNeeded(base::TimeTicks current_time);
    void StopFling();

patch/patches/rfh_navigation_4829483.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/renderer_host/render_frame_host_impl.cc content/browser/renderer_host/render_frame_host_impl.cc
-index ebf407904b9b9..2bfdce0253d62 100644
+index 8ec8da33fe2ba..e3f56f527f38f 100644
 --- content/browser/renderer_host/render_frame_host_impl.cc
 +++ content/browser/renderer_host/render_frame_host_impl.cc
 @@ -9788,6 +9788,16 @@ void RenderFrameHostImpl::CreateNewWindow(

patch/patches/views_1749_2102_3330.patch

@@ -254,12 +254,12 @@ index b4cb7c83a3e4c..562e096930147 100644
    std::unique_ptr<SelectionController> selection_controller_;
  
 diff --git ui/views/controls/menu/menu_controller.cc ui/views/controls/menu/menu_controller.cc
-index a777b6b4c61c2..456e2b04848fc 100644
+index 0072453f5ba55..55b994b982a9e 100644
 --- ui/views/controls/menu/menu_controller.cc
 +++ ui/views/controls/menu/menu_controller.cc
-@@ -589,7 +589,8 @@ void MenuController::Run(Widget* parent,
+@@ -599,7 +599,8 @@ void MenuController::Run(Widget* parent,
                           ui::mojom::MenuSourceType source_type,
-                          bool context_menu,
+                          MenuType menu_type,
                           bool is_nested_drag,
 -                         gfx::NativeView native_view_for_gestures) {
 +                         gfx::NativeView native_view_for_gestures,
@@ -267,7 +267,7 @@ index a777b6b4c61c2..456e2b04848fc 100644
    exit_type_ = ExitType::kNone;
    possible_drag_ = false;
    drag_in_progress_ = false;
-@@ -658,6 +659,7 @@ void MenuController::Run(Widget* parent,
+@@ -668,6 +669,7 @@ void MenuController::Run(Widget* parent,
      }
  
      native_view_for_gestures_ = native_view_for_gestures;
@@ -275,7 +275,7 @@ index a777b6b4c61c2..456e2b04848fc 100644
  
      // Only create a MenuPreTargetHandler for non-nested menus. Nested menus
      // will use the existing one.
-@@ -2386,6 +2388,7 @@ void MenuController::OpenMenuImpl(MenuItemView* item, bool show) {
+@@ -2396,6 +2398,7 @@ void MenuController::OpenMenuImpl(MenuItemView* item, bool show) {
      params.do_capture = do_capture;
      params.native_view_for_gestures = native_view_for_gestures_;
      params.owned_window_anchor = anchor;
@@ -283,7 +283,7 @@ index a777b6b4c61c2..456e2b04848fc 100644
      if (item->GetParentMenuItem()) {
        params.context = item->GetWidget();
        // (crbug.com/1414232) The item to be open is a submenu. Make sure
-@@ -3100,7 +3103,11 @@ MenuItemView* MenuController::FindInitialSelectableMenuItem(
+@@ -3120,7 +3123,11 @@ MenuItemView* MenuController::FindInitialSelectableMenuItem(
  
  void MenuController::OpenSubmenuChangeSelectionIfCan() {
    MenuItemView* item = pending_state_.item;
@@ -296,7 +296,7 @@ index a777b6b4c61c2..456e2b04848fc 100644
      return;
    }
  
-@@ -3125,6 +3132,7 @@ void MenuController::CloseSubmenu() {
+@@ -3145,6 +3152,7 @@ void MenuController::CloseSubmenu() {
    MenuItemView* item = state_.item;
    DCHECK(item);
    if (!item->GetParentMenuItem()) {
@@ -305,12 +305,12 @@ index a777b6b4c61c2..456e2b04848fc 100644
    }
    if (item->SubmenuIsShowing()) {
 diff --git ui/views/controls/menu/menu_controller.h ui/views/controls/menu/menu_controller.h
-index 737b5dd9a243e..44b088afd01c8 100644
+index 2a42f071fcfad..3de8c2be46058 100644
 --- ui/views/controls/menu/menu_controller.h
 +++ ui/views/controls/menu/menu_controller.h
-@@ -140,7 +140,8 @@ class VIEWS_EXPORT MenuController final : public gfx::AnimationDelegate,
+@@ -146,7 +146,8 @@ class VIEWS_EXPORT MenuController final : public gfx::AnimationDelegate,
        ui::mojom::MenuSourceType source_type = ui::mojom::MenuSourceType::kNone,
-       bool context_menu = false,
+       MenuType menu_type = MenuType::kNormal,
        bool is_nested_drag = false,
 -      gfx::NativeView native_view_for_gestures = gfx::NativeView());
 +      gfx::NativeView native_view_for_gestures = gfx::NativeView(),
@@ -318,7 +318,7 @@ index 737b5dd9a243e..44b088afd01c8 100644
  
    bool for_drop() const { return for_drop_; }
  
-@@ -740,6 +741,8 @@ class VIEWS_EXPORT MenuController final : public gfx::AnimationDelegate,
+@@ -746,6 +747,8 @@ class VIEWS_EXPORT MenuController final : public gfx::AnimationDelegate,
    // RunType::SEND_GESTURE_EVENTS_TO_OWNER is set.
    gfx::NativeView native_view_for_gestures_ = gfx::NativeView();
  
@@ -567,10 +567,10 @@ index 87739aa15210f..e785faf160c2e 100644
  }
  
 diff --git ui/views/controls/menu/menu_runner.h ui/views/controls/menu/menu_runner.h
-index c60b13df53aae..2e2b9174938f7 100644
+index cb9d9d46eea37..a9ffb74761fce 100644
 --- ui/views/controls/menu/menu_runner.h
 +++ ui/views/controls/menu/menu_runner.h
-@@ -160,6 +160,8 @@ class VIEWS_EXPORT MenuRunner {
+@@ -164,6 +164,8 @@ class VIEWS_EXPORT MenuRunner {
                   MenuAnchorPosition anchor,
                   ui::mojom::MenuSourceType source_type,
                   gfx::NativeView native_view_for_gestures = gfx::NativeView(),
@@ -580,7 +580,7 @@ index c60b13df53aae..2e2b9174938f7 100644
                   std::optional<std::string> show_menu_host_duration_histogram =
                       std::nullopt);
 diff --git ui/views/controls/menu/menu_runner_impl.cc ui/views/controls/menu/menu_runner_impl.cc
-index bf7f7c6d8d31e..b7054a59a8876 100644
+index 3793390d203db..d56aa411470ab 100644
 --- ui/views/controls/menu/menu_runner_impl.cc
 +++ ui/views/controls/menu/menu_runner_impl.cc
 @@ -119,6 +119,7 @@ void MenuRunnerImpl::RunMenuAt(
@@ -591,9 +591,9 @@ index bf7f7c6d8d31e..b7054a59a8876 100644
      std::optional<gfx::RoundedCornersF> corners,
      std::optional<std::string> show_menu_host_duration_histogram) {
    closing_event_time_ = base::TimeTicks();
-@@ -193,7 +194,7 @@ void MenuRunnerImpl::RunMenuAt(
+@@ -199,7 +200,7 @@ void MenuRunnerImpl::RunMenuAt(
    controller->Run(parent, button_controller, menu_.get(), bounds, anchor,
-                   source_type, (run_types & MenuRunner::CONTEXT_MENU) != 0,
+                   source_type, menu_type,
                    (run_types & MenuRunner::NESTED_DRAG) != 0,
 -                  native_view_for_gestures);
 +                  native_view_for_gestures, parent_widget);

patch/patches/views_widget.patch

@@ -61,10 +61,10 @@ index 971e5273f1b05..a5d847f7f9d60 100644
      case ui::mojom::WindowShowState::kMaximized:
        return kSerializedShowStateMaximized;
 diff --git content/browser/renderer_host/render_widget_host_view_base.cc content/browser/renderer_host/render_widget_host_view_base.cc
-index 30ec1b5e2688b..e9452c1eb9dee 100644
+index bb7475f1f8be4..522c7a8e74640 100644
 --- content/browser/renderer_host/render_widget_host_view_base.cc
 +++ content/browser/renderer_host/render_widget_host_view_base.cc
-@@ -602,6 +602,14 @@ float RenderWidgetHostViewBase::GetScaleOverrideForCapture() const {
+@@ -603,6 +603,14 @@ float RenderWidgetHostViewBase::GetScaleOverrideForCapture() const {
    return scale_override_for_capture_;
  }
  
@@ -80,7 +80,7 @@ index 30ec1b5e2688b..e9452c1eb9dee 100644
    if (!GetMouseWheelPhaseHandler())
      return;
 diff --git content/browser/renderer_host/render_widget_host_view_base.h content/browser/renderer_host/render_widget_host_view_base.h
-index c93e93d13f101..cefd78e15857a 100644
+index faed571e32325..4b33792b4f233 100644
 --- content/browser/renderer_host/render_widget_host_view_base.h
 +++ content/browser/renderer_host/render_widget_host_view_base.h
 @@ -73,6 +73,7 @@ namespace content {
@@ -91,7 +91,7 @@ index c93e93d13f101..cefd78e15857a 100644
  class ScopedViewTransitionResources;
  class TextInputManager;
  class TouchSelectionControllerClientManager;
-@@ -159,6 +160,9 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -157,6 +158,9 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
  
    virtual void DidOverscroll(const ui::DidOverscrollParams& params) {}
  
@@ -101,7 +101,7 @@ index c93e93d13f101..cefd78e15857a 100644
    // Identical to `CopyFromSurface()`, except that this method issues the
    // `viz::CopyOutputRequest` against the exact `viz::Surface` currently
    // embedded by this View, while `CopyFromSurface()` may return a copy of any
-@@ -229,6 +233,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -227,6 +231,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    // Called when screen information or native widget bounds change.
    virtual void UpdateScreenInfo();
  
@@ -112,7 +112,7 @@ index c93e93d13f101..cefd78e15857a 100644
    // Called by the TextInputManager to notify the view about being removed from
    // the list of registered views, i.e., TextInputManager is no longer tracking
    // TextInputState from this view. The RWHV should reset |text_input_manager_|
-@@ -355,6 +363,12 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -353,6 +361,12 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
                             const gfx::Rect& bounds,
                             const gfx::Rect& anchor_rect) = 0;
  
@@ -125,7 +125,7 @@ index c93e93d13f101..cefd78e15857a 100644
    // Indicates whether the page has finished loading.
    virtual void SetIsLoading(bool is_loading) = 0;
  
-@@ -623,6 +637,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -621,6 +635,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
    // to all displays.
    gfx::Size system_cursor_size_;
  
@@ -136,7 +136,7 @@ index c93e93d13f101..cefd78e15857a 100644
   private:
    FRIEND_TEST_ALL_PREFIXES(
        BrowserSideFlingBrowserTest,
-@@ -644,10 +662,6 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
+@@ -642,10 +660,6 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
  
    void SynchronizeVisualProperties();
  
@@ -273,7 +273,7 @@ index 077855979045d..69f369b06c29e 100644
    return host ? host->GetAcceleratedWidget() : nullptr;
  }
 diff --git ui/views/widget/desktop_aura/desktop_window_tree_host_linux.cc ui/views/widget/desktop_aura/desktop_window_tree_host_linux.cc
-index a5114063ad742..9a4a1be60f6b5 100644
+index a5114063ad742..e8254548b7d62 100644
 --- ui/views/widget/desktop_aura/desktop_window_tree_host_linux.cc
 +++ ui/views/widget/desktop_aura/desktop_window_tree_host_linux.cc
 @@ -193,6 +193,18 @@ Widget::MoveLoopResult DesktopWindowTreeHostLinux::RunMoveLoop(
@@ -295,11 +295,13 @@ index a5114063ad742..9a4a1be60f6b5 100644
  void DesktopWindowTreeHostLinux::DispatchEvent(ui::Event* event) {
    // In Windows, the native events sent to chrome are separated into client
    // and non-client versions of events, which we record on our LocatedEvent
-@@ -333,6 +345,8 @@ void DesktopWindowTreeHostLinux::AddAdditionalInitProperties(
+@@ -333,6 +345,10 @@ void DesktopWindowTreeHostLinux::AddAdditionalInitProperties(
  
    properties->wayland_app_id = params.wayland_app_id;
  
-+  properties->parent_widget = params.parent_widget;
++  if (!properties->parent_widget) {
++    properties->parent_widget = params.parent_widget;
++  }
 +
    DCHECK(!properties->x11_extension_delegate);
    properties->x11_extension_delegate = this;
@@ -352,7 +354,7 @@ index 2150c344075c7..feb1abf159d51 100644
  
    // Calculate initial bounds.
 diff --git ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-index 6ad16425f2fb3..f2e5c506e23f5 100644
+index 58244f0e9b476..ae04f2ae156b8 100644
 --- ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
 +++ ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
 @@ -24,6 +24,7 @@
@@ -363,7 +365,7 @@ index 6ad16425f2fb3..f2e5c506e23f5 100644
  #include "ui/aura/window_event_dispatcher.h"
  #include "ui/base/class_property.h"
  #include "ui/base/cursor/cursor.h"
-@@ -199,7 +200,10 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
+@@ -193,7 +194,10 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
                          native_widget_delegate_.get());
  
    HWND parent_hwnd = nullptr;
@@ -375,7 +377,7 @@ index 6ad16425f2fb3..f2e5c506e23f5 100644
      parent_hwnd = params.parent->GetHost()->GetAcceleratedWidget();
    }
  
-@@ -207,9 +211,18 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
+@@ -201,9 +205,18 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
    has_non_client_view_ = Widget::RequiresNonClientView(params.type);
    z_order_ = params.EffectiveZOrderLevel();
  
@@ -397,16 +399,15 @@ index 6ad16425f2fb3..f2e5c506e23f5 100644
    message_handler_->Init(parent_hwnd, pixel_bounds);
  
    // If the Redirection Surface is removed, there needs to be a replacement
-@@ -221,7 +234,7 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
-   // gutter.
+@@ -215,6 +228,7 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
    if (((message_handler_->window_ex_style() & WS_EX_NOREDIRECTIONBITMAP) ==
         WS_EX_NOREDIRECTIONBITMAP) &&
--      !message_handler_->is_translucent()) {
-+      !message_handler_->is_translucent() && !has_external_parent_) {
+       !message_handler_->is_translucent() &&
++      !has_external_parent_ &&
+       GetFrameMode() != FrameMode::SYSTEM_DRAWN) {
      // Ensure that the hwnd has been created.
      CHECK(GetHWND());
- 
-@@ -253,6 +266,13 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
+@@ -231,6 +245,13 @@ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
    InitHost();
    window()->Show();
  
@@ -420,16 +421,7 @@ index 6ad16425f2fb3..f2e5c506e23f5 100644
    // Stack immediately above its parent so that it does not cover other
    // root-level windows, with the exception of menus, to allow them to be
    // displayed on top of other windows.
-@@ -284,7 +304,7 @@ void DesktopWindowTreeHostWin::OnWidgetInitDone() {}
- 
- void DesktopWindowTreeHostWin::OnWidgetThemeChanged(
-     ui::ColorProviderKey::ColorMode color_mode) {
--  if (ShouldApplySystemBackdrop()) {
-+  if (ShouldApplySystemBackdrop() && !has_external_parent_) {
-     // Ensure that DWM knows to apply the correct color scheme to the window
-     // backdrop whenever it changes.
-     BOOL use_dark_mode =
-@@ -1207,6 +1227,18 @@ void DesktopWindowTreeHostWin::HandleWindowMinimizedOrRestored(bool restored) {
+@@ -1174,6 +1195,18 @@ void DesktopWindowTreeHostWin::HandleWindowMinimizedOrRestored(bool restored) {
  
    if (restored) {
      window()->Show();
@@ -448,7 +440,7 @@ index 6ad16425f2fb3..f2e5c506e23f5 100644
    } else {
      window()->Hide();
    }
-@@ -1228,11 +1260,17 @@ void DesktopWindowTreeHostWin::HandleFrameChanged() {
+@@ -1195,11 +1228,17 @@ void DesktopWindowTreeHostWin::HandleFrameChanged() {
  }
  
  void DesktopWindowTreeHostWin::HandleNativeFocus(HWND last_focused_window) {
@@ -468,7 +460,7 @@ index 6ad16425f2fb3..f2e5c506e23f5 100644
  }
  
  bool DesktopWindowTreeHostWin::HandleMouseEvent(ui::MouseEvent* event) {
-@@ -1241,6 +1279,12 @@ bool DesktopWindowTreeHostWin::HandleMouseEvent(ui::MouseEvent* event) {
+@@ -1208,6 +1247,12 @@ bool DesktopWindowTreeHostWin::HandleMouseEvent(ui::MouseEvent* event) {
      return true;
    }
  
@@ -481,7 +473,7 @@ index 6ad16425f2fb3..f2e5c506e23f5 100644
    SendEventToSink(event);
    return event->handled();
  }
-@@ -1426,9 +1470,17 @@ void DesktopWindowTreeHostWin::SetBoundsInDIP(const gfx::Rect& bounds) {
+@@ -1393,9 +1438,17 @@ void DesktopWindowTreeHostWin::SetBoundsInDIP(const gfx::Rect& bounds) {
    // positions in variable-DPI situations. See https://crbug.com/1224715 for
    // details.
    aura::Window* root = nullptr;
@@ -635,7 +627,7 @@ index 65154f18c7ce7..67c626d78e5d3 100644
    // Deactivates the widget, making the next window in the Z order the active
    // window.
 diff --git ui/views/widget/widget_delegate.h ui/views/widget/widget_delegate.h
-index 7c2463cb91d00..72c6a239ecc21 100644
+index 89de188e6a013..e87a2f25c8f43 100644
 --- ui/views/widget/widget_delegate.h
 +++ ui/views/widget/widget_delegate.h
 @@ -24,6 +24,9 @@
@@ -648,7 +640,7 @@ index 7c2463cb91d00..72c6a239ecc21 100644
  class DesktopMediaPickerDialogView;
  class DigitalIdentityMultiStepDialogDelegate;
  class DownloadBubbleContentsViewTest;
-@@ -375,6 +378,8 @@ class VIEWS_EXPORT WidgetDelegate {
+@@ -371,6 +374,8 @@ class VIEWS_EXPORT WidgetDelegate {
      // These existing cases are "grandfathered in", but there shouldn't be more.
      // See comments atop `SetOwnedByWidget()`.
      friend class ::AutoPipSettingView;
@@ -657,7 +649,7 @@ index 7c2463cb91d00..72c6a239ecc21 100644
      friend class ::DigitalIdentityMultiStepDialogDelegate;
      friend class ::DownloadBubbleContentsViewTest;
      friend class ::DownloadBubbleSecurityViewTest;
-@@ -471,6 +476,9 @@ class VIEWS_EXPORT WidgetDelegate {
+@@ -466,6 +471,9 @@ class VIEWS_EXPORT WidgetDelegate {
      // DO NOT ADD TO THIS LIST!
      // These existing cases are "grandfathered in", but there shouldn't be more.
      // See comments atop `RegisterDeleteDelegateCallback()`.
@@ -667,7 +659,7 @@ index 7c2463cb91d00..72c6a239ecc21 100644
      friend class ::DesktopMediaPickerDialogView;
      friend class ::MediaGalleriesDialogViews;
      friend class ::PresentationReceiverWindowView;
-@@ -795,6 +803,10 @@ class VIEWS_EXPORT WidgetDelegate {
+@@ -790,6 +798,10 @@ class VIEWS_EXPORT WidgetDelegate {
    // Returns true if the title text should be centered.
    bool ShouldCenterWindowTitleText() const;
  
@@ -678,7 +670,7 @@ index 7c2463cb91d00..72c6a239ecc21 100644
    bool focus_traverses_out() const { return params_.focus_traverses_out; }
    bool enable_arrow_key_traversal() const {
      return params_.enable_arrow_key_traversal;
-@@ -917,7 +929,6 @@ class VIEWS_EXPORT WidgetDelegateView : public WidgetDelegate, public View {
+@@ -912,7 +924,6 @@ class VIEWS_EXPORT WidgetDelegateView : public WidgetDelegate, public View {
    const Widget* GetWidget() const override;
    View* GetContentsView() override;
  
@@ -686,7 +678,7 @@ index 7c2463cb91d00..72c6a239ecc21 100644
    // DO NOT ADD TO THIS LIST!
    // These existing cases are "grandfathered in", but there shouldn't be more.
    // See comments atop class.
-@@ -984,6 +995,7 @@ class VIEWS_EXPORT WidgetDelegateView : public WidgetDelegate, public View {
+@@ -979,6 +990,7 @@ class VIEWS_EXPORT WidgetDelegateView : public WidgetDelegate, public View {
  
    WidgetDelegateView();
  

patch/patches/web_contents_1257_1565.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index fe352434dd26e..72b68afb94d80 100644
+index 544832152c8b1..ffd5f32eeff14 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
-@@ -3947,6 +3947,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
+@@ -3952,6 +3952,12 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
        params.main_frame_name, GetOpener(), primary_main_frame_policy,
        base::UnguessableToken::Create());
  
@@ -15,7 +15,7 @@ index fe352434dd26e..72b68afb94d80 100644
    std::unique_ptr<WebContentsViewDelegate> delegate =
        GetContentClient()->browser()->GetWebContentsViewDelegate(this);
  
-@@ -3957,6 +3963,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
+@@ -3962,6 +3968,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
      view_ = CreateWebContentsView(this, std::move(delegate),
                                    &render_view_host_delegate_view_);
    }
@@ -23,7 +23,7 @@ index fe352434dd26e..72b68afb94d80 100644
    CHECK(render_view_host_delegate_view_);
    CHECK(view_.get());
  
-@@ -4167,6 +4174,9 @@ void WebContentsImpl::RenderWidgetCreated(
+@@ -4172,6 +4179,9 @@ void WebContentsImpl::RenderWidgetCreated(
                          "render_widget_host", render_widget_host);
    CHECK(!created_widgets_.contains(render_widget_host->GetFrameSinkId()));
    created_widgets_[render_widget_host->GetFrameSinkId()] = render_widget_host;
@@ -33,7 +33,7 @@ index fe352434dd26e..72b68afb94d80 100644
  }
  
  void WebContentsImpl::RenderWidgetDeleted(
-@@ -5086,6 +5096,15 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5091,6 +5101,15 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      create_params.picture_in_picture_options = *(params.pip_options);
    }
  
@@ -49,7 +49,7 @@ index fe352434dd26e..72b68afb94d80 100644
    // Check whether there is an available prerendered page for this navigation if
    // this is not for guest. If it exists, take WebContents pre-created for
    // hosting the prerendered page instead of creating new WebContents.
-@@ -9913,6 +9932,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
+@@ -9918,6 +9937,9 @@ void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
    }
  
    CloseListenerManager::DidChangeFocusedFrame(this);
@@ -59,7 +59,7 @@ index fe352434dd26e..72b68afb94d80 100644
  }
  
  FrameTree* WebContentsImpl::GetOwnedPictureInPictureFrameTree() {
-@@ -10561,6 +10583,11 @@ void WebContentsImpl::Resize(const gfx::Rect& new_bounds) {
+@@ -10566,6 +10588,11 @@ void WebContentsImpl::Resize(const gfx::Rect& new_bounds) {
    OPTIONAL_TRACE_EVENT0("content", "WebContentsImpl::Resize");
  #if defined(USE_AURA)
    aura::Window* window = GetNativeView();
@@ -71,7 +71,7 @@ index fe352434dd26e..72b68afb94d80 100644
    window->SetBounds(gfx::Rect(window->bounds().origin(), new_bounds.size()));
  #elif BUILDFLAG(IS_ANDROID)
    content::RenderWidgetHostView* view = GetRenderWidgetHostView();
-@@ -10573,6 +10600,11 @@ void WebContentsImpl::Resize(const gfx::Rect& new_bounds) {
+@@ -10578,6 +10605,11 @@ void WebContentsImpl::Resize(const gfx::Rect& new_bounds) {
  gfx::Size WebContentsImpl::GetSize() {
  #if defined(USE_AURA)
    aura::Window* window = GetNativeView();
@@ -120,7 +120,7 @@ index f1105a13aa0eb..d1dba26bbac1f 100644
    return gfx::Size(NSWidth(frame), NSHeight(frame));
  }
 diff --git content/public/browser/web_contents.h content/public/browser/web_contents.h
-index 437060750090e..337acf70169b1 100644
+index 404f12c976dca..e09af607cfa98 100644
 --- content/public/browser/web_contents.h
 +++ content/public/browser/web_contents.h
 @@ -121,10 +121,12 @@ class BrowserPluginGuestDelegate;
@@ -136,7 +136,7 @@ index 437060750090e..337acf70169b1 100644
  class WebUI;
  struct DropData;
  struct MHTMLGenerationParams;
-@@ -270,6 +272,10 @@ class WebContents : public PageNavigator, public base::SupportsUserData {
+@@ -274,6 +276,10 @@ class WebContents : public PageNavigator, public base::SupportsUserData {
      network::mojom::WebSandboxFlags starting_sandbox_flags =
          network::mojom::WebSandboxFlags::kNone;
  

patch/patches/win_sandbox_3210.patch

@@ -1,5 +1,5 @@
 diff --git sandbox/policy/win/sandbox_win.cc sandbox/policy/win/sandbox_win.cc
-index 4fb8e2a9d7a6e..46e3db1d36f73 100644
+index 4fb8e2a9d7a6e..797e5af27ca56 100644
 --- sandbox/policy/win/sandbox_win.cc
 +++ sandbox/policy/win/sandbox_win.cc
 @@ -939,6 +939,17 @@ ResultCode SandboxWin::StartSandboxedProcess(
@@ -20,3 +20,21 @@ index 4fb8e2a9d7a6e..46e3db1d36f73 100644
    SandboxLaunchTimer timer;
  
    // Avoid making a policy if we won't use it.
+@@ -1015,10 +1026,16 @@ void SandboxWin::FinishStartSandboxedProcess(
+ // static
+ ResultCode SandboxWin::GetPolicyDiagnostics(
+     base::OnceCallback<void(base::Value)> response) {
+-  CHECK(g_broker_services);
+   CHECK(!response.is_null());
+   auto receiver = std::make_unique<ServiceManagerDiagnosticsReceiver>(
+       base::SequencedTaskRunner::GetCurrentDefault(), std::move(response));
++  // Will be nullptr if SandboxInterfaceInfo was not initialized by the CEF
++  // client, meaning that the sandbox is implicitly disabled. Match the
++  // failure behavior in BrokerServicesBase::GetPolicyDiagnostics.
++  if (!g_broker_services) {
++    receiver->OnError(SBOX_ERROR_GENERIC);
++    return SBOX_ERROR_GENERIC;
++  }
+   return g_broker_services->GetPolicyDiagnostics(std::move(receiver));
+ }
+ 

tests/ceftests/print_to_pdf_unittest.cc

@@ -0,0 +1,290 @@
+// Copyright (c) 2025 The Chromium Embedded Framework Authors. All rights
+// reserved. Use of this source code is governed by a BSD-style license that
+// can be found in the LICENSE file.
+
+#include <algorithm>
+
+#include "include/base/cef_callback.h"
+#include "include/wrapper/cef_closure_task.h"
+#include "include/wrapper/cef_scoped_temp_dir.h"
+#include "tests/ceftests/test_handler.h"
+#include "tests/ceftests/test_util.h"
+#include "tests/gtest/include/gtest/gtest.h"
+#include "tests/shared/browser/file_util.h"
+
+namespace {
+
+const char kPrintHtmlUrl[] = "https://tests/print.html";
+const char kTestFileName[] = "print.pdf";
+#if defined(OS_WIN)
+const char kTestFileNameInvalid[] = "print.pdf?";
+#endif  // defined(OS_WIN)
+const char kTestHtml[] =
+    "<!DOCTYPE html>\n"
+    "<html lang=\"en\">\n"
+    "<head>\n"
+    "    <meta charset=\"UTF-8\">\n"
+    "    <meta name=\"viewport\" content=\"width=device-width, "
+    "initial-scale=1.0\">\n"
+    "    <title>Print Test</title>\n"
+    "    <style>\n"
+    "        body {\n"
+    "            font-family: Arial, sans-serif;\n"
+    "            margin: 20px;\n"
+    "            padding: 20px;\n"
+    "            border: 1px solid #ccc;\n"
+    "        }\n"
+    "        h1 {\n"
+    "            color: #333;\n"
+    "        }\n"
+    "        p {\n"
+    "            font-size: 16px;\n"
+    "            line-height: 1.5;\n"
+    "        }\n"
+    "        @media print {\n"
+    "            body {\n"
+    "                margin: 0;\n"
+    "                padding: 0;\n"
+    "                border: none;\n"
+    "            }\n"
+    "            h1 {\n"
+    "                color: black;\n"
+    "            }\n"
+    "            p {\n"
+    "                color: black;\n"
+    "            }\n"
+    "        }\n"
+    "    </style>\n"
+    "</head>\n"
+    "<body>\n"
+    "    <h1>Print Test Document</h1>\n"
+    "    <p>This is a simple test document to check printing "
+    "functionality.</p>\n"
+    "</body>\n"
+    "</html>";
+
+// Browser-side test handler.
+class PrintToPdfTestHandler : public TestHandler, public CefPdfPrintCallback {
+ public:
+  PrintToPdfTestHandler(const std::string& url, bool expect_ok)
+      : url_(url), expect_ok_(expect_ok) {}
+
+  virtual std::string GetTestFileName() { return kTestFileName; }
+
+  void RunTest() override {
+    EXPECT_TRUE(temp_dir_.CreateUniqueTempDir());
+
+    test_path_ =
+        client::file_util::JoinPath(temp_dir_.GetPath(), GetTestFileName());
+
+    // Add the resource.
+    AddResource(url_, kTestHtml, "text/html");
+
+    // Create the browser.
+    CreateBrowser(url_);
+
+    // Time out the test after a reasonable period of time.
+    SetTestTimeout(5000);
+  }
+
+  void OnLoadEnd(CefRefPtr<CefBrowser> browser,
+                 CefRefPtr<CefFrame> frame,
+                 int httpStatusCode) override {
+    const std::string& url = frame->GetURL();
+    if (url == "about:blank" || url.find("chrome-extension://") == 0) {
+      return;
+    }
+
+    if (url == kPrintHtmlUrl) {
+      EXPECT_FALSE(got_on_load_end_html_);
+      got_on_load_end_html_.yes();
+    } else {
+      NOTREACHED() << "url=" << url;
+    }
+
+    PrintToPDF(browser);
+  }
+
+  void OnPdfPrintFinished(const CefString& path, bool ok) override {
+    EXPECT_EQ(expect_ok_, ok);
+
+    if (ok) {
+      EXPECT_EQ(test_path_, path);
+    }
+
+    EXPECT_FALSE(got_on_pdf_print_finished_);
+    got_on_pdf_print_finished_.yes();
+
+    CompleteTest();
+  }
+
+  void VerifyResultsOnFileThread() {
+    EXPECT_TRUE(CefCurrentlyOn(TID_FILE_USER_VISIBLE));
+
+    // Verify the file contents.
+    std::string contents;
+    bool ok = client::file_util::ReadFileToString(test_path_, &contents);
+    EXPECT_EQ(ok, expect_ok_);
+    if (expect_ok_) {
+      EXPECT_GT(contents.size(), 1024U);
+      // https://en.wikipedia.org/wiki/PDF
+      // The file starts with a header containing a magic number (as a readable
+      // string) and the version of the format, for example %PDF-1.7
+      if (contents.size() >= 4U) {
+        EXPECT_EQ(contents[0], '%');
+        EXPECT_EQ(contents[1], 'P');
+        EXPECT_EQ(contents[2], 'D');
+        EXPECT_EQ(contents[3], 'F');
+      }
+    }
+
+    EXPECT_TRUE(temp_dir_.Delete());
+    EXPECT_TRUE(temp_dir_.IsEmpty());
+
+    CefPostTask(TID_UI,
+                base::BindOnce(&PrintToPdfTestHandler::CompleteTest, this));
+  }
+
+  void CompleteTest() {
+    if (!verified_results_ && !temp_dir_.IsEmpty()) {
+      verified_results_ = true;
+      CefPostTask(TID_FILE_USER_VISIBLE,
+                  base::BindOnce(
+                      &PrintToPdfTestHandler::VerifyResultsOnFileThread, this));
+      return;
+    }
+
+    DestroyTest();
+  }
+
+  void DestroyTest() override {
+    EXPECT_TRUE(got_on_load_end_html_);
+    EXPECT_TRUE(got_on_pdf_print_finished_);
+    EXPECT_TRUE(verified_results_);
+
+    if (temp_dir_.IsValid()) {
+      ASSERT_TRUE(temp_dir_.Delete());
+    }
+
+    TestHandler::DestroyTest();
+  }
+
+  virtual void PrintToPDF(CefRefPtr<CefBrowser> browser) {
+    CefPdfPrintSettings settings;
+    browser->GetHost()->PrintToPDF(test_path_, settings, this);
+  }
+
+ protected:
+  CefScopedTempDir temp_dir_;
+
+  const std::string url_;
+  CefString test_path_;
+  const bool expect_ok_;
+  bool verified_results_ = false;
+
+  TrackCallback got_on_load_end_html_;
+  TrackCallback got_on_pdf_print_finished_;
+
+  IMPLEMENT_REFCOUNTING(PrintToPdfTestHandler);
+};
+
+class PrintToPdfInvalidMarginTestHandler : public PrintToPdfTestHandler {
+ public:
+  PrintToPdfInvalidMarginTestHandler(const std::string& url, bool expect_ok)
+      : PrintToPdfTestHandler(url, expect_ok) {}
+
+  virtual void PrintToPDF(CefRefPtr<CefBrowser> browser) override {
+    CefPdfPrintSettings settings;
+    settings.margin_left = -1;
+    settings.margin_type = cef_pdf_print_margin_type_t::PDF_PRINT_MARGIN_CUSTOM;
+    browser->GetHost()->PrintToPDF(test_path_, settings, this);
+  }
+
+ protected:
+  IMPLEMENT_REFCOUNTING(PrintToPdfInvalidMarginTestHandler);
+};
+
+class PrintToPdfInvalidPaperDimTestHandler : public PrintToPdfTestHandler {
+ public:
+  PrintToPdfInvalidPaperDimTestHandler(const std::string& url, bool expect_ok)
+      : PrintToPdfTestHandler(url, expect_ok) {}
+
+  virtual void PrintToPDF(CefRefPtr<CefBrowser> browser) override {
+    CefPdfPrintSettings settings;
+    settings.paper_width = -1;
+    settings.paper_height = -1;
+    browser->GetHost()->PrintToPDF(test_path_, settings, this);
+  }
+
+ protected:
+  IMPLEMENT_REFCOUNTING(PrintToPdfInvalidPaperDimTestHandler);
+};
+
+class PrintToPdfInvalidScaleTestHandler : public PrintToPdfTestHandler {
+ public:
+  PrintToPdfInvalidScaleTestHandler(const std::string& url, bool expect_ok)
+      : PrintToPdfTestHandler(url, expect_ok) {}
+
+  virtual void PrintToPDF(CefRefPtr<CefBrowser> browser) override {
+    CefPdfPrintSettings settings;
+    settings.scale = 999999999;
+    browser->GetHost()->PrintToPDF(test_path_, settings, this);
+  }
+
+ protected:
+  IMPLEMENT_REFCOUNTING(PrintToPdfInvalidScaleTestHandler);
+};
+
+#if defined(OS_WIN)
+class PrintToPdfInvalidFileNameTestHandler : public PrintToPdfTestHandler {
+ public:
+  PrintToPdfInvalidFileNameTestHandler(const std::string& url, bool expect_ok)
+      : PrintToPdfTestHandler(url, expect_ok) {}
+
+  std::string GetTestFileName() override { return kTestFileNameInvalid; }
+
+ protected:
+  IMPLEMENT_REFCOUNTING(PrintToPdfInvalidFileNameTestHandler);
+};
+#endif  // defined(OS_WIN)
+
+}  // namespace
+
+TEST(PdfPrintTest, DefaultSettings) {
+  CefRefPtr<PrintToPdfTestHandler> handler =
+      new PrintToPdfTestHandler(kPrintHtmlUrl, true);
+  handler->ExecuteTest();
+  ReleaseAndWaitForDestructor(handler);
+}
+
+TEST(PdfPrintTest, InvalidMargin) {
+  // Should still pass as settings are validated
+  CefRefPtr<PrintToPdfInvalidMarginTestHandler> handler =
+      new PrintToPdfInvalidMarginTestHandler(kPrintHtmlUrl, true);
+  handler->ExecuteTest();
+  ReleaseAndWaitForDestructor(handler);
+}
+
+TEST(PdfPrintTest, InvalidPageDim) {
+  // Should still pass as settings are validated
+  CefRefPtr<PrintToPdfInvalidPaperDimTestHandler> handler =
+      new PrintToPdfInvalidPaperDimTestHandler(kPrintHtmlUrl, true);
+  handler->ExecuteTest();
+  ReleaseAndWaitForDestructor(handler);
+}
+
+TEST(PdfPrintTest, InvalidScale) {
+  CefRefPtr<PrintToPdfInvalidScaleTestHandler> handler =
+      new PrintToPdfInvalidScaleTestHandler(kPrintHtmlUrl, false);
+  handler->ExecuteTest();
+  ReleaseAndWaitForDestructor(handler);
+}
+
+#if defined(OS_WIN)
+TEST(PdfPrintTest, InvalidFileName) {
+  CefRefPtr<PrintToPdfInvalidFileNameTestHandler> handler =
+      new PrintToPdfInvalidFileNameTestHandler(kPrintHtmlUrl, false);
+  handler->ExecuteTest();
+  ReleaseAndWaitForDestructor(handler);
+}
+#endif  // defined(OS_WIN)

tools/distrib/bazel/BUILD.bazel

@@ -151,8 +151,6 @@ declare_cc_library(
                "@platforms//os:windows": [":cef"],
                "//conditions:default": None,
            }),
-    # Support <angled> includes.
-    includes = ["./"],
 )
 
 # Only available on MacOS/Windows.