From 7d8616b2b7339a9f5f316e7d9a80ac9c36cd7a86 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Wed, 24 Mar 2021 01:55:51 +0100
Subject: [PATCH 01/48] chore: cherry-pick e1505713dc31 from chromium (#28234)

---
 patches/chromium/.patches                     |   1 +
 ...s_use_the_document_s_url_as_referrer.patch | 447 ++++++++++++++++++
 2 files changed, 448 insertions(+)
 create mode 100644 patches/chromium/css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 83acfecbfe6ce..33275bdc72308 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -160,3 +160,4 @@ cherry-pick-b3dc4c4b349d.patch
 cherry-pick-c6d6f7aee733.patch
 cherry-pick-37210e5ab006.patch
 reland_reland_fsa_add_issafepathcomponent_checks_to.patch
+css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch
diff --git a/patches/chromium/css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch b/patches/chromium/css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch
new file mode 100644
index 0000000000000..0883a3c9c5561
--- /dev/null
+++ b/patches/chromium/css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch
@@ -0,0 +1,447 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: David Van Cleve <davidvc@chromium.org>
+Date: Thu, 4 Mar 2021 16:50:46 +0000
+Subject: css: Make fetches from inline CSS use the document's URL as referrer
+
+Right now, fetches from inline CSS use the inline CSS's base URL
+instead of the URL from the context that embeds the inline CSS: for
+instance, loading a source-site.com page with the following code
+  <base href="https://other-site.com">
+  <style type=text/css> @import('best-sheet.com') </style>
+should lead to the best-sheet.com sheet getting fetched with a
+source-site.com referrer, but it will currently provide an
+other-site.com referrer. However, if the imported sheet from
+best-sheet.com makes more nested fetches, those nested requests should
+use best-sheet.com as the basis for their referrers (as they do
+currently).
+
+This CL updates CSSParserContext's referrer setting logic to roughly do
+the following:
+- inline CSS: use the embedding document's URL as the referrer, or, for
+srcdoc iframes, walk up the frame tree until hitting a non-srcdoc frame
+- requests from fetched stylesheets: just as currently, use the fetched
+sheet's URL as the basis for constructing the referrer
+
+This seemed like it required refactoring CSSParserContext slightly
+because there are constructors that take both a Document and a base URL,
+and it's not obvious from the constructor signature whether the
+Document or the base URL should be the one that provides the referrer.
+To resolve this ambiguity, the refactor updates these CSSParserContext
+constructors to take caller-provided Referrer objects.
+
+(cherry picked from commit 0b1539fcb923056624d4adc84b88140d367d92da)
+
+Change-Id: If5a99d8057dff5e771e821d0e1f605566e28ff1d
+Fixed: 1158645, 1158010
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2592447
+Reviewed-by: Rune Lillesveen <futhark@chromium.org>
+Reviewed-by: Matt Falkenhagen <falken@chromium.org>
+Commit-Queue: David Van Cleve <davidvc@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#841509}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2731576
+Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
+Commit-Queue: Victor-Gabriel Savu <vsavu@google.com>
+Cr-Commit-Position: refs/branch-heads/4240@{#1558}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/third_party/blink/renderer/core/css/css_style_sheet.cc b/third_party/blink/renderer/core/css/css_style_sheet.cc
+index c168b0a244865e3c390989e3e5af275fdef2a4cd..10efc5bd894c16de745b7f4bb07268719f443e73 100644
+--- a/third_party/blink/renderer/core/css/css_style_sheet.cc
++++ b/third_party/blink/renderer/core/css/css_style_sheet.cc
+@@ -37,6 +37,7 @@
+ #include "third_party/blink/renderer/core/dom/document.h"
+ #include "third_party/blink/renderer/core/dom/node.h"
+ #include "third_party/blink/renderer/core/frame/deprecation.h"
++#include "third_party/blink/renderer/core/frame/local_dom_window.h"
+ #include "third_party/blink/renderer/core/html/html_link_element.h"
+ #include "third_party/blink/renderer/core/html/html_style_element.h"
+ #include "third_party/blink/renderer/core/html_names.h"
+@@ -138,9 +139,15 @@ CSSStyleSheet* CSSStyleSheet::CreateInline(Node& owner_node,
+                                            const KURL& base_url,
+                                            const TextPosition& start_position,
+                                            const WTF::TextEncoding& encoding) {
++  Document& owner_node_document = owner_node.GetDocument();
+   auto* parser_context = MakeGarbageCollected<CSSParserContext>(
+-      owner_node.GetDocument(), owner_node.GetDocument().BaseURL(),
+-      true /* origin_clean */, owner_node.GetDocument().GetReferrerPolicy(),
++      owner_node_document, owner_node_document.BaseURL(),
++      true /* origin_clean */,
++      Referrer(
++          owner_node_document.GetExecutionContext()
++              ? owner_node_document.GetExecutionContext()->OutgoingReferrer()
++              : String(),  // GetExecutionContext() only returns null in tests.
++          owner_node.GetDocument().GetReferrerPolicy()),
+       encoding);
+   if (AdTracker::IsAdScriptExecutingInDocument(&owner_node.GetDocument()))
+     parser_context->SetIsAdRelated();
+diff --git a/third_party/blink/renderer/core/css/parser/css_parser_context.cc b/third_party/blink/renderer/core/css/parser/css_parser_context.cc
+index 5c1292cf13b4265c3db36fd3c1a71a30b3c81c68..b636bd5388a871fd284a74b7926aeb5922e274e5 100644
+--- a/third_party/blink/renderer/core/css/parser/css_parser_context.cc
++++ b/third_party/blink/renderer/core/css/parser/css_parser_context.cc
+@@ -53,27 +53,25 @@ CSSParserContext::CSSParserContext(const CSSParserContext* other,
+   is_ad_related_ = other->is_ad_related_;
+ }
+ 
+-CSSParserContext::CSSParserContext(
+-    const CSSParserContext* other,
+-    const KURL& base_url,
+-    bool origin_clean,
+-    network::mojom::ReferrerPolicy referrer_policy,
+-    const WTF::TextEncoding& charset,
+-    const Document* use_counter_document)
+-    : CSSParserContext(
+-          base_url,
+-          origin_clean,
+-          charset,
+-          other->mode_,
+-          other->match_mode_,
+-          other->profile_,
+-          Referrer(base_url.StrippedForUseAsReferrer(), referrer_policy),
+-          other->is_html_document_,
+-          other->use_legacy_background_size_shorthand_behavior_,
+-          other->secure_context_mode_,
+-          other->should_check_content_security_policy_,
+-          use_counter_document,
+-          other->resource_fetch_restriction_) {
++CSSParserContext::CSSParserContext(const CSSParserContext* other,
++                                   const KURL& base_url,
++                                   bool origin_clean,
++                                   const Referrer& referrer,
++                                   const WTF::TextEncoding& charset,
++                                   const Document* use_counter_document)
++    : CSSParserContext(base_url,
++                       origin_clean,
++                       charset,
++                       other->mode_,
++                       other->match_mode_,
++                       other->profile_,
++                       referrer,
++                       other->is_html_document_,
++                       other->use_legacy_background_size_shorthand_behavior_,
++                       other->secure_context_mode_,
++                       other->should_check_content_security_policy_,
++                       use_counter_document,
++                       other->resource_fetch_restriction_) {
+   is_ad_related_ = other->is_ad_related_;
+ }
+ 
+@@ -96,18 +94,23 @@ CSSParserContext::CSSParserContext(CSSParserMode mode,
+                        ResourceFetchRestriction::kNone) {}
+ 
+ CSSParserContext::CSSParserContext(const Document& document)
+-    : CSSParserContext(document,
+-                       document.BaseURL(),
+-                       true /* origin_clean */,
+-                       document.GetReferrerPolicy(),
+-                       WTF::TextEncoding(),
+-                       kLiveProfile) {}
++    : CSSParserContext(
++          document,
++          document.BaseURL(),
++          true /* origin_clean */,
++          Referrer(document.GetExecutionContext()
++                       ? document.GetExecutionContext()->OutgoingReferrer()
++                       : String(),  // GetExecutionContext() only returns null
++                                    // in tests.
++                   document.GetReferrerPolicy()),
++          WTF::TextEncoding(),
++          kLiveProfile) {}
+ 
+ CSSParserContext::CSSParserContext(
+     const Document& document,
+     const KURL& base_url_override,
+     bool origin_clean,
+-    network::mojom::ReferrerPolicy referrer_policy_override,
++    const Referrer& referrer,
+     const WTF::TextEncoding& charset,
+     SelectorProfile profile,
+     enum ResourceFetchRestriction resource_fetch_restriction)
+@@ -122,8 +125,7 @@ CSSParserContext::CSSParserContext(
+                      : kHTMLStandardMode)
+               : document.InQuirksMode() ? kHTMLQuirksMode : kHTMLStandardMode,
+           profile,
+-          Referrer(base_url_override.StrippedForUseAsReferrer(),
+-                   referrer_policy_override),
++          referrer,
+           IsA<HTMLDocument>(document),
+           document.GetSettings()
+               ? document.GetSettings()
+diff --git a/third_party/blink/renderer/core/css/parser/css_parser_context.h b/third_party/blink/renderer/core/css/parser/css_parser_context.h
+index 33b458f21910bcbfdb6956b02cd2ef56bb39778b..8d7ec9e6b7a14fffaaf72dcd0d2c0d0f062dbbfa 100644
+--- a/third_party/blink/renderer/core/css/parser/css_parser_context.h
++++ b/third_party/blink/renderer/core/css/parser/css_parser_context.h
+@@ -40,10 +40,15 @@ class CORE_EXPORT CSSParserContext final
+   explicit CSSParserContext(const CSSParserContext* other,
+                             const Document* use_counter_document = nullptr);
+ 
++  // Creates a context with most of its constructor attributes provided by
++  // copying from |other|, except that the remaining constructor arguments take
++  // precedence over the corresponding characteristics of |other|. This is
++  // useful for initializing @imported sheets' contexts, which inherit most of
++  // their characteristics from their parents.
+   CSSParserContext(const CSSParserContext* other,
+                    const KURL& base_url_override,
+                    bool origin_clean,
+-                   network::mojom::ReferrerPolicy referrer_policy_override,
++                   const Referrer& referrer,
+                    const WTF::TextEncoding& charset_override,
+                    const Document* use_counter_document);
+   CSSParserContext(CSSParserMode,
+@@ -54,7 +59,7 @@ class CORE_EXPORT CSSParserContext final
+   CSSParserContext(const Document&,
+                    const KURL& base_url_override,
+                    bool origin_clean,
+-                   network::mojom::ReferrerPolicy referrer_policy_override,
++                   const Referrer& referrer,
+                    const WTF::TextEncoding& charset = WTF::TextEncoding(),
+                    SelectorProfile = kLiveProfile,
+                    ResourceFetchRestriction resource_fetch_restriction =
+@@ -69,7 +74,7 @@ class CORE_EXPORT CSSParserContext final
+                    CSSParserMode,
+                    CSSParserMode match_mode,
+                    SelectorProfile,
+-                   const Referrer&,
++                   const Referrer& referrer,
+                    bool is_html_document,
+                    bool use_legacy_background_size_shorthand_behavior,
+                    SecureContextMode,
+diff --git a/third_party/blink/renderer/core/css/selector_query.cc b/third_party/blink/renderer/core/css/selector_query.cc
+index 722b751f19207b070664d79c5a9cc758f1c044f4..35d9d926f2e1ac0c2d032817b87c1079af9408ec 100644
+--- a/third_party/blink/renderer/core/css/selector_query.cc
++++ b/third_party/blink/renderer/core/css/selector_query.cc
+@@ -535,9 +535,8 @@ SelectorQuery* SelectorQueryCache::Add(const AtomicString& selectors,
+ 
+   CSSSelectorList selector_list = CSSParser::ParseSelector(
+       MakeGarbageCollected<CSSParserContext>(
+-          document, document.BaseURL(), true /* origin_clean */,
+-          document.GetReferrerPolicy(), WTF::TextEncoding(),
+-          CSSParserContext::kSnapshotProfile),
++          document, document.BaseURL(), true /* origin_clean */, Referrer(),
++          WTF::TextEncoding(), CSSParserContext::kSnapshotProfile),
+       nullptr, selectors);
+ 
+   if (!selector_list.First()) {
+diff --git a/third_party/blink/renderer/core/css/selector_query_test.cc b/third_party/blink/renderer/core/css/selector_query_test.cc
+index 8d701d91372e5c2fb4b1a30f190f629f95e1b0b2..bf14850baf8dd2e92f74b89b78963a367440a704 100644
+--- a/third_party/blink/renderer/core/css/selector_query_test.cc
++++ b/third_party/blink/renderer/core/css/selector_query_test.cc
+@@ -72,9 +72,8 @@ TEST(SelectorQueryTest, NotMatchingPseudoElement) {
+ 
+   CSSSelectorList selector_list = CSSParser::ParseSelector(
+       MakeGarbageCollected<CSSParserContext>(
+-          *document, NullURL(), true /* origin_clean */,
+-          network::mojom::ReferrerPolicy::kDefault, WTF::TextEncoding(),
+-          CSSParserContext::kSnapshotProfile),
++          *document, NullURL(), true /* origin_clean */, Referrer(),
++          WTF::TextEncoding(), CSSParserContext::kSnapshotProfile),
+       nullptr, "span::before");
+   std::unique_ptr<SelectorQuery> query =
+       SelectorQuery::Adopt(std::move(selector_list));
+@@ -83,9 +82,8 @@ TEST(SelectorQueryTest, NotMatchingPseudoElement) {
+ 
+   selector_list = CSSParser::ParseSelector(
+       MakeGarbageCollected<CSSParserContext>(
+-          *document, NullURL(), true /* origin_clean */,
+-          network::mojom::ReferrerPolicy::kDefault, WTF::TextEncoding(),
+-          CSSParserContext::kSnapshotProfile),
++          *document, NullURL(), true /* origin_clean */, Referrer(),
++          WTF::TextEncoding(), CSSParserContext::kSnapshotProfile),
+       nullptr, "span");
+   query = SelectorQuery::Adopt(std::move(selector_list));
+   elm = query->QueryFirst(*document);
+@@ -103,9 +101,8 @@ TEST(SelectorQueryTest, LastOfTypeNotFinishedParsing) {
+ 
+   CSSSelectorList selector_list = CSSParser::ParseSelector(
+       MakeGarbageCollected<CSSParserContext>(
+-          *document, NullURL(), true /* origin_clean */,
+-          network::mojom::ReferrerPolicy::kDefault, WTF::TextEncoding(),
+-          CSSParserContext::kSnapshotProfile),
++          *document, NullURL(), true /* origin_clean */, Referrer(),
++          WTF::TextEncoding(), CSSParserContext::kSnapshotProfile),
+       nullptr, "p:last-of-type");
+   std::unique_ptr<SelectorQuery> query =
+       SelectorQuery::Adopt(std::move(selector_list));
+diff --git a/third_party/blink/renderer/core/css/style_rule_import.cc b/third_party/blink/renderer/core/css/style_rule_import.cc
+index 447d130a9c29a698c81c0436b318058172b3a7ef..857fb15c74063613d467c29829eda0a8ea18b9bb 100644
+--- a/third_party/blink/renderer/core/css/style_rule_import.cc
++++ b/third_party/blink/renderer/core/css/style_rule_import.cc
+@@ -83,8 +83,9 @@ void StyleRuleImport::NotifyFinished(Resource* resource) {
+   CSSParserContext* context = MakeGarbageCollected<CSSParserContext>(
+       parent_context, cached_style_sheet->GetResponse().ResponseUrl(),
+       cached_style_sheet->GetResponse().IsCorsSameOrigin(),
+-      cached_style_sheet->GetReferrerPolicy(), cached_style_sheet->Encoding(),
+-      document);
++      Referrer(cached_style_sheet->GetResponse().ResponseUrl(),
++               cached_style_sheet->GetReferrerPolicy()),
++      cached_style_sheet->Encoding(), document);
+   if (cached_style_sheet->GetResourceRequest().IsAdResource())
+     context->SetIsAdRelated();
+ 
+diff --git a/third_party/blink/renderer/core/dom/processing_instruction.cc b/third_party/blink/renderer/core/dom/processing_instruction.cc
+index 739226d95f964ebf4ae35983c6e1cd5faa01b324..1a1ead65c7642350f7d13364046f665c021bc3b0 100644
+--- a/third_party/blink/renderer/core/dom/processing_instruction.cc
++++ b/third_party/blink/renderer/core/dom/processing_instruction.cc
+@@ -206,7 +206,9 @@ void ProcessingInstruction::NotifyFinished(Resource* resource) {
+     auto* parser_context = MakeGarbageCollected<CSSParserContext>(
+         GetDocument(), style_resource->GetResponse().ResponseUrl(),
+         style_resource->GetResponse().IsCorsSameOrigin(),
+-        style_resource->GetReferrerPolicy(), style_resource->Encoding());
++        Referrer(style_resource->GetResponse().ResponseUrl(),
++                 style_resource->GetReferrerPolicy()),
++        style_resource->Encoding());
+     if (style_resource->GetResourceRequest().IsAdResource())
+       parser_context->SetIsAdRelated();
+ 
+diff --git a/third_party/blink/renderer/core/html/link_style.cc b/third_party/blink/renderer/core/html/link_style.cc
+index 5036ac1f0cb9613772c704a6dc5c5e2496ab5567..5e3b7e361ae1ebe2ff89f10448eac4fe33352031 100644
+--- a/third_party/blink/renderer/core/html/link_style.cc
++++ b/third_party/blink/renderer/core/html/link_style.cc
+@@ -88,7 +88,9 @@ void LinkStyle::NotifyFinished(Resource* resource) {
+   auto* parser_context = MakeGarbageCollected<CSSParserContext>(
+       GetDocument(), cached_style_sheet->GetResponse().ResponseUrl(),
+       cached_style_sheet->GetResponse().IsCorsSameOrigin(),
+-      cached_style_sheet->GetReferrerPolicy(), cached_style_sheet->Encoding());
++      Referrer(cached_style_sheet->GetResponse().ResponseUrl(),
++               cached_style_sheet->GetReferrerPolicy()),
++      cached_style_sheet->Encoding());
+   if (cached_style_sheet->GetResourceRequest().IsAdResource()) {
+     parser_context->SetIsAdRelated();
+   }
+diff --git a/third_party/blink/renderer/core/html/track/vtt/vtt_parser.cc b/third_party/blink/renderer/core/html/track/vtt/vtt_parser.cc
+index 0b6e9b6b8b66029f46ca79f24a2519f13e611005..e492003c470af4c7b96551f6dfee79d26f8b7c77 100644
+--- a/third_party/blink/renderer/core/html/track/vtt/vtt_parser.cc
++++ b/third_party/blink/renderer/core/html/track/vtt/vtt_parser.cc
+@@ -244,9 +244,8 @@ VTTParser::ParseState VTTParser::CollectRegionSettings(const String& line) {
+ VTTParser::ParseState VTTParser::CollectStyleSheet(const String& line) {
+   if (line.IsEmpty() || line.Contains("-->")) {
+     auto* parser_context = MakeGarbageCollected<CSSParserContext>(
+-        *document_, NullURL(), true /* origin_clean */,
+-        document_->GetReferrerPolicy(), UTF8Encoding(),
+-        CSSParserContext::kLiveProfile,
++        *document_, NullURL(), true /* origin_clean */, Referrer(),
++        UTF8Encoding(), CSSParserContext::kLiveProfile,
+         ResourceFetchRestriction::kOnlyDataUrls);
+     auto* style_sheet_contents =
+         MakeGarbageCollected<StyleSheetContents>(parser_context);
+diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
+index acf5033054cecc1099068e2452cfbef8f1ffbd95..0e9ac683c48befe5f3e740e0632bf93e7569c686 100644
+--- a/third_party/blink/web_tests/TestExpectations
++++ b/third_party/blink/web_tests/TestExpectations
+@@ -3245,6 +3245,7 @@ virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-restartIce-onneg
+ # See also crbug.com/920100 (sheriff 2019-01-09).
+ crbug.com/626703 external/wpt/referrer-policy/css-integration/svg/external-stylesheet.html [ Timeout Failure ]
+ crbug.com/626703 external/wpt/referrer-policy/css-integration/svg/inline-style.html [ Timeout Failure ]
++crbug.com/626703 external/wpt/referrer-policy/css-integration/svg/inline-style-with-differentorigin-base-tag.tentative.html [ Timeout Failure ]
+ crbug.com/626703 external/wpt/referrer-policy/css-integration/svg/internal-stylesheet.html [ Timeout Failure ]
+ crbug.com/626703 external/wpt/referrer-policy/css-integration/svg/presentation-attribute.html [ Timeout Failure ]
+ crbug.com/626703 external/wpt/referrer-policy/css-integration/svg/processing-instruction.html [ Timeout Failure ]
+diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/css-integration/image/inline-style-with-differentorigin-base-tag.tentative.html b/third_party/blink/web_tests/external/wpt/referrer-policy/css-integration/image/inline-style-with-differentorigin-base-tag.tentative.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..091afd832ab35a76136b4242df1c1ec73aee109d
+--- /dev/null
++++ b/third_party/blink/web_tests/external/wpt/referrer-policy/css-integration/image/inline-style-with-differentorigin-base-tag.tentative.html
+@@ -0,0 +1,45 @@
++<!DOCTYPE html>
++<title>CSS integration - image from inline style from document with base tag</title>
++<link rel="help" href="https://crbug.com/1158645" />
++
++<head>
++  <meta name="referrer" content="origin">
++</head>
++
++<script src="/resources/testharness.js"></script>
++<script src="/resources/testharnessreport.js"></script>
++<script src="/common/utils.js"></script>
++<!-- Common global functions for referrer-policy tests. -->
++<script src="/common/security-features/resources/common.sub.js"></script>
++
++<!-- This has to follow the <script> tags, or it will make the js files fail to load. -->
++<base href="http://other-site.example" />
++
++<p>Check that resources from inline styles are loaded with
++  the referrer and referrer policy from the document and, in
++  particular, not with the different base URL set in the base tag.</p>
++
++<div class="styled"></div>
++
++<script>
++  'use strict';
++  promise_test(function(css_test) {
++    var id = token();
++    var css_url = location.protocol + "//www1." + location.hostname + ":" + location.port + "/common/security-features/subresource/image.py" + "?id=" + id;
++    var img_url = css_url + "&report-headers";
++
++    var div = document.querySelector("div.styled");
++    div.style = "content:url(" + css_url + ")";
++    return timeoutPromise(css_test, 1000)
++      .then(() => requestViaXhr(img_url))
++      .then(function(message) {
++        assert_own_property(message, "headers");
++        assert_own_property(message, "referrer");
++        assert_equals(message.referrer, location.origin + "/");
++      });
++  }, "Image from inline styles.");
++</script>
++
++<div id="log"></div>
++
++</html>
+diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/css-integration/svg/inline-style-with-differentorigin-base-tag.tentative.html b/third_party/blink/web_tests/external/wpt/referrer-policy/css-integration/svg/inline-style-with-differentorigin-base-tag.tentative.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..9a8bc6da418bc7302138daba8cf06cb449bd2dfe
+--- /dev/null
++++ b/third_party/blink/web_tests/external/wpt/referrer-policy/css-integration/svg/inline-style-with-differentorigin-base-tag.tentative.html
+@@ -0,0 +1,40 @@
++<!DOCTYPE html>
++<html>
++
++<head>
++  <title>CSS integration - styling SVG from inline style on page with different-origin base tag</title>
++  <script src="/resources/testharness.js"></script>
++  <script src="/resources/testharnessreport.js"></script>
++  <script src="/common/utils.js"></script>
++  <!-- Common global functions for referrer-policy tests. -->
++  <script src="/common/security-features/resources/common.sub.js"></script>
++  <!-- Helper functions for referrer-policy css tests. -->
++  <script src="/referrer-policy/css-integration/css-test-helper.js"></script>
++  <meta name="referrer" content="origin">
++</head>
++
++<base href="http://other-page.example/" />
++
++<body>
++  <p>Check that resources from inline styles are loaded with
++    the referrer and referrer policy from the document and, in
++    particular, not from the document's overridden base URL.</p>
++  <script>
++    function setInlineStyle(test) {
++      test.expected = location.origin + "/";
++      let svg = createSvg();
++      document.body.appendChild(svg);
++      let element = svg.getElementsByTagName('path')[0];
++      element.style = test.property + ": url(" + url_prefix + "svg.py?id=" +
++        test.id + "#invalidFragment);";
++    }
++
++    runSvgTests(svg_test_properties,
++      "Styling SVG from inline styles",
++      setInlineStyle);
++  </script>
++
++  <div id="log"></div>
++</body>
++
++</html>
+diff --git a/third_party/blink/web_tests/http/tests/css/resources/referrer-check.php b/third_party/blink/web_tests/http/tests/css/resources/referrer-check.php
+index 69483e01544c842f56a51d00d1b2ee5dc24b4162..7a517de692f418c3c8b365d0f7aefb9e585c9da0 100644
+--- a/third_party/blink/web_tests/http/tests/css/resources/referrer-check.php
++++ b/third_party/blink/web_tests/http/tests/css/resources/referrer-check.php
+@@ -31,7 +31,7 @@ $expectedReferrerPaths = array(
+     "document" => "/css/css-resources-referrer.html",
+     "sheet" => "/css/resources/css-resources-referrer.css",
+     "importedSheet" => "/css/resources/css-resources-referrer-import.css",
+-    "iframe" => "/from/iframe.html"
++    "iframe" => "/css/css-resources-referrer-srcdoc.html"
+ );
+ 
+ $from = $_GET["from"];

From b44be5775254849576230679e8b9973a9c86ac03 Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Thu, 25 Mar 2021 12:15:45 -0700
Subject: [PATCH 02/48] fix: disappearing thumbar after win.hide() (#28388)

* fix: disappearing thumbar after win.hide()

* Add descriptive comment

Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
---
 shell/browser/native_window_views.cc | 8 ++++++++
 shell/browser/ui/win/taskbar_host.cc | 5 +++--
 shell/browser/ui/win/taskbar_host.h  | 2 ++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/shell/browser/native_window_views.cc b/shell/browser/native_window_views.cc
index 2770db5d08ee3..710887f3bca49 100644
--- a/shell/browser/native_window_views.cc
+++ b/shell/browser/native_window_views.cc
@@ -421,6 +421,14 @@ void NativeWindowViews::Hide() {
   if (global_menu_bar_)
     global_menu_bar_->OnWindowUnmapped();
 #endif
+
+#if defined(OS_WIN)
+  // When the window is removed from the taskbar via win.hide(),
+  // the thumbnail buttons need to be set up again.
+  // Ensure that when the window is hidden,
+  // the taskbar host is notified that it should re-add them.
+  taskbar_host_.SetThumbarButtonsAdded(false);
+#endif
 }
 
 bool NativeWindowViews::IsVisible() {
diff --git a/shell/browser/ui/win/taskbar_host.cc b/shell/browser/ui/win/taskbar_host.cc
index 717937b5855df..56fdc8668ca7b 100644
--- a/shell/browser/ui/win/taskbar_host.cc
+++ b/shell/browser/ui/win/taskbar_host.cc
@@ -114,11 +114,12 @@ bool TaskbarHost::SetThumbarButtons(HWND window,
 
   // Finally add them to taskbar.
   HRESULT r;
-  if (thumbar_buttons_added_)
+  if (thumbar_buttons_added_) {
     r = taskbar_->ThumbBarUpdateButtons(window, kMaxButtonsCount,
                                         thumb_buttons);
-  else
+  } else {
     r = taskbar_->ThumbBarAddButtons(window, kMaxButtonsCount, thumb_buttons);
+  }
 
   thumbar_buttons_added_ = true;
   last_buttons_ = buttons;
diff --git a/shell/browser/ui/win/taskbar_host.h b/shell/browser/ui/win/taskbar_host.h
index 886633ff2789e..f97070618944c 100644
--- a/shell/browser/ui/win/taskbar_host.h
+++ b/shell/browser/ui/win/taskbar_host.h
@@ -60,6 +60,8 @@ class TaskbarHost {
   // Called by the window that there is a button in thumbar clicked.
   bool HandleThumbarButtonEvent(int button_id);
 
+  void SetThumbarButtonsAdded(bool added) { thumbar_buttons_added_ = added; }
+
  private:
   // Initialize the taskbar object.
   bool InitializeTaskbar();

From ce1242981456b3a3498edfb3bf8e392453062df5 Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Wed, 7 Apr 2021 09:47:42 +0900
Subject: [PATCH 03/48] ci: Add goma fallback flag (#28547)

* ci: fallback to local compile if goma auth fails

* use correct flag

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
---
 .circleci/config.yml | 1 +
 appveyor.yml         | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 6ce9a15d0cb83..48df451e63527 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -303,6 +303,7 @@ step-setup-goma-for-build: &step-setup-goma-for-build
       third_party/goma/goma_ctl.py ensure_start
       echo 'export GN_GOMA_FILE='`node -e "console.log(require('./src/utils/goma.js').gnFilePath)"` >> $BASH_ENV
       echo 'export LOCAL_GOMA_DIR='`node -e "console.log(require('./src/utils/goma.js').dir)"` >> $BASH_ENV
+      echo 'export GOMA_FALLBACK_ON_AUTH_FAILURE=true' >> $BASH_ENV
       cd ..
 
 step-restore-brew-cache: &step-restore-brew-cache
diff --git a/appveyor.yml b/appveyor.yml
index 9945b1faf5f81..20f07607e825d 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -36,6 +36,7 @@ environment:
   ELECTRON_ENABLE_STACK_DUMPING: 1
   MOCHA_REPORTER: mocha-multi-reporters
   MOCHA_MULTI_REPORTERS: mocha-appveyor-reporter, tap
+  GOMA_FALLBACK_ON_AUTH_FAILURE: true
 notifications:
   - provider: Webhook
     url: https://electron-mission-control.herokuapp.com/rest/appveyor-hook

From 18d60df17363830eee8938382f0e837117e8fc2f Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Mon, 12 Apr 2021 00:14:36 -0700
Subject: [PATCH 04/48] docs: systemPreferences.subscribeWorkspaceNotification
 return type (#28611)

Co-authored-by: Samuel Maddock <samuel.maddock@gmail.com>
---
 docs/api/system-preferences.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/api/system-preferences.md b/docs/api/system-preferences.md
index a9c5ed5c5b4cd..704c72ea4c594 100644
--- a/docs/api/system-preferences.md
+++ b/docs/api/system-preferences.md
@@ -132,6 +132,8 @@ This is necessary for events such as `NSUserDefaultsDidChangeNotification`.
   * `userInfo` Record<String, unknown>
   * `object` String
 
+Returns `Number` - The ID of this subscription
+
 Same as `subscribeNotification`, but uses `NSWorkspace.sharedWorkspace.notificationCenter`.
 This is necessary for events such as `NSWorkspaceDidActivateApplicationNotification`.
 

From 602f65ab5dab248f178f347f62fbb73b9be1f4bd Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Tue, 13 Apr 2021 13:29:37 -0700
Subject: [PATCH 05/48] chore: cherry-pick 02f84c745fc0 from v8 (#28640)

* chore: cherry-pick 02f84c745fc0 from v8

* update patches
---
 patches/v8/.patches                       |  1 +
 patches/v8/cherry-pick-02f84c745fc0.patch | 89 +++++++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 patches/v8/cherry-pick-02f84c745fc0.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index 9ea034424d9a4..2ed7487d57628 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -25,3 +25,4 @@ cherry-pick-36abafa0a316.patch
 merged_interpreter_store_accumulator_to_callee_after_optional.patch
 reland_regexp_hard-crash_on_invalid_offsets_in.patch
 regexp_throw_when_length_of_text_nodes_in_alternatives_is_too.patch
+cherry-pick-02f84c745fc0.patch
diff --git a/patches/v8/cherry-pick-02f84c745fc0.patch b/patches/v8/cherry-pick-02f84c745fc0.patch
new file mode 100644
index 0000000000000..d6ac1746a93c3
--- /dev/null
+++ b/patches/v8/cherry-pick-02f84c745fc0.patch
@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Mon, 12 Apr 2021 09:42:03 +0200
+Subject: Fix bug in InstructionSelector::ChangeInt32ToInt64
+
+Bug: chromium:1196683
+Change-Id: Ib4ea738b47b64edc81450583be4c80a41698c3d1
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820971
+Commit-Queue: Georg Neis <neis@chromium.org>
+Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#73903}
+
+diff --git a/src/compiler/backend/x64/instruction-selector-x64.cc b/src/compiler/backend/x64/instruction-selector-x64.cc
+index ab669864954fb5335b0e98881351a43134f870a4..82d8cbd6f7ec5309461d03fb1769382d0bf19877 100644
+--- a/src/compiler/backend/x64/instruction-selector-x64.cc
++++ b/src/compiler/backend/x64/instruction-selector-x64.cc
+@@ -1270,7 +1270,9 @@ void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
+         opcode = load_rep.IsSigned() ? kX64Movsxwq : kX64Movzxwq;
+         break;
+       case MachineRepresentation::kWord32:
+-        opcode = load_rep.IsSigned() ? kX64Movsxlq : kX64Movl;
++        // ChangeInt32ToInt64 must interpret its input as a _signed_ 32-bit
++        // integer, so here we must sign-extend the loaded value in any case.
++        opcode = kX64Movsxlq;
+         break;
+       default:
+         UNREACHABLE();
+diff --git a/test/mjsunit/compiler/regress-1196683.js b/test/mjsunit/compiler/regress-1196683.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..abd7d6b2f8da45991e1e3b6c72582bc716d63efb
+--- /dev/null
++++ b/test/mjsunit/compiler/regress-1196683.js
+@@ -0,0 +1,56 @@
++// Copyright 2021 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --allow-natives-syntax
++
++
++(function() {
++  const arr = new Uint32Array([2**31]);
++  function foo() {
++    return (arr[0] ^ 0) + 1;
++  }
++  %PrepareFunctionForOptimization(foo);
++  assertEquals(-(2**31) + 1, foo());
++  %OptimizeFunctionOnNextCall(foo);
++  assertEquals(-(2**31) + 1, foo());
++});
++
++
++// The remaining tests already passed without the bugfix.
++
++
++(function() {
++  const arr = new Uint16Array([2**15]);
++  function foo() {
++    return (arr[0] ^ 0) + 1;
++  }
++  %PrepareFunctionForOptimization(foo);
++  assertEquals(2**15 + 1, foo());
++  %OptimizeFunctionOnNextCall(foo);
++  assertEquals(2**15 + 1, foo());
++})();
++
++
++(function() {
++  const arr = new Uint8Array([2**7]);
++  function foo() {
++    return (arr[0] ^ 0) + 1;
++  }
++  %PrepareFunctionForOptimization(foo);
++  assertEquals(2**7 + 1, foo());
++  %OptimizeFunctionOnNextCall(foo);
++  assertEquals(2**7 + 1, foo());
++})();
++
++
++(function() {
++  const arr = new Int32Array([-(2**31)]);
++  function foo() {
++    return (arr[0] >>> 0) + 1;
++  }
++  %PrepareFunctionForOptimization(foo);
++  assertEquals(2**31 + 1, foo());
++  %OptimizeFunctionOnNextCall(foo);
++  assertEquals(2**31 + 1, foo());
++})();

From 792d1892417f5fd8ec7dee0fcbabad965ed8c9ce Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Tue, 13 Apr 2021 13:36:46 -0700
Subject: [PATCH 06/48] Bump v10.4.3

---
 ELECTRON_VERSION                        | 2 +-
 package.json                            | 2 +-
 shell/browser/resources/win/electron.rc | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ELECTRON_VERSION b/ELECTRON_VERSION
index d3a69816afe67..32002b998f80d 100644
--- a/ELECTRON_VERSION
+++ b/ELECTRON_VERSION
@@ -1 +1 @@
-10.4.2
\ No newline at end of file
+10.4.3
\ No newline at end of file
diff --git a/package.json b/package.json
index bb61168bf2396..69658f1f0692e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "10.4.2",
+  "version": "10.4.3",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
diff --git a/shell/browser/resources/win/electron.rc b/shell/browser/resources/win/electron.rc
index 043e314d7cebb..30db59c83a714 100644
--- a/shell/browser/resources/win/electron.rc
+++ b/shell/browser/resources/win/electron.rc
@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 10,4,2,0
- PRODUCTVERSION 10,4,2,0
+ FILEVERSION 10,4,3,0
+ PRODUCTVERSION 10,4,3,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "10.4.2"
+            VALUE "FileVersion", "10.4.3"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "10.4.2"
+            VALUE "ProductVersion", "10.4.3"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

From 7c72a36b15f7b41a98eedfa2a4c163f4bf17794c Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Mon, 19 Apr 2021 15:52:15 +0200
Subject: [PATCH 07/48] chore: cherry-pick 3c80bb2a594f from chromium (#28690)

* chore: cherry-pick 3c80bb2a594f from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-3c80bb2a594f.patch   | 46 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-3c80bb2a594f.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 33275bdc72308..4ac900f0d0b70 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -161,3 +161,4 @@ cherry-pick-c6d6f7aee733.patch
 cherry-pick-37210e5ab006.patch
 reland_reland_fsa_add_issafepathcomponent_checks_to.patch
 css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch
+cherry-pick-3c80bb2a594f.patch
diff --git a/patches/chromium/cherry-pick-3c80bb2a594f.patch b/patches/chromium/cherry-pick-3c80bb2a594f.patch
new file mode 100644
index 0000000000000..e8f0e9fcd93dc
--- /dev/null
+++ b/patches/chromium/cherry-pick-3c80bb2a594f.patch
@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jana Grill <janagrill@google.com>
+Date: Wed, 14 Apr 2021 08:40:10 +0000
+Subject: Forbid script execution while updating the paint lifecycle.
+
+(cherry picked from commit 5425d3b100fab533ea9ddc2ed8fbfc4870db0587)
+
+Bug: 1196781
+Change-Id: Idc8d24792d5c413691977b09ca821de4e13887ad
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2812000
+Commit-Queue: Adrian Taylor <adetaylor@chromium.org>
+Commit-Queue: Robert Flack <flackr@chromium.org>
+Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#870275}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821879
+Reviewed-by: Robert Flack <flackr@chromium.org>
+Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Commit-Queue: Jana Grill <janagrill@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1601}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/third_party/blink/renderer/core/frame/local_frame_view.cc b/third_party/blink/renderer/core/frame/local_frame_view.cc
+index 9a4c7a5249424b021759bf7895dd3f343b9641e6..37054d34157e7f4b4d65b022cdb83c832deb26a8 100644
+--- a/third_party/blink/renderer/core/frame/local_frame_view.cc
++++ b/third_party/blink/renderer/core/frame/local_frame_view.cc
+@@ -2648,11 +2648,14 @@ void LocalFrameView::RunPaintLifecyclePhase() {
+         for (PaintLayerScrollableArea* area : *animating_scrollable_areas)
+           area->UpdateCompositorScrollAnimations();
+       }
+-      frame_view.GetLayoutView()
+-          ->GetDocument()
+-          .GetDocumentAnimations()
+-          .UpdateAnimations(DocumentLifecycle::kPaintClean,
+-                            paint_artifact_compositor_.get());
++      {
++        ScriptForbiddenScope forbid_script;
++        frame_view.GetLayoutView()
++            ->GetDocument()
++            .GetDocumentAnimations()
++            .UpdateAnimations(DocumentLifecycle::kPaintClean,
++                              paint_artifact_compositor_.get());
++      }
+     });
+ 
+     // Initialize animation properties in the newly created paint property

From bb913bc17b88032659d4649fa75075cc7da451dd Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Mon, 19 Apr 2021 15:54:40 +0200
Subject: [PATCH 08/48] chore: cherry-pick 254c7945ee from v8 (#28698)

---
 patches/v8/.patches                           |   1 +
 ..._fix_bug_in_optimizedframe_summarize.patch | 209 ++++++++++++++++++
 2 files changed, 210 insertions(+)
 create mode 100644 patches/v8/merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index 2ed7487d57628..f36b2e4f9d937 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -26,3 +26,4 @@ merged_interpreter_store_accumulator_to_callee_after_optional.patch
 reland_regexp_hard-crash_on_invalid_offsets_in.patch
 regexp_throw_when_length_of_text_nodes_in_alternatives_is_too.patch
 cherry-pick-02f84c745fc0.patch
+merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch
diff --git a/patches/v8/merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch b/patches/v8/merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch
new file mode 100644
index 0000000000000..1bed8ccc93d16
--- /dev/null
+++ b/patches/v8/merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch
@@ -0,0 +1,209 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Tue, 23 Mar 2021 17:37:21 +0100
+Subject: Merged: [deoptimizer] Fix bug in OptimizedFrame::Summarize
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Revision: 3353a7d0b017146d543434be4036a81aaf7d25ae
+
+BUG=chromium:1182647
+NOTRY=true
+NOPRESUBMIT=true
+NOTREECHECKS=true
+R=​bmeurer@chromium.org
+
+(cherry picked from commit c0c96b768a7d3463b11403874549e6496529740d)
+
+Change-Id: I86abd6a3f34169be5f99aa9f54bb7bb3706fa85a
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2780300
+Reviewed-by: Georg Neis <neis@chromium.org>
+Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
+Commit-Queue: Georg Neis <neis@chromium.org>
+Cr-Original-Commit-Position: refs/branch-heads/8.9@{#49}
+Cr-Original-Branched-From: 16b9bbbd581c25391981aa03180b76aa60463a3e-refs/heads/8.9.255@{#1}
+Cr-Original-Branched-From: d16a2a688498bd1c3e6a49edb25d8c4ca56232dc-refs/heads/master@{#72039}
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794427
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Commit-Queue: Artem Sumaneev <asumaneev@google.com>
+Cr-Commit-Position: refs/branch-heads/8.6@{#72}
+Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
+Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
+
+diff --git a/src/deoptimizer/deoptimizer.cc b/src/deoptimizer/deoptimizer.cc
+index 804b77c065723de1d27ace6bbbe5456ef42fbad0..b89975ce2edd1a16fd65d6e5cbc0c9d098691691 100644
+--- a/src/deoptimizer/deoptimizer.cc
++++ b/src/deoptimizer/deoptimizer.cc
+@@ -3277,7 +3277,8 @@ Address TranslatedState::DecompressIfNeeded(intptr_t value) {
+   }
+ }
+ 
+-TranslatedState::TranslatedState(const JavaScriptFrame* frame) {
++TranslatedState::TranslatedState(const JavaScriptFrame* frame)
++    : purpose_(kFrameInspection) {
+   int deopt_index = Safepoint::kNoDeoptimizationIndex;
+   DeoptimizationData data =
+       static_cast<const OptimizedFrame*>(frame)->GetDeoptimizationData(
+@@ -3666,25 +3667,63 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
+     }
+ 
+     default:
+-      CHECK(map->IsJSObjectMap());
+       EnsureJSObjectAllocated(slot, map);
+-      TranslatedValue* properties_slot = &(frame->values_[value_index]);
+-      value_index++;
++      int remaining_children_count = slot->GetChildrenCount() - 1;
++
++      TranslatedValue* properties_slot = frame->ValueAt(value_index);
++      value_index++, remaining_children_count--;
+       if (properties_slot->kind() == TranslatedValue::kCapturedObject) {
+-        // If we are materializing the property array, make sure we put
+-        // the mutable heap numbers at the right places.
++        // We are materializing the property array, so make sure we put the
++        // mutable heap numbers at the right places.
+         EnsurePropertiesAllocatedAndMarked(properties_slot, map);
+         EnsureChildrenAllocated(properties_slot->GetChildrenCount(), frame,
+                                 &value_index, worklist);
++      } else {
++        CHECK_EQ(properties_slot->kind(), TranslatedValue::kTagged);
+       }
+-      // Make sure all the remaining children (after the map and properties) are
+-      // allocated.
+-      return EnsureChildrenAllocated(slot->GetChildrenCount() - 2, frame,
++
++      TranslatedValue* elements_slot = frame->ValueAt(value_index);
++      value_index++, remaining_children_count--;
++      if (elements_slot->kind() == TranslatedValue::kCapturedObject ||
++          !map->IsJSArrayMap()) {
++        // Handle this case with the other remaining children below.
++        value_index--, remaining_children_count++;
++      } else {
++        CHECK_EQ(elements_slot->kind(), TranslatedValue::kTagged);
++        elements_slot->GetValue();
++        if (purpose_ == kFrameInspection) {
++          // We are materializing a JSArray for the purpose of frame inspection.
++          // If we were to construct it with the above elements value then an
++          // actual deopt later on might create another JSArray instance with
++          // the same elements store. That would violate the key assumption
++          // behind left-trimming.
++          elements_slot->ReplaceElementsArrayWithCopy();
++        }
++      }
++
++      // Make sure all the remaining children (after the map, properties store,
++      // and possibly elements store) are allocated.
++      return EnsureChildrenAllocated(remaining_children_count, frame,
+                                      &value_index, worklist);
+   }
+   UNREACHABLE();
+ }
+ 
++void TranslatedValue::ReplaceElementsArrayWithCopy() {
++  DCHECK_EQ(kind(), TranslatedValue::kTagged);
++  DCHECK_EQ(materialization_state(), TranslatedValue::kFinished);
++  auto elements = Handle<FixedArrayBase>::cast(GetValue());
++  DCHECK(elements->IsFixedArray() || elements->IsFixedDoubleArray());
++  if (elements->IsFixedDoubleArray()) {
++    DCHECK(!elements->IsCowArray());
++    set_storage(isolate()->factory()->CopyFixedDoubleArray(
++        Handle<FixedDoubleArray>::cast(elements)));
++  } else if (!elements->IsCowArray()) {
++    set_storage(isolate()->factory()->CopyFixedArray(
++        Handle<FixedArray>::cast(elements)));
++  }
++}
++
+ void TranslatedState::EnsureChildrenAllocated(int count, TranslatedFrame* frame,
+                                               int* value_index,
+                                               std::stack<int>* worklist) {
+@@ -3749,6 +3788,7 @@ Handle<ByteArray> TranslatedState::AllocateStorageFor(TranslatedValue* slot) {
+ 
+ void TranslatedState::EnsureJSObjectAllocated(TranslatedValue* slot,
+                                               Handle<Map> map) {
++  CHECK(map->IsJSObjectMap());
+   CHECK_EQ(map->instance_size(), slot->GetChildrenCount() * kTaggedSize);
+ 
+   Handle<ByteArray> object_storage = AllocateStorageFor(slot);
+diff --git a/src/deoptimizer/deoptimizer.h b/src/deoptimizer/deoptimizer.h
+index 6c68ea1f96f00df51008a14d3ca7c7e672c47f0f..8f413cd93dc562cbda06e0b8bda5a37a7b4f09b9 100644
+--- a/src/deoptimizer/deoptimizer.h
++++ b/src/deoptimizer/deoptimizer.h
+@@ -117,6 +117,8 @@ class TranslatedValue {
+     return storage_;
+   }
+ 
++  void ReplaceElementsArrayWithCopy();
++
+   Kind kind_;
+   MaterializationState materialization_state_ = kUninitialized;
+   TranslatedState* container_;  // This is only needed for materialization of
+@@ -313,7 +315,15 @@ class TranslatedFrame {
+ 
+ class TranslatedState {
+  public:
+-  TranslatedState() = default;
++  // There are two constructors, each for a different purpose:
++
++  // The default constructor is for the purpose of deoptimizing an optimized
++  // frame (replacing it with one or several unoptimized frames). It is used by
++  // the Deoptimizer.
++  TranslatedState() : purpose_(kDeoptimization) {}
++
++  // This constructor is for the purpose of merely inspecting an optimized
++  // frame. It is used by stack trace generation and various debugging features.
+   explicit TranslatedState(const JavaScriptFrame* frame);
+ 
+   void Prepare(Address stack_frame_pointer);
+@@ -347,6 +357,12 @@ class TranslatedState {
+  private:
+   friend TranslatedValue;
+ 
++  // See the description of the constructors for an explanation of the two
++  // purposes. The only actual difference is that in the kFrameInspection case
++  // extra work is needed to not violate assumptions made by left-trimming.  For
++  // details, see the code around ReplaceElementsArrayWithCopy.
++  enum Purpose { kDeoptimization, kFrameInspection };
++
+   TranslatedFrame CreateNextTranslatedFrame(TranslationIterator* iterator,
+                                             FixedArray literal_array,
+                                             Address fp, FILE* trace_file);
+@@ -404,6 +420,7 @@ class TranslatedState {
+   static Float32 GetFloatSlot(Address fp, int slot_index);
+   static Float64 GetDoubleSlot(Address fp, int slot_index);
+ 
++  Purpose const purpose_;
+   std::vector<TranslatedFrame> frames_;
+   Isolate* isolate_ = nullptr;
+   Address stack_frame_pointer_ = kNullAddress;
+diff --git a/test/mjsunit/compiler/regress-1182647.js b/test/mjsunit/compiler/regress-1182647.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..e0582f7cbfb4f1e5d081443374248c1b5eb30a2e
+--- /dev/null
++++ b/test/mjsunit/compiler/regress-1182647.js
+@@ -0,0 +1,25 @@
++// Copyright 2021 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --allow-natives-syntax --verify-heap
++
++function foo() {
++  const arr = Array(1000);
++
++  function bar() {
++    try { ({a: p4nda, b: arr.length}); } catch(e) {}
++  }
++
++  for (var i = 0; i < 25; i++) bar();
++
++  /p4nda/.test({});  // Deopt here.
++
++  arr.shift();
++}
++
++%PrepareFunctionForOptimization(foo);
++foo();
++foo();
++%OptimizeFunctionOnNextCall(foo);
++foo();

From 95b81c16c46869c0d9d548f50c6a77cb2c450e8a Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Mon, 19 Apr 2021 19:59:11 -0400
Subject: [PATCH 09/48] build: read node files as binary files (#28733)

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
---
 script/release/uploaders/upload-node-checksums.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/script/release/uploaders/upload-node-checksums.py b/script/release/uploaders/upload-node-checksums.py
index 1774308320c10..41d509f2a6f72 100755
--- a/script/release/uploaders/upload-node-checksums.py
+++ b/script/release/uploaders/upload-node-checksums.py
@@ -88,7 +88,7 @@ def create_checksum(algorithm, directory, filename, files):
   lines = []
   for path in files:
     h = hashlib.new(algorithm)
-    with open(path, 'r') as f:
+    with open(path, 'rb') as f:
       h.update(f.read())
       lines.append(h.hexdigest() + '  ' + os.path.relpath(path, directory))
 

From 4f4c6a21611753a1a63c785b60326406f8eba748 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Tue, 20 Apr 2021 17:50:10 +0200
Subject: [PATCH 10/48] chore: cherry-pick 012e9baf46c9 from chromium (#28725)

* chore: cherry-pick 012e9baf46c9 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-012e9baf46c9.patch   | 86 +++++++++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-012e9baf46c9.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 4ac900f0d0b70..88e428d1fb54a 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -162,3 +162,4 @@ cherry-pick-37210e5ab006.patch
 reland_reland_fsa_add_issafepathcomponent_checks_to.patch
 css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch
 cherry-pick-3c80bb2a594f.patch
+cherry-pick-012e9baf46c9.patch
diff --git a/patches/chromium/cherry-pick-012e9baf46c9.patch b/patches/chromium/cherry-pick-012e9baf46c9.patch
new file mode 100644
index 0000000000000..f2021d4766405
--- /dev/null
+++ b/patches/chromium/cherry-pick-012e9baf46c9.patch
@@ -0,0 +1,86 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jana Grill <janagrill@google.com>
+Date: Thu, 15 Apr 2021 20:49:42 +0000
+Subject: Mojo: Remove some inappropriate DCHECKs
+
+There are a few places where we DCHECK conditions that cannot be
+reliably asserted since they depend on untrusted inputs. These are
+replaced with logic to conditionally terminate the connection to the
+offending peer process.
+
+(cherry picked from commit a32b061fc92cc3864d036ffb8c22c12b05202589)
+
+Fixed: 1195333
+Change-Id: I0c6873bf55d6b0b1d0cbb3c2e5b256e1a57ff696
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2808893
+Reviewed-by: Robert Sesek <rsesek@chromium.org>
+Commit-Queue: Ken Rockot <rockot@google.com>
+Cr-Original-Commit-Position: refs/heads/master@{#870007}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821958
+Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1608}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/mojo/core/node_controller.cc b/mojo/core/node_controller.cc
+index c7646fa4dc5c5062e8a8a620e55839301af51bed..c333ed64f71f0dfe5d0012b07bcedccfd94cd5e9 100644
+--- a/mojo/core/node_controller.cc
++++ b/mojo/core/node_controller.cc
+@@ -942,7 +942,11 @@ void NodeController::OnBrokerClientAdded(const ports::NodeName& from_node,
+ void NodeController::OnAcceptBrokerClient(const ports::NodeName& from_node,
+                                           const ports::NodeName& broker_name,
+                                           PlatformHandle broker_channel) {
+-  DCHECK(!GetConfiguration().is_broker_process);
++  if (GetConfiguration().is_broker_process) {
++    // The broker should never receive this message from anyone.
++    DropPeer(from_node, nullptr);
++    return;
++  }
+ 
+   // This node should already have an inviter in bootstrap mode.
+   ports::NodeName inviter_name;
+@@ -953,8 +957,13 @@ void NodeController::OnAcceptBrokerClient(const ports::NodeName& from_node,
+     inviter = bootstrap_inviter_channel_;
+     bootstrap_inviter_channel_ = nullptr;
+   }
+-  DCHECK(inviter_name == from_node);
+-  DCHECK(inviter);
++
++  if (inviter_name != from_node || !inviter ||
++      broker_name == ports::kInvalidNodeName) {
++    // We are not expecting this message. Assume the source is hostile.
++    DropPeer(from_node, nullptr);
++    return;
++  }
+ 
+   base::queue<ports::NodeName> pending_broker_clients;
+   std::unordered_map<ports::NodeName, OutgoingMessageQueue>
+@@ -965,22 +974,22 @@ void NodeController::OnAcceptBrokerClient(const ports::NodeName& from_node,
+     std::swap(pending_broker_clients, pending_broker_clients_);
+     std::swap(pending_relay_messages, pending_relay_messages_);
+   }
+-  DCHECK(broker_name != ports::kInvalidNodeName);
+ 
+   // It's now possible to add both the broker and the inviter as peers.
+   // Note that the broker and inviter may be the same node.
+   scoped_refptr<NodeChannel> broker;
+   if (broker_name == inviter_name) {
+-    DCHECK(!broker_channel.is_valid());
+     broker = inviter;
+-  } else {
+-    DCHECK(broker_channel.is_valid());
++  } else if (broker_channel.is_valid()) {
+     broker = NodeChannel::Create(
+         this,
+         ConnectionParams(PlatformChannelEndpoint(std::move(broker_channel))),
+         Channel::HandlePolicy::kAcceptHandles, io_task_runner_,
+         ProcessErrorCallback());
+     AddPeer(broker_name, broker, true /* start_channel */);
++  } else {
++    DropPeer(from_node, nullptr);
++    return;
+   }
+ 
+   AddPeer(inviter_name, inviter, false /* start_channel */);

From 0b6842d429842f398a5fb28a17d93fe9a78380d2 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Wed, 21 Apr 2021 12:21:04 +0200
Subject: [PATCH 11/48] chore: cherry-pick 872b8c13d7 from skia (#28739)

---
 patches/skia/.patches                         |   1 +
 ...kscalercontext_getimage_less_brittle.patch | 199 ++++++++++++++++++
 2 files changed, 200 insertions(+)
 create mode 100644 patches/skia/skscalercontext_getimage_less_brittle.patch

diff --git a/patches/skia/.patches b/patches/skia/.patches
index f790163ecfd00..9db688a673039 100644
--- a/patches/skia/.patches
+++ b/patches/skia/.patches
@@ -1,2 +1,3 @@
 cherry-pick-6763a713f957.patch
 cherry-pick-b0d3d3e85fa6.patch
+skscalercontext_getimage_less_brittle.patch
diff --git a/patches/skia/skscalercontext_getimage_less_brittle.patch b/patches/skia/skscalercontext_getimage_less_brittle.patch
new file mode 100644
index 0000000000000..1085f4f7379ed
--- /dev/null
+++ b/patches/skia/skscalercontext_getimage_less_brittle.patch
@@ -0,0 +1,199 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ben Wagner <bungeman@google.com>
+Date: Thu, 1 Apr 2021 15:02:21 -0400
+Subject: SkScalerContext::getImage less brittle.
+
+Properly handle edge cases like
+ * the temporary glyph being a different size than expected
+ * filters which reduce in size
+ * filters which return false to indicate no filtering has been done
+
+Bug: chromium:1190525
+Change-Id: Ibc53eb1d7014210019e96cd6bae3e256d967be54
+Reviewed-on: https://skia-review.googlesource.com/c/skia/+/392156
+Commit-Queue: Ben Wagner <bungeman@google.com>
+Reviewed-by: Herb Derby <herb@google.com>
+(cherry picked from commit 348ee387a96d7d94733d46ad9e82b19cb890dd16)
+Reviewed-on: https://skia-review.googlesource.com/c/skia/+/392437
+
+diff --git a/src/core/SkScalerContext.cpp b/src/core/SkScalerContext.cpp
+index a2df87c3ef62790353b8fac8169d83bc657db3d4..d1cb80a631814e995c756dc23764a21b00e97270 100644
+--- a/src/core/SkScalerContext.cpp
++++ b/src/core/SkScalerContext.cpp
+@@ -534,41 +534,39 @@ static void generateMask(const SkMask& mask, const SkPath& path,
+ }
+ 
+ void SkScalerContext::getImage(const SkGlyph& origGlyph) {
+-    const SkGlyph*  glyph = &origGlyph;
++    const SkGlyph* unfilteredGlyph = &origGlyph;
+     SkGlyph  tmpGlyph{origGlyph.getPackedID()};
+ 
+     // in case we need to call generateImage on a mask-format that is different
+     // (i.e. larger) than what our caller allocated by looking at origGlyph.
+     SkAutoMalloc tmpGlyphImageStorage;
+ 
+-    if (fMaskFilter) {   // restore the prefilter bounds
+-
++    if (fMaskFilter) {
+         // need the original bounds, sans our maskfilter
+         sk_sp<SkMaskFilter> mf = std::move(fMaskFilter);
+         this->getMetrics(&tmpGlyph);
+         fMaskFilter = std::move(mf);
+ 
+-        // we need the prefilter bounds to be <= filter bounds
+-        SkASSERT(tmpGlyph.fWidth <= origGlyph.fWidth);
+-        SkASSERT(tmpGlyph.fHeight <= origGlyph.fHeight);
+-
+-        if (tmpGlyph.fMaskFormat == origGlyph.fMaskFormat) {
++        // Use the origGlyph storage for the temporary unfiltered mask if it will fit.
++        if (tmpGlyph.fMaskFormat == origGlyph.fMaskFormat &&
++            tmpGlyph.imageSize() <= origGlyph.imageSize())
++        {
+             tmpGlyph.fImage = origGlyph.fImage;
+         } else {
+             tmpGlyphImageStorage.reset(tmpGlyph.imageSize());
+             tmpGlyph.fImage = tmpGlyphImageStorage.get();
+         }
+-        glyph = &tmpGlyph;
++        unfilteredGlyph = &tmpGlyph;
+     }
+ 
+     if (!fGenerateImageFromPath) {
+-        generateImage(*glyph);
++        generateImage(*unfilteredGlyph);
+     } else {
+         SkPath devPath;
+-        SkMask mask = glyph->mask();
++        SkMask mask = unfilteredGlyph->mask();
+ 
+-        if (!this->internalGetPath(glyph->getPackedID(), &devPath)) {
+-            generateImage(*glyph);
++        if (!this->internalGetPath(unfilteredGlyph->getPackedID(), &devPath)) {
++            generateImage(*unfilteredGlyph);
+         } else {
+             SkASSERT(SkMask::kARGB32_Format != origGlyph.fMaskFormat);
+             SkASSERT(SkMask::kARGB32_Format != mask.fFormat);
+@@ -579,39 +577,98 @@ void SkScalerContext::getImage(const SkGlyph& origGlyph) {
+     }
+ 
+     if (fMaskFilter) {
+-        // the src glyph image shouldn't be 3D
+-        SkASSERT(SkMask::k3D_Format != glyph->fMaskFormat);
++        // k3D_Format should not be mask filtered.
++        SkASSERT(SkMask::k3D_Format != unfilteredGlyph->fMaskFormat);
++
++        SkMask filteredMask;
++        SkMask srcMask;
++        SkMatrix m;
++        fRec.getMatrixFrom2x2(&m);
++
++        if (as_MFB(fMaskFilter)->filterMask(&filteredMask, unfilteredGlyph->mask(), m, nullptr)) {
++            // Filter succeeded; filteredMask.fImage was allocated.
++            srcMask = filteredMask;
++        } else if (unfilteredGlyph->fImage == tmpGlyphImageStorage.get()) {
++            // Filter did nothing; unfiltered mask is independent of origGlyph.fImage.
++            srcMask = unfilteredGlyph->mask();
++        } else if (origGlyph.iRect() == unfilteredGlyph->iRect()) {
++            // Filter did nothing; the unfiltered mask is in origGlyph.fImage and matches.
++            return;
++        } else {
++            // Filter did nothing; the unfiltered mask is in origGlyph.fImage and conflicts.
++            srcMask = unfilteredGlyph->mask();
++            size_t imageSize = unfilteredGlyph->imageSize();
++            tmpGlyphImageStorage.reset(imageSize);
++            srcMask.fImage = static_cast<uint8_t*>(tmpGlyphImageStorage.get());
++            memcpy(srcMask.fImage, unfilteredGlyph->fImage, imageSize);
++        }
+ 
+-        SkMask      srcM = glyph->mask(),
+-                    dstM;
+-        SkMatrix    matrix;
++        SkASSERT_RELEASE(srcMask.fFormat == origGlyph.fMaskFormat);
++        SkMask dstMask = origGlyph.mask();
++        SkIRect origBounds = dstMask.fBounds;
+ 
+-        fRec.getMatrixFrom2x2(&matrix);
++        // Find the intersection of src and dst while updating the fImages.
++        if (srcMask.fBounds.fTop < dstMask.fBounds.fTop) {
++            int32_t topDiff = dstMask.fBounds.fTop - srcMask.fBounds.fTop;
++            srcMask.fImage += srcMask.fRowBytes * topDiff;
++            srcMask.fBounds.fTop = dstMask.fBounds.fTop;
++        }
++        if (dstMask.fBounds.fTop < srcMask.fBounds.fTop) {
++            int32_t topDiff = srcMask.fBounds.fTop - dstMask.fBounds.fTop;
++            dstMask.fImage += dstMask.fRowBytes * topDiff;
++            dstMask.fBounds.fTop = srcMask.fBounds.fTop;
++        }
+ 
+-        if (as_MFB(fMaskFilter)->filterMask(&dstM, srcM, matrix, nullptr)) {
+-            int width = std::min<int>(origGlyph.fWidth, dstM.fBounds.width());
+-            int height = std::min<int>(origGlyph.fHeight, dstM.fBounds.height());
+-            int dstRB = origGlyph.rowBytes();
+-            int srcRB = dstM.fRowBytes;
++        if (srcMask.fBounds.fLeft < dstMask.fBounds.fLeft) {
++            int32_t leftDiff = dstMask.fBounds.fLeft - srcMask.fBounds.fLeft;
++            srcMask.fImage += leftDiff;
++            srcMask.fBounds.fLeft = dstMask.fBounds.fLeft;
++        }
++        if (dstMask.fBounds.fLeft < srcMask.fBounds.fLeft) {
++            int32_t leftDiff = srcMask.fBounds.fLeft - dstMask.fBounds.fLeft;
++            dstMask.fImage += leftDiff;
++            dstMask.fBounds.fLeft = srcMask.fBounds.fLeft;
++        }
+ 
+-            const uint8_t* src = (const uint8_t*)dstM.fImage;
+-            uint8_t* dst = (uint8_t*)origGlyph.fImage;
++        if (srcMask.fBounds.fBottom < dstMask.fBounds.fBottom) {
++            dstMask.fBounds.fBottom = srcMask.fBounds.fBottom;
++        }
++        if (dstMask.fBounds.fBottom < srcMask.fBounds.fBottom) {
++            srcMask.fBounds.fBottom = dstMask.fBounds.fBottom;
++        }
+ 
+-            if (SkMask::k3D_Format == dstM.fFormat) {
+-                // we have to copy 3 times as much
+-                height *= 3;
+-            }
++        if (srcMask.fBounds.fRight < dstMask.fBounds.fRight) {
++            dstMask.fBounds.fRight = srcMask.fBounds.fRight;
++        }
++        if (dstMask.fBounds.fRight < srcMask.fBounds.fRight) {
++            srcMask.fBounds.fRight = dstMask.fBounds.fRight;
++        }
+ 
+-            // clean out our glyph, since it may be larger than dstM
+-            //sk_bzero(dst, height * dstRB);
++        SkASSERT(srcMask.fBounds == dstMask.fBounds);
++        int width = srcMask.fBounds.width();
++        int height = srcMask.fBounds.height();
++        int dstRB = dstMask.fRowBytes;
++        int srcRB = srcMask.fRowBytes;
+ 
+-            while (--height >= 0) {
+-                memcpy(dst, src, width);
+-                src += srcRB;
+-                dst += dstRB;
+-            }
+-            SkMask::FreeImage(dstM.fImage);
++        const uint8_t* src = srcMask.fImage;
++        uint8_t* dst = dstMask.fImage;
++
++        if (SkMask::k3D_Format == filteredMask.fFormat) {
++            // we have to copy 3 times as much
++            height *= 3;
++        }
++
++        // If not filling the full original glyph, clear it out first.
++        if (dstMask.fBounds != origBounds) {
++            sk_bzero(origGlyph.fImage, origGlyph.fHeight * origGlyph.rowBytes());
++        }
++
++        while (--height >= 0) {
++            memcpy(dst, src, width);
++            src += srcRB;
++            dst += dstRB;
+         }
++        SkMask::FreeImage(filteredMask.fImage);
+     }
+ }
+ 

From 8f1074c204b3f84093978639fa35e1ccddfdcc88 Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Wed, 21 Apr 2021 03:29:48 -0700
Subject: [PATCH 12/48] chore: cherry-pick 512cd5e179f4 from v8 (#28750)

* chore: cherry-pick 512cd5e179f4 from v8

* update patches
---
 patches/v8/.patches                       |   1 +
 patches/v8/cherry-pick-512cd5e179f4.patch | 109 ++++++++++++++++++++++
 2 files changed, 110 insertions(+)
 create mode 100644 patches/v8/cherry-pick-512cd5e179f4.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index f36b2e4f9d937..baef29ebe0167 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -27,3 +27,4 @@ reland_regexp_hard-crash_on_invalid_offsets_in.patch
 regexp_throw_when_length_of_text_nodes_in_alternatives_is_too.patch
 cherry-pick-02f84c745fc0.patch
 merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch
+cherry-pick-512cd5e179f4.patch
diff --git a/patches/v8/cherry-pick-512cd5e179f4.patch b/patches/v8/cherry-pick-512cd5e179f4.patch
new file mode 100644
index 0000000000000..f443fe88936a4
--- /dev/null
+++ b/patches/v8/cherry-pick-512cd5e179f4.patch
@@ -0,0 +1,109 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Wed, 14 Apr 2021 13:19:44 +0200
+Subject: Merged: [compiler] Fix bug in
+ RepresentationChanger::GetWord32RepresentationFor
+
+Revision: fd29e246f65a7cee130e72cd10f618f3b82af232
+
+BUG=chromium:1195777
+NOTRY=true
+NOPRESUBMIT=true
+NOTREECHECKS=true
+R=nicohartmann@chromium.org
+
+Change-Id: I0400b3ae5736ef86dbeae558d15bfcca2e9f351a
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826114
+Commit-Queue: Georg Neis <neis@chromium.org>
+Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
+Cr-Commit-Position: refs/branch-heads/9.0@{#34}
+Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1}
+Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001}
+
+diff --git a/src/compiler/representation-change.cc b/src/compiler/representation-change.cc
+index 5967d1005e5d859bfc873bda3cde2b2b26667d31..7dca85da59f074171bbaf00394af03c4dce33b61 100644
+--- a/src/compiler/representation-change.cc
++++ b/src/compiler/representation-change.cc
+@@ -949,10 +949,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
+     return node;
+   } else if (output_rep == MachineRepresentation::kWord64) {
+     if (output_type.Is(Type::Signed32()) ||
+-        output_type.Is(Type::Unsigned32())) {
+-      op = machine()->TruncateInt64ToInt32();
+-    } else if (output_type.Is(cache_->kSafeInteger) &&
+-               use_info.truncation().IsUsedAsWord32()) {
++        (output_type.Is(Type::Unsigned32()) &&
++         use_info.type_check() == TypeCheckKind::kNone) ||
++        (output_type.Is(cache_->kSafeInteger) &&
++         use_info.truncation().IsUsedAsWord32())) {
+       op = machine()->TruncateInt64ToInt32();
+     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
+                use_info.type_check() == TypeCheckKind::kSigned32 ||
+diff --git a/test/mjsunit/compiler/regress-1195777.js b/test/mjsunit/compiler/regress-1195777.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..b122f4f0169af573723d4318b9f1127c857c9e35
+--- /dev/null
++++ b/test/mjsunit/compiler/regress-1195777.js
+@@ -0,0 +1,62 @@
++// Copyright 2021 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --allow-natives-syntax
++
++
++(function() {
++  function foo(b) {
++    let y = (new Date(42)).getMilliseconds();
++    let x = -1;
++    if (b) x = 0xFFFF_FFFF;
++    return y < Math.max(1 << y, x, 1 + y);
++  }
++  assertTrue(foo(true));
++  %PrepareFunctionForOptimization(foo);
++  assertTrue(foo(false));
++  %OptimizeFunctionOnNextCall(foo);
++  assertTrue(foo(true));
++})();
++
++
++(function() {
++  function foo(b) {
++    let x = 0;
++    if (b) x = -1;
++    return x == Math.max(-1, x >>> Infinity);
++  }
++  assertFalse(foo(true));
++  %PrepareFunctionForOptimization(foo);
++  assertTrue(foo(false));
++  %OptimizeFunctionOnNextCall(foo);
++  assertFalse(foo(true));
++})();
++
++
++(function() {
++  function foo(b) {
++    let x = -1;
++    if (b) x = 0xFFFF_FFFF;
++    return -1 < Math.max(0, x, -1);
++  }
++  assertTrue(foo(true));
++  %PrepareFunctionForOptimization(foo);
++  assertTrue(foo(false));
++  %OptimizeFunctionOnNextCall(foo);
++  assertTrue(foo(true));
++})();
++
++
++(function() {
++  function foo(b) {
++    let x = 0x7FFF_FFFF;
++    if (b) x = 0;
++    return 0 < (Math.max(-5 >>> x, -5) % -5);
++  }
++  assertTrue(foo(true));
++  %PrepareFunctionForOptimization(foo);
++  assertTrue(foo(false));
++  %OptimizeFunctionOnNextCall(foo);
++  assertTrue(foo(true));
++})();

From 16568d71e4ad39ce19bb55c038f5441b0b8b9e85 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Wed, 21 Apr 2021 13:18:10 +0200
Subject: [PATCH 13/48] chore: cherry-pick 6a6361c9f31c from chromium (#28703)

* chore: cherry-pick 6a6361c9f31c from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-6a6361c9f31c.patch   | 48 +++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-6a6361c9f31c.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 88e428d1fb54a..07e1fec988724 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -162,4 +162,5 @@ cherry-pick-37210e5ab006.patch
 reland_reland_fsa_add_issafepathcomponent_checks_to.patch
 css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch
 cherry-pick-3c80bb2a594f.patch
+cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
diff --git a/patches/chromium/cherry-pick-6a6361c9f31c.patch b/patches/chromium/cherry-pick-6a6361c9f31c.patch
new file mode 100644
index 0000000000000..d761e3dfe0c03
--- /dev/null
+++ b/patches/chromium/cherry-pick-6a6361c9f31c.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Palak Agarwal <agpalak@chromium.org>
+Date: Wed, 31 Mar 2021 16:10:26 +0000
+Subject: WebContents bug fix: Device capture only if web contents is valid
+
+(cherry picked from commit a462be0883486431086c5f07cdafbd3607005a59)
+
+(cherry picked from commit e6f11cafde08981e47ba77e71abf99a271f7a042)
+
+Bug: 1181228
+Change-Id: I0a4c9718a3c0ccb52cefa4565b9787e6912554c9
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2752235
+Reviewed-by: Guido Urdaneta <guidou@chromium.org>
+Commit-Queue: Palak Agarwal <agpalak@chromium.org>
+Cr-Original-Original-Commit-Position: refs/heads/master@{#863828}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2782122
+Auto-Submit: Guido Urdaneta <guidou@chromium.org>
+Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Cr-Original-Commit-Position: refs/branch-heads/4389@{#1586}
+Cr-Original-Branched-From: 9251c5db2b6d5a59fe4eac7aafa5fed37c139bb7-refs/heads/master@{#843830}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2795101
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Reviewed-by: Artem Sumaneev <asumaneev@google.com>
+Auto-Submit: Artem Sumaneev <asumaneev@google.com>
+Commit-Queue: Guido Urdaneta <guidou@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1585}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/chrome/browser/media/webrtc/desktop_capture_access_handler.cc b/chrome/browser/media/webrtc/desktop_capture_access_handler.cc
+index e3f7e784f0339581a1c8a50301f8dbfd465abbfd..1f0811610e155715cc5cd72bbaa7e703728a1fe5 100644
+--- a/chrome/browser/media/webrtc/desktop_capture_access_handler.cc
++++ b/chrome/browser/media/webrtc/desktop_capture_access_handler.cc
+@@ -248,6 +248,14 @@ void DesktopCaptureAccessHandler::ProcessScreenCaptureAccessRequest(
+       const bool display_notification =
+           display_notification_ && ShouldDisplayNotification(extension);
+ 
++      if (!content::WebContents::FromRenderFrameHost(
++              content::RenderFrameHost::FromID(request.render_process_id,
++                                               request.render_frame_id))) {
++        std::move(callback).Run(
++            devices, blink::mojom::MediaStreamRequestResult::INVALID_STATE,
++            std::move(ui));
++        return;
++      }
+       ui = GetDevicesForDesktopCapture(
+           web_contents, &devices, screen_id,
+           blink::mojom::MediaStreamType::GUM_DESKTOP_VIDEO_CAPTURE,

From f8738fb355cd9fd0ef470f67ce6b120bd6fe1a65 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Wed, 21 Apr 2021 17:42:27 +0200
Subject: [PATCH 14/48] chore: cherry-pick 8c3eb9d1c409 from chromium (#28705)

* chore: cherry-pick 8c3eb9d1c409 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |   1 +
 .../chromium/cherry-pick-8c3eb9d1c409.patch   | 143 ++++++++++++++++++
 2 files changed, 144 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-8c3eb9d1c409.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 07e1fec988724..c49b5210852fd 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -164,3 +164,4 @@ css_make_fetches_from_inline_css_use_the_document_s_url_as_referrer.patch
 cherry-pick-3c80bb2a594f.patch
 cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
+cherry-pick-8c3eb9d1c409.patch
diff --git a/patches/chromium/cherry-pick-8c3eb9d1c409.patch b/patches/chromium/cherry-pick-8c3eb9d1c409.patch
new file mode 100644
index 0000000000000..e401c6f81f04d
--- /dev/null
+++ b/patches/chromium/cherry-pick-8c3eb9d1c409.patch
@@ -0,0 +1,143 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Scott Violet <sky@chromium.org>
+Date: Wed, 31 Mar 2021 13:28:05 +0000
+Subject: x11/ozone: fix two edge cases
+
+WindowTreeHost::OnHostMovedInPixels() may trigger a nested message
+loop (tab dragging), which when the stack unravels means this may
+be deleted. This adds an early out if this happens.
+
+X11WholeScreenMoveLoop has a similar issue, in so far as notifying
+the delegate may delete this.
+
+BUG=1185482
+TEST=WindowTreeHostPlatform.DeleteHostFromOnHostMovedInPixels
+
+(cherry picked from commit 5e3a738b1204941aab9f15c0eb3d06e20fefd96e)
+
+(cherry picked from commit 8ad84a8e7882275fb32f938fd0adc04d1a2a5773)
+
+Change-Id: Ieca1c90b3e4358da50b332abe2941fdbb50c5c25
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2743555
+Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
+Commit-Queue: Scott Violet <sky@chromium.org>
+Cr-Original-Original-Commit-Position: refs/heads/master@{#860852}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2779886
+Cr-Original-Commit-Position: refs/branch-heads/4389@{#1583}
+Cr-Original-Branched-From: 9251c5db2b6d5a59fe4eac7aafa5fed37c139bb7-refs/heads/master@{#843830}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2794391
+Reviewed-by: Scott Violet <sky@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Commit-Queue: Artem Sumaneev <asumaneev@google.com>
+Cr-Commit-Position: refs/branch-heads/4240@{#1583}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/ui/aura/window_tree_host_platform.cc b/ui/aura/window_tree_host_platform.cc
+index 917b45bf3f8554c63886af30b1483cd97670299c..c9053e7c7e7abb1cdbaf114028579a0484b1d4a9 100644
+--- a/ui/aura/window_tree_host_platform.cc
++++ b/ui/aura/window_tree_host_platform.cc
+@@ -214,13 +214,21 @@ void WindowTreeHostPlatform::OnBoundsChanged(const gfx::Rect& new_bounds) {
+   float current_scale = compositor()->device_scale_factor();
+   float new_scale = ui::GetScaleFactorForNativeView(window());
+   gfx::Rect old_bounds = bounds_in_pixels_;
++  auto weak_ref = GetWeakPtr();
+   bounds_in_pixels_ = new_bounds;
+-  if (bounds_in_pixels_.origin() != old_bounds.origin())
++  if (bounds_in_pixels_.origin() != old_bounds.origin()) {
+     OnHostMovedInPixels(bounds_in_pixels_.origin());
++    // Changing the bounds may destroy this.
++    if (!weak_ref)
++      return;
++  }
+   if (bounds_in_pixels_.size() != old_bounds.size() ||
+       current_scale != new_scale) {
+     pending_size_ = gfx::Size();
+     OnHostResizedInPixels(bounds_in_pixels_.size());
++    // Changing the size may destroy this.
++    if (!weak_ref)
++      return;
+   }
+   DCHECK_GT(on_bounds_changed_recursion_depth_, 0);
+   if (--on_bounds_changed_recursion_depth_ == 0) {
+diff --git a/ui/aura/window_tree_host_platform_unittest.cc b/ui/aura/window_tree_host_platform_unittest.cc
+index eda14e2f0cdf5015f366aa70ea68ae2a2c2b431e..4de039c88af8a6f0ac03df2f772cfea2dfe3514f 100644
+--- a/ui/aura/window_tree_host_platform_unittest.cc
++++ b/ui/aura/window_tree_host_platform_unittest.cc
+@@ -34,7 +34,7 @@ class TestWindowTreeHost : public WindowTreeHostPlatform {
+ // OnHostWill/DidProcessBoundsChange. Additionally, this triggers a bounds
+ // change from within OnHostResized(). Such a scenario happens in production
+ // code.
+-class TestWindowTreeHostObserver : public aura::WindowTreeHostObserver {
++class TestWindowTreeHostObserver : public WindowTreeHostObserver {
+  public:
+   TestWindowTreeHostObserver(WindowTreeHostPlatform* host,
+                              ui::PlatformWindow* platform_window)
+@@ -51,7 +51,7 @@ class TestWindowTreeHostObserver : public aura::WindowTreeHostObserver {
+     return on_host_will_process_bounds_change_count_;
+   }
+ 
+-  // aura::WindowTreeHostObserver:
++  // WindowTreeHostObserver:
+   void OnHostResized(WindowTreeHost* host) override {
+     if (!should_change_bounds_in_on_resized_)
+       return;
+@@ -92,5 +92,41 @@ TEST_F(WindowTreeHostPlatformTest, HostWillProcessBoundsChangeRecursion) {
+   EXPECT_EQ(1, observer.on_host_will_process_bounds_change_count());
+ }
+ 
++// Deletes WindowTreeHostPlatform from OnHostMovedInPixels().
++class DeleteHostWindowTreeHostObserver : public WindowTreeHostObserver {
++ public:
++  explicit DeleteHostWindowTreeHostObserver(
++      std::unique_ptr<TestWindowTreeHost> host)
++      : host_(std::move(host)) {
++    host_->AddObserver(this);
++  }
++  ~DeleteHostWindowTreeHostObserver() override = default;
++
++  TestWindowTreeHost* host() { return host_.get(); }
++
++  // WindowTreeHostObserver:
++  void OnHostMovedInPixels(WindowTreeHost* host,
++                           const gfx::Point& new_origin_in_pixels) override {
++    host_->RemoveObserver(this);
++    host_.reset();
++  }
++
++ private:
++  std::unique_ptr<TestWindowTreeHost> host_;
++
++  DISALLOW_COPY_AND_ASSIGN(DeleteHostWindowTreeHostObserver);
++};
++
++// Verifies WindowTreeHostPlatform can be safely deleted when calling
++// OnHostMovedInPixels().
++// Regression test for https://crbug.com/1185482
++TEST_F(WindowTreeHostPlatformTest, DeleteHostFromOnHostMovedInPixels) {
++  std::unique_ptr<TestWindowTreeHost> host =
++      std::make_unique<TestWindowTreeHost>();
++  DeleteHostWindowTreeHostObserver observer(std::move(host));
++  observer.host()->SetBoundsInPixels(gfx::Rect(1, 2, 3, 4));
++  EXPECT_EQ(nullptr, observer.host());
++}
++
+ }  // namespace
+ }  // namespace aura
+diff --git a/ui/base/x/x11_whole_screen_move_loop.cc b/ui/base/x/x11_whole_screen_move_loop.cc
+index 39f4d0c12aa1feb1702c3f4aa4ba0f62be591197..2bbb1f035b0db8de218ce629cc16aab91cf8519b 100644
+--- a/ui/base/x/x11_whole_screen_move_loop.cc
++++ b/ui/base/x/x11_whole_screen_move_loop.cc
+@@ -62,9 +62,13 @@ X11WholeScreenMoveLoop::~X11WholeScreenMoveLoop() = default;
+ void X11WholeScreenMoveLoop::DispatchMouseMovement() {
+   if (!last_motion_in_screen_)
+     return;
++  auto weak_ref = weak_factory_.GetWeakPtr();
+   delegate_->OnMouseMovement(last_motion_in_screen_->root_location(),
+                              last_motion_in_screen_->flags(),
+                              last_motion_in_screen_->time_stamp());
++  // The delegate may delete this during dispatch.
++  if (!weak_ref)
++    return;
+   last_motion_in_screen_.reset();
+ }
+ 

From 840ff8d7203e69048a3d574715b9214d621d65e4 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Thu, 22 Apr 2021 19:57:47 +0200
Subject: [PATCH 15/48] chore: cherry-pick 74c9ad9a53 from chromium (#28761)

---
 patches/chromium/.patches                     |   1 +
 ..._for_permission_change_subscriptions.patch | 951 ++++++++++++++++++
 shell/browser/electron_permission_manager.cc  |   7 +-
 shell/browser/electron_permission_manager.h   |   5 +-
 4 files changed, 959 insertions(+), 5 deletions(-)
 create mode 100644 patches/chromium/use_idtype_for_permission_change_subscriptions.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index c49b5210852fd..5690a270297c5 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -165,3 +165,4 @@ cherry-pick-3c80bb2a594f.patch
 cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
 cherry-pick-8c3eb9d1c409.patch
+use_idtype_for_permission_change_subscriptions.patch
diff --git a/patches/chromium/use_idtype_for_permission_change_subscriptions.patch b/patches/chromium/use_idtype_for_permission_change_subscriptions.patch
new file mode 100644
index 0000000000000..a2cdffc236f2f
--- /dev/null
+++ b/patches/chromium/use_idtype_for_permission_change_subscriptions.patch
@@ -0,0 +1,951 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jana Grill <janagrill@google.com>
+Date: Thu, 15 Apr 2021 19:35:42 +0000
+Subject: Use IDType for permission change subscriptions.
+
+(cherry picked from commit ad1489b7c3ed705fc623cdffdc292324be9fcbfa)
+
+Bug: 1025683
+Change-Id: I3b44ba7833138e8a657a4192e1a36c978695db32
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2791431
+Reviewed-by: Richard Coles <torne@chromium.org>
+Reviewed-by: Yuchen Liu <yucliu@chromium.org>
+Reviewed-by: Nasko Oskov <nasko@chromium.org>
+Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
+Reviewed-by: Fabrice de Gans-Riberi <fdegans@chromium.org>
+Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
+Reviewed-by: Illia Klimov <elklm@google.com>
+Auto-Submit: Balazs Engedy <engedy@chromium.org>
+Commit-Queue: Balazs Engedy <engedy@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#867999}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2817980
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
+Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1607}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/android_webview/browser/aw_permission_manager.cc b/android_webview/browser/aw_permission_manager.cc
+index bedb16b046d45b257e28e29e410afe43f5c8817c..c020e9668cbd2de9d36d2e160a07e324a2510d6b 100644
+--- a/android_webview/browser/aw_permission_manager.cc
++++ b/android_webview/browser/aw_permission_manager.cc
+@@ -469,16 +469,17 @@ PermissionStatus AwPermissionManager::GetPermissionStatusForFrame(
+           .GetOrigin());
+ }
+ 
+-int AwPermissionManager::SubscribePermissionStatusChange(
++AwPermissionManager::SubscriptionId
++AwPermissionManager::SubscribePermissionStatusChange(
+     PermissionType permission,
+     content::RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+     base::RepeatingCallback<void(PermissionStatus)> callback) {
+-  return content::PermissionController::kNoPendingOperation;
++  return SubscriptionId();
+ }
+ 
+ void AwPermissionManager::UnsubscribePermissionStatusChange(
+-    int subscription_id) {}
++    SubscriptionId subscription_id) {}
+ 
+ void AwPermissionManager::CancelPermissionRequest(int request_id) {
+   PendingRequest* pending_request = pending_requests_.Lookup(request_id);
+diff --git a/android_webview/browser/aw_permission_manager.h b/android_webview/browser/aw_permission_manager.h
+index d9670cac33b84016568e9693b62e83c5e7ee0969..7439e78199783b8ebe2c303ebebf0e1cf62dc718 100644
+--- a/android_webview/browser/aw_permission_manager.h
++++ b/android_webview/browser/aw_permission_manager.h
+@@ -49,13 +49,14 @@ class AwPermissionManager : public content::PermissionControllerDelegate {
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin) override;
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override;
++  void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) override;
+ 
+  protected:
+   void CancelPermissionRequest(int request_id);
+diff --git a/chrome/browser/permissions/permission_manager_browsertest.cc b/chrome/browser/permissions/permission_manager_browsertest.cc
+index 440203ce6eca40070e09eae8bafe2a50bea75060..d48e6d85611b2ea4560f56d5e09fafa3a3453e7a 100644
+--- a/chrome/browser/permissions/permission_manager_browsertest.cc
++++ b/chrome/browser/permissions/permission_manager_browsertest.cc
+@@ -49,13 +49,13 @@ class SubscriptionInterceptingPermissionManager
+     callback_ = std::move(callback);
+   }
+ 
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override {
+-    int result =
++    SubscriptionId result =
+         permissions::PermissionManager::SubscribePermissionStatusChange(
+             permission, render_frame_host, requesting_origin, callback);
+     std::move(callback_).Run();
+diff --git a/chromecast/browser/cast_permission_manager.cc b/chromecast/browser/cast_permission_manager.cc
+index b358fc3bdb5c6af93a1e6568a667049574367741..b3a226dabff062e591fee38682409dec5e38a213 100644
+--- a/chromecast/browser/cast_permission_manager.cc
++++ b/chromecast/browser/cast_permission_manager.cc
+@@ -63,17 +63,17 @@ CastPermissionManager::GetPermissionStatusForFrame(
+   return blink::mojom::PermissionStatus::GRANTED;
+ }
+ 
+-int CastPermissionManager::SubscribePermissionStatusChange(
++CastPermissionManager::SubscriptionId
++CastPermissionManager::SubscribePermissionStatusChange(
+     content::PermissionType permission,
+     content::RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+     base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback) {
+-  return content::PermissionController::kNoPendingOperation;
++  return SubscriptionId();
+ }
+ 
+ void CastPermissionManager::UnsubscribePermissionStatusChange(
+-    int subscription_id) {
+-}
++    SubscriptionId subscription_id) {}
+ 
+ }  // namespace shell
+ }  // namespace chromecast
+diff --git a/chromecast/browser/cast_permission_manager.h b/chromecast/browser/cast_permission_manager.h
+index 564ac2b304596027cf7096892dfaf9796500419c..f9da64c6110307cf9912e897f87fcbb2ca123d75 100644
+--- a/chromecast/browser/cast_permission_manager.h
++++ b/chromecast/browser/cast_permission_manager.h
+@@ -43,13 +43,14 @@ class CastPermissionManager : public content::PermissionControllerDelegate {
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin) override;
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override;
++  void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) override;
+ 
+  private:
+   DISALLOW_COPY_AND_ASSIGN(CastPermissionManager);
+diff --git a/components/permissions/permission_manager.cc b/components/permissions/permission_manager.cc
+index a9566441647f0e8527a6b9603f663f66e49b2abb..bdf639f49a987eb2d7ae31346dc01b85dac57eaa 100644
+--- a/components/permissions/permission_manager.cc
++++ b/components/permissions/permission_manager.cc
+@@ -542,14 +542,15 @@ bool PermissionManager::IsPermissionOverridableByDevTools(
+                                                             origin->GetURL());
+ }
+ 
+-int PermissionManager::SubscribePermissionStatusChange(
++PermissionManager::SubscriptionId
++PermissionManager::SubscribePermissionStatusChange(
+     PermissionType permission,
+     content::RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+     base::RepeatingCallback<void(PermissionStatus)> callback) {
+   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+   if (is_shutting_down_)
+-    return 0;
++    return SubscriptionId();
+ 
+   if (subscriptions_.IsEmpty())
+     PermissionsClient::Get()
+@@ -586,16 +587,20 @@ int PermissionManager::SubscribePermissionStatusChange(
+   subscription->callback =
+       base::BindRepeating(&SubscriptionCallbackWrapper, std::move(callback));
+ 
+-  return subscriptions_.Add(std::move(subscription));
++  auto id = subscription_id_generator_.GenerateNextId();
++  subscriptions_.AddWithID(std::move(subscription), id);
++  return id;
+ }
+ 
+-void PermissionManager::UnsubscribePermissionStatusChange(int subscription_id) {
++void PermissionManager::UnsubscribePermissionStatusChange(
++    SubscriptionId subscription_id) {
+   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+   if (is_shutting_down_)
+     return;
+ 
+-  // Whether |subscription_id| is known will be checked by the Remove() call.
+-  subscriptions_.Remove(subscription_id);
++  if (subscriptions_.Lookup(subscription_id)) {
++    subscriptions_.Remove(subscription_id);
++  }
+ 
+   if (subscriptions_.IsEmpty()) {
+     PermissionsClient::Get()
+diff --git a/components/permissions/permission_manager.h b/components/permissions/permission_manager.h
+index d11fb4b2c4a1a360ae01154995091439e13bd9a0..19d29dde0392adff318e82bd1c3091c4e1dcd926 100644
+--- a/components/permissions/permission_manager.h
++++ b/components/permissions/permission_manager.h
+@@ -114,13 +114,14 @@ class PermissionManager : public KeyedService,
+   bool IsPermissionOverridableByDevTools(
+       content::PermissionType permission,
+       const base::Optional<url::Origin>& origin) override;
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override;
++  void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) override;
+ 
+   // TODO(raymes): Rather than exposing this, use the denial reason from
+   // GetPermissionStatus in callers to determine whether a permission is
+@@ -153,7 +154,8 @@ class PermissionManager : public KeyedService,
+   class PermissionResponseCallback;
+ 
+   struct Subscription;
+-  using SubscriptionsMap = base::IDMap<std::unique_ptr<Subscription>>;
++  using SubscriptionsMap =
++      base::IDMap<std::unique_ptr<Subscription>, SubscriptionId>;
+ 
+   PermissionContextBase* GetPermissionContext(ContentSettingsType type);
+ 
+@@ -186,6 +188,7 @@ class PermissionManager : public KeyedService,
+   content::BrowserContext* browser_context_;
+   PendingRequestsMap pending_requests_;
+   SubscriptionsMap subscriptions_;
++  SubscriptionId::Generator subscription_id_generator_;
+ 
+   PermissionContextMap permission_contexts_;
+   using ContentSettingsTypeOverrides =
+diff --git a/components/permissions/permission_manager_unittest.cc b/components/permissions/permission_manager_unittest.cc
+index ff5793acc907134fc486fcd5b9c20bf0cf2d960c..0070768b4a41e2890b89aba817fe24f6268272c1 100644
+--- a/components/permissions/permission_manager_unittest.cc
++++ b/components/permissions/permission_manager_unittest.cc
+@@ -325,7 +325,7 @@ TEST_F(PermissionManagerTest, SubscriptionDestroyedCleanlyWithoutUnsubscribe) {
+ }
+ 
+ TEST_F(PermissionManagerTest, SubscribeUnsubscribeAfterShutdown) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -340,7 +340,7 @@ TEST_F(PermissionManagerTest, SubscribeUnsubscribeAfterShutdown) {
+       subscription_id);
+ 
+   // Check that subscribe/unsubscribe after shutdown don't crash.
+-  int subscription2_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription2_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -351,7 +351,7 @@ TEST_F(PermissionManagerTest, SubscribeUnsubscribeAfterShutdown) {
+ }
+ 
+ TEST_F(PermissionManagerTest, SameTypeChangeNotifies) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -369,7 +369,7 @@ TEST_F(PermissionManagerTest, SameTypeChangeNotifies) {
+ }
+ 
+ TEST_F(PermissionManagerTest, DifferentTypeChangeDoesNotNotify) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -386,7 +386,7 @@ TEST_F(PermissionManagerTest, DifferentTypeChangeDoesNotNotify) {
+ }
+ 
+ TEST_F(PermissionManagerTest, ChangeAfterUnsubscribeDoesNotNotify) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -403,7 +403,7 @@ TEST_F(PermissionManagerTest, ChangeAfterUnsubscribeDoesNotNotify) {
+ }
+ 
+ TEST_F(PermissionManagerTest, DifferentPrimaryUrlDoesNotNotify) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -420,7 +420,7 @@ TEST_F(PermissionManagerTest, DifferentPrimaryUrlDoesNotNotify) {
+ }
+ 
+ TEST_F(PermissionManagerTest, DifferentSecondaryUrlDoesNotNotify) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -437,7 +437,7 @@ TEST_F(PermissionManagerTest, DifferentSecondaryUrlDoesNotNotify) {
+ }
+ 
+ TEST_F(PermissionManagerTest, WildCardPatternNotifies) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -458,7 +458,7 @@ TEST_F(PermissionManagerTest, ClearSettingsNotifies) {
+       url(), url(), ContentSettingsType::GEOLOCATION, std::string(),
+       CONTENT_SETTING_ALLOW);
+ 
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -475,7 +475,7 @@ TEST_F(PermissionManagerTest, ClearSettingsNotifies) {
+ }
+ 
+ TEST_F(PermissionManagerTest, NewValueCorrectlyPassed) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -497,7 +497,7 @@ TEST_F(PermissionManagerTest, ChangeWithoutPermissionChangeDoesNotNotify) {
+       url(), url(), ContentSettingsType::GEOLOCATION, std::string(),
+       CONTENT_SETTING_ALLOW);
+ 
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -518,7 +518,7 @@ TEST_F(PermissionManagerTest, ChangesBackAndForth) {
+       url(), url(), ContentSettingsType::GEOLOCATION, std::string(),
+       CONTENT_SETTING_ASK);
+ 
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -549,7 +549,7 @@ TEST_F(PermissionManagerTest, ChangesBackAndForthWorker) {
+       url(), url(), ContentSettingsType::GEOLOCATION, std::string(),
+       CONTENT_SETTING_ASK);
+ 
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, nullptr, url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -576,7 +576,7 @@ TEST_F(PermissionManagerTest, ChangesBackAndForthWorker) {
+ }
+ 
+ TEST_F(PermissionManagerTest, SubscribeMIDIPermission) {
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::MIDI, main_rfh(), url(),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+@@ -796,7 +796,7 @@ TEST_F(PermissionManagerTest, SubscribeWithPermissionDelegation) {
+   content::RenderFrameHost* parent = main_rfh();
+   content::RenderFrameHost* child = AddChildRFH(parent, kOrigin2);
+ 
+-  int subscription_id =
++  content::PermissionControllerDelegate::SubscriptionId subscription_id =
+       GetPermissionControllerDelegate()->SubscribePermissionStatusChange(
+           PermissionType::GEOLOCATION, child, GURL(kOrigin2),
+           base::Bind(&PermissionManagerTest::OnPermissionChange,
+diff --git a/content/browser/android/nfc_host.cc b/content/browser/android/nfc_host.cc
+index 30517f69b3d790690121bda2f3de50c0e31fadd1..0f077d211a23d05813dafd7dc621915c1fb79ba5 100644
+--- a/content/browser/android/nfc_host.cc
++++ b/content/browser/android/nfc_host.cc
+@@ -99,8 +99,8 @@ void NFCHost::OnPermissionStatusChange(blink::mojom::PermissionStatus status) {
+ 
+ void NFCHost::Close() {
+   nfc_provider_.reset();
+-  if (subscription_id_ != 0)
+-    permission_controller_->UnsubscribePermissionStatusChange(subscription_id_);
++  permission_controller_->UnsubscribePermissionStatusChange(subscription_id_);
++  subscription_id_ = PermissionController::SubscriptionId();
+ }
+ 
+ }  // namespace content
+diff --git a/content/browser/android/nfc_host.h b/content/browser/android/nfc_host.h
+index 8df7cbec810ecb535f4ce4b54266c34243341571..6b5f8dde17d0abda6132845018b4a8f81859cd0d 100644
+--- a/content/browser/android/nfc_host.h
++++ b/content/browser/android/nfc_host.h
+@@ -44,7 +44,7 @@ class NFCHost : public WebContentsObserver {
+   mojo::Remote<device::mojom::NFCProvider> nfc_provider_;
+ 
+   // Permission change subscription ID provided by |permission_controller_|.
+-  int subscription_id_ = 0;
++  PermissionController::SubscriptionId subscription_id_;
+ 
+   DISALLOW_COPY_AND_ASSIGN(NFCHost);
+ };
+diff --git a/content/browser/permissions/permission_controller_impl.cc b/content/browser/permissions/permission_controller_impl.cc
+index c6edd2ebec0b57808512c3b6c574548431efac7e..4722e9d7b3ed77489fa28f97afa55726f7f727e4 100644
+--- a/content/browser/permissions/permission_controller_impl.cc
++++ b/content/browser/permissions/permission_controller_impl.cc
+@@ -132,7 +132,8 @@ struct PermissionControllerImpl::Subscription {
+   int render_frame_id = -1;
+   int render_process_id = -1;
+   base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback;
+-  int delegate_subscription_id;
++  // This is default-initialized to an invalid ID.
++  PermissionControllerDelegate::SubscriptionId delegate_subscription_id;
+ };
+ 
+ PermissionControllerImpl::~PermissionControllerImpl() {
+@@ -388,7 +389,8 @@ void PermissionControllerImpl::OnDelegatePermissionStatusChange(
+     subscription->callback.Run(status);
+ }
+ 
+-int PermissionControllerImpl::SubscribePermissionStatusChange(
++PermissionControllerImpl::SubscriptionId
++PermissionControllerImpl::SubscribePermissionStatusChange(
+     PermissionType permission,
+     RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+@@ -422,21 +424,21 @@ int PermissionControllerImpl::SubscribePermissionStatusChange(
+             base::BindRepeating(
+                 &PermissionControllerImpl::OnDelegatePermissionStatusChange,
+                 base::Unretained(this), subscription.get()));
+-  } else {
+-    subscription->delegate_subscription_id = kNoPendingOperation;
+   }
+-  return subscriptions_.Add(std::move(subscription));
++
++  auto id = subscription_id_generator_.GenerateNextId();
++  subscriptions_.AddWithID(std::move(subscription), id);
++  return id;
+ }
+ 
+ void PermissionControllerImpl::UnsubscribePermissionStatusChange(
+-    int subscription_id) {
++    SubscriptionId subscription_id) {
+   Subscription* subscription = subscriptions_.Lookup(subscription_id);
+   if (!subscription)
+     return;
+   PermissionControllerDelegate* delegate =
+       browser_context_->GetPermissionControllerDelegate();
+-  if (delegate &&
+-      subscription->delegate_subscription_id != kNoPendingOperation) {
++  if (delegate) {
+     delegate->UnsubscribePermissionStatusChange(
+         subscription->delegate_subscription_id);
+   }
+diff --git a/content/browser/permissions/permission_controller_impl.h b/content/browser/permissions/permission_controller_impl.h
+index 7ebf3c48a0e863d9f4312b37e014ce0f89e5c3c7..d85788867f746547f80405c46660e055631d9208 100644
+--- a/content/browser/permissions/permission_controller_impl.h
++++ b/content/browser/permissions/permission_controller_impl.h
+@@ -72,18 +72,19 @@ class CONTENT_EXPORT PermissionControllerImpl : public PermissionController {
+                        const GURL& requesting_origin,
+                        const GURL& embedding_origin);
+ 
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       PermissionType permission,
+       RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       const base::RepeatingCallback<void(blink::mojom::PermissionStatus)>&
+           callback);
+ 
+-  void UnsubscribePermissionStatusChange(int subscription_id);
++  void UnsubscribePermissionStatusChange(SubscriptionId subscription_id);
+ 
+  private:
+   struct Subscription;
+-  using SubscriptionsMap = base::IDMap<std::unique_ptr<Subscription>>;
++  using SubscriptionsMap =
++      base::IDMap<std::unique_ptr<Subscription>, SubscriptionId>;
+   using SubscriptionsStatusMap =
+       base::flat_map<SubscriptionsMap::KeyType, blink::mojom::PermissionStatus>;
+ 
+@@ -98,7 +99,13 @@ class CONTENT_EXPORT PermissionControllerImpl : public PermissionController {
+       const base::Optional<url::Origin>& origin);
+ 
+   DevToolsPermissionOverrides devtools_permission_overrides_;
++
++  // Note that SubscriptionId is distinct from
++  // PermissionControllerDelegate::SubscriptionId, and the concrete ID values
++  // may be different as well.
+   SubscriptionsMap subscriptions_;
++  SubscriptionId::Generator subscription_id_generator_;
++
+   BrowserContext* browser_context_;
+ 
+   DISALLOW_COPY_AND_ASSIGN(PermissionControllerImpl);
+diff --git a/content/browser/permissions/permission_service_context.cc b/content/browser/permissions/permission_service_context.cc
+index c3ab81294edbb297108c3b8f59a35f1cfb8131f9..f15abf265eb690b5dfd66bb1c2d5e13b005ddbd0 100644
+--- a/content/browser/permissions/permission_service_context.cc
++++ b/content/browser/permissions/permission_service_context.cc
+@@ -11,7 +11,6 @@
+ #include "content/browser/permissions/permission_service_impl.h"
+ #include "content/public/browser/browser_context.h"
+ #include "content/public/browser/navigation_handle.h"
+-#include "content/public/browser/permission_controller.h"
+ #include "content/public/browser/render_frame_host.h"
+ #include "content/public/browser/render_process_host.h"
+ #include "content/public/browser/web_contents.h"
+@@ -32,7 +31,7 @@ class PermissionServiceContext::PermissionSubscription {
+   PermissionSubscription& operator=(const PermissionSubscription&) = delete;
+ 
+   ~PermissionSubscription() {
+-    DCHECK_NE(id_, 0);
++    DCHECK(id_);
+     BrowserContext* browser_context = context_->GetBrowserContext();
+     if (browser_context) {
+       PermissionControllerImpl::FromBrowserContext(browser_context)
+@@ -41,7 +40,7 @@ class PermissionServiceContext::PermissionSubscription {
+   }
+ 
+   void OnConnectionError() {
+-    DCHECK_NE(id_, 0);
++    DCHECK(id_);
+     context_->ObserverHadConnectionError(id_);
+   }
+ 
+@@ -49,12 +48,12 @@ class PermissionServiceContext::PermissionSubscription {
+     observer_->OnPermissionStatusChange(status);
+   }
+ 
+-  void set_id(int id) { id_ = id; }
++  void set_id(PermissionController::SubscriptionId id) { id_ = id; }
+ 
+  private:
+   PermissionServiceContext* const context_;
+   mojo::Remote<blink::mojom::PermissionObserver> observer_;
+-  int id_ = 0;
++  PermissionController::SubscriptionId id_;
+ };
+ 
+ PermissionServiceContext::PermissionServiceContext(
+@@ -108,7 +107,7 @@ void PermissionServiceContext::CreateSubscription(
+   }
+ 
+   GURL requesting_origin(origin.Serialize());
+-  int subscription_id =
++  auto subscription_id =
+       PermissionControllerImpl::FromBrowserContext(browser_context)
+           ->SubscribePermissionStatusChange(
+               permission_type, render_frame_host_, requesting_origin,
+@@ -119,7 +118,8 @@ void PermissionServiceContext::CreateSubscription(
+   subscriptions_[subscription_id] = std::move(subscription);
+ }
+ 
+-void PermissionServiceContext::ObserverHadConnectionError(int subscription_id) {
++void PermissionServiceContext::ObserverHadConnectionError(
++    PermissionController::SubscriptionId subscription_id) {
+   size_t erased = subscriptions_.erase(subscription_id);
+   DCHECK_EQ(1u, erased);
+ }
+diff --git a/content/browser/permissions/permission_service_context.h b/content/browser/permissions/permission_service_context.h
+index 4f93be504fd854b50bea96dedbc5d324d25ea6f1..0680c70c8ee4a79bb85c2fd1e3769a29f339816e 100644
+--- a/content/browser/permissions/permission_service_context.h
++++ b/content/browser/permissions/permission_service_context.h
+@@ -9,6 +9,7 @@
+ #include <unordered_map>
+ 
+ #include "content/common/content_export.h"
++#include "content/public/browser/permission_controller.h"
+ #include "content/public/browser/permission_type.h"
+ #include "content/public/browser/web_contents_observer.h"
+ #include "mojo/public/cpp/bindings/pending_receiver.h"
+@@ -52,7 +53,8 @@ class CONTENT_EXPORT PermissionServiceContext : public WebContentsObserver {
+       mojo::PendingRemote<blink::mojom::PermissionObserver> observer);
+ 
+   // Called when the connection to a PermissionObserver has an error.
+-  void ObserverHadConnectionError(int subscription_id);
++  void ObserverHadConnectionError(
++      PermissionController::SubscriptionId subscription_id);
+ 
+   // May return nullptr during teardown, or when showing an interstitial.
+   BrowserContext* GetBrowserContext() const;
+@@ -78,7 +80,8 @@ class CONTENT_EXPORT PermissionServiceContext : public WebContentsObserver {
+   RenderFrameHost* const render_frame_host_;
+   RenderProcessHost* const render_process_host_;
+   mojo::UniqueReceiverSet<blink::mojom::PermissionService> services_;
+-  std::unordered_map<int, std::unique_ptr<PermissionSubscription>>
++  std::unordered_map<PermissionController::SubscriptionId,
++                     std::unique_ptr<PermissionSubscription>>
+       subscriptions_;
+ };
+ 
+diff --git a/content/browser/renderer_host/media/media_stream_manager.h b/content/browser/renderer_host/media/media_stream_manager.h
+index 4468b5c906454a8cf4484c8f3f81841c9130721b..677f7a5fe22b55f12c324048972a7200ac8c873b 100644
+--- a/content/browser/renderer_host/media/media_stream_manager.h
++++ b/content/browser/renderer_host/media/media_stream_manager.h
+@@ -50,6 +50,7 @@
+ #include "content/public/browser/desktop_media_id.h"
+ #include "content/public/browser/media_request_state.h"
+ #include "content/public/browser/media_stream_request.h"
++#include "content/public/browser/permission_controller.h"
+ #include "media/base/video_facing.h"
+ #include "third_party/blink/public/common/mediastream/media_devices.h"
+ #include "third_party/blink/public/common/mediastream/media_stream_controls.h"
+diff --git a/content/public/browser/permission_controller.h b/content/public/browser/permission_controller.h
+index b9b42def49b35d31c22ee0d6c158737bdc0824b6..77fe96a1c33aea5e887e171b92f199acdf7dd6df 100644
+--- a/content/public/browser/permission_controller.h
++++ b/content/public/browser/permission_controller.h
+@@ -6,6 +6,7 @@
+ #define CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_H_
+ 
+ #include "base/supports_user_data.h"
++#include "base/util/type_safety/id_type.h"
+ #include "content/common/content_export.h"
+ #include "content/public/browser/permission_type.h"
+ #include "third_party/blink/public/mojom/permissions/permission_status.mojom.h"
+@@ -20,8 +21,13 @@ class RenderFrameHost;
+ class CONTENT_EXPORT PermissionController
+     : public base::SupportsUserData::Data {
+  public:
+-  // Constant retured when registering and subscribing if
+-  // cancelling/unsubscribing at a later stage would have no effect.
++  // Identifier for an active subscription. This is intentionally a distinct
++  // type from PermissionControllerDelegate::SubscriptionId as the concrete
++  // identifier values may be different.
++  using SubscriptionId = util::IdType64<PermissionController>;
++
++  // Constant returned when requesting a permission if cancelling at a later
++  // stage would have no effect.
+   static const int kNoPendingOperation = -1;
+ 
+   ~PermissionController() override {}
+@@ -48,4 +54,17 @@ class CONTENT_EXPORT PermissionController
+ 
+ }  // namespace content
+ 
++namespace std {
++
++template <>
++struct hash<content::PermissionController::SubscriptionId> {
++  std::size_t operator()(
++      const content::PermissionController::SubscriptionId& v) const {
++    content::PermissionController::SubscriptionId::Hasher hasher;
++    return hasher(v);
++  }
++};
++
++}  // namespace std
++
+ #endif  // CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_H_
+diff --git a/content/public/browser/permission_controller_delegate.h b/content/public/browser/permission_controller_delegate.h
+index e47de2a278e67091442c63bb7130022eae587041..82a1d4f0efd384386d8215f39d735ba488e4bc61 100644
+--- a/content/public/browser/permission_controller_delegate.h
++++ b/content/public/browser/permission_controller_delegate.h
+@@ -5,6 +5,7 @@
+ #ifndef CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_DELEGATE_H_
+ #define CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_DELEGATE_H_
+ 
++#include "base/util/type_safety/id_type.h"
+ #include "content/common/content_export.h"
+ #include "content/public/browser/devtools_permission_overrides.h"
+ #include "third_party/blink/public/mojom/permissions/permission_status.mojom.h"
+@@ -18,6 +19,10 @@ class RenderFrameHost;
+ class CONTENT_EXPORT PermissionControllerDelegate {
+  public:
+   using PermissionOverrides = DevToolsPermissionOverrides::PermissionOverrides;
++
++  // Identifier for an active subscription.
++  using SubscriptionId = util::IdType64<PermissionControllerDelegate>;
++
+   virtual ~PermissionControllerDelegate() = default;
+ 
+   // Requests a permission on behalf of a frame identified by
+@@ -80,21 +85,21 @@ class CONTENT_EXPORT PermissionControllerDelegate {
+ 
+   // Runs the given |callback| whenever the |permission| associated with the
+   // given RenderFrameHost changes. A nullptr should be passed if the request
+-  // is from a worker. Returns the subscription_id to be used to unsubscribe.
+-  // Can be kNoPendingOperation if the subscribe was not successful.
+-  virtual int SubscribePermissionStatusChange(
++  // is from a worker. Returns the ID to be used to unsubscribe, which can be
++  // `is_null()` if the subscribe was not successful.
++  virtual SubscriptionId SubscribePermissionStatusChange(
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)>
+           callback) = 0;
+ 
+-  // Unregisters from permission status change notifications.
+-  // The |subscription_id| must match the value returned by the
+-  // SubscribePermissionStatusChange call. Unsubscribing
+-  // an already unsubscribed |subscription_id| or providing the
+-  // |subscription_id| kNoPendingOperation is a no-op.
+-  virtual void UnsubscribePermissionStatusChange(int subscription_id) = 0;
++  // Unregisters from permission status change notifications. The
++  // |subscription_id| must match the value returned by the
++  // SubscribePermissionStatusChange call. Unsubscribing an already
++  // unsubscribed |subscription_id| or an `is_null()` ID is a no-op.
++  virtual void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) = 0;
+ 
+   // Manually overrides default permission settings of delegate, if overrides
+   // are tracked by the delegate. This method should only be called by the
+@@ -116,4 +121,17 @@ class CONTENT_EXPORT PermissionControllerDelegate {
+ 
+ }  // namespace content
+ 
++namespace std {
++
++template <>
++struct hash<content::PermissionControllerDelegate::SubscriptionId> {
++  std::size_t operator()(
++      const content::PermissionControllerDelegate::SubscriptionId& v) const {
++    content::PermissionControllerDelegate::SubscriptionId::Hasher hasher;
++    return hasher(v);
++  }
++};
++
++}  // namespace std
++
+ #endif  // CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_DELEGATE_H_
+diff --git a/content/public/test/mock_permission_manager.h b/content/public/test/mock_permission_manager.h
+index a193bd00e23abf2295c8bcf2ed5fb3acae68440f..34e71e23a2dae6d55348d8139480459b36377c0c 100644
+--- a/content/public/test/mock_permission_manager.h
++++ b/content/public/test/mock_permission_manager.h
+@@ -49,13 +49,13 @@ class MockPermissionManager : public PermissionControllerDelegate {
+   void ResetPermission(PermissionType permission,
+                        const GURL& requesting_origin,
+                        const GURL& embedding_origin) override {}
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       PermissionType permission,
+       RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override {}
++  void UnsubscribePermissionStatusChange(SubscriptionId subscription_id) override {}
+ 
+  private:
+   DISALLOW_COPY_AND_ASSIGN(MockPermissionManager);
+diff --git a/content/shell/browser/shell_permission_manager.cc b/content/shell/browser/shell_permission_manager.cc
+index d0396ea346f267a26a8d318d518be59a55b9311a..b302b378960e9cf2445e1e8983d05f6fc2c668b6 100644
+--- a/content/shell/browser/shell_permission_manager.cc
++++ b/content/shell/browser/shell_permission_manager.cc
+@@ -133,16 +133,16 @@ ShellPermissionManager::GetPermissionStatusForFrame(
+           .GetOrigin());
+ }
+ 
+-int ShellPermissionManager::SubscribePermissionStatusChange(
++ShellPermissionManager::SubscriptionId
++ShellPermissionManager::SubscribePermissionStatusChange(
+     PermissionType permission,
+     RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+     base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback) {
+-  return PermissionController::kNoPendingOperation;
++  return SubscriptionId();
+ }
+ 
+ void ShellPermissionManager::UnsubscribePermissionStatusChange(
+-    int subscription_id) {
+-}
++    SubscriptionId subscription_id) {}
+ 
+ }  // namespace content
+diff --git a/content/shell/browser/shell_permission_manager.h b/content/shell/browser/shell_permission_manager.h
+index 85477665a9dd643f50c4567c1133973bc258a94f..ecda464779c39df4a8b4b1726414cf2763033f53 100644
+--- a/content/shell/browser/shell_permission_manager.h
++++ b/content/shell/browser/shell_permission_manager.h
+@@ -42,13 +42,14 @@ class ShellPermissionManager : public PermissionControllerDelegate {
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin) override;
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       PermissionType permission,
+       RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override;
++  void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) override;
+ 
+  private:
+   DISALLOW_COPY_AND_ASSIGN(ShellPermissionManager);
+diff --git a/content/shell/browser/web_test/web_test_permission_manager.cc b/content/shell/browser/web_test/web_test_permission_manager.cc
+index 67f34deebcbf854692be497b1c31d8da72a5b03d..9c876335c3a2feee4f73d9f6f8e14d67f3988291 100644
+--- a/content/shell/browser/web_test/web_test_permission_manager.cc
++++ b/content/shell/browser/web_test/web_test_permission_manager.cc
+@@ -147,7 +147,8 @@ WebTestPermissionManager::GetPermissionStatusForFrame(
+           .GetOrigin());
+ }
+ 
+-int WebTestPermissionManager::SubscribePermissionStatusChange(
++WebTestPermissionManager::SubscriptionId
++WebTestPermissionManager::SubscribePermissionStatusChange(
+     PermissionType permission,
+     RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+@@ -170,14 +171,18 @@ int WebTestPermissionManager::SubscribePermissionStatusChange(
+       GetPermissionStatus(permission, subscription->permission.origin,
+                           subscription->permission.embedding_origin);
+ 
+-  return subscriptions_.Add(std::move(subscription));
++  auto id = subscription_id_generator_.GenerateNextId();
++  subscriptions_.AddWithID(std::move(subscription), id);
++  return id;
+ }
+ 
+ void WebTestPermissionManager::UnsubscribePermissionStatusChange(
+-    int subscription_id) {
++    SubscriptionId subscription_id) {
+   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+ 
+-  // Whether |subscription_id| is known will be checked by the Remove() call.
++  if (!subscriptions_.Lookup(subscription_id))
++    return;
++
+   subscriptions_.Remove(subscription_id);
+ }
+ 
+diff --git a/content/shell/browser/web_test/web_test_permission_manager.h b/content/shell/browser/web_test/web_test_permission_manager.h
+index 1d15dbb9c7dda0b1e8642435d8a1e8f48af72e5c..46490c28fb013c2f5c8e75d7e7e24761f4498a58 100644
+--- a/content/shell/browser/web_test/web_test_permission_manager.h
++++ b/content/shell/browser/web_test/web_test_permission_manager.h
+@@ -52,13 +52,14 @@ class WebTestPermissionManager
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin) override;
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       PermissionType permission,
+       RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override;
++  void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) override;
+ 
+   void SetPermission(PermissionType permission,
+                      blink::mojom::PermissionStatus status,
+@@ -98,7 +99,8 @@ class WebTestPermissionManager
+   };
+ 
+   struct Subscription;
+-  using SubscriptionsMap = base::IDMap<std::unique_ptr<Subscription>>;
++  using SubscriptionsMap =
++      base::IDMap<std::unique_ptr<Subscription>, SubscriptionId>;
+   using PermissionsMap = std::unordered_map<PermissionDescription,
+                                             blink::mojom::PermissionStatus,
+                                             PermissionDescription::Hash>;
+@@ -116,6 +118,7 @@ class WebTestPermissionManager
+ 
+   // List of subscribers currently listening to permission changes.
+   SubscriptionsMap subscriptions_;
++  SubscriptionId::Generator subscription_id_generator_;
+ 
+   mojo::ReceiverSet<blink::test::mojom::PermissionAutomation> receivers_;
+ 
+diff --git a/fuchsia/engine/browser/web_engine_permission_delegate.cc b/fuchsia/engine/browser/web_engine_permission_delegate.cc
+index 98592f05b6d56108119b106a42d839c28131a324..c18b8be7cdf73720cf02afce9ea75ab98d3f1f64 100644
+--- a/fuchsia/engine/browser/web_engine_permission_delegate.cc
++++ b/fuchsia/engine/browser/web_engine_permission_delegate.cc
+@@ -83,20 +83,21 @@ WebEnginePermissionDelegate::GetPermissionStatusForFrame(
+       permission, url::Origin::Create(requesting_origin));
+ }
+ 
+-int WebEnginePermissionDelegate::SubscribePermissionStatusChange(
++WebEnginePermissionDelegate::SubscriptionId
++WebEnginePermissionDelegate::SubscribePermissionStatusChange(
+     content::PermissionType permission,
+     content::RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+     base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback) {
+   // TODO(crbug.com/1063094): Implement permission status subscription. It's
+   // used in blink to emit PermissionStatus.onchange notifications.
+-  NOTIMPLEMENTED() << ": " << static_cast<int>(permission);
+-  return content::PermissionController::kNoPendingOperation;
++  NOTIMPLEMENTED_LOG_ONCE() << ": " << static_cast<int>(permission);
++  return SubscriptionId();
+ }
+ 
+ void WebEnginePermissionDelegate::UnsubscribePermissionStatusChange(
+-    int subscription_id) {
++    SubscriptionId subscription_id) {
+   // TODO(crbug.com/1063094): Implement permission status subscription. It's
+   // used in blink to emit PermissionStatus.onchange notifications.
+-  NOTREACHED();
++  NOTIMPLEMENTED_LOG_ONCE();
+ }
+diff --git a/fuchsia/engine/browser/web_engine_permission_delegate.h b/fuchsia/engine/browser/web_engine_permission_delegate.h
+index 036207b75d33b752981007a41aa51f3e64db4f0e..c39989b471c2a74ee1a9140e12f205866a0b7aff 100644
+--- a/fuchsia/engine/browser/web_engine_permission_delegate.h
++++ b/fuchsia/engine/browser/web_engine_permission_delegate.h
+@@ -45,13 +45,14 @@ class WebEnginePermissionDelegate
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin) override;
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override;
++  void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) override;
+ };
+ 
+ #endif  // FUCHSIA_ENGINE_BROWSER_WEB_ENGINE_PERMISSION_DELEGATE_H_
+diff --git a/headless/lib/browser/headless_permission_manager.cc b/headless/lib/browser/headless_permission_manager.cc
+index 5d4d609fc0c10e57ef3c6a730340dc409789dcdd..359ecdc4b72d560da830c51f23374150e6b30a2d 100644
+--- a/headless/lib/browser/headless_permission_manager.cc
++++ b/headless/lib/browser/headless_permission_manager.cc
+@@ -71,15 +71,16 @@ HeadlessPermissionManager::GetPermissionStatusForFrame(
+   return blink::mojom::PermissionStatus::ASK;
+ }
+ 
+-int HeadlessPermissionManager::SubscribePermissionStatusChange(
++HeadlessPermissionManager::SubscriptionId
++HeadlessPermissionManager::SubscribePermissionStatusChange(
+     content::PermissionType permission,
+     content::RenderFrameHost* render_frame_host,
+     const GURL& requesting_origin,
+     base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback) {
+-  return content::PermissionController::kNoPendingOperation;
++  return SubscriptionId();
+ }
+ 
+ void HeadlessPermissionManager::UnsubscribePermissionStatusChange(
+-    int subscription_id) {}
++    SubscriptionId subscription_id) {}
+ 
+ }  // namespace headless
+diff --git a/headless/lib/browser/headless_permission_manager.h b/headless/lib/browser/headless_permission_manager.h
+index 4b83309ab3ada17f7f2ac3323ba5f13ab76b9409..ac30670cb384a79457033a25c13da0c305b8eff2 100644
+--- a/headless/lib/browser/headless_permission_manager.h
++++ b/headless/lib/browser/headless_permission_manager.h
+@@ -46,13 +46,14 @@ class HeadlessPermissionManager : public content::PermissionControllerDelegate {
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin) override;
+-  int SubscribePermissionStatusChange(
++  SubscriptionId SubscribePermissionStatusChange(
+       content::PermissionType permission,
+       content::RenderFrameHost* render_frame_host,
+       const GURL& requesting_origin,
+       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
+       override;
+-  void UnsubscribePermissionStatusChange(int subscription_id) override;
++  void UnsubscribePermissionStatusChange(
++      SubscriptionId subscription_id) override;
+ 
+  private:
+   content::BrowserContext* browser_context_;
diff --git a/shell/browser/electron_permission_manager.cc b/shell/browser/electron_permission_manager.cc
index c06828be6c36e..b5545829e9d05 100644
--- a/shell/browser/electron_permission_manager.cc
+++ b/shell/browser/electron_permission_manager.cc
@@ -227,16 +227,17 @@ blink::mojom::PermissionStatus ElectronPermissionManager::GetPermissionStatus(
   return blink::mojom::PermissionStatus::GRANTED;
 }
 
-int ElectronPermissionManager::SubscribePermissionStatusChange(
+ElectronPermissionManager::SubscriptionId
+ElectronPermissionManager::SubscribePermissionStatusChange(
     content::PermissionType permission,
     content::RenderFrameHost* render_frame_host,
     const GURL& requesting_origin,
     base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback) {
-  return -1;
+  return SubscriptionId();
 }
 
 void ElectronPermissionManager::UnsubscribePermissionStatusChange(
-    int subscription_id) {}
+    SubscriptionId subscription_id) {}
 
 bool ElectronPermissionManager::CheckPermissionWithDetails(
     content::PermissionType permission,
diff --git a/shell/browser/electron_permission_manager.h b/shell/browser/electron_permission_manager.h
index a347afd8375e7..97aade1b5dc49 100644
--- a/shell/browser/electron_permission_manager.h
+++ b/shell/browser/electron_permission_manager.h
@@ -90,13 +90,14 @@ class ElectronPermissionManager : public content::PermissionControllerDelegate {
       content::PermissionType permission,
       const GURL& requesting_origin,
       const GURL& embedding_origin) override;
-  int SubscribePermissionStatusChange(
+  SubscriptionId SubscribePermissionStatusChange(
       content::PermissionType permission,
       content::RenderFrameHost* render_frame_host,
       const GURL& requesting_origin,
       base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback)
       override;
-  void UnsubscribePermissionStatusChange(int subscription_id) override;
+  void UnsubscribePermissionStatusChange(
+      SubscriptionId subscription_id) override;
 
  private:
   class PendingRequest;

From a5e40fea7dca95982c0af597983cb344d087ab1c Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Mon, 26 Apr 2021 09:16:38 +0200
Subject: [PATCH 16/48] chore: cherry-pick 6b84dc72351b from chromium (#28808)

* chore: cherry-pick 6b84dc72351b from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-6b84dc72351b.patch   | 82 +++++++++++++++++++
 2 files changed, 83 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-6b84dc72351b.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 5690a270297c5..a7ef0f8e0f363 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -166,3 +166,4 @@ cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
 cherry-pick-8c3eb9d1c409.patch
 use_idtype_for_permission_change_subscriptions.patch
+cherry-pick-6b84dc72351b.patch
diff --git a/patches/chromium/cherry-pick-6b84dc72351b.patch b/patches/chromium/cherry-pick-6b84dc72351b.patch
new file mode 100644
index 0000000000000..caec3db896ac6
--- /dev/null
+++ b/patches/chromium/cherry-pick-6b84dc72351b.patch
@@ -0,0 +1,82 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Brendon Tiszka <btiszka@gmail.com>
+Date: Tue, 20 Apr 2021 15:45:03 +0000
+Subject: M86-LTS: Ensure that BrowserContext is not used after it has been
+ freed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Previously, it was possible for the BrowserContext to be destroyed
+before ReportAnchorElementMetricsOnClick attempted to access it.
+
+The fix uses the fact that NavigationPredictor extends
+WebContentsObserver and checks that web_contents is still alive
+before dereferencing BrowserContext. WebContents will always
+outlive BrowserContext.
+
+R=​lukasza@chromium.org, ryansturm@chromium.org
+
+(cherry picked from commit 7313a810ae0b1361cbe8453bc5496654dee24c76)
+
+Bug: 1197904
+Change-Id: Iee4f126e92670a84d57c7a4ec7d6f702fb975c7e
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821639
+Reviewed-by: Ryan Sturm <ryansturm@chromium.org>
+Reviewed-by: Łukasz Anforowicz <lukasza@chromium.org>
+Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#872021}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2838328
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Auto-Submit: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Artem Sumaneev <asumaneev@google.com>
+Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1613}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/AUTHORS b/AUTHORS
+index 3aa101a8d38a899fefcca149e4ac8e658188e590..cccc1f6d1407183806e78cb99e56abe7bd93de82 100644
+--- a/AUTHORS
++++ b/AUTHORS
+@@ -145,6 +145,7 @@ Bobby Powers <bobbypowers@gmail.com>
+ Branden Archer <bma4@zips.uakron.edu>
+ Brendan Kirby <brendan.kirby@imgtec.com>
+ Brendan Long <self@brendanlong.com>
++Brendon Tiszka <btiszka@gmail.com>
+ Brian Clifton <clifton@brave.com>
+ Brian G. Merrell <bgmerrell@gmail.com>
+ Brian Konzman, SJ <b.g.konzman@gmail.com>
+diff --git a/chrome/browser/navigation_predictor/navigation_predictor.cc b/chrome/browser/navigation_predictor/navigation_predictor.cc
+index 495bb165a30f2b1bf690e6d0724ad8f347a76d44..b62a97501565555493f4db82ce4a1ababff19eb6 100644
+--- a/chrome/browser/navigation_predictor/navigation_predictor.cc
++++ b/chrome/browser/navigation_predictor/navigation_predictor.cc
+@@ -506,6 +506,9 @@ void NavigationPredictor::ReportAnchorElementMetricsOnClick(
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+   DCHECK(base::FeatureList::IsEnabled(blink::features::kNavigationPredictor));
+ 
++  if (!web_contents())
++    return;
++
+   if (browser_context_->IsOffTheRecord())
+     return;
+ 
+@@ -652,6 +655,9 @@ void NavigationPredictor::ReportAnchorElementMetricsOnLoad(
+   // Each document should only report metrics once when page is loaded.
+   DCHECK(navigation_scores_map_.empty());
+ 
++  if (!web_contents())
++    return;
++
+   if (browser_context_->IsOffTheRecord())
+     return;
+ 
+@@ -897,6 +903,9 @@ void NavigationPredictor::MaybeTakeActionOnLoad(
+ }
+ 
+ void NavigationPredictor::MaybePrefetch() {
++  if (!web_contents())
++    return;
++
+   // If prefetches aren't allowed here, this URL has already
+   // been prefetched, or the current tab is hidden,
+   // we shouldn't prefetch again.

From 049b1d08170c4d5c082ab11c8f03a3a5a44f3cd1 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Mon, 26 Apr 2021 09:30:37 +0200
Subject: [PATCH 17/48] chore: cherry-pick ffde6ee0e4 from v8 (#28800)

---
 patches/v8/.patches                           |   1 +
 .../v8/merged_squashed_multiple_commits.patch | 202 ++++++++++++++++++
 2 files changed, 203 insertions(+)
 create mode 100644 patches/v8/merged_squashed_multiple_commits.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index baef29ebe0167..f9f171b7015df 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -28,3 +28,4 @@ regexp_throw_when_length_of_text_nodes_in_alternatives_is_too.patch
 cherry-pick-02f84c745fc0.patch
 merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch
 cherry-pick-512cd5e179f4.patch
+merged_squashed_multiple_commits.patch
diff --git a/patches/v8/merged_squashed_multiple_commits.patch b/patches/v8/merged_squashed_multiple_commits.patch
new file mode 100644
index 0000000000000..e94ad38afb84a
--- /dev/null
+++ b/patches/v8/merged_squashed_multiple_commits.patch
@@ -0,0 +1,202 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Wed, 10 Mar 2021 09:45:36 +0100
+Subject: Merged: Squashed multiple commits.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Merged: [const-tracking] Mark const field as mutable when reconfiguring
+Revision: 7535b91f7cb22274de734d5da7d0324d8653d626
+
+Merged: [const-tracking] Fix incorrect DCHECK in MapUpdater
+Revision: f95db8916a731e6e5ccc0282616bc907ce06012f
+
+BUG=chromium:1161847,chromium:1185463,v8:9233
+NOTRY=true
+NOPRESUBMIT=true
+NOTREECHECKS=true
+R=​ishell@chromium.org
+
+(cherry picked from commit 56518020bff4d0e8b82cff843c9f618c90084e42)
+
+Change-Id: I7f46a701646e1dd67a049b2aa4ac32d05b6885f3
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2748079
+Commit-Queue: Georg Neis <neis@chromium.org>
+Reviewed-by: Igor Sheludko <ishell@chromium.org>
+Cr-Original-Commit-Position: refs/branch-heads/8.9@{#43}
+Cr-Original-Branched-From: 16b9bbbd581c25391981aa03180b76aa60463a3e-refs/heads/8.9.255@{#1}
+Cr-Original-Branched-From: d16a2a688498bd1c3e6a49edb25d8c4ca56232dc-refs/heads/master@{#72039}
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794428
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Commit-Queue: Artem Sumaneev <asumaneev@google.com>
+Cr-Commit-Position: refs/branch-heads/8.6@{#73}
+Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
+Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
+
+diff --git a/src/objects/map-updater.cc b/src/objects/map-updater.cc
+index b4b158749381efcf780d5c8ba07c286be6ba6b30..047750ebbd454a5f3f1fce7bc06ac042085245a4 100644
+--- a/src/objects/map-updater.cc
++++ b/src/objects/map-updater.cc
+@@ -121,6 +121,41 @@ Handle<Map> MapUpdater::ReconfigureToDataField(InternalIndex descriptor,
+   PropertyDetails old_details =
+       old_descriptors_->GetDetails(modified_descriptor_);
+ 
++  // If the {descriptor} was "const" data field so far, we need to update the
++  // {old_map_} here, otherwise we could get the constants wrong, i.e.
++  //
++  //   o.x = 1;
++  //   change o.x's attributes to something else
++  //   delete o.x;
++  //   o.x = 2;
++  //
++  // could trick V8 into thinking that `o.x` is still 1 even after the second
++  // assignment.
++  // This situation is similar to what might happen with property deletion.
++  if (old_details.constness() == PropertyConstness::kConst &&
++      old_details.location() == kField &&
++      old_details.attributes() != new_attributes_) {
++    Handle<FieldType> field_type(
++        old_descriptors_->GetFieldType(modified_descriptor_), isolate_);
++    Map::GeneralizeField(isolate_, old_map_, descriptor,
++                         PropertyConstness::kMutable,
++                         old_details.representation(), field_type);
++    // The old_map_'s property must become mutable.
++    // Note, that the {old_map_} and {old_descriptors_} are not expected to be
++    // updated by the generalization if the map is already deprecated.
++    DCHECK_IMPLIES(
++        !old_map_->is_deprecated(),
++        PropertyConstness::kMutable ==
++            old_descriptors_->GetDetails(modified_descriptor_).constness());
++    // Although the property in the old map is marked as mutable we still
++    // treat it as constant when merging with the new path in transition tree.
++    // This is fine because up until this reconfiguration the field was
++    // known to be constant, so it's fair to proceed treating it as such
++    // during this reconfiguration session. The issue is that after the
++    // reconfiguration the original field might become mutable (see the delete
++    // example above).
++  }
++
+   // If property kind is not reconfigured merge the result with
+   // representation/field type from the old descriptor.
+   if (old_details.kind() == new_kind_) {
+diff --git a/test/cctest/test-field-type-tracking.cc b/test/cctest/test-field-type-tracking.cc
+index 740ae05c1eaf8104ad5c3c443b2e39429fc7fca5..99ffbe9bac6094c70ffda3f362ef0d0997d61fc1 100644
+--- a/test/cctest/test-field-type-tracking.cc
++++ b/test/cctest/test-field-type-tracking.cc
+@@ -1081,20 +1081,31 @@ void TestReconfigureDataFieldAttribute_GeneralizeField(
+   Handle<Code> code_field_type = CreateDummyOptimizedCode(isolate);
+   Handle<Code> code_field_repr = CreateDummyOptimizedCode(isolate);
+   Handle<Code> code_field_const = CreateDummyOptimizedCode(isolate);
+-  Handle<Map> field_owner(
+-      map->FindFieldOwner(isolate, InternalIndex(kSplitProp)), isolate);
+-  DependentCode::InstallDependency(isolate,
+-                                   MaybeObjectHandle::Weak(code_field_type),
+-                                   field_owner, DependentCode::kFieldTypeGroup);
+-  DependentCode::InstallDependency(
+-      isolate, MaybeObjectHandle::Weak(code_field_repr), field_owner,
+-      DependentCode::kFieldRepresentationGroup);
+-  DependentCode::InstallDependency(
+-      isolate, MaybeObjectHandle::Weak(code_field_const), field_owner,
+-      DependentCode::kFieldConstGroup);
++  Handle<Code> code_src_field_const = CreateDummyOptimizedCode(isolate);
++  {
++    Handle<Map> field_owner(
++        map->FindFieldOwner(isolate, InternalIndex(kSplitProp)), isolate);
++    DependentCode::InstallDependency(
++        isolate, MaybeObjectHandle::Weak(code_field_type), field_owner,
++        DependentCode::kFieldTypeGroup);
++    DependentCode::InstallDependency(
++        isolate, MaybeObjectHandle::Weak(code_field_repr), field_owner,
++        DependentCode::kFieldRepresentationGroup);
++    DependentCode::InstallDependency(
++        isolate, MaybeObjectHandle::Weak(code_field_const), field_owner,
++        DependentCode::kFieldConstGroup);
++  }
++  {
++    Handle<Map> field_owner(
++        map2->FindFieldOwner(isolate, InternalIndex(kSplitProp)), isolate);
++    DependentCode::InstallDependency(
++        isolate, MaybeObjectHandle::Weak(code_src_field_const), field_owner,
++        DependentCode::kFieldConstGroup);
++  }
+   CHECK(!code_field_type->marked_for_deoptimization());
+   CHECK(!code_field_repr->marked_for_deoptimization());
+   CHECK(!code_field_const->marked_for_deoptimization());
++  CHECK(!code_src_field_const->marked_for_deoptimization());
+ 
+   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
+   // should generalize representations in |map1|.
+@@ -1102,10 +1113,21 @@ void TestReconfigureDataFieldAttribute_GeneralizeField(
+       Map::ReconfigureExistingProperty(isolate, map2, InternalIndex(kSplitProp),
+                                        kData, NONE, PropertyConstness::kConst);
+ 
+-  // |map2| should be left unchanged but marked unstable.
++  // |map2| should be mosly left unchanged but marked unstable and if the
++  // source property was constant it should also be transitioned to kMutable.
+   CHECK(!map2->is_stable());
+   CHECK(!map2->is_deprecated());
+   CHECK_NE(*map2, *new_map);
++  // If the "source" property was const then update constness expectations for
++  // "source" map and ensure the deoptimization dependency was triggered.
++  if (to.constness == PropertyConstness::kConst) {
++    expectations2.SetDataField(kSplitProp, READ_ONLY,
++                               PropertyConstness::kMutable, to.representation,
++                               to.type);
++    CHECK(code_src_field_const->marked_for_deoptimization());
++  } else {
++    CHECK(!code_src_field_const->marked_for_deoptimization());
++  }
+   CHECK(expectations2.Check(*map2));
+ 
+   for (int i = kSplitProp; i < kPropCount; i++) {
+diff --git a/test/mjsunit/regress/regress-crbug-1161847-1.js b/test/mjsunit/regress/regress-crbug-1161847-1.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..282d9b878718105db40fee0283d15227fb724a3a
+--- /dev/null
++++ b/test/mjsunit/regress/regress-crbug-1161847-1.js
+@@ -0,0 +1,19 @@
++// Copyright 2021 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --allow-natives-syntax
++
++function foo(first_run) {
++  let o = { x: 0 };
++  if (first_run) assertTrue(%HasOwnConstDataProperty(o, 'x'));
++  Object.defineProperty(o, 'x', { writable: false });
++  delete o.x;
++  o.x = 23;
++  if (first_run) assertFalse(%HasOwnConstDataProperty(o, 'x'));
++}
++%PrepareFunctionForOptimization(foo);
++foo(true);
++foo(false);
++%OptimizeFunctionOnNextCall(foo);
++foo(false);
+diff --git a/test/mjsunit/regress/regress-crbug-1161847-2.js b/test/mjsunit/regress/regress-crbug-1161847-2.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..ec61fee068acea0ea259164816142a01851f3669
+--- /dev/null
++++ b/test/mjsunit/regress/regress-crbug-1161847-2.js
+@@ -0,0 +1,19 @@
++// Copyright 2021 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --allow-natives-syntax
++
++function foo(first_run) {
++  let o = { x: 0 };
++  if (first_run) assertTrue(%HasOwnConstDataProperty(o, 'x'));
++  Object.defineProperty(o, 'x', { get() { return 1; }, configurable: true, enumerable: true });
++  delete o.x;
++  o.x = 23;
++  if (first_run) assertFalse(%HasOwnConstDataProperty(o, 'x'));
++}
++%PrepareFunctionForOptimization(foo);
++foo(true);
++foo(false);
++%OptimizeFunctionOnNextCall(foo);
++foo(false);

From 5593485831e71a8538667d3e3f71215c82dca42e Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Mon, 26 Apr 2021 11:49:43 +0200
Subject: [PATCH 18/48] fix: only set backgroundColor in default-app for
 default index.html (#28840)

Co-authored-by: Milan Burda <milan.burda@gmail.com>
---
 default_app/default_app.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/default_app/default_app.ts b/default_app/default_app.ts
index 7c2d8a3b9eecb..08d1c7ce39558 100644
--- a/default_app/default_app.ts
+++ b/default_app/default_app.ts
@@ -41,14 +41,14 @@ ipcMain.handle('bootstrap', (event) => {
   return isTrustedSender(event.sender) ? electronPath : null;
 });
 
-async function createWindow () {
+async function createWindow (backgroundColor?: string) {
   await app.whenReady();
 
   const options: Electron.BrowserWindowConstructorOptions = {
     width: 960,
     height: 620,
     autoHideMenuBar: true,
-    backgroundColor: '#2f3241',
+    backgroundColor,
     webPreferences: {
       preload: path.resolve(__dirname, 'preload.js'),
       contextIsolation: true,
@@ -96,7 +96,7 @@ export const loadURL = async (appUrl: string) => {
 };
 
 export const loadFile = async (appPath: string) => {
-  mainWindow = await createWindow();
+  mainWindow = await createWindow(appPath === 'index.html' ? '#2f3241' : undefined);
   mainWindow.loadFile(appPath);
   mainWindow.focus();
 };

From 95d9d7ddfed6e3d81270ca625c9ce37de9e38dd3 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Mon, 26 Apr 2021 13:08:57 +0200
Subject: [PATCH 19/48] chore: cherry-pick fe20b05a0e5e from chromium (#28780)

* chore: cherry-pick fe20b05a0e5e from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: Cheng Zhao <zcbenz@gmail.com>
---
 patches/chromium/.patches                     |   1 +
 .../chromium/cherry-pick-fe20b05a0e5e.patch   | 140 ++++++++++++++++++
 2 files changed, 141 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-fe20b05a0e5e.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index a7ef0f8e0f363..9facf1bacb806 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -166,4 +166,5 @@ cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
 cherry-pick-8c3eb9d1c409.patch
 use_idtype_for_permission_change_subscriptions.patch
+cherry-pick-fe20b05a0e5e.patch
 cherry-pick-6b84dc72351b.patch
diff --git a/patches/chromium/cherry-pick-fe20b05a0e5e.patch b/patches/chromium/cherry-pick-fe20b05a0e5e.patch
new file mode 100644
index 0000000000000..ece508e56af62
--- /dev/null
+++ b/patches/chromium/cherry-pick-fe20b05a0e5e.patch
@@ -0,0 +1,140 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jana Grill <janagrill@google.com>
+Date: Tue, 20 Apr 2021 18:23:33 +0000
+Subject: M86-LTS: DevTools: expect PageHandler may be destroyed during
+ Page.navigate
+
+(cherry picked from commit ff5e70191ec701cce4f84aaa25cd676376253a8a)
+
+Bug: 1188889
+Change-Id: I5c2fcca84834d66c46d77a70683212c2330177a5
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2787756
+Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
+Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
+Reviewed-by: Karan Bhatia <karandeepb@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#867507}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821536
+Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1618}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/chrome/browser/extensions/api/debugger/debugger_apitest.cc b/chrome/browser/extensions/api/debugger/debugger_apitest.cc
+index 71ce5a3399db29451e990d530736460aa28eeec0..b35accc8ce46f3465624898fe18d463529498d07 100644
+--- a/chrome/browser/extensions/api/debugger/debugger_apitest.cc
++++ b/chrome/browser/extensions/api/debugger/debugger_apitest.cc
+@@ -24,6 +24,7 @@
+ #include "components/sessions/content/session_tab_helper.h"
+ #include "content/public/test/browser_test.h"
+ #include "content/public/test/browser_test_utils.h"
++#include "content/public/test/no_renderer_crashes_assertion.h"
+ #include "extensions/browser/extension_function.h"
+ #include "extensions/common/extension.h"
+ #include "extensions/common/extension_builder.h"
+@@ -353,6 +354,19 @@ IN_PROC_BROWSER_TEST_F(DebuggerExtensionApiTest,
+       << message_;
+ }
+ 
++// Tests that navigation to a forbidden URL is properly denied and
++// does not cause a crash.
++// This is a regression test for https://crbug.com/1188889.
++IN_PROC_BROWSER_TEST_F(DebuggerExtensionApiTest, DISABLED_NavigateToForbiddenUrl) {
++  content::ScopedAllowRendererCrashes scoped_allow_renderer_crashes;
++  // We don't send a DevTools command callback before disconnecting the session,
++  // so the extension does not receive a callback either.
++  base::AutoReset<bool> ignore_did_respond(
++      &ExtensionFunction::ignore_all_did_respond_for_testing_do_not_use, true);
++  ASSERT_TRUE(RunExtensionTest("debugger_navigate_to_forbidden_url"))
++      << message_;
++}
++
+ class SitePerProcessDebuggerExtensionApiTest : public DebuggerExtensionApiTest {
+  public:
+   void SetUpCommandLine(base::CommandLine* command_line) override {
+diff --git a/chrome/test/data/extensions/api_test/debugger_navigate_to_forbidden_url/background.js b/chrome/test/data/extensions/api_test/debugger_navigate_to_forbidden_url/background.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..e2ef32fffd3e5d49e7dc10d53f8c891ddb0f3872
+--- /dev/null
++++ b/chrome/test/data/extensions/api_test/debugger_navigate_to_forbidden_url/background.js
+@@ -0,0 +1,28 @@
++// Copyright 2021 The Chromium Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++const protocolVersion = '1.3';
++const DETACHED_WHILE_HANDLING = 'Detached while handling command.';
++
++chrome.test.runTests([
++  async function testNavigateToForbiddenUrl() {
++    const {openTab} = await import('/_test_resources/test_util/tabs_util.js');
++    const tab = await openTab('about:blank');
++    const debuggee = {tabId: tab.id};
++    await new Promise(resolve =>
++        chrome.debugger.attach(debuggee, protocolVersion, resolve));
++    chrome.debugger.sendCommand(debuggee, 'Page.crash');
++    await new Promise(resolve =>
++        chrome.debugger.onEvent.addListener((source, method, params) => {
++          if (method === 'Inspector.targetCrashed')
++            resolve();
++        }));
++    const result = await new Promise(resolve =>
++      chrome.debugger.sendCommand(debuggee, 'Page.navigate', {
++          url: 'chrome://version'
++      }, resolve));
++    chrome.test.assertLastError(DETACHED_WHILE_HANDLING);
++    chrome.test.succeed();
++  }
++]);
+diff --git a/chrome/test/data/extensions/api_test/debugger_navigate_to_forbidden_url/manifest.json b/chrome/test/data/extensions/api_test/debugger_navigate_to_forbidden_url/manifest.json
+new file mode 100644
+index 0000000000000000000000000000000000000000..05db294ed7f49893431b0039a5f338d20e08f27d
+--- /dev/null
++++ b/chrome/test/data/extensions/api_test/debugger_navigate_to_forbidden_url/manifest.json
+@@ -0,0 +1,11 @@
++{
++  "name": "Debugger API test for CDP-initiated navigation to forbidden URLs",
++  "version": "1.0",
++  "manifest_version": 2,
++  "background": {
++    "scripts": ["background.js"]
++  },
++  "permissions": [
++    "debugger"
++  ]
++}
+diff --git a/content/browser/devtools/protocol/page_handler.cc b/content/browser/devtools/protocol/page_handler.cc
+index 630de0dd016fd3d054bcd40b22d75a242eeaa23e..a340d3e4519ada9edba279090ea11b57521ef0f4 100644
+--- a/content/browser/devtools/protocol/page_handler.cc
++++ b/content/browser/devtools/protocol/page_handler.cc
+@@ -496,7 +496,12 @@ void PageHandler::Navigate(const std::string& url,
+   params.referrer = Referrer(GURL(referrer.fromMaybe("")), policy);
+   params.transition_type = type;
+   params.frame_tree_node_id = frame_tree_node->frame_tree_node_id();
++  // Handler may be destroyed while navigating if the session
++  // gets disconnected as a result of access checks.
++  base::WeakPtr<PageHandler> weak_self = weak_factory_.GetWeakPtr();
+   frame_tree_node->navigator().GetController()->LoadURLWithParams(params);
++  if (!weak_self)
++    return;
+ 
+   base::UnguessableToken frame_token = frame_tree_node->devtools_frame_token();
+   auto navigate_callback = navigate_callbacks_.find(frame_token);
+diff --git a/content/browser/devtools/render_frame_devtools_agent_host.cc b/content/browser/devtools/render_frame_devtools_agent_host.cc
+index 52fdd0f1066699cc019c33de2517c23f12b4a616..8795c547717b206f4e459f655f6e62a7ba9229e0 100644
+--- a/content/browser/devtools/render_frame_devtools_agent_host.cc
++++ b/content/browser/devtools/render_frame_devtools_agent_host.cc
+@@ -472,8 +472,11 @@ void RenderFrameDevToolsAgentHost::UpdateFrameHost(
+     if (!ShouldAllowSession(session))
+       restricted_sessions.push_back(session);
+   }
+-  if (!restricted_sessions.empty())
++  scoped_refptr<RenderFrameDevToolsAgentHost> protect;
++  if (!restricted_sessions.empty()) {
++    protect = this;
+     ForceDetachRestrictedSessions(restricted_sessions);
++  }
+ 
+   UpdateFrameAlive();
+ }

From 3fe97b1b1b166b6579cea631e026d00c0c09ea7f Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Mon, 26 Apr 2021 13:09:36 +0200
Subject: [PATCH 20/48] chore: cherry-pick 8ebd894186 and 1e35f64725 from v8
 (#28811)

* chore: cherry-pick 8ebd894186 and 1e35f64725 from v8

* update patches

Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: Cheng Zhao <zcbenz@gmail.com>
---
 patches/v8/.patches                           |  2 +
 ..._array_prototype_concat_with_species.patch | 96 +++++++++++++++++++
 ...iltins_harden_array_prototype_concat.patch | 79 +++++++++++++++
 3 files changed, 177 insertions(+)
 create mode 100644 patches/v8/lts-m86_builtins_fix_array_prototype_concat_with_species.patch
 create mode 100644 patches/v8/lts-m86_builtins_harden_array_prototype_concat.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index f9f171b7015df..bc8b71bf99c10 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -28,4 +28,6 @@ regexp_throw_when_length_of_text_nodes_in_alternatives_is_too.patch
 cherry-pick-02f84c745fc0.patch
 merged_deoptimizer_fix_bug_in_optimizedframe_summarize.patch
 cherry-pick-512cd5e179f4.patch
+lts-m86_builtins_fix_array_prototype_concat_with_species.patch
+lts-m86_builtins_harden_array_prototype_concat.patch
 merged_squashed_multiple_commits.patch
diff --git a/patches/v8/lts-m86_builtins_fix_array_prototype_concat_with_species.patch b/patches/v8/lts-m86_builtins_fix_array_prototype_concat_with_species.patch
new file mode 100644
index 0000000000000..de0269a10a104
--- /dev/null
+++ b/patches/v8/lts-m86_builtins_fix_array_prototype_concat_with_species.patch
@@ -0,0 +1,96 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Igor Sheludko <ishell@chromium.org>
+Date: Wed, 7 Apr 2021 19:12:32 +0200
+Subject: Fix Array.prototype.concat with @@species
+
+(cherry picked from commit 7989e04979c3195e60a6814e8263063eb91f7b47)
+
+No-Try: true
+No-Presubmit: true
+No-Tree-Checks: true
+Bug: chromium:1195977
+Change-Id: I16843bce2e9f776abca0f2b943b898ab5e597e42
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810787
+Reviewed-by: Camillo Bruni <cbruni@chromium.org>
+Commit-Queue: Igor Sheludko <ishell@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#73842}
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823829
+Commit-Queue: Jana Grill <janagrill@chromium.org>
+Reviewed-by: Igor Sheludko <ishell@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Cr-Commit-Position: refs/branch-heads/8.6@{#77}
+Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
+Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
+
+diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
+index 3c2fe33c5b4b330c509d2926bc1e30daa1e09dba..938fb96c1d42d8152f974df33c3bed4cc1b542d3 100644
+--- a/src/builtins/builtins-array.cc
++++ b/src/builtins/builtins-array.cc
+@@ -649,11 +649,14 @@ class ArrayConcatVisitor {
+         index_offset_(0u),
+         bit_field_(FastElementsField::encode(fast_elements) |
+                    ExceedsLimitField::encode(false) |
+-                   IsFixedArrayField::encode(storage->IsFixedArray()) |
++                   IsFixedArrayField::encode(storage->IsFixedArray(isolate)) |
+                    HasSimpleElementsField::encode(
+-                       storage->IsFixedArray() ||
+-                       !storage->map().IsCustomElementsReceiverMap())) {
+-    DCHECK(!(this->fast_elements() && !is_fixed_array()));
++                       storage->IsFixedArray(isolate) ||
++                       // Don't take fast path for storages that might have
++                       // side effects when storing to them.
++                       (!storage->map(isolate).IsCustomElementsReceiverMap() &&
++                        !storage->IsJSTypedArray(isolate)))) {
++    DCHECK_IMPLIES(this->fast_elements(), is_fixed_array());
+   }
+ 
+   ~ArrayConcatVisitor() { clear_storage(); }
+@@ -1063,8 +1066,8 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
+     return IterateElementsSlow(isolate, receiver, length, visitor);
+   }
+ 
+-  if (!HasOnlySimpleElements(isolate, *receiver) ||
+-      !visitor->has_simple_elements()) {
++  if (!visitor->has_simple_elements() ||
++      !HasOnlySimpleElements(isolate, *receiver)) {
+     return IterateElementsSlow(isolate, receiver, length, visitor);
+   }
+   Handle<JSObject> array = Handle<JSObject>::cast(receiver);
+diff --git a/src/objects/fixed-array-inl.h b/src/objects/fixed-array-inl.h
+index adde6c7c1f7958643c46aedf8be33300d36f6306..1bc26ed1747d85d17da218f7521ff3a26bbdf25f 100644
+--- a/src/objects/fixed-array-inl.h
++++ b/src/objects/fixed-array-inl.h
+@@ -320,7 +320,7 @@ int Search(T* array, Name name, int valid_entries, int* out_insertion_index,
+ double FixedDoubleArray::get_scalar(int index) {
+   DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+          map() != GetReadOnlyRoots().fixed_array_map());
+-  DCHECK(index >= 0 && index < this->length());
++  DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
+   DCHECK(!is_the_hole(index));
+   return ReadField<double>(kHeaderSize + index * kDoubleSize);
+ }
+@@ -328,7 +328,7 @@ double FixedDoubleArray::get_scalar(int index) {
+ uint64_t FixedDoubleArray::get_representation(int index) {
+   DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+          map() != GetReadOnlyRoots().fixed_array_map());
+-  DCHECK(index >= 0 && index < this->length());
++  DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
+   int offset = kHeaderSize + index * kDoubleSize;
+   // Bug(v8:8875): Doubles may be unaligned.
+   return base::ReadUnalignedValue<uint64_t>(field_address(offset));
+@@ -346,6 +346,7 @@ Handle<Object> FixedDoubleArray::get(FixedDoubleArray array, int index,
+ void FixedDoubleArray::set(int index, double value) {
+   DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+          map() != GetReadOnlyRoots().fixed_array_map());
++  DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
+   int offset = kHeaderSize + index * kDoubleSize;
+   if (std::isnan(value)) {
+     WriteField<double>(offset, std::numeric_limits<double>::quiet_NaN());
+@@ -362,6 +363,7 @@ void FixedDoubleArray::set_the_hole(Isolate* isolate, int index) {
+ void FixedDoubleArray::set_the_hole(int index) {
+   DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+          map() != GetReadOnlyRoots().fixed_array_map());
++  DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
+   int offset = kHeaderSize + index * kDoubleSize;
+   base::WriteUnalignedValue<uint64_t>(field_address(offset), kHoleNanInt64);
+ }
diff --git a/patches/v8/lts-m86_builtins_harden_array_prototype_concat.patch b/patches/v8/lts-m86_builtins_harden_array_prototype_concat.patch
new file mode 100644
index 0000000000000..b3516e25daa20
--- /dev/null
+++ b/patches/v8/lts-m86_builtins_harden_array_prototype_concat.patch
@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jana Grill <janagrill@google.com>
+Date: Tue, 13 Apr 2021 16:54:14 +0200
+Subject: Harden Array.prototype.concat.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Defence in depth patch to prevent JavaScript from executing
+from within IterateElements.
+
+R=​ishell@chromium.org
+R=​cbruni@chromium.org
+
+(cherry picked from commit 8284359ed0607e452a4dda2ce89811fb019b4aaa)
+
+No-Try: true
+No-Presubmit: true
+No-Tree-Checks: true
+Bug: chromium:1195977
+Change-Id: Ie59d468b73b94818cea986a3ded0804f6dddd10b
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2819941
+Reviewed-by: Camillo Bruni <cbruni@chromium.org>
+Reviewed-by: Igor Sheludko <ishell@chromium.org>
+Commit-Queue: Igor Sheludko <ishell@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#73898}
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821961
+Commit-Queue: Jana Grill <janagrill@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Cr-Commit-Position: refs/branch-heads/8.6@{#76}
+Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
+Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
+
+diff --git a/AUTHORS b/AUTHORS
+index 31a46b9bec0757c78650124793ba30def5f438f7..09e7fe40fd13b9fb65d5900489554f9b76072eab 100644
+--- a/AUTHORS
++++ b/AUTHORS
+@@ -66,6 +66,7 @@ Ben Newman <ben@meteor.com>
+ Ben Noordhuis <info@bnoordhuis.nl>
+ Benjamin Tan <demoneaux@gmail.com>
+ Bert Belder <bertbelder@gmail.com>
++Brendon Tiszka <btiszka@gmail.com>
+ Burcu Dogan <burcujdogan@gmail.com>
+ Caitlin Potter <caitpotter88@gmail.com>
+ Craig Schlenter <craig.schlenter@gmail.com>
+diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
+index 938fb96c1d42d8152f974df33c3bed4cc1b542d3..8055d8382d48f618d8fcd3b18f48b2da04fa3f69 100644
+--- a/src/builtins/builtins-array.cc
++++ b/src/builtins/builtins-array.cc
+@@ -1083,6 +1083,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
+     case HOLEY_SEALED_ELEMENTS:
+     case HOLEY_NONEXTENSIBLE_ELEMENTS:
+     case HOLEY_ELEMENTS: {
++      // Disallow execution so the cached elements won't change mid execution.
++      DisallowJavascriptExecution no_js(isolate);
++
+       // Run through the elements FixedArray and use HasElement and GetElement
+       // to check the prototype for missing elements.
+       Handle<FixedArray> elements(FixedArray::cast(array->elements()), isolate);
+@@ -1109,6 +1112,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
+     }
+     case HOLEY_DOUBLE_ELEMENTS:
+     case PACKED_DOUBLE_ELEMENTS: {
++      // Disallow execution so the cached elements won't change mid execution.
++      DisallowJavascriptExecution no_js(isolate);
++
+       // Empty array is FixedArray but not FixedDoubleArray.
+       if (length == 0) break;
+       // Run through the elements FixedArray and use HasElement and GetElement
+@@ -1145,6 +1151,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
+     }
+ 
+     case DICTIONARY_ELEMENTS: {
++      // Disallow execution so the cached dictionary won't change mid execution.
++      DisallowJavascriptExecution no_js(isolate);
++
+       Handle<NumberDictionary> dict(array->element_dictionary(), isolate);
+       std::vector<uint32_t> indices;
+       indices.reserve(dict->Capacity() / 2);

From d3152808bbbdd074a3e47bcd63a2ad3998cd3060 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Mon, 26 Apr 2021 18:35:15 +0200
Subject: [PATCH 21/48] chore: cherry-pick 8f054c5df2 and de1dbdb608 from
 chromium (#28823)

* chore: cherry-pick 8f054c5df2 and de1dbdb608 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
---
 patches/chromium/.patches                     |   2 +
 ..._in_renderwidgethostinputeventrouter.patch |  36 ++++
 ...er_to_rwhier_framesinkidownermap_and.patch | 168 ++++++++++++++++++
 3 files changed, 206 insertions(+)
 create mode 100644 patches/chromium/m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
 create mode 100644 patches/chromium/m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 9facf1bacb806..0bb5d0c2bb439 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -166,5 +166,7 @@ cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
 cherry-pick-8c3eb9d1c409.patch
 use_idtype_for_permission_change_subscriptions.patch
+m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
+m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
 cherry-pick-fe20b05a0e5e.patch
 cherry-pick-6b84dc72351b.patch
diff --git a/patches/chromium/m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch b/patches/chromium/m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
new file mode 100644
index 0000000000000..2ec494c9b53fc
--- /dev/null
+++ b/patches/chromium/m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lan Wei <lanwei@chromium.org>
+Date: Tue, 20 Apr 2021 17:08:53 +0000
+Subject: M86-LTS: Add null pointer check in RenderWidgetHostInputEventRouter
+
+We have some crashes in RenderWidgetHostInputEventRouter class, we are
+adding some null pointer check in this class to avoid the crash.
+
+(cherry picked from commit 5f47666b79ac7ded20e1c7657037498561bd3352)
+
+Bug: 1155297
+Change-Id: I3b63d5748523ae2ce8ab469832adfc75d586e411
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2818680
+Reviewed-by: Charlie Reis <creis@chromium.org>
+Commit-Queue: Lan Wei <lanwei@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#871108}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2838329
+Reviewed-by: Lan Wei <lanwei@chromium.org>
+Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1617}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/content/browser/renderer_host/render_widget_host_input_event_router.cc b/content/browser/renderer_host/render_widget_host_input_event_router.cc
+index f45da60a8f8cdeb6406e123554c05c4f399b0433..d88d28c2d4b09a00a9a42b59acad898d6516c158 100644
+--- a/content/browser/renderer_host/render_widget_host_input_event_router.cc
++++ b/content/browser/renderer_host/render_widget_host_input_event_router.cc
+@@ -1949,7 +1949,7 @@ void RenderWidgetHostInputEventRouter::OnAggregatedHitTestRegionListUpdated(
+     const std::vector<viz::AggregatedHitTestRegion>& hit_test_data) {
+   for (auto& region : hit_test_data) {
+     auto iter = owner_map_.find(region.frame_sink_id);
+-    if (iter != owner_map_.end())
++    if (iter != owner_map_.end() && iter->second)
+       iter->second->NotifyHitTestRegionUpdated(region);
+   }
+ }
diff --git a/patches/chromium/m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch b/patches/chromium/m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
new file mode 100644
index 0000000000000..b67de30288865
--- /dev/null
+++ b/patches/chromium/m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
@@ -0,0 +1,168 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lan Wei <lanwei@chromium.org>
+Date: Tue, 20 Apr 2021 16:32:33 +0000
+Subject: M86-LTS: Add weak pointer to RWHIER::FrameSinkIdOwnerMap and
+ RWHIER::TargetMap
+
+In RWHIER::FrameSinkIdOwnerMap and RWHIER::TargetMap, we change raw
+pointer of RenderWidgetHostViewBase to weak pointer, such as
+using FrameSinkIdOwnerMap = std::unordered_map<viz::FrameSinkId,
+                                base::WeakPtr<RenderWidgetHostViewBase>,
+                                viz::FrameSinkIdHash>;
+using TargetMap = std::map<uint32_t,
+                           base::WeakPtr<RenderWidgetHostViewBase>>;
+
+This CL should fix the crash of stale pointer.
+
+(cherry picked from commit 3e3e3cf7036d7e33a4d68b8416ae25730f9eee1d)
+
+Bug: 1155297
+Change-Id: I5b3270882ef06ae48c86bd460261723c7113953d
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2792344
+Reviewed-by: James MacLean <wjmaclean@chromium.org>
+Reviewed-by: Aaron Colwell <acolwell@chromium.org>
+Commit-Queue: Lan Wei <lanwei@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#870013}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2838587
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Auto-Submit: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Lan Wei <lanwei@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1616}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/content/browser/renderer_host/render_widget_host_input_event_router.cc b/content/browser/renderer_host/render_widget_host_input_event_router.cc
+index d88d28c2d4b09a00a9a42b59acad898d6516c158..0a19dfd63474bcc7da579bee850f92f642d525c7 100644
+--- a/content/browser/renderer_host/render_widget_host_input_event_router.cc
++++ b/content/browser/renderer_host/render_widget_host_input_event_router.cc
+@@ -345,7 +345,7 @@ void RenderWidgetHostInputEventRouter::OnRenderWidgetHostViewBaseDestroyed(
+ 
+   // Remove this view from the owner_map.
+   for (auto entry : owner_map_) {
+-    if (entry.second == view) {
++    if (entry.second.get() == view) {
+       owner_map_.erase(entry.first);
+       // There will only be one instance of a particular view in the map.
+       break;
+@@ -368,7 +368,7 @@ void RenderWidgetHostInputEventRouter::OnRenderWidgetHostViewBaseDestroyed(
+   // replace it with nullptr so that we maintain the 1:1 correspondence between
+   // map entries and the touch sequences that underly them.
+   for (auto it : touchscreen_gesture_target_map_) {
+-    if (it.second == view)
++    if (it.second.get() == view)
+       it.second = nullptr;
+   }
+ 
+@@ -417,8 +417,10 @@ void RenderWidgetHostInputEventRouter::OnRenderWidgetHostViewBaseDestroyed(
+ void RenderWidgetHostInputEventRouter::ClearAllObserverRegistrations() {
+   // Since we're shutting down, it's safe to call RenderWidgetHostViewBase::
+   // RemoveObserver() directly here.
+-  for (auto entry : owner_map_)
+-    entry.second->RemoveObserver(this);
++  for (auto entry : owner_map_) {
++    if (entry.second)
++      entry.second->RemoveObserver(this);
++  }
+   owner_map_.clear();
+   viz::HostFrameSinkManager* manager = GetHostFrameSinkManager();
+   if (manager)
+@@ -840,7 +842,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchEvent(
+                touch_event.unique_touch_event_id) ==
+            touchscreen_gesture_target_map_.end());
+     touchscreen_gesture_target_map_[touch_event.unique_touch_event_id] =
+-        touch_target_;
++        touch_target_->GetWeakPtr();
+   } else if (touch_event.GetType() == blink::WebInputEvent::Type::kTouchStart) {
+     active_touches_ += CountChangedTouchPoints(touch_event);
+   }
+@@ -1352,7 +1354,7 @@ void RenderWidgetHostInputEventRouter::AddFrameSinkIdOwner(
+   // We want to be notified if the owner is destroyed so we can remove it from
+   // our map.
+   owner->AddObserver(this);
+-  owner_map_.insert(std::make_pair(id, owner));
++  owner_map_.insert(std::make_pair(id, owner->GetWeakPtr()));
+ }
+ 
+ void RenderWidgetHostInputEventRouter::RemoveFrameSinkIdOwner(
+@@ -1364,7 +1366,8 @@ void RenderWidgetHostInputEventRouter::RemoveFrameSinkIdOwner(
+     // stale values if the view destructs and isn't an observer anymore.
+     // Note: the view the iterator points at will be deleted in the following
+     // call, and shouldn't be used after this point.
+-    OnRenderWidgetHostViewBaseDestroyed(it_to_remove->second);
++    if (it_to_remove->second)
++      OnRenderWidgetHostViewBaseDestroyed(it_to_remove->second.get());
+   }
+ }
+ 
+@@ -1415,7 +1418,7 @@ RenderWidgetHostInputEventRouter::FindTouchscreenGestureEventTarget(
+ bool RenderWidgetHostInputEventRouter::IsViewInMap(
+     const RenderWidgetHostViewBase* view) const {
+   DCHECK(!is_registered(view->GetFrameSinkId()) ||
+-         owner_map_.find(view->GetFrameSinkId())->second == view);
++         owner_map_.find(view->GetFrameSinkId())->second.get() == view);
+   return is_registered(view->GetFrameSinkId());
+ }
+ 
+@@ -1552,7 +1555,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
+     target = result.view;
+     fallback_target_location = transformed_point;
+   } else if (is_gesture_start) {
+-    target = gesture_target_it->second;
++    target = gesture_target_it->second.get();
+     touchscreen_gesture_target_map_.erase(gesture_target_it);
+ 
+     // Abort any scroll bubbling in progress to avoid double entry.
+@@ -1738,7 +1741,7 @@ RenderWidgetHostInputEventRouter::FindViewFromFrameSinkId(
+   // If the point hit a Surface whose namspace is no longer in the map, then
+   // it likely means the RenderWidgetHostView has been destroyed but its
+   // parent frame has not sent a new compositor frame since that happened.
+-  return iter == owner_map_.end() ? nullptr : iter->second;
++  return iter == owner_map_.end() ? nullptr : iter->second.get();
+ }
+ 
+ bool RenderWidgetHostInputEventRouter::ShouldContinueHitTesting(
+@@ -1758,8 +1761,10 @@ bool RenderWidgetHostInputEventRouter::ShouldContinueHitTesting(
+ std::vector<RenderWidgetHostView*>
+ RenderWidgetHostInputEventRouter::GetRenderWidgetHostViewsForTests() const {
+   std::vector<RenderWidgetHostView*> hosts;
+-  for (auto entry : owner_map_)
+-    hosts.push_back(entry.second);
++  for (auto entry : owner_map_) {
++    DCHECK(entry.second);
++    hosts.push_back(entry.second.get());
++  }
+ 
+   return hosts;
+ }
+@@ -1928,8 +1933,10 @@ void RenderWidgetHostInputEventRouter::SetCursor(const WebCursor& cursor) {
+   last_device_scale_factor_ =
+       last_mouse_move_root_view_->current_device_scale_factor();
+   if (auto* cursor_manager = last_mouse_move_root_view_->GetCursorManager()) {
+-    for (auto it : owner_map_)
+-      cursor_manager->UpdateCursor(it.second, cursor);
++    for (auto it : owner_map_) {
++      if (it.second)
++        cursor_manager->UpdateCursor(it.second.get(), cursor);
++    }
+   }
+ }
+ 
+diff --git a/content/browser/renderer_host/render_widget_host_input_event_router.h b/content/browser/renderer_host/render_widget_host_input_event_router.h
+index 42629b133b883865bebfa27f5d29eb5e2d153d0b..c4ce54a5a6beb509d6242ee0e5ebdf4c88f01251 100644
+--- a/content/browser/renderer_host/render_widget_host_input_event_router.h
++++ b/content/browser/renderer_host/render_widget_host_input_event_router.h
+@@ -195,10 +195,11 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
+   FRIEND_TEST_ALL_PREFIXES(BrowserSideFlingBrowserTest,
+                            InertialGSUBubblingStopsWhenParentCannotScroll);
+ 
+-  using FrameSinkIdOwnerMap = std::unordered_map<viz::FrameSinkId,
+-                                                 RenderWidgetHostViewBase*,
+-                                                 viz::FrameSinkIdHash>;
+-  using TargetMap = std::map<uint32_t, RenderWidgetHostViewBase*>;
++  using FrameSinkIdOwnerMap =
++      std::unordered_map<viz::FrameSinkId,
++                         base::WeakPtr<RenderWidgetHostViewBase>,
++                         viz::FrameSinkIdHash>;
++  using TargetMap = std::map<uint32_t, base::WeakPtr<RenderWidgetHostViewBase>>;
+ 
+   void ClearAllObserverRegistrations();
+   RenderWidgetTargetResult FindViewAtLocation(

From 99a521ecbee873650af9b17d779aaaedae384ed4 Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Mon, 26 Apr 2021 20:37:25 -0400
Subject: [PATCH 22/48] build: fix releases that failed halfway through npm
 publish actions (#28854)

Co-authored-by: Samuel Attard <samuel.r.attard@gmail.com>
---
 script/release/publish-to-npm.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/script/release/publish-to-npm.js b/script/release/publish-to-npm.js
index 1ec37ad62f5aa..c6c8c4e4dde96 100644
--- a/script/release/publish-to-npm.js
+++ b/script/release/publish-to-npm.js
@@ -150,7 +150,13 @@ new Promise((resolve, reject) => {
       resolve(tarballPath);
     });
   })
-  .then((tarballPath) => childProcess.execSync(`npm publish ${tarballPath} --tag ${npmTag} --otp=${process.env.ELECTRON_NPM_OTP}`))
+  .then((tarballPath) => {
+    const existingVersionJSON = childProcess.execSync(`npm view electron@${rootPackageJson.version} --json`).toString('utf-8');
+    // It's possible this is a re-run and we already have published the package, if not we just publish like normal
+    if (!existingVersionJSON) {
+      childProcess.execSync(`npm publish ${tarballPath} --tag ${npmTag} --otp=${process.env.ELECTRON_NPM_OTP}`);
+    }
+  })
   .then(() => {
     const currentTags = JSON.parse(childProcess.execSync('npm show electron dist-tags --json').toString());
     const localVersion = rootPackageJson.version;

From c9774944ba3bf40931c7156f3e0250558a52946a Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Tue, 27 Apr 2021 03:11:54 +0200
Subject: [PATCH 23/48] chore: cherry-pick 406ae3e8a9a8 from chromium (#28814)

* chore: cherry-pick 406ae3e8a9a8 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
---
 patches/chromium/.patches                     |   5 +-
 .../chromium/cherry-pick-406ae3e8a9a8.patch   | 100 ++++++++++++++++++
 2 files changed, 103 insertions(+), 2 deletions(-)
 create mode 100644 patches/chromium/cherry-pick-406ae3e8a9a8.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 0bb5d0c2bb439..f2c176971a6de 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -166,7 +166,8 @@ cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
 cherry-pick-8c3eb9d1c409.patch
 use_idtype_for_permission_change_subscriptions.patch
-m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
-m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
+cherry-pick-406ae3e8a9a8.patch
 cherry-pick-fe20b05a0e5e.patch
 cherry-pick-6b84dc72351b.patch
+m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
+m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
diff --git a/patches/chromium/cherry-pick-406ae3e8a9a8.patch b/patches/chromium/cherry-pick-406ae3e8a9a8.patch
new file mode 100644
index 0000000000000..a922984741905
--- /dev/null
+++ b/patches/chromium/cherry-pick-406ae3e8a9a8.patch
@@ -0,0 +1,100 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ken Rockot <rockot@google.com>
+Date: Tue, 20 Apr 2021 15:46:33 +0000
+Subject: M86-LTS: Mojo: Properly validate broadcast events
+
+This corrects broadcast event deserialization by adding a missing
+validation step when decoding the outer message header.
+
+(cherry picked from commit 6740adb28374ddeee13febfd5e5d20cb8a365979)
+
+Fixed: 1195308
+Change-Id: Ia67a20e48614e7ef00b1b32f7f4e5f20235be310
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2808678
+Reviewed-by: Daniel Cheng <dcheng@chromium.org>
+Commit-Queue: Ken Rockot <rockot@google.com>
+Cr-Original-Commit-Position: refs/heads/master@{#870238}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2837712
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Auto-Submit: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Artem Sumaneev <asumaneev@google.com>
+Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1614}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/mojo/core/node_channel.cc b/mojo/core/node_channel.cc
+index 061ea1026e95d1b1f80a762ce377aebdd97e1b42..07e3b8b21f7ef70b64d214ec03e0dd1eb807fad6 100644
+--- a/mojo/core/node_channel.cc
++++ b/mojo/core/node_channel.cc
+@@ -191,13 +191,16 @@ Channel::MessagePtr NodeChannel::CreateEventMessage(size_t capacity,
+ }
+ 
+ // static
+-void NodeChannel::GetEventMessageData(Channel::Message* message,
++bool NodeChannel::GetEventMessageData(Channel::Message& message,
+                                       void** data,
+                                       size_t* num_data_bytes) {
+-  // NOTE: OnChannelMessage guarantees that we never accept a Channel::Message
+-  // with a payload of fewer than |sizeof(Header)| bytes.
+-  *data = reinterpret_cast<Header*>(message->mutable_payload()) + 1;
+-  *num_data_bytes = message->payload_size() - sizeof(Header);
++  // NOTE: Callers must guarantee that the payload in `message` must be at least
++  // large enough to hold a Header.
++  if (message.payload_size() < sizeof(Header))
++    return false;
++  *data = reinterpret_cast<Header*>(message.mutable_payload()) + 1;
++  *num_data_bytes = message.payload_size() - sizeof(Header);
++  return true;
+ }
+ 
+ void NodeChannel::Start() {
+diff --git a/mojo/core/node_channel.h b/mojo/core/node_channel.h
+index 58ab42bd01fc856856d171985dac50934d4e00b2..7ae08e3e73110667f0eafe0fe4f70242bfeece39 100644
+--- a/mojo/core/node_channel.h
++++ b/mojo/core/node_channel.h
+@@ -90,7 +90,9 @@ class MOJO_SYSTEM_IMPL_EXPORT NodeChannel
+                                                 void** payload,
+                                                 size_t num_handles);
+ 
+-  static void GetEventMessageData(Channel::Message* message,
++  // Retrieves address and size of an Event message's underlying message data.
++  // Returns `false` if the message is not a valid Event message.
++  static bool GetEventMessageData(Channel::Message& message,
+                                   void** data,
+                                   size_t* num_data_bytes);
+ 
+diff --git a/mojo/core/node_controller.cc b/mojo/core/node_controller.cc
+index c333ed64f71f0dfe5d0012b07bcedccfd94cd5e9..a8b8520729510408dc822532271d0ff4a36a7151 100644
+--- a/mojo/core/node_controller.cc
++++ b/mojo/core/node_controller.cc
+@@ -76,7 +76,9 @@ ports::ScopedEvent DeserializeEventMessage(
+     Channel::MessagePtr channel_message) {
+   void* data;
+   size_t size;
+-  NodeChannel::GetEventMessageData(channel_message.get(), &data, &size);
++  bool valid = NodeChannel::GetEventMessageData(*channel_message, &data, &size);
++  if (!valid)
++    return nullptr;
+   auto event = ports::Event::Deserialize(data, size);
+   if (!event)
+     return nullptr;
+diff --git a/mojo/core/user_message_impl.cc b/mojo/core/user_message_impl.cc
+index 2f1665e55cf0af69c58c21f2e0d602a93e79052e..a6b35b2cd812bb0da7026b088aa0d96acbbc6a2f 100644
+--- a/mojo/core/user_message_impl.cc
++++ b/mojo/core/user_message_impl.cc
+@@ -415,7 +415,14 @@ Channel::MessagePtr UserMessageImpl::FinalizeEventMessage(
+   if (channel_message) {
+     void* data;
+     size_t size;
+-    NodeChannel::GetEventMessageData(channel_message.get(), &data, &size);
++    // The `channel_message` must either be produced locally or must have
++    // already been validated by the caller, as is done for example by
++    // NodeController::DeserializeEventMessage before
++    // NodeController::OnBroadcast re-serializes each copy of the message it
++    // received.
++    bool result =
++        NodeChannel::GetEventMessageData(*channel_message, &data, &size);
++    DCHECK(result);
+     message_event->Serialize(data);
+   }
+ 

From 1f6e825a9f2f1493a4be2d94ce305da0281c98fc Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Tue, 27 Apr 2021 09:47:26 +0200
Subject: [PATCH 24/48] chore: cherry-pick fe85e04a1797 from chromium (#28798)

* chore: cherry-pick fe85e04a1797 from chromium

* update patches

* update patches

Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
Co-authored-by: Cheng Zhao <zcbenz@gmail.com>
---
 patches/chromium/.patches                     |   5 +-
 .../chromium/cherry-pick-fe85e04a1797.patch   | 291 ++++++++++++++++++
 2 files changed, 294 insertions(+), 2 deletions(-)
 create mode 100644 patches/chromium/cherry-pick-fe85e04a1797.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index f2c176971a6de..f1d3428b3be16 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -166,8 +166,9 @@ cherry-pick-6a6361c9f31c.patch
 cherry-pick-012e9baf46c9.patch
 cherry-pick-8c3eb9d1c409.patch
 use_idtype_for_permission_change_subscriptions.patch
+cherry-pick-fe85e04a1797.patch
+m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
+m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
 cherry-pick-406ae3e8a9a8.patch
 cherry-pick-fe20b05a0e5e.patch
 cherry-pick-6b84dc72351b.patch
-m86-lts_add_null_pointer_check_in_renderwidgethostinputeventrouter.patch
-m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
diff --git a/patches/chromium/cherry-pick-fe85e04a1797.patch b/patches/chromium/cherry-pick-fe85e04a1797.patch
new file mode 100644
index 0000000000000..2fae048bacdd8
--- /dev/null
+++ b/patches/chromium/cherry-pick-fe85e04a1797.patch
@@ -0,0 +1,291 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ken Rockot <rockot@google.com>
+Date: Wed, 31 Mar 2021 18:44:06 +0000
+Subject: Don't use BigBuffer for IPC::Message transport
+
+M86 merge conflicts and resolution:
+* ipc/ipc_message_pipe_reader.cc
+  Fixed extra include.
+
+(cherry picked from commit 85bd7c88523545ab0e497d5e7b3e929793813358)
+
+(cherry picked from commit fad3b9ffe7c7ff82909d911c573bd185aa3b3b50)
+
+Fixed: 1184399
+Change-Id: Iddd91ae8d7ae63022b61c96239f5e39261dfb735
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2737012
+Commit-Queue: Ken Rockot <rockot@google.com>
+Reviewed-by: Daniel Cheng <dcheng@chromium.org>
+Cr-Original-Original-Commit-Position: refs/heads/master@{#860010}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2779918
+Auto-Submit: Ken Rockot <rockot@google.com>
+Reviewed-by: Adrian Taylor <adetaylor@chromium.org>
+Reviewed-by: Alex Gough <ajgo@chromium.org>
+Commit-Queue: Alex Gough <ajgo@chromium.org>
+Cr-Original-Commit-Position: refs/branch-heads/4389@{#1597}
+Cr-Original-Branched-From: 9251c5db2b6d5a59fe4eac7aafa5fed37c139bb7-refs/heads/master@{#843830}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2794488
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Reviewed-by: Artem Sumaneev <asumaneev@google.com>
+Reviewed-by: Ken Rockot <rockot@google.com>
+Auto-Submit: Artem Sumaneev <asumaneev@google.com>
+Commit-Queue: Artem Sumaneev <asumaneev@google.com>
+Cr-Commit-Position: refs/branch-heads/4240@{#1587}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/ipc/BUILD.gn b/ipc/BUILD.gn
+index 994d45e84502670f544742a3011a8f9381a711bc..281e84df83ae73e8c4716fda1624cb4065342c76 100644
+--- a/ipc/BUILD.gn
++++ b/ipc/BUILD.gn
+@@ -187,10 +187,7 @@ mojom_component("mojom") {
+   output_prefix = "ipc_mojom"
+   macro_prefix = "IPC_MOJOM"
+   sources = [ "ipc.mojom" ]
+-  public_deps = [
+-    "//mojo/public/interfaces/bindings",
+-    "//mojo/public/mojom/base",
+-  ]
++  public_deps = [ "//mojo/public/interfaces/bindings" ]
+ 
+   cpp_typemaps = [
+     {
+@@ -207,10 +204,7 @@ mojom_component("mojom") {
+         "//ipc/message_view.cc",
+         "//ipc/message_view.h",
+       ]
+-      traits_public_deps = [
+-        "//ipc:message_support",
+-        "//mojo/public/cpp/base:shared_typemap_traits",
+-      ]
++      traits_public_deps = [ "//ipc:message_support" ]
+     },
+   ]
+ 
+diff --git a/ipc/ipc.mojom b/ipc/ipc.mojom
+index c66799642fbee2cef3449ff5d52cd5f187808cfe..4606022b28bca1df06ba6eb8eaac025573475b10 100644
+--- a/ipc/ipc.mojom
++++ b/ipc/ipc.mojom
+@@ -4,7 +4,6 @@
+ 
+ module IPC.mojom;
+ 
+-import "mojo/public/mojom/base/big_buffer.mojom";
+ import "mojo/public/interfaces/bindings/native_struct.mojom";
+ 
+ // A placeholder interface type since we don't yet support generic associated
+@@ -14,7 +13,7 @@ interface GenericInterface {};
+ // Typemapped such that arbitrarily large IPC::Message objects can be sent and
+ // received with minimal copying.
+ struct Message {
+-  mojo_base.mojom.BigBuffer buffer;
++  array<uint8> bytes;
+   array<mojo.native.SerializedHandle>? handles;
+ };
+ 
+@@ -24,6 +23,7 @@ interface Channel {
+   SetPeerPid(int32 pid);
+ 
+   // Transmits a classical Chrome IPC message.
++  [UnlimitedSize]
+   Receive(Message message);
+ 
+   // Requests a Channel-associated interface.
+diff --git a/ipc/ipc_message_pipe_reader.cc b/ipc/ipc_message_pipe_reader.cc
+index bdc5dd680d0f9107719765334d0a1ea3e864e200..cbf0363a9d941db1ab34ae835e707b7825447659 100644
+--- a/ipc/ipc_message_pipe_reader.cc
++++ b/ipc/ipc_message_pipe_reader.cc
+@@ -10,6 +10,7 @@
+ 
+ #include "base/bind.h"
+ #include "base/bind_helpers.h"
++#include "base/containers/span.h"
+ #include "base/location.h"
+ #include "base/logging.h"
+ #include "base/macros.h"
+@@ -62,7 +63,9 @@ bool MessagePipeReader::Send(std::unique_ptr<Message> message) {
+   if (!sender_)
+     return false;
+ 
+-  sender_->Receive(MessageView(*message, std::move(handles)));
++  base::span<const uint8_t> bytes(static_cast<const uint8_t*>(message->data()),
++                                  message->size());
++  sender_->Receive(MessageView(bytes, std::move(handles)));
+   DVLOG(4) << "Send " << message->type() << ": " << message->size();
+   return true;
+ }
+@@ -82,11 +85,12 @@ void MessagePipeReader::SetPeerPid(int32_t peer_pid) {
+ }
+ 
+ void MessagePipeReader::Receive(MessageView message_view) {
+-  if (!message_view.size()) {
++  if (message_view.bytes().empty()) {
+     delegate_->OnBrokenDataReceived();
+     return;
+   }
+-  Message message(message_view.data(), message_view.size());
++  Message message(reinterpret_cast<const char*>(message_view.bytes().data()),
++                  message_view.bytes().size());
+   if (!message.IsValid()) {
+     delegate_->OnBrokenDataReceived();
+     return;
+diff --git a/ipc/ipc_mojo_bootstrap_unittest.cc b/ipc/ipc_mojo_bootstrap_unittest.cc
+index 47a7ad79a30165c76041075be10b9be8c13f5e75..b32941da752a54ba7317e439150982adbb9fbcad 100644
+--- a/ipc/ipc_mojo_bootstrap_unittest.cc
++++ b/ipc/ipc_mojo_bootstrap_unittest.cc
+@@ -77,7 +77,9 @@ class PeerPidReceiver : public IPC::mojom::Channel {
+     ASSERT_NE(MessageExpectation::kNotExpected, message_expectation_);
+     received_message_ = true;
+ 
+-    IPC::Message message(message_view.data(), message_view.size());
++    IPC::Message message(
++        reinterpret_cast<const char*>(message_view.bytes().data()),
++        message_view.bytes().size());
+     bool expected_valid =
+         message_expectation_ == MessageExpectation::kExpectedValid;
+     EXPECT_EQ(expected_valid, message.IsValid());
+@@ -196,8 +198,7 @@ MULTIPROCESS_TEST_MAIN_WITH_SETUP(
+ 
+   uint8_t data = 0;
+   sender->Receive(
+-      IPC::MessageView(mojo_base::BigBufferView(base::make_span(&data, 0)),
+-                       base::nullopt /* handles */));
++      IPC::MessageView(base::make_span(&data, 0), base::nullopt /* handles */));
+ 
+   base::RunLoop run_loop;
+   PeerPidReceiver impl(std::move(receiver), run_loop.QuitClosure());
+diff --git a/ipc/message_mojom_traits.cc b/ipc/message_mojom_traits.cc
+index 4aab9248e9ff6ca8e2d7d085ae3e996ac04666e8..d8ad4a2f919b01362e3e2746bfb7f4fae77b059d 100644
+--- a/ipc/message_mojom_traits.cc
++++ b/ipc/message_mojom_traits.cc
+@@ -4,15 +4,13 @@
+ 
+ #include "ipc/message_mojom_traits.h"
+ 
+-#include "mojo/public/cpp/base/big_buffer_mojom_traits.h"
+-
+ namespace mojo {
+ 
+ // static
+-mojo_base::BigBufferView
+-StructTraits<IPC::mojom::MessageDataView, IPC::MessageView>::buffer(
++base::span<const uint8_t>
++StructTraits<IPC::mojom::MessageDataView, IPC::MessageView>::bytes(
+     IPC::MessageView& view) {
+-  return view.TakeBufferView();
++  return view.bytes();
+ }
+ 
+ // static
+@@ -26,14 +24,14 @@ StructTraits<IPC::mojom::MessageDataView, IPC::MessageView>::handles(
+ bool StructTraits<IPC::mojom::MessageDataView, IPC::MessageView>::Read(
+     IPC::mojom::MessageDataView data,
+     IPC::MessageView* out) {
+-  mojo_base::BigBufferView buffer_view;
+-  if (!data.ReadBuffer(&buffer_view))
+-    return false;
++  mojo::ArrayDataView<uint8_t> bytes;
++  data.GetBytesDataView(&bytes);
++
+   base::Optional<std::vector<mojo::native::SerializedHandlePtr>> handles;
+   if (!data.ReadHandles(&handles))
+     return false;
+ 
+-  *out = IPC::MessageView(std::move(buffer_view), std::move(handles));
++  *out = IPC::MessageView(bytes, std::move(handles));
+   return true;
+ }
+ 
+diff --git a/ipc/message_mojom_traits.h b/ipc/message_mojom_traits.h
+index 617ffbe37309946464e3f180a0ebde97f56dbd75..6b5064a12191e9a663519e7b5cb7c5f907a75054 100644
+--- a/ipc/message_mojom_traits.h
++++ b/ipc/message_mojom_traits.h
+@@ -7,10 +7,10 @@
+ 
+ #include <vector>
+ 
++#include "base/containers/span.h"
+ #include "base/optional.h"
+ #include "ipc/ipc.mojom-shared.h"
+ #include "ipc/message_view.h"
+-#include "mojo/public/cpp/base/big_buffer.h"
+ #include "mojo/public/cpp/bindings/struct_traits.h"
+ #include "mojo/public/interfaces/bindings/native_struct.mojom.h"
+ 
+@@ -19,7 +19,7 @@ namespace mojo {
+ template <>
+ class StructTraits<IPC::mojom::MessageDataView, IPC::MessageView> {
+  public:
+-  static mojo_base::BigBufferView buffer(IPC::MessageView& view);
++  static base::span<const uint8_t> bytes(IPC::MessageView& view);
+   static base::Optional<std::vector<mojo::native::SerializedHandlePtr>> handles(
+       IPC::MessageView& view);
+ 
+diff --git a/ipc/message_view.cc b/ipc/message_view.cc
+index 49a80878e7a92cda13105ea0f2fea36ad7ed05e6..39c6608dd507c3ca051b619d966ae521e95fe8e2 100644
+--- a/ipc/message_view.cc
++++ b/ipc/message_view.cc
+@@ -11,16 +11,9 @@ namespace IPC {
+ MessageView::MessageView() = default;
+ 
+ MessageView::MessageView(
+-    const Message& message,
++    base::span<const uint8_t> bytes,
+     base::Optional<std::vector<mojo::native::SerializedHandlePtr>> handles)
+-    : buffer_view_(base::make_span(static_cast<const uint8_t*>(message.data()),
+-                                   message.size())),
+-      handles_(std::move(handles)) {}
+-
+-MessageView::MessageView(
+-    mojo_base::BigBufferView buffer_view,
+-    base::Optional<std::vector<mojo::native::SerializedHandlePtr>> handles)
+-    : buffer_view_(std::move(buffer_view)), handles_(std::move(handles)) {}
++    : bytes_(bytes), handles_(std::move(handles)) {}
+ 
+ MessageView::MessageView(MessageView&&) = default;
+ 
+diff --git a/ipc/message_view.h b/ipc/message_view.h
+index 4ec059bf3639b9c75178f2300d0796b433e1d2ed..c7801bb963f06b03c51ba87bffc307792b592dae 100644
+--- a/ipc/message_view.h
++++ b/ipc/message_view.h
+@@ -11,7 +11,6 @@
+ #include "base/containers/span.h"
+ #include "base/macros.h"
+ #include "ipc/ipc_message.h"
+-#include "mojo/public/cpp/base/big_buffer.h"
+ #include "mojo/public/interfaces/bindings/native_struct.mojom-forward.h"
+ 
+ namespace IPC {
+@@ -20,30 +19,18 @@ class COMPONENT_EXPORT(IPC_MOJOM) MessageView {
+  public:
+   MessageView();
+   MessageView(
+-      const Message& message,
+-      base::Optional<std::vector<mojo::native::SerializedHandlePtr>> handles);
+-  MessageView(
+-      mojo_base::BigBufferView buffer_view,
++      base::span<const uint8_t> bytes,
+       base::Optional<std::vector<mojo::native::SerializedHandlePtr>> handles);
+   MessageView(MessageView&&);
+   ~MessageView();
+ 
+   MessageView& operator=(MessageView&&);
+ 
+-  const char* data() const {
+-    return reinterpret_cast<const char*>(buffer_view_.data().data());
+-  }
+-
+-  uint32_t size() const {
+-    return static_cast<uint32_t>(buffer_view_.data().size());
+-  }
+-
+-  mojo_base::BigBufferView TakeBufferView() { return std::move(buffer_view_); }
+-
++  base::span<const uint8_t> bytes() const { return bytes_; }
+   base::Optional<std::vector<mojo::native::SerializedHandlePtr>> TakeHandles();
+ 
+  private:
+-  mojo_base::BigBufferView buffer_view_;
++  base::span<const uint8_t> bytes_;
+   base::Optional<std::vector<mojo::native::SerializedHandlePtr>> handles_;
+ 
+   DISALLOW_COPY_AND_ASSIGN(MessageView);

From 1b8d60305bed10d1771d6df18b20f303a512e4ba Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Tue, 27 Apr 2021 08:00:07 -0700
Subject: [PATCH 25/48] Bump v10.4.4

---
 ELECTRON_VERSION                        | 2 +-
 package.json                            | 2 +-
 shell/browser/resources/win/electron.rc | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ELECTRON_VERSION b/ELECTRON_VERSION
index 32002b998f80d..69068409e7e73 100644
--- a/ELECTRON_VERSION
+++ b/ELECTRON_VERSION
@@ -1 +1 @@
-10.4.3
\ No newline at end of file
+10.4.4
\ No newline at end of file
diff --git a/package.json b/package.json
index 69658f1f0692e..8664f9e471725 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "10.4.3",
+  "version": "10.4.4",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
diff --git a/shell/browser/resources/win/electron.rc b/shell/browser/resources/win/electron.rc
index 30db59c83a714..5710814f96bbe 100644
--- a/shell/browser/resources/win/electron.rc
+++ b/shell/browser/resources/win/electron.rc
@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 10,4,3,0
- PRODUCTVERSION 10,4,3,0
+ FILEVERSION 10,4,4,0
+ PRODUCTVERSION 10,4,4,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "10.4.3"
+            VALUE "FileVersion", "10.4.4"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "10.4.3"
+            VALUE "ProductVersion", "10.4.4"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

From 59c0c9fce0f456e4519f210677495c6648ad6c63 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Tue, 27 Apr 2021 18:02:50 +0200
Subject: [PATCH 26/48] chore: cherry-pick aa2154a9c1 from v8 (#28863)

---
 patches/v8/.patches                           |  1 +
 ...in_visitspeculativeintegeradditiveop.patch | 44 +++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 patches/v8/merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index bc8b71bf99c10..761c8753b299f 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -31,3 +31,4 @@ cherry-pick-512cd5e179f4.patch
 lts-m86_builtins_fix_array_prototype_concat_with_species.patch
 lts-m86_builtins_harden_array_prototype_concat.patch
 merged_squashed_multiple_commits.patch
+merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch
diff --git a/patches/v8/merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch b/patches/v8/merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch
new file mode 100644
index 0000000000000..9ede9078f1b1a
--- /dev/null
+++ b/patches/v8/merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch
@@ -0,0 +1,44 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Tue, 20 Apr 2021 13:48:07 +0200
+Subject: Merged: [compiler] Fix a bug in VisitSpeculativeIntegerAdditiveOp
+
+Revision: 9313c4ce3f32ad81df1c65becccec7e129181ce3
+
+BUG=chromium:1199345
+NOTRY=true
+NOPRESUBMIT=true
+NOTREECHECKS=true
+R=nicohartmann@chromium.org
+
+Change-Id: I0ee9f13815b1a7d248d4caa506c6930697e1866c
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839559
+Commit-Queue: Georg Neis <neis@chromium.org>
+Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
+Cr-Commit-Position: refs/branch-heads/9.0@{#41}
+Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1}
+Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001}
+
+diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc
+index 307ad5333869d4d80e59c115a486ed2f07f1798b..97bd328c28e24d25e1813399b798ecdb8a248cfd 100644
+--- a/src/compiler/simplified-lowering.cc
++++ b/src/compiler/simplified-lowering.cc
+@@ -1456,10 +1456,15 @@ class RepresentationSelector {
+     Type right_feedback_type = TypeOf(node->InputAt(1));
+ 
+     // Using Signed32 as restriction type amounts to promising there won't be
+-    // signed overflow. This is incompatible with relying on a Word32
+-    // truncation in order to skip the overflow check.
++    // signed overflow. This is incompatible with relying on a Word32 truncation
++    // in order to skip the overflow check.  Similarly, we must not drop -0 from
++    // the result type unless we deopt for -0 inputs.
+     Type const restriction =
+-        truncation.IsUsedAsWord32() ? Type::Any() : Type::Signed32();
++        truncation.IsUsedAsWord32()
++            ? Type::Any()
++            : (truncation.identify_zeros() == kIdentifyZeros)
++                  ? Type::Signed32OrMinusZero()
++                  : Type::Signed32();
+ 
+     // Handle the case when no int32 checks on inputs are necessary (but
+     // an overflow check is needed on the output). Note that we do not

From c84055061963b390a01724e7ec7c13b95d27d02a Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Wed, 28 Apr 2021 06:05:00 +0200
Subject: [PATCH 27/48] chore: cherry-pick 5745eaf16077 from chromium (#28802)

* chore: cherry-pick 5745eaf16077 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-5745eaf16077.patch   | 89 +++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-5745eaf16077.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index f1d3428b3be16..1cfec8c99d4c4 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -172,3 +172,4 @@ m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
 cherry-pick-406ae3e8a9a8.patch
 cherry-pick-fe20b05a0e5e.patch
 cherry-pick-6b84dc72351b.patch
+cherry-pick-5745eaf16077.patch
diff --git a/patches/chromium/cherry-pick-5745eaf16077.patch b/patches/chromium/cherry-pick-5745eaf16077.patch
new file mode 100644
index 0000000000000..d2789fddf0efb
--- /dev/null
+++ b/patches/chromium/cherry-pick-5745eaf16077.patch
@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Asanka Herath <asanka@chromium.org>
+Date: Wed, 31 Mar 2021 16:33:46 +0000
+Subject: Remove unnecessary kCanvasReadback metrics.
+
+The identifiability metrics recorded under kCanvasReadback surface type
+used two conflicting sources as inputs: the CanvasRenderingContext
+type, and the paint-op digest.
+
+There are known collisions between resulting IdentifiableSurface values
+from the two sources, which makes it impossible to losslessly separate
+the two during analysis.
+
+While the fact that a canvas readback happened is interesting, it
+doesn't help determine the observed diversity of clients. Hence this
+change removes one of those sources: the CanvasRenderingContext type.
+
+M86 merge conflicts and resolution:
+* third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc
+  M86 does not have the code removed in original CL.
+* third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.cc
+  third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+  Removed corresponding code, kept old API.
+
+(cherry picked from commit 809231f0c9fdc6180b6a99cf067d0a32db053034)
+
+(cherry picked from commit b206b57b96985713ad167738f6839a8d32db78f2)
+
+Bug: 1161379, 1186641
+Change-Id: I770cb631c9c4afe4c36d1b129aaf61410db25d43
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2600386
+Commit-Queue: Asanka Herath <asanka@chromium.org>
+Reviewed-by: Caleb Raitto <caraitto@chromium.org>
+Reviewed-by: Kentaro Hara <haraken@chromium.org>
+Cr-Original-Original-Commit-Position: refs/heads/master@{#847480}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2785145
+Reviewed-by: Justin Novosad <junov@chromium.org>
+Reviewed-by: Juanmi Huertas <juanmihd@chromium.org>
+Reviewed-by: Asanka Herath <asanka@chromium.org>
+Commit-Queue: Yi Xu <yiyix@chromium.org>
+Cr-Original-Commit-Position: refs/branch-heads/4389@{#1599}
+Cr-Original-Branched-From: 9251c5db2b6d5a59fe4eac7aafa5fed37c139bb7-refs/heads/master@{#843830}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2794506
+Reviewed-by: Artem Sumaneev <asumaneev@google.com>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Auto-Submit: Artem Sumaneev <asumaneev@google.com>
+Commit-Queue: Artem Sumaneev <asumaneev@google.com>
+Cr-Commit-Position: refs/branch-heads/4240@{#1586}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.cc b/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.cc
+index d4e0d5d0657e89f531d810f407a232248e0fca6f..95c891fc795cb0024e561ee522da79a82b8f14ce 100644
+--- a/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.cc
++++ b/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.cc
+@@ -680,12 +680,6 @@ ImageData* CanvasRenderingContext2D::getImageData(
+     int sw,
+     int sh,
+     ExceptionState& exception_state) {
+-  blink::IdentifiabilityMetricBuilder(ukm_source_id_)
+-      .Set(blink::IdentifiableSurface::FromTypeAndInput(
+-               blink::IdentifiableSurface::Type::kCanvasReadback,
+-               GetContextType()),
+-           0)
+-      .Record(ukm_recorder_);
+   return BaseRenderingContext2D::getImageData(sx, sy, sw, sh, exception_state);
+ }
+ 
+diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+index d7445bf31a391bea3742327c34dc3eb46c72513b..32e945f0692b66de95735a3cd949943243ec5a7b 100644
+--- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
++++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+@@ -4508,17 +4508,6 @@ void WebGLRenderingContextBase::readPixels(
+     GLenum format,
+     GLenum type,
+     MaybeShared<DOMArrayBufferView> pixels) {
+-  if (IsUserInIdentifiabilityStudy()) {
+-    base::Optional<UkmParameters> ukm_params = ukm_parameters();
+-    if (ukm_params) {
+-      blink::IdentifiabilityMetricBuilder(ukm_params->source_id)
+-          .Set(blink::IdentifiableSurface::FromTypeAndInput(
+-                   blink::IdentifiableSurface::Type::kCanvasReadback,
+-                   GetContextType()),
+-               0)
+-          .Record(ukm_params->ukm_recorder);
+-    }
+-  }
+   ReadPixelsHelper(x, y, width, height, format, type, pixels.View(), 0);
+ }
+ 

From 882eb8a3baac0cee4adc86a8146ab96f3769dcba Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Wed, 28 Apr 2021 02:03:04 -0700
Subject: [PATCH 28/48] build: actually use SSL when downloading things via
 python (#28891)

Co-authored-by: Samuel Attard <samuel.r.attard@gmail.com>
---
 script/lib/util.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/script/lib/util.py b/script/lib/util.py
index c717ab989d16b..1f02409f40251 100644
--- a/script/lib/util.py
+++ b/script/lib/util.py
@@ -69,9 +69,6 @@ def scoped_env(key, value):
 def download(text, url, path):
   safe_mkdir(os.path.dirname(path))
   with open(path, 'wb') as local_file:
-    if hasattr(ssl, '_create_unverified_context'):
-      ssl._create_default_https_context = ssl._create_unverified_context
-
     print("Downloading %s to %s" % (url, path))
     web_file = urlopen(url)
     info = web_file.info()

From 72f3c5e8ece9b77e4e820c32bea7c8993e581bc5 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Wed, 28 Apr 2021 11:12:08 +0200
Subject: [PATCH 29/48] chore: cherry-pick ed5f62c36d from angle. (#28874)

* chore: cherry-pick ed5f62c36d from angle.

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/angle/.patches                        |   1 +
 ...ere_is_no_intersection_of_dest_areas.patch | 137 ++++++++++++++++++
 2 files changed, 138 insertions(+)
 create mode 100644 patches/angle/d3d11_skip_blits_if_there_is_no_intersection_of_dest_areas.patch

diff --git a/patches/angle/.patches b/patches/angle/.patches
index 3b7a410a581e1..d02488bd9b539 100644
--- a/patches/angle/.patches
+++ b/patches/angle/.patches
@@ -1 +1,2 @@
 cherry-pick-2882e1afd982.patch
+d3d11_skip_blits_if_there_is_no_intersection_of_dest_areas.patch
diff --git a/patches/angle/d3d11_skip_blits_if_there_is_no_intersection_of_dest_areas.patch b/patches/angle/d3d11_skip_blits_if_there_is_no_intersection_of_dest_areas.patch
new file mode 100644
index 0000000000000..7712badda757d
--- /dev/null
+++ b/patches/angle/d3d11_skip_blits_if_there_is_no_intersection_of_dest_areas.patch
@@ -0,0 +1,137 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Geoff Lang <geofflang@chromium.org>
+Date: Mon, 19 Apr 2021 12:47:05 -0400
+Subject: D3D11: Skip blits if there is no intersection of dest areas
+
+Blit11 would clip the destination rectangle with the destination size
+but ignore the result. gl::ClipRectangle returns false when the
+rectangles do not intersect at all, indicating the blit can be skipped.
+
+This could lead to an out-of-bounds write to the GPU memory for the
+destination texture.
+
+Mark ClipRectangle as nodiscard to prevent future issues.
+
+Bug: chromium:1199402
+Change-Id: I260e82d0917b8aa7e7887f2c9f7ed4b1a03ba785
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2836786
+Reviewed-by: Jamie Madill <jmadill@chromium.org>
+Commit-Queue: Geoff Lang <geofflang@chromium.org>
+(cherry picked from commit b574643ef28c92fcea5122dd7a72acb42a514eed)
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2846982
+Reviewed-by: Geoff Lang <geofflang@chromium.org>
+
+diff --git a/src/libANGLE/angletypes.h b/src/libANGLE/angletypes.h
+index e9e955b58f053a4a895c3c3fa105aac9db3c8baf..37740dda4be1aa59b57529841e0f13ee8a349af6 100644
+--- a/src/libANGLE/angletypes.h
++++ b/src/libANGLE/angletypes.h
+@@ -62,7 +62,7 @@ struct Rectangle
+ bool operator==(const Rectangle &a, const Rectangle &b);
+ bool operator!=(const Rectangle &a, const Rectangle &b);
+ 
+-bool ClipRectangle(const Rectangle &source, const Rectangle &clip, Rectangle *intersection);
++ANGLE_NO_DISCARD bool ClipRectangle(const Rectangle &source, const Rectangle &clip, Rectangle *intersection);
+ 
+ struct Offset
+ {
+diff --git a/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp b/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp
+index 55f8f8f4d38f30990d7061de6ebaa0595f0447da..6d9365af8db5fa9835127650162d5aeb6ce46b77 100644
+--- a/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp
++++ b/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp
+@@ -141,7 +141,10 @@ void StretchedBlitNearest(const gl::Box &sourceArea,
+                           uint8_t *destData)
+ {
+     gl::Rectangle clippedDestArea(destArea.x, destArea.y, destArea.width, destArea.height);
+-    gl::ClipRectangle(clippedDestArea, clipRect, &clippedDestArea);
++    if (!gl::ClipRectangle(clippedDestArea, clipRect, &clippedDestArea))
++    {
++        return;
++    }
+ 
+     // Determine if entire rows can be copied at once instead of each individual pixel. There
+     // must be no out of bounds lookups, whole rows copies, and no scale.
+diff --git a/src/libANGLE/renderer/gl/FramebufferGL.cpp b/src/libANGLE/renderer/gl/FramebufferGL.cpp
+index 2dd83c1f2d7c4be71bcc16a3c5d6f7f209a5b6b1..d709449547af9021ccf4ef2476e217af2f1517e5 100644
+--- a/src/libANGLE/renderer/gl/FramebufferGL.cpp
++++ b/src/libANGLE/renderer/gl/FramebufferGL.cpp
+@@ -1115,7 +1115,10 @@ angle::Result FramebufferGL::clipSrcRegion(const gl::Context *context,
+         // If pixels lying outside the read framebuffer, adjust src region
+         // and dst region to appropriate in-bounds regions respectively.
+         gl::Rectangle realSourceRegion;
+-        ClipRectangle(bounds.sourceRegion, bounds.sourceBounds, &realSourceRegion);
++        if (!ClipRectangle(bounds.sourceRegion, bounds.sourceBounds, &realSourceRegion))
++        {
++            return angle::Result::Stop;
++        }
+         GLuint xOffset = realSourceRegion.x - bounds.sourceRegion.x;
+         GLuint yOffset = realSourceRegion.y - bounds.sourceRegion.y;
+ 
+diff --git a/src/libANGLE/renderer/metal/ContextMtl.mm b/src/libANGLE/renderer/metal/ContextMtl.mm
+index d8d421f925675113a7d95250572e692fecb986ef..4bda9cf8518f24b8628ec4576e19ee7499131f10 100644
+--- a/src/libANGLE/renderer/metal/ContextMtl.mm
++++ b/src/libANGLE/renderer/metal/ContextMtl.mm
+@@ -1282,7 +1282,10 @@ void ContextMtl::updateScissor(const gl::State &glState)
+ 
+     // Clip the render area to the viewport.
+     gl::Rectangle viewportClippedRenderArea;
+-    gl::ClipRectangle(renderArea, glState.getViewport(), &viewportClippedRenderArea);
++    if (!gl::ClipRectangle(renderArea, glState.getViewport(), &viewportClippedRenderArea))
++    {
++        viewportClippedRenderArea = gl::Rectangle();
++    }
+ 
+     gl::Rectangle scissoredArea = ClipRectToScissor(getState(), viewportClippedRenderArea, false);
+     if (framebufferMtl->flipY())
+diff --git a/src/libANGLE/renderer/vulkan/ContextVk.cpp b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+index 0276a4a8b579d36f239cd86527a6f8e08291d058..6092575364db4896caaf755eeaf93fb1d2fad9c4 100644
+--- a/src/libANGLE/renderer/vulkan/ContextVk.cpp
++++ b/src/libANGLE/renderer/vulkan/ContextVk.cpp
+@@ -2533,8 +2533,11 @@ angle::Result ContextVk::updateScissor(const gl::State &glState)
+ 
+     // Clip the render area to the viewport.
+     gl::Rectangle viewportClippedRenderArea;
+-    gl::ClipRectangle(renderArea, getCorrectedViewport(glState.getViewport()),
+-                      &viewportClippedRenderArea);
++    if (!gl::ClipRectangle(renderArea, getCorrectedViewport(glState.getViewport()),
++                           &viewportClippedRenderArea))
++    {
++        viewportClippedRenderArea = gl::Rectangle();
++    }
+ 
+     gl::Rectangle scissoredArea = ClipRectToScissor(getState(), viewportClippedRenderArea, false);
+     gl::Rectangle rotatedScissoredArea;
+diff --git a/src/tests/gl_tests/BlitFramebufferANGLETest.cpp b/src/tests/gl_tests/BlitFramebufferANGLETest.cpp
+index 79ba46aa10ae8c689b1546b3e1e99ce815f414bd..b38bebb31f17d9f1d127e170495fd810aba21390 100644
+--- a/src/tests/gl_tests/BlitFramebufferANGLETest.cpp
++++ b/src/tests/gl_tests/BlitFramebufferANGLETest.cpp
+@@ -1997,6 +1997,30 @@ TEST_P(BlitFramebufferTest, BlitFramebufferSizeOverflow2)
+     EXPECT_GL_ERROR(GL_INVALID_VALUE);
+ }
+ 
++// Test an edge case in D3D11 stencil blitting on the CPU that does not properly clip the
++// destination regions
++TEST_P(BlitFramebufferTest, BlitFramebufferStencilClipNoIntersection)
++{
++    GLFramebuffer framebuffers[2];
++    glBindFramebuffer(GL_READ_FRAMEBUFFER, framebuffers[0]);
++    glBindFramebuffer(GL_DRAW_FRAMEBUFFER, framebuffers[1]);
++
++    GLRenderbuffer renderbuffers[2];
++    glBindRenderbuffer(GL_RENDERBUFFER, renderbuffers[0]);
++    glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH24_STENCIL8, 4, 4);
++    glFramebufferRenderbuffer(GL_READ_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER,
++                              renderbuffers[0]);
++
++    glBindRenderbuffer(GL_RENDERBUFFER, renderbuffers[1]);
++    glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH24_STENCIL8, 4, 4);
++    glFramebufferRenderbuffer(GL_DRAW_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER,
++                              renderbuffers[1]);
++
++    glBlitFramebuffer(0, 0, 4, 4, 1 << 24, 1 << 24, 1 << 25, 1 << 25, GL_STENCIL_BUFFER_BIT,
++                      GL_NEAREST);
++    EXPECT_GL_NO_ERROR();
++}
++
+ // Use this to select which configurations (e.g. which renderer, which GLES major version) these
+ // tests should be run against.
+ ANGLE_INSTANTIATE_TEST(BlitFramebufferANGLETest,

From 40d0be96618fb42cfb9094764955e36729a55725 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Wed, 28 Apr 2021 13:10:07 +0200
Subject: [PATCH 30/48] chore: cherry-pick 1028ffc9bd83 from chromium (#28817)

* chore: cherry-pick 1028ffc9bd83 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-1028ffc9bd83.patch   | 57 +++++++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-1028ffc9bd83.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 1cfec8c99d4c4..69c9b48d21af2 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -172,4 +172,5 @@ m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
 cherry-pick-406ae3e8a9a8.patch
 cherry-pick-fe20b05a0e5e.patch
 cherry-pick-6b84dc72351b.patch
+cherry-pick-1028ffc9bd83.patch
 cherry-pick-5745eaf16077.patch
diff --git a/patches/chromium/cherry-pick-1028ffc9bd83.patch b/patches/chromium/cherry-pick-1028ffc9bd83.patch
new file mode 100644
index 0000000000000..f623de049a423
--- /dev/null
+++ b/patches/chromium/cherry-pick-1028ffc9bd83.patch
@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Bill Budge <bbudge@chromium.org>
+Date: Tue, 20 Apr 2021 15:22:33 +0000
+Subject: M86-LTS: [GeneratedCodeCache] Copy large data before hashing and
+ writing
+
+- Makes a copy before hashing and writing large code entries.
+
+(cherry picked from commit cea0cb8eee9900308d9b43661e9faca449086940)
+
+Bug: chromium:1194046
+Change-Id: Id5a6e6d3a04c83cfed2f18db53587d654d642fc0
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2807255
+Reviewed-by: Nasko Oskov <nasko@chromium.org>
+Reviewed-by: Mythri Alle <mythria@chromium.org>
+Commit-Queue: Bill Budge <bbudge@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#870064}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2838077
+Reviewed-by: Bill Budge <bbudge@chromium.org>
+Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1612}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/content/browser/code_cache/generated_code_cache.cc b/content/browser/code_cache/generated_code_cache.cc
+index dd5c28f92503ce95082b9b6b6254f6922e5b81ac..4b71cde691a7a89344a556396780ce71cf7aebf7 100644
+--- a/content/browser/code_cache/generated_code_cache.cc
++++ b/content/browser/code_cache/generated_code_cache.cc
+@@ -382,9 +382,18 @@ void GeneratedCodeCache::WriteEntry(const GURL& url,
+     // [stream1] <empty>
+     // [stream0 (checksum key entry)] <empty>
+     // [stream1 (checksum key entry)] data
++
++    // Make a copy of the data before hashing. A compromised renderer could
++    // change shared memory before we can compute the hash and write the data.
++    // TODO(1135729) Eliminate this copy when the shared memory can't be written
++    // by the sender.
++    mojo_base::BigBuffer copy({data.data(), data.size()});
++    if (copy.size() != data.size())
++      return;
++    data = mojo_base::BigBuffer();  // Release the old buffer.
+     uint8_t result[crypto::kSHA256Length];
+     crypto::SHA256HashString(
+-        base::StringPiece(reinterpret_cast<char*>(data.data()), data.size()),
++        base::StringPiece(reinterpret_cast<char*>(copy.data()), copy.size()),
+         result, base::size(result));
+     std::string checksum_key = base::HexEncode(result, base::size(result));
+     small_buffer = base::MakeRefCounted<net::IOBufferWithSize>(
+@@ -399,7 +408,7 @@ void GeneratedCodeCache::WriteEntry(const GURL& url,
+     // Issue another write operation for the code, with the checksum as the key
+     // and nothing in the header.
+     auto small_buffer2 = base::MakeRefCounted<net::IOBufferWithSize>(0);
+-    auto large_buffer2 = base::MakeRefCounted<BigIOBuffer>(std::move(data));
++    auto large_buffer2 = base::MakeRefCounted<BigIOBuffer>(std::move(copy));
+     auto op2 = std::make_unique<PendingOperation>(Operation::kWriteWithSHAKey,
+                                                   checksum_key, small_buffer2,
+                                                   large_buffer2);

From d52c1ef2013699867621e71c52405301bccd8dc2 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Wed, 28 Apr 2021 15:58:42 +0200
Subject: [PATCH 31/48] chore: cherry-pick 7dd3b1c86795 from chromium (#28820)

* chore: cherry-pick 7dd3b1c86795 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-7dd3b1c86795.patch   | 40 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-7dd3b1c86795.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 69c9b48d21af2..71a9864cefc1d 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -172,5 +172,6 @@ m86-lts_add_weak_pointer_to_rwhier_framesinkidownermap_and.patch
 cherry-pick-406ae3e8a9a8.patch
 cherry-pick-fe20b05a0e5e.patch
 cherry-pick-6b84dc72351b.patch
+cherry-pick-7dd3b1c86795.patch
 cherry-pick-1028ffc9bd83.patch
 cherry-pick-5745eaf16077.patch
diff --git a/patches/chromium/cherry-pick-7dd3b1c86795.patch b/patches/chromium/cherry-pick-7dd3b1c86795.patch
new file mode 100644
index 0000000000000..ff5e93109ae42
--- /dev/null
+++ b/patches/chromium/cherry-pick-7dd3b1c86795.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Wez <wez@chromium.org>
+Date: Thu, 15 Apr 2021 18:24:27 +0000
+Subject: Handle window deletion during HandleDisplayChange.
+
+In principle there is no reason why the HWNDMessageHandler shouldn't be
+deleted by a HandleDisplayChange() call out to the delegate, e.g. if the
+change results in a change in window layout.
+
+(cherry picked from commit 299155e5e37a77670b7969771e09e9a16b1f5612)
+
+Bug: 1192552
+Change-Id: I9fca35ff32e7037c6492f4cee7069e272059b920
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2804382
+Auto-Submit: Wez <wez@chromium.org>
+Commit-Queue: Scott Violet <sky@chromium.org>
+Reviewed-by: Scott Violet <sky@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#869603}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2826321
+Cr-Commit-Position: refs/branch-heads/4430@{#1291}
+Cr-Branched-From: e5ce7dc4f7518237b3d9bb93cccca35d25216cbe-refs/heads/master@{#857950}
+
+diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
+index f6e9f97e47b44fa47e8e6c237be371754a5204bd..39518ac65d091bc52a26cf84b89fa350459e874b 100644
+--- a/ui/views/win/hwnd_message_handler.cc
++++ b/ui/views/win/hwnd_message_handler.cc
+@@ -1670,7 +1670,13 @@ void HWNDMessageHandler::OnDisplayChange(UINT bits_per_pixel,
+                                          const gfx::Size& screen_size) {
+   TRACE_EVENT0("ui", "HWNDMessageHandler::OnDisplayChange");
+ 
++  base::WeakPtr<HWNDMessageHandler> ref(msg_handler_weak_factory_.GetWeakPtr());
+   delegate_->HandleDisplayChange();
++
++  // HandleDisplayChange() may result in |this| being deleted.
++  if (!ref)
++    return;
++
+   // Force a WM_NCCALCSIZE to occur to ensure that we handle auto hide
+   // taskbars correctly.
+   SendFrameChanged();

From 88ede25a99c826dbbbd52385f717939cefed2476 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Wed, 28 Apr 2021 21:50:08 +0200
Subject: [PATCH 32/48] chore: cherry-pick 00245033cf from v8 (#28903)

---
 patches/v8/.patches                           |  1 +
 ...by-one_error_in_kadditivesafeinteger.patch | 37 +++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 patches/v8/m86-lts_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index 761c8753b299f..bb04421da0f3d 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -32,3 +32,4 @@ lts-m86_builtins_fix_array_prototype_concat_with_species.patch
 lts-m86_builtins_harden_array_prototype_concat.patch
 merged_squashed_multiple_commits.patch
 merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch
+m86-lts_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch
diff --git a/patches/v8/m86-lts_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch b/patches/v8/m86-lts_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch
new file mode 100644
index 0000000000000..4a2f10ec16f7e
--- /dev/null
+++ b/patches/v8/m86-lts_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch
@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Mon, 19 Apr 2021 13:12:46 +0200
+Subject: M86-LTS: [compiler] Fix off-by-one error in kAdditiveSafeInteger
+
+(cherry picked from commit 798fbcb0a3e5a292fb775c37c19d9fe73bbac17c)
+
+No-Try: true
+No-Presubmit: true
+No-Tree-Checks: true
+Bug: chromium:1198705
+Change-Id: I6b3ad82754e1ca72701ce57f16c4f085f8c87f77
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835705
+Auto-Submit: Georg Neis <neis@chromium.org>
+Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
+Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#74033}
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850708
+Commit-Queue: Artem Sumaneev <asumaneev@google.com>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Cr-Commit-Position: refs/branch-heads/8.6@{#87}
+Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
+Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
+
+diff --git a/src/compiler/type-cache.h b/src/compiler/type-cache.h
+index b71ea8455d544daccca1ef530bbb7dc735d0df09..54e725c64f7e359df3fd930c06fa59c5f17c95bd 100644
+--- a/src/compiler/type-cache.h
++++ b/src/compiler/type-cache.h
+@@ -80,7 +80,7 @@ class V8_EXPORT_PRIVATE TypeCache final {
+       Type::Union(kPositiveIntegerOrMinusZero, Type::NaN(), zone());
+ 
+   Type const kAdditiveSafeInteger =
+-      CreateRange(-4503599627370496.0, 4503599627370496.0);
++      CreateRange(-4503599627370495.0, 4503599627370495.0);
+   Type const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
+   Type const kAdditiveSafeIntegerOrMinusZero =
+       Type::Union(kAdditiveSafeInteger, Type::MinusZero(), zone());

From 3cd06c90950d5a8dea304b293f9105b9ca116eb2 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <pepontes@microsoft.com>
Date: Thu, 29 Apr 2021 00:40:15 +0200
Subject: [PATCH 33/48] chore: cherry-pick 619083c7d8 from v8 (#28906)

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/v8/.patches                           |  1 +
 ...prototypepop_and_arrayprototypeshift.patch | 94 +++++++++++++++++++
 2 files changed, 95 insertions(+)
 create mode 100644 patches/v8/merged_turbofan_harden_arrayprototypepop_and_arrayprototypeshift.patch

diff --git a/patches/v8/.patches b/patches/v8/.patches
index bb04421da0f3d..16c1e2ed92040 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -32,4 +32,5 @@ lts-m86_builtins_fix_array_prototype_concat_with_species.patch
 lts-m86_builtins_harden_array_prototype_concat.patch
 merged_squashed_multiple_commits.patch
 merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch
+merged_turbofan_harden_arrayprototypepop_and_arrayprototypeshift.patch
 m86-lts_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch
diff --git a/patches/v8/merged_turbofan_harden_arrayprototypepop_and_arrayprototypeshift.patch b/patches/v8/merged_turbofan_harden_arrayprototypepop_and_arrayprototypeshift.patch
new file mode 100644
index 0000000000000..55c1a6b77337f
--- /dev/null
+++ b/patches/v8/merged_turbofan_harden_arrayprototypepop_and_arrayprototypeshift.patch
@@ -0,0 +1,94 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Sun, 18 Apr 2021 09:46:25 +0200
+Subject: Merged: [turbofan] Harden ArrayPrototypePop and ArrayPrototypeShift
+
+Revision: d4aafa4022b718596b3deadcc3cdcb9209896154
+
+TBR=glazunov@chromium.org
+BUG=chromium:1198696
+NOTRY=true
+NOPRESUBMIT=true
+NOTREECHECKS=true
+
+Change-Id: I1840ffabbed3a3caab75b0abea1d37d9ed446d3f
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2833911
+Reviewed-by: Georg Neis <neis@chromium.org>
+Commit-Queue: Georg Neis <neis@chromium.org>
+Cr-Commit-Position: refs/branch-heads/9.0@{#39}
+Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1}
+Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001}
+
+diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
+index a2f9aaeb6ff2253ec7626df5f133b08aa6514f19..e1f590f6e499e99d6536ad670c98d55b015221ac 100644
+--- a/src/compiler/js-call-reducer.cc
++++ b/src/compiler/js-call-reducer.cc
+@@ -5147,24 +5147,31 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
+       }
+ 
+       // Compute the new {length}.
+-      length = graph()->NewNode(simplified()->NumberSubtract(), length,
+-                                jsgraph()->OneConstant());
++      Node* new_length = graph()->NewNode(simplified()->NumberSubtract(),
++                                          length, jsgraph()->OneConstant());
++
++      // This extra check exists solely to break an exploitation technique
++      // that abuses typer mismatches.
++      new_length = efalse = graph()->NewNode(
++          simplified()->CheckBounds(p.feedback(),
++                                    CheckBoundsFlag::kAbortOnOutOfBounds),
++          new_length, length, efalse, if_false);
+ 
+       // Store the new {length} to the {receiver}.
+       efalse = graph()->NewNode(
+           simplified()->StoreField(AccessBuilder::ForJSArrayLength(kind)),
+-          receiver, length, efalse, if_false);
++          receiver, new_length, efalse, if_false);
+ 
+       // Load the last entry from the {elements}.
+       vfalse = efalse = graph()->NewNode(
+           simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(kind)),
+-          elements, length, efalse, if_false);
++          elements, new_length, efalse, if_false);
+ 
+       // Store a hole to the element we just removed from the {receiver}.
+       efalse = graph()->NewNode(
+           simplified()->StoreElement(
+               AccessBuilder::ForFixedArrayElement(GetHoleyElementsKind(kind))),
+-          elements, length, jsgraph()->TheHoleConstant(), efalse, if_false);
++          elements, new_length, jsgraph()->TheHoleConstant(), efalse, if_false);
+     }
+ 
+     control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+@@ -5338,19 +5345,27 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
+         }
+ 
+         // Compute the new {length}.
+-        length = graph()->NewNode(simplified()->NumberSubtract(), length,
+-                                  jsgraph()->OneConstant());
++        Node* new_length = graph()->NewNode(simplified()->NumberSubtract(),
++                                            length, jsgraph()->OneConstant());
++
++        // This extra check exists solely to break an exploitation technique
++        // that abuses typer mismatches.
++        new_length = etrue1 = graph()->NewNode(
++            simplified()->CheckBounds(p.feedback(),
++                                      CheckBoundsFlag::kAbortOnOutOfBounds),
++            new_length, length, etrue1, if_true1);
+ 
+         // Store the new {length} to the {receiver}.
+         etrue1 = graph()->NewNode(
+             simplified()->StoreField(AccessBuilder::ForJSArrayLength(kind)),
+-            receiver, length, etrue1, if_true1);
++            receiver, new_length, etrue1, if_true1);
+ 
+         // Store a hole to the element we just removed from the {receiver}.
+         etrue1 = graph()->NewNode(
+             simplified()->StoreElement(AccessBuilder::ForFixedArrayElement(
+                 GetHoleyElementsKind(kind))),
+-            elements, length, jsgraph()->TheHoleConstant(), etrue1, if_true1);
++            elements, new_length, jsgraph()->TheHoleConstant(), etrue1,
++            if_true1);
+       }
+ 
+       Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);

From 118c2faa86ae0bb5e0512504e2e34a10ea272735 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Thu, 29 Apr 2021 17:33:42 +0200
Subject: [PATCH 34/48] chore: cherry-pick 668cf831e912 from chromium (#28931)

* chore: cherry-pick 668cf831e912 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |  1 +
 .../chromium/cherry-pick-668cf831e912.patch   | 57 +++++++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-668cf831e912.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 71a9864cefc1d..f2ae140a7355c 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -175,3 +175,4 @@ cherry-pick-6b84dc72351b.patch
 cherry-pick-7dd3b1c86795.patch
 cherry-pick-1028ffc9bd83.patch
 cherry-pick-5745eaf16077.patch
+cherry-pick-668cf831e912.patch
diff --git a/patches/chromium/cherry-pick-668cf831e912.patch b/patches/chromium/cherry-pick-668cf831e912.patch
new file mode 100644
index 0000000000000..e724f55a883e0
--- /dev/null
+++ b/patches/chromium/cherry-pick-668cf831e912.patch
@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ken Rockot <rockot@google.com>
+Date: Tue, 23 Mar 2021 21:13:00 +0000
+Subject: Never fail in ReceiverSet::Add
+
+Because of how UniqueReceiverSet is implemented and used, it is
+dangerous to allow Add() to fail: callers reasonably assume that added
+objects are still alive immediately after the Add() call.
+
+This changes ReceiverId to a uint64 and simply CHECK-fails on
+insert collision.
+
+This fundamentally increases binary size of 32-bit builds, because
+a widely used 32-bit data type is expanding to 64 bits for the sake
+of security and stability. It is effectively unavoidable for now, and
+also just barely above the tolerable threshold.
+
+A follow-up (but less backwards-mergeable) change should be able to
+reduce binary size beyond this increase by consolidating shared
+code among ReceiverSet template instantiations.
+
+Fixed: 1185732
+Change-Id: I9acf6aaaa36e10fdce5aa49a890173caddc13c52
+Binary-Size: Unavoidable (see above)
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2778871
+Commit-Queue: Ken Rockot <rockot@google.com>
+Auto-Submit: Ken Rockot <rockot@google.com>
+Reviewed-by: Robert Sesek <rsesek@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#865815}
+
+diff --git a/mojo/public/cpp/bindings/receiver_set.h b/mojo/public/cpp/bindings/receiver_set.h
+index 8d7d73231543c70b67913fdf735c1a16cc6170b1..56027d1f3e6393f739c3b51330137d54ae3fc0d2 100644
+--- a/mojo/public/cpp/bindings/receiver_set.h
++++ b/mojo/public/cpp/bindings/receiver_set.h
+@@ -24,7 +24,7 @@
+ 
+ namespace mojo {
+ 
+-using ReceiverId = size_t;
++using ReceiverId = uint64_t;
+ 
+ template <typename ReceiverType>
+ struct ReceiverSetTraits;
+@@ -359,11 +359,11 @@ class ReceiverSetBase {
+                      Context context,
+                      scoped_refptr<base::SequencedTaskRunner> task_runner) {
+     ReceiverId id = next_receiver_id_++;
+-    DCHECK_GE(next_receiver_id_, 0u);
+     auto entry =
+         std::make_unique<Entry>(std::move(impl), std::move(receiver), this, id,
+                                 std::move(context), std::move(task_runner));
+-    receivers_.insert(std::make_pair(id, std::move(entry)));
++    auto result = receivers_.insert(std::make_pair(id, std::move(entry)));
++    CHECK(result.second) << "ReceiverId overflow with collision";
+     return id;
+   }
+ 

From 56b680713a876b710c74c5df878f282793d6dbf3 Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Thu, 29 Apr 2021 22:38:17 +0200
Subject: [PATCH 35/48] chore: cherry-pick 02f5ef8c88d7 from chromium (#28935)

* chore: cherry-pick 02f5ef8c88d7 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |   1 +
 .../chromium/cherry-pick-02f5ef8c88d7.patch   | 106 ++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-02f5ef8c88d7.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index f2ae140a7355c..6b1ac3e7fbe9d 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -175,4 +175,5 @@ cherry-pick-6b84dc72351b.patch
 cherry-pick-7dd3b1c86795.patch
 cherry-pick-1028ffc9bd83.patch
 cherry-pick-5745eaf16077.patch
+cherry-pick-02f5ef8c88d7.patch
 cherry-pick-668cf831e912.patch
diff --git a/patches/chromium/cherry-pick-02f5ef8c88d7.patch b/patches/chromium/cherry-pick-02f5ef8c88d7.patch
new file mode 100644
index 0000000000000..535b1c6519186
--- /dev/null
+++ b/patches/chromium/cherry-pick-02f5ef8c88d7.patch
@@ -0,0 +1,106 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Josh Karlin <jkarlin@chromium.org>
+Date: Wed, 14 Apr 2021 09:21:00 +0000
+Subject: Fix removal of observers in NetworkStateNotifier
+
+The NetworkStateNotifier has a per-thread list of observer pointers. If
+one is deleted mid-iteration, what we do is replace the pointer in the
+list with a 0, and add the index to the zeroed list of observers to
+remove after iteration completes. Well, the removal step was broken
+for cases where there were multiple elements to remove. It didn't adjust
+for the fact that the indexes shifted after each removal.
+
+(cherry picked from commit 5d34987de6cffb8d747c5ed16e82614e9146cc0a)
+
+Bug: 1170148
+Change-Id: I446acaae5f8a805a58142848634a0ee8c5f90882
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2727306
+Reviewed-by: Kentaro Hara <haraken@chromium.org>
+Commit-Queue: Josh Karlin <jkarlin@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#858853}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821797
+Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Commit-Queue: Jana Grill <janagrill@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1602}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/third_party/blink/renderer/platform/network/network_state_notifier.cc b/third_party/blink/renderer/platform/network/network_state_notifier.cc
+index dbc9d03a813c5ed50b033ce135851311a731c02a..f9bfbe1c520fe8f293f5ffbd948052c6a8c5d6b7 100644
+--- a/third_party/blink/renderer/platform/network/network_state_notifier.cc
++++ b/third_party/blink/renderer/platform/network/network_state_notifier.cc
+@@ -394,8 +394,14 @@ void NetworkStateNotifier::CollectZeroedObservers(
+ 
+   // If any observers were removed during the iteration they will have
+   // 0 values, clean them up.
+-  for (wtf_size_t i = 0; i < list->zeroed_observers.size(); ++i)
+-    list->observers.EraseAt(list->zeroed_observers[i]);
++  std::sort(list->zeroed_observers.begin(), list->zeroed_observers.end());
++  int removed = 0;
++  for (wtf_size_t i = 0; i < list->zeroed_observers.size(); ++i) {
++    int index_to_remove = list->zeroed_observers[i] - removed;
++    DCHECK_EQ(nullptr, list->observers[index_to_remove]);
++    list->observers.EraseAt(index_to_remove);
++    removed += 1;
++  }
+ 
+   list->zeroed_observers.clear();
+ 
+diff --git a/third_party/blink/renderer/platform/network/network_state_notifier_test.cc b/third_party/blink/renderer/platform/network/network_state_notifier_test.cc
+index eb2bd791529df4339ebd8159700769fcd06d795f..f7c359235a87adc231c00eb252dc24a7d95065f8 100644
+--- a/third_party/blink/renderer/platform/network/network_state_notifier_test.cc
++++ b/third_party/blink/renderer/platform/network/network_state_notifier_test.cc
+@@ -528,6 +528,53 @@ TEST_F(NetworkStateNotifierTest, RemoveFutureObserverWhileNotifying) {
+       kUnknownThroughputMbps, SaveData::kOff));
+ }
+ 
++// It should be safe to remove multiple observers in one iteration.
++TEST_F(NetworkStateNotifierTest, RemoveMultipleObserversWhileNotifying) {
++  StateObserver observer1, observer2, observer3;
++  std::unique_ptr<NetworkStateNotifier::NetworkStateObserverHandle> handle1 =
++      notifier_.AddConnectionObserver(&observer1, GetTaskRunner());
++  std::unique_ptr<NetworkStateNotifier::NetworkStateObserverHandle> handle2 =
++      notifier_.AddConnectionObserver(&observer2, GetTaskRunner());
++  std::unique_ptr<NetworkStateNotifier::NetworkStateObserverHandle> handle3 =
++      notifier_.AddConnectionObserver(&observer3, GetTaskRunner());
++  observer1.RemoveObserverOnNotification(std::move(handle1));
++  observer3.RemoveObserverOnNotification(std::move(handle3));
++
++  // Running the first time should delete observers 1 and 3.
++  SetConnection(kWebConnectionTypeBluetooth, kBluetoothMaxBandwidthMbps,
++                WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt,
++                kUnknownRtt, kUnknownThroughputMbps, SaveData::kOff);
++  EXPECT_TRUE(VerifyObservations(
++      observer1, kWebConnectionTypeBluetooth, kBluetoothMaxBandwidthMbps,
++      WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt, kUnknownRtt,
++      kUnknownThroughputMbps, SaveData::kOff));
++  EXPECT_TRUE(VerifyObservations(
++      observer2, kWebConnectionTypeBluetooth, kBluetoothMaxBandwidthMbps,
++      WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt, kUnknownRtt,
++      kUnknownThroughputMbps, SaveData::kOff));
++  EXPECT_TRUE(VerifyObservations(
++      observer3, kWebConnectionTypeBluetooth, kBluetoothMaxBandwidthMbps,
++      WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt, kUnknownRtt,
++      kUnknownThroughputMbps, SaveData::kOff));
++
++  // Run again and only observer 2 should have been updated.
++  SetConnection(kWebConnectionTypeEthernet, kEthernetMaxBandwidthMbps,
++                WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt,
++                kUnknownRtt, kUnknownThroughputMbps, SaveData::kOff);
++  EXPECT_TRUE(VerifyObservations(
++      observer1, kWebConnectionTypeBluetooth, kBluetoothMaxBandwidthMbps,
++      WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt, kUnknownRtt,
++      kUnknownThroughputMbps, SaveData::kOff));
++  EXPECT_TRUE(VerifyObservations(
++      observer2, kWebConnectionTypeEthernet, kEthernetMaxBandwidthMbps,
++      WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt, kUnknownRtt,
++      kUnknownThroughputMbps, SaveData::kOff));
++  EXPECT_TRUE(VerifyObservations(
++      observer3, kWebConnectionTypeBluetooth, kBluetoothMaxBandwidthMbps,
++      WebEffectiveConnectionType::kTypeUnknown, kUnknownRtt, kUnknownRtt,
++      kUnknownThroughputMbps, SaveData::kOff));
++}
++
+ TEST_F(NetworkStateNotifierTest, MultipleContextsAddObserver) {
+   StateObserver observer1, observer2;
+   std::unique_ptr<NetworkStateNotifier::NetworkStateObserverHandle> handle1 =

From 770fff694a50b8fbffc9a46e8cd4af70d2b9d0fd Mon Sep 17 00:00:00 2001
From: Pedro Pontes <ppontes@gmail.com>
Date: Fri, 30 Apr 2021 18:37:06 +0200
Subject: [PATCH 36/48] chore: cherry-pick f37149c4434f from chromium (#28949)

* chore: cherry-pick f37149c4434f from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
---
 patches/chromium/.patches                     |   1 +
 .../chromium/cherry-pick-f37149c4434f.patch   | 314 ++++++++++++++++++
 2 files changed, 315 insertions(+)
 create mode 100644 patches/chromium/cherry-pick-f37149c4434f.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 6b1ac3e7fbe9d..90aaa1a2bd17e 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -177,3 +177,4 @@ cherry-pick-1028ffc9bd83.patch
 cherry-pick-5745eaf16077.patch
 cherry-pick-02f5ef8c88d7.patch
 cherry-pick-668cf831e912.patch
+cherry-pick-f37149c4434f.patch
diff --git a/patches/chromium/cherry-pick-f37149c4434f.patch b/patches/chromium/cherry-pick-f37149c4434f.patch
new file mode 100644
index 0000000000000..a72ab6bd60189
--- /dev/null
+++ b/patches/chromium/cherry-pick-f37149c4434f.patch
@@ -0,0 +1,314 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jana Grill <janagrill@google.com>
+Date: Mon, 19 Apr 2021 10:55:05 +0000
+Subject: Don't show autofill dropdown for element outside the viewport
+
+Details are in the linked bug.
+
+Also cherry pick crrev/c/2682341 and a part of crrev/c/2628287 to fix
+failing tests and compile errors.
+
+(cherry picked from commit 53a4f38ee5d44bd935d176cc89e3e59fd0a3970e)
+
+Bug: 1172533,1173297
+Change-Id: Iee429cac167ccdb0cd74acf57fc5f7c3821883b1
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2675932
+Commit-Queue: Mohamed Amir Yosef <mamir@chromium.org>
+Reviewed-by: Vasilii Sukhanov <vasilii@chromium.org>
+Reviewed-by: Evan Stade <estade@chromium.org>
+Cr-Original-Commit-Position: refs/heads/master@{#851718}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2822155
+Commit-Queue: Jana Grill <janagrill@google.com>
+Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
+Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
+Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
+Cr-Commit-Position: refs/branch-heads/4240@{#1611}
+Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
+
+diff --git a/chrome/browser/autofill/autofill_interactive_uitest.cc b/chrome/browser/autofill/autofill_interactive_uitest.cc
+index e28756cffe70f5f62630e54f4d74230ca21e477f..45be9ac71dc96783bfd0402f5012f94d02f9ab93 100644
+--- a/chrome/browser/autofill/autofill_interactive_uitest.cc
++++ b/chrome/browser/autofill/autofill_interactive_uitest.cc
+@@ -2771,7 +2771,14 @@ class AutofillInteractiveIsolationTest : public AutofillInteractiveTestBase {
+   }
+ };
+ 
+-IN_PROC_BROWSER_TEST_F(AutofillInteractiveIsolationTest, SimpleCrossSiteFill) {
++// Flaky on ChromeOS http://crbug.com/1175735
++#if defined(OS_CHROMEOS)
++#define MAYBE_SimpleCrossSiteFill DISABLED_SimpleCrossSiteFill
++#else
++#define MAYBE_SimpleCrossSiteFill SimpleCrossSiteFill
++#endif
++IN_PROC_BROWSER_TEST_F(AutofillInteractiveIsolationTest,
++                       MAYBE_SimpleCrossSiteFill) {
+   CreateTestProfile();
+ 
+   // Main frame is on a.com, iframe is on b.com.
+@@ -2814,7 +2821,8 @@ IN_PROC_BROWSER_TEST_F(AutofillInteractiveIsolationTest, SimpleCrossSiteFill) {
+ // This test verifies that credit card (payment card list) popup works when the
+ // form is inside an OOPIF.
+ // Flaky on Windows http://crbug.com/728488
+-#if defined(OS_WIN)
++// Flaky on ChromeOS http://crbug.com/1175735
++#if defined(OS_WIN) || defined(OS_CHROMEOS)
+ #define MAYBE_CrossSitePaymentForms DISABLED_CrossSitePaymentForms
+ #else
+ #define MAYBE_CrossSitePaymentForms CrossSitePaymentForms
+@@ -2852,8 +2860,14 @@ IN_PROC_BROWSER_TEST_F(AutofillInteractiveTest, MAYBE_CrossSitePaymentForms) {
+                        {ObservedUiEvents::kSuggestionShown});
+ }
+ 
++// Flaky on ChromeOS http://crbug.com/1175735
++#if defined(OS_CHROMEOS)
++#define MAYBE_DeletingFrameUnderSuggestion DISABLED_DeletingFrameUnderSuggestion
++#else
++#define MAYBE_DeletingFrameUnderSuggestion DeletingFrameUnderSuggestion
++#endif
+ IN_PROC_BROWSER_TEST_F(AutofillInteractiveIsolationTest,
+-                       DeletingFrameUnderSuggestion) {
++                       MAYBE_DeletingFrameUnderSuggestion) {
+   CreateTestProfile();
+ 
+   // Main frame is on a.com, iframe is on b.com.
+diff --git a/chrome/browser/autofill/autofill_uitest.cc b/chrome/browser/autofill/autofill_uitest.cc
+index b405c197f6a51bfe28aea9790fc73025238be8e2..f136fd6ac034316822d71d3ccaafb906c43a5139 100644
+--- a/chrome/browser/autofill/autofill_uitest.cc
++++ b/chrome/browser/autofill/autofill_uitest.cc
+@@ -8,6 +8,7 @@
+ #include "base/macros.h"
+ #include "base/run_loop.h"
+ #include "chrome/browser/autofill/autofill_uitest.h"
++#include "chrome/browser/autofill/autofill_uitest_util.h"
+ #include "chrome/browser/autofill/personal_data_manager_factory.h"
+ #include "chrome/browser/profiles/profile.h"
+ #include "chrome/browser/ui/browser.h"
+@@ -78,6 +79,10 @@ void AutofillUiTest::SetUpOnMainThread() {
+                          /* new_host = */ GetWebContents()->GetMainFrame());
+   Observe(GetWebContents());
+ 
++  // Wait for Personal Data Manager to be fully loaded to prevent that
++  // spurious notifications deceive the tests.
++  WaitForPersonalDataManagerToBeLoaded(browser());
++
+   disable_animation_ = std::make_unique<ui::ScopedAnimationDurationScaleMode>(
+       ui::ScopedAnimationDurationScaleMode::ZERO_DURATION);
+ 
+diff --git a/chrome/browser/autofill/autofill_uitest_util.cc b/chrome/browser/autofill/autofill_uitest_util.cc
+index 5bee77a2b6b451c4e15b0329379961164ac4f973..69d62b4f506e83e46db57d7afbff5ddf3911fd79 100644
+--- a/chrome/browser/autofill/autofill_uitest_util.cc
++++ b/chrome/browser/autofill/autofill_uitest_util.cc
+@@ -113,4 +113,12 @@ void WaitForPersonalDataChange(Browser* browser) {
+   observer.Wait();
+ }
+ 
++// Adjusted from crrev/c/2628287 to fix failure in crrev/c/2822155
++void WaitForPersonalDataManagerToBeLoaded(Browser* browser) {
++  PersonalDataManager* pdm =
++      autofill::PersonalDataManagerFactory::GetForProfile(browser->profile());
++  while (!pdm->IsDataLoaded())
++    WaitForPersonalDataChange(browser);
++}
++
+ }  // namespace autofill
+diff --git a/chrome/browser/autofill/autofill_uitest_util.h b/chrome/browser/autofill/autofill_uitest_util.h
+index df333ecf76a98def05aa55fa0c332010fb4eebd0..c95a3888563d43fa26196b7164c73db96cb80343 100644
+--- a/chrome/browser/autofill/autofill_uitest_util.h
++++ b/chrome/browser/autofill/autofill_uitest_util.h
+@@ -24,6 +24,9 @@ void AddTestAutofillData(Browser* browser,
+                          const CreditCard& card);
+ void WaitForPersonalDataChange(Browser* browser);
+ 
++// Adjusted from crrev/c/2628287 to fix failure in crrev/c/2822155
++void WaitForPersonalDataManagerToBeLoaded(Browser* browser);
++
+ }  // namespace autofill
+ 
+ #endif  // CHROME_BROWSER_AUTOFILL_AUTOFILL_UITEST_UTIL_H_
+diff --git a/chrome/browser/ui/passwords/password_generation_popup_view_browsertest.cc b/chrome/browser/ui/passwords/password_generation_popup_view_browsertest.cc
+index 7fbfcfe10bb7ed8987aaddabf3562c7a25efbaf4..31cb5347160cc069ac0fd16abd3f76017d82314a 100644
+--- a/chrome/browser/ui/passwords/password_generation_popup_view_browsertest.cc
++++ b/chrome/browser/ui/passwords/password_generation_popup_view_browsertest.cc
+@@ -26,9 +26,15 @@ class TestPasswordGenerationPopupController
+   explicit TestPasswordGenerationPopupController(
+       content::WebContents* web_contents)
+       : PasswordGenerationPopupControllerImpl(
+-            gfx::RectF(0, 0, 10, 10),
++            gfx::RectF(web_contents->GetContainerBounds().x(),
++                       web_contents->GetContainerBounds().y(),
++                       10,
++                       10),
+             autofill::password_generation::PasswordGenerationUIData(
+-                /*bounds=*/gfx::RectF(0, 0, 10, 10),
++                /*bounds=*/gfx::RectF(web_contents->GetContainerBounds().x(),
++                                      web_contents->GetContainerBounds().y(),
++                                      10,
++                                      10),
+                 /*max_length=*/10,
+                 /*generation_element=*/base::string16(),
+                 autofill::FieldRendererId(100),
+@@ -70,7 +76,9 @@ IN_PROC_BROWSER_TEST_F(PasswordGenerationPopupViewTest,
+       new autofill::TestPasswordGenerationPopupController(GetWebContents());
+   controller_->Show(PasswordGenerationPopupController::kEditGeneratedPassword);
+ 
+-  GetViewTester()->SimulateMouseMovementAt(gfx::Point(1, 1));
++  GetViewTester()->SimulateMouseMovementAt(
++      gfx::Point(GetWebContents()->GetContainerBounds().x() + 1,
++                 GetWebContents()->GetContainerBounds().y() + 1));
+ 
+   // This hides the popup and destroys the controller.
+   GetWebContents()->Close();
+diff --git a/chrome/browser/ui/views/autofill/autofill_popup_base_view.cc b/chrome/browser/ui/views/autofill/autofill_popup_base_view.cc
+index cb0c7e0b669fcae0f9c842221be47c2866a18d39..f748f66b78f6880dc72037e09b86697f30b696c2 100644
+--- a/chrome/browser/ui/views/autofill/autofill_popup_base_view.cc
++++ b/chrome/browser/ui/views/autofill/autofill_popup_base_view.cc
+@@ -259,8 +259,8 @@ bool AutofillPopupBaseView::DoUpdateBoundsAndRedrawPopup() {
+   // area so that the user notices the presence of the popup.
+   int item_height =
+       children().size() > 0 ? children()[0]->GetPreferredSize().height() : 0;
+-  if (!HasEnoughHeightForOneRow(item_height, GetContentAreaBounds(),
+-                                element_bounds)) {
++  if (!CanShowDropdownHere(item_height, GetContentAreaBounds(),
++                           element_bounds)) {
+     HideController(PopupHidingReason::kInsufficientSpace);
+     return false;
+   }
+diff --git a/chrome/browser/ui/views/autofill/autofill_popup_base_view_browsertest.cc b/chrome/browser/ui/views/autofill/autofill_popup_base_view_browsertest.cc
+index fcf2076ddff00a4a010f8d5c14c9b99070aa6911..92b79871919e971aff7043718b0187d8b9e8972c 100644
+--- a/chrome/browser/ui/views/autofill/autofill_popup_base_view_browsertest.cc
++++ b/chrome/browser/ui/views/autofill/autofill_popup_base_view_browsertest.cc
+@@ -53,10 +53,13 @@ class AutofillPopupBaseViewTest : public InProcessBrowserTest {
+   ~AutofillPopupBaseViewTest() override {}
+ 
+   void SetUpOnMainThread() override {
+-    gfx::NativeView native_view =
+-        browser()->tab_strip_model()->GetActiveWebContents()->GetNativeView();
++    content::WebContents* web_contents =
++        browser()->tab_strip_model()->GetActiveWebContents();
++    gfx::NativeView native_view = web_contents->GetNativeView();
+     EXPECT_CALL(mock_delegate_, container_view())
+         .WillRepeatedly(Return(native_view));
++    EXPECT_CALL(mock_delegate_, GetWebContents())
++        .WillRepeatedly(Return(web_contents));
+     EXPECT_CALL(mock_delegate_, ViewDestroyed());
+ 
+     view_ = new AutofillPopupBaseView(
+diff --git a/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc b/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc
+index 6622a15d0c10c4a3cc1d4fc69aee682372e42aa6..be6dd2e36d2ba0c9173c158f31c7dae9856adc2c 100644
+--- a/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc
++++ b/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc
+@@ -1229,8 +1229,9 @@ bool AutofillPopupViewNativeViews::DoUpdateBoundsAndRedrawPopup() {
+       body_container_ && body_container_->children().size() > 0
+           ? body_container_->children()[0]->GetPreferredSize().height()
+           : 0;
+-  if (!HasEnoughHeightForOneRow(item_height, GetContentAreaBounds(),
+-                                element_bounds)) {
++
++  if (!CanShowDropdownHere(item_height, GetContentAreaBounds(),
++                           element_bounds)) {
+     controller_->Hide(PopupHidingReason::kInsufficientSpace);
+     return false;
+   }
+diff --git a/chrome/browser/ui/views/autofill/autofill_popup_view_utils.cc b/chrome/browser/ui/views/autofill/autofill_popup_view_utils.cc
+index e95fe363ba65c7bf6223820f5f3ec110d395cbeb..82f528c39a6edeb329bc8c19321831caca41e553 100644
+--- a/chrome/browser/ui/views/autofill/autofill_popup_view_utils.cc
++++ b/chrome/browser/ui/views/autofill/autofill_popup_view_utils.cc
+@@ -87,16 +87,26 @@ gfx::Rect CalculatePopupBounds(const gfx::Size& desired_size,
+   return popup_bounds;
+ }
+ 
+-bool HasEnoughHeightForOneRow(int item_height,
+-                              const gfx::Rect& content_area_bounds,
+-                              const gfx::Rect& element_bounds) {
+-  // Ensure that at least one row of the popup can be displayed within the
++bool CanShowDropdownHere(int item_height,
++                         const gfx::Rect& content_area_bounds,
++                         const gfx::Rect& element_bounds) {
++  // Ensure that at least one row of the popup will be displayed within the
+   // bounds of the content area so that the user notices the presence of the
+   // popup.
+   bool enough_space_for_one_item_in_content_area_above_element =
+       element_bounds.y() - content_area_bounds.y() >= item_height;
++  bool element_top_is_within_content_area_bounds =
++      element_bounds.y() > content_area_bounds.y() &&
++      element_bounds.y() < content_area_bounds.bottom();
++
+   bool enough_space_for_one_item_in_content_area_below_element =
+       content_area_bounds.bottom() - element_bounds.bottom() >= item_height;
+-  return enough_space_for_one_item_in_content_area_above_element ||
+-         enough_space_for_one_item_in_content_area_below_element;
++  bool element_bottom_is_within_content_area_bounds =
++      element_bounds.bottom() > content_area_bounds.y() &&
++      element_bounds.bottom() < content_area_bounds.bottom();
++
++  return (enough_space_for_one_item_in_content_area_above_element &&
++          element_top_is_within_content_area_bounds) ||
++         (enough_space_for_one_item_in_content_area_below_element &&
++          element_bottom_is_within_content_area_bounds);
+ }
+diff --git a/chrome/browser/ui/views/autofill/autofill_popup_view_utils.h b/chrome/browser/ui/views/autofill/autofill_popup_view_utils.h
+index 990d67cababe9363fe5ee1b91bee81986846f807..bab1a26c38f7fcbea7da51e92e0d8e3dfe97622b 100644
+--- a/chrome/browser/ui/views/autofill/autofill_popup_view_utils.h
++++ b/chrome/browser/ui/views/autofill/autofill_popup_view_utils.h
+@@ -34,9 +34,10 @@ gfx::Rect CalculatePopupBounds(const gfx::Size& desired_size,
+                                bool is_rtl);
+ 
+ // Returns whether there is enough height within |content_area_bounds| above or
+-// below |element_bounds| to display |item_height|.
+-bool HasEnoughHeightForOneRow(int item_height,
+-                              const gfx::Rect& content_area_bounds,
+-                              const gfx::Rect& element_bounds);
++// below |element_bounds| to display |item_height|, and that the first dropdown
++// item will actually be visible within the bounds of the content area.
++bool CanShowDropdownHere(int item_height,
++                         const gfx::Rect& content_area_bounds,
++                         const gfx::Rect& element_bounds);
+ 
+ #endif  // CHROME_BROWSER_UI_VIEWS_AUTOFILL_AUTOFILL_POPUP_VIEW_UTILS_H_
+diff --git a/chrome/browser/ui/views/autofill/autofill_popup_view_utils_unittest.cc b/chrome/browser/ui/views/autofill/autofill_popup_view_utils_unittest.cc
+index 78fa8a09a4791bde5825935e8f2b7e805c100b1f..cecd8d2c3173ea7b48ebebf5ae33fd2c531e6551 100644
+--- a/chrome/browser/ui/views/autofill/autofill_popup_view_utils_unittest.cc
++++ b/chrome/browser/ui/views/autofill/autofill_popup_view_utils_unittest.cc
+@@ -1,3 +1,4 @@
++
+ // Copyright 2020 The Chromium Authors. All rights reserved.
+ // Use of this source code is governed by a BSD-style license that can be
+ // found in the LICENSE file.
+@@ -115,7 +116,34 @@ TEST(AutofillPopupViewUtilsTest, NotEnoughHeightForAnItem) {
+   gfx::Rect content_area_bounds(x, window_y + 2, width, height - 2);
+   gfx::Rect element_bounds(x, window_y + 3, width, height - 3);
+ 
+-  bool enough_height_for_item = HasEnoughHeightForOneRow(
+-      item_height, content_area_bounds, element_bounds);
+-  EXPECT_FALSE(enough_height_for_item);
++  EXPECT_FALSE(
++      CanShowDropdownHere(item_height, content_area_bounds, element_bounds));
++}
++
++TEST(AutofillPopupViewUtilsTest, ElementOutOfContentAreaBounds) {
++  // In this test, each row of the popup has a height of 8 pixels, and there is
++  // no enough height in the content area to show one row.
++  //
++  //  |---------------------|    ---> y = 5
++  //  |       Window        |
++  //  | |-----------------| |    ---> y = 7
++  //  | |                 | |
++  //  | |   Content Area  | |
++  //  | |                 | |
++  //  |-|-----------------|-|    ---> y = 50
++  //      |-------------|        ---> y = 53
++  //      |   Element   |
++  //      |-------------|        ---> y = 63
++
++  constexpr int item_height = 8;
++  constexpr int window_y = 5;
++  constexpr int x = 10;
++  constexpr int width = 5;
++  constexpr int height = 46;
++
++  gfx::Rect content_area_bounds(x, window_y + 2, width, height - 2);
++  gfx::Rect element_bounds(x, window_y + height + 3, width, 10);
++
++  EXPECT_FALSE(
++      CanShowDropdownHere(item_height, content_area_bounds, element_bounds));
+ }

From b0bbf47e0cc0451e4269b5bfb5e99e607650c442 Mon Sep 17 00:00:00 2001
From: Keeley Hammond <vertedinde@electronjs.org>
Date: Fri, 30 Apr 2021 10:58:47 -0700
Subject: [PATCH 37/48] build: add release-env context to publish-macos
 (#28946)

---
 .circleci/config.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 48df451e63527..6887368c3d3e0 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -2369,9 +2369,11 @@ workflows:
     - osx-publish-skip-checkout:
         requires:
           - mac-checkout
+        context: release-env
     - mas-publish-skip-checkout:
         requires:
           - mac-checkout
+        context: release-env
 
   lint:
     when: << pipeline.parameters.run-lint >>

From 382f1ec9e448b266bda5febcc616bc5f0b7f7853 Mon Sep 17 00:00:00 2001
From: Samuel Attard <sam@electronjs.org>
Date: Tue, 13 Apr 2021 15:30:46 -0700
Subject: [PATCH 38/48] build: do not require vsts token for releases (#28643)

---
 .env.example                       | 1 -
 script/release/ci-release-build.js | 4 +++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index eb3df4b6bdf9c..4d218327bd60e 100644
--- a/.env.example
+++ b/.env.example
@@ -4,4 +4,3 @@
 APPVEYOR_CLOUD_TOKEN=
 CIRCLE_TOKEN=
 ELECTRON_GITHUB_TOKEN=
-VSTS_TOKEN=
\ No newline at end of file
diff --git a/script/release/ci-release-build.js b/script/release/ci-release-build.js
index 3b838a7971671..e0eaeb13caa08 100644
--- a/script/release/ci-release-build.js
+++ b/script/release/ci-release-build.js
@@ -270,11 +270,13 @@ async function buildVSTS (targetBranch, options) {
     }
   }
 
+  const vstsToken = process.env.VSTS_TOKEN;
+  assert(vstsToken, `${options.ci} requires the $VSTS_TOKEN environment variable to be provided`);
   const requestOpts = {
     url: `${VSTS_URL}/definitions?api-version=4.1`,
     auth: {
       user: '',
-      password: process.env.VSTS_TOKEN
+      password: vstsToken
     },
     headers: {
       'Content-Type': 'application/json'

From 9824bc06d5734c56cb3f2732e166a69f373a1af7 Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Fri, 30 Apr 2021 11:09:10 -0700
Subject: [PATCH 39/48] Bump v10.4.5

---
 ELECTRON_VERSION                        | 2 +-
 package.json                            | 2 +-
 shell/browser/resources/win/electron.rc | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ELECTRON_VERSION b/ELECTRON_VERSION
index 69068409e7e73..9dd5407ec81c5 100644
--- a/ELECTRON_VERSION
+++ b/ELECTRON_VERSION
@@ -1 +1 @@
-10.4.4
\ No newline at end of file
+10.4.5
\ No newline at end of file
diff --git a/package.json b/package.json
index 8664f9e471725..aef9fc3372268 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "10.4.4",
+  "version": "10.4.5",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
diff --git a/shell/browser/resources/win/electron.rc b/shell/browser/resources/win/electron.rc
index 5710814f96bbe..04353f4f0517f 100644
--- a/shell/browser/resources/win/electron.rc
+++ b/shell/browser/resources/win/electron.rc
@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 10,4,4,0
- PRODUCTVERSION 10,4,4,0
+ FILEVERSION 10,4,5,0
+ PRODUCTVERSION 10,4,5,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "10.4.4"
+            VALUE "FileVersion", "10.4.5"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "10.4.4"
+            VALUE "ProductVersion", "10.4.5"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

From 1adea52f3d49269c0276b2242acfa0ec80c26e82 Mon Sep 17 00:00:00 2001
From: Samuel Attard <samuel.r.attard@gmail.com>
Date: Mon, 3 May 2021 16:04:55 -0700
Subject: [PATCH 40/48] Revert "Bump v10.4.5"

This reverts commit 9824bc06d5734c56cb3f2732e166a69f373a1af7.
---
 ELECTRON_VERSION                        | 2 +-
 package.json                            | 2 +-
 shell/browser/resources/win/electron.rc | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ELECTRON_VERSION b/ELECTRON_VERSION
index 9dd5407ec81c5..69068409e7e73 100644
--- a/ELECTRON_VERSION
+++ b/ELECTRON_VERSION
@@ -1 +1 @@
-10.4.5
\ No newline at end of file
+10.4.4
\ No newline at end of file
diff --git a/package.json b/package.json
index aef9fc3372268..8664f9e471725 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "10.4.5",
+  "version": "10.4.4",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
diff --git a/shell/browser/resources/win/electron.rc b/shell/browser/resources/win/electron.rc
index 04353f4f0517f..5710814f96bbe 100644
--- a/shell/browser/resources/win/electron.rc
+++ b/shell/browser/resources/win/electron.rc
@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 10,4,5,0
- PRODUCTVERSION 10,4,5,0
+ FILEVERSION 10,4,4,0
+ PRODUCTVERSION 10,4,4,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "10.4.5"
+            VALUE "FileVersion", "10.4.4"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "10.4.5"
+            VALUE "ProductVersion", "10.4.4"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

From 030562e0654373fc8c9b7c47e5d1feb109407bc4 Mon Sep 17 00:00:00 2001
From: Samuel Attard <sam@electronjs.org>
Date: Mon, 3 May 2021 18:01:24 -0700
Subject: [PATCH 41/48] build: Use goma for all releases (#26476) (#28977)

* build: use goma for all release builds

* Make sure goma is setup everywhere it is needed

* Show ninja stats on release builds

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
---
 .circleci/config.yml | 142 ++++++++++---------------------------------
 1 file changed, 31 insertions(+), 111 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 6887368c3d3e0..7098fa8b66360 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -135,9 +135,6 @@ env-mas: &env-mas
   MAS_BUILD: 'true'
 
 # Misc build configuration options.
-env-enable-sccache: &env-enable-sccache
-  USE_SCCACHE: true
-
 env-send-slack-notifications: &env-send-slack-notifications
   NOTIFY_SLACK: true
   
@@ -271,22 +268,10 @@ step-setup-env-for-build: &step-setup-env-for-build
       # To find `gn` executable.
       echo 'export CHROMIUM_BUILDTOOLS_PATH="'"$PWD"'/src/buildtools"' >> $BASH_ENV
 
-      if [ "$USE_SCCACHE" == "true" ]; then
-        # https://github.com/mozilla/sccache
-        SCCACHE_PATH="$PWD/src/electron/external_binaries/sccache"
-        echo 'export SCCACHE_PATH="'"$SCCACHE_PATH"'"' >> $BASH_ENV
-        if [ "$CIRCLE_PR_NUMBER" != "" ]; then
-          #if building a fork set readonly access to sccache
-          echo 'export SCCACHE_BUCKET="electronjs-sccache-ci"' >> $BASH_ENV
-          echo 'export SCCACHE_TWO_TIER=true' >> $BASH_ENV
-        fi
-      fi
-
 step-setup-goma-for-build: &step-setup-goma-for-build
   run:
     name: Setup Goma
     command: |
-      echo 'export USE_GOMA=true' >> $BASH_ENV
       echo 'export NUMBER_OF_NINJA_PROCESSES=300' >> $BASH_ENV
       if [ "`uname`" == "Darwin" ]; then
         echo 'ulimit -n 10000' >> $BASH_ENV
@@ -407,11 +392,7 @@ step-gn-gen-default: &step-gn-gen-default
     name: Default GN gen
     command: |
       cd src
-      if [ "$USE_GOMA" == "true" ]; then
-        gn gen out/Default --args="import(\"$GN_CONFIG\") import(\"$GN_GOMA_FILE\") $GN_EXTRA_ARGS $GN_BUILDFLAG_ARGS"
-      else
-        gn gen out/Default --args="import(\"$GN_CONFIG\") cc_wrapper=\"$SCCACHE_PATH\" $GN_EXTRA_ARGS $GN_BUILDFLAG_ARGS"
-      fi
+      gn gen out/Default --args="import(\"$GN_CONFIG\") import(\"$GN_GOMA_FILE\") $GN_EXTRA_ARGS $GN_BUILDFLAG_ARGS"
 
 step-gn-check: &step-gn-check
   run:
@@ -508,11 +489,7 @@ step-electron-maybe-chromedriver-gn-gen: &step-electron-maybe-chromedriver-gn-ge
     command: |
       cd src
       if [ "$TARGET_ARCH" == "arm" ] || [ "$TARGET_ARCH" == "arm64" ]; then
-        if [ "$USE_GOMA" == "true" ]; then
-          gn gen out/chromedriver --args="import(\"$GN_CONFIG\") import(\"$GN_GOMA_FILE\") is_component_ffmpeg=false proprietary_codecs=false $GN_EXTRA_ARGS $GN_BUILDFLAG_ARGS"
-        else
-          gn gen out/chromedriver --args="import(\"$GN_CONFIG\") cc_wrapper=\"$SCCACHE_PATH\" is_component_ffmpeg=false proprietary_codecs=false $GN_EXTRA_ARGS $GN_BUILDFLAG_ARGS"
-        fi
+        gn gen out/chromedriver --args="import(\"$GN_CONFIG\") import(\"$GN_GOMA_FILE\") is_component_ffmpeg=false proprietary_codecs=false $GN_EXTRA_ARGS $GN_BUILDFLAG_ARGS"
       fi
 
 step-electron-chromedriver-build: &step-electron-chromedriver-build
@@ -623,11 +600,7 @@ step-ffmpeg-gn-gen: &step-ffmpeg-gn-gen
     name: ffmpeg GN gen
     command: |
       cd src
-      if [ "$USE_GOMA" == "true" ]; then
-        gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") import(\"$GN_GOMA_FILE\") $GN_EXTRA_ARGS"
-      else
-        gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") cc_wrapper=\"$SCCACHE_PATH\" $GN_EXTRA_ARGS"
-      fi
+      gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") import(\"$GN_GOMA_FILE\") $GN_EXTRA_ARGS"
 
 step-ffmpeg-build: &step-ffmpeg-build
   run:
@@ -670,16 +643,17 @@ step-setup-linux-for-headless-testing: &step-setup-linux-for-headless-testing
         sh -e /etc/init.d/xvfb start
       fi
 
-step-show-sccache-stats: &step-show-sccache-stats
+step-show-goma-stats: &step-show-goma-stats
   run:
-    name: Check sccache/goma stats after build
+    shell: /bin/bash
+    name: Check goma stats after build
     command: |
-      if [ "$SCCACHE_PATH" != "" ]; then
-        $SCCACHE_PATH -s
-      fi
-      if [ "$USE_GOMA" == "true" ]; then
-        $LOCAL_GOMA_DIR/goma_ctl.py stat
-      fi
+      set +e
+      set +o pipefail
+      $LOCAL_GOMA_DIR/goma_ctl.py stat
+      $LOCAL_GOMA_DIR/diagnose_goma_log.py
+      true
+    when: always
 
 step-mksnapshot-build: &step-mksnapshot-build
   run:
@@ -1050,6 +1024,7 @@ steps-electron-gn-check: &steps-electron-gn-check
     - *step-maybe-early-exit-doc-only-change
     - *step-depot-tools-add-to-path
     - *step-setup-env-for-build
+    - *step-setup-goma-for-build
     - *step-gn-gen-default
     - *step-gn-check
 
@@ -1083,6 +1058,7 @@ steps-electron-ts-compile-for-doc-change: &steps-electron-ts-compile-for-doc-cha
 
     - *step-depot-tools-add-to-path
     - *step-setup-env-for-build
+    - *step-setup-goma-for-build
     - *step-restore-brew-cache
     - *step-get-more-space-on-mac
     - *step-install-npm-deps-on-mac
@@ -1092,26 +1068,13 @@ steps-electron-ts-compile-for-doc-change: &steps-electron-ts-compile-for-doc-cha
     #Compile ts/js to verify doc change didn't break anything
     - *step-ts-compile
 
-steps-chromedriver-build: &steps-chromedriver-build
-  steps:
-    - attach_workspace:
-        at: .
-    - *step-depot-tools-add-to-path
-    - *step-setup-env-for-build
-    - *step-fix-sync-on-mac
-
-    - *step-electron-maybe-chromedriver-gn-gen
-    - *step-electron-chromedriver-build
-    - *step-electron-chromedriver-store
-
-    - *step-maybe-notify-slack-failure
-
 steps-native-tests: &steps-native-tests
   steps:
     - attach_workspace:
         at: .
     - *step-depot-tools-add-to-path
     - *step-setup-env-for-build
+    - *step-setup-goma-for-build
     - *step-gn-gen-default
 
     - run:
@@ -1119,7 +1082,7 @@ steps-native-tests: &steps-native-tests
         command: |
           cd src
           ninja -C out/Default $BUILD_TARGET
-    - *step-show-sccache-stats
+    - *step-show-goma-stats
 
     - *step-setup-linux-for-headless-testing
     - run:
@@ -1413,7 +1376,7 @@ commands:
             - *step-nodejs-headers-build
             - *step-nodejs-headers-store
 
-            - *step-show-sccache-stats
+            - *step-show-goma-stats
 
             # mksnapshot
             - *step-mksnapshot-build
@@ -1501,13 +1464,14 @@ commands:
             - *step-gclient-sync
             - *step-delete-git-directories
             - *step-minimize-workspace-size-from-checkout
-      - *step-fix-sync-on-mac            
+      - *step-fix-sync-on-mac
       - *step-setup-env-for-build
+      - *step-setup-goma-for-build
       - *step-gn-gen-default
 
       # Electron app
       - *step-electron-build
-      - *step-show-sccache-stats
+      - *step-show-goma-stats
       - *step-maybe-generate-breakpad-symbols
       - *step-maybe-electron-dist-strip
       - *step-electron-dist-build
@@ -1691,14 +1655,6 @@ jobs:
       <<: *env-testing-build
     <<: *steps-electron-gn-check
 
-  linux-x64-chromedriver:
-    <<: *machine-linux-medium
-    environment:
-      <<: *env-linux-medium
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-    <<: *steps-chromedriver-build
-
   linux-x64-release:
     <<: *machine-linux-2xlarge
     environment:
@@ -1718,8 +1674,8 @@ jobs:
       <<: *env-linux-2xlarge-release
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_boto=True --custom-var=checkout_requests=True'
       <<: *env-release-build
-      <<: *env-enable-sccache
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: false
@@ -1730,8 +1686,8 @@ jobs:
     environment:
       <<: *env-linux-2xlarge-release
       <<: *env-release-build
-      <<: *env-enable-sccache
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: true
@@ -1751,15 +1707,6 @@ jobs:
           checkout: true
           use-out-cache: false
 
-  linux-ia32-chromedriver:
-    <<: *machine-linux-medium
-    environment:
-      <<: *env-linux-medium
-      <<: *env-ia32
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-    <<: *steps-chromedriver-build
-
   linux-ia32-release:
     <<: *machine-linux-2xlarge
     environment:
@@ -1781,9 +1728,9 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_boto=True --custom-var=checkout_requests=True'
       <<: *env-ia32
       <<: *env-release-build
-      <<: *env-enable-sccache
       <<: *env-32bit-release
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: false
@@ -1795,9 +1742,9 @@ jobs:
       <<: *env-linux-2xlarge-release
       <<: *env-ia32
       <<: *env-release-build
-      <<: *env-enable-sccache
       <<: *env-32bit-release
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: true
@@ -1818,15 +1765,6 @@ jobs:
           checkout: true
           use-out-cache: false
 
-  linux-arm-chromedriver:
-    <<: *machine-linux-medium
-    environment:
-      <<: *env-linux-medium
-      <<: *env-arm
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-    <<: *steps-chromedriver-build
-
   linux-arm-release:
     <<: *machine-linux-2xlarge
     environment:
@@ -1847,10 +1785,10 @@ jobs:
       <<: *env-linux-2xlarge-release
       <<: *env-arm
       <<: *env-release-build
-      <<: *env-enable-sccache
       <<: *env-32bit-release
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_boto=True --custom-var=checkout_requests=True'
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: false
@@ -1862,9 +1800,9 @@ jobs:
       <<: *env-linux-2xlarge-release
       <<: *env-arm
       <<: *env-release-build
-      <<: *env-enable-sccache
       <<: *env-32bit-release
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: true
@@ -1893,15 +1831,6 @@ jobs:
       <<: *env-testing-build
     <<: *steps-electron-gn-check
 
-  linux-arm64-chromedriver:
-    <<: *machine-linux-medium
-    environment:
-      <<: *env-linux-medium
-      <<: *env-arm64
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-    <<: *steps-chromedriver-build
-
   linux-arm64-release:
     <<: *machine-linux-2xlarge
     environment:
@@ -1922,9 +1851,9 @@ jobs:
       <<: *env-linux-2xlarge-release
       <<: *env-arm64
       <<: *env-release-build
-      <<: *env-enable-sccache
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm64=True --custom-var=checkout_boto=True --custom-var=checkout_requests=True'
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: false
@@ -1936,8 +1865,8 @@ jobs:
       <<: *env-linux-2xlarge-release
       <<: *env-arm64
       <<: *env-release-build
-      <<: *env-enable-sccache
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: true
@@ -1965,14 +1894,6 @@ jobs:
       <<: *env-testing-build
     <<: *steps-electron-gn-check
 
-  osx-chromedriver:
-    <<: *machine-mac
-    environment:
-      <<: *env-machine-mac
-      <<: *env-release-build
-      <<: *env-send-slack-notifications
-    <<: *steps-chromedriver-build
-
   osx-release:
     <<: *machine-mac-large
     environment:
@@ -1992,9 +1913,9 @@ jobs:
     environment:
       <<: *env-mac-large-release
       <<: *env-release-build
-      <<: *env-enable-sccache
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_boto=True --custom-var=checkout_requests=True'
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: false
@@ -2005,8 +1926,8 @@ jobs:
     environment:
       <<: *env-mac-large-release
       <<: *env-release-build
-      <<: *env-enable-sccache
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: true
@@ -2057,9 +1978,9 @@ jobs:
       <<: *env-mac-large-release
       <<: *env-mas
       <<: *env-release-build
-      <<: *env-enable-sccache
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_boto=True --custom-var=checkout_requests=True'
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
+      <<: *env-ninja-status
     steps:
       - electron-publish:  
           attach: false
@@ -2071,7 +1992,6 @@ jobs:
       <<: *env-mac-large-release
       <<: *env-mas
       <<: *env-release-build
-      <<: *env-enable-sccache
       UPLOAD_TO_S3: << pipeline.parameters.upload-to-s3 >>
     steps:
       - electron-publish:  

From 3ed3d28d7024371a0a22da12d678d2ea30073e1e Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Tue, 4 May 2021 11:47:30 -0700
Subject: [PATCH 42/48] Bump v10.4.5

---
 ELECTRON_VERSION                        | 2 +-
 package.json                            | 2 +-
 shell/browser/resources/win/electron.rc | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ELECTRON_VERSION b/ELECTRON_VERSION
index 69068409e7e73..9dd5407ec81c5 100644
--- a/ELECTRON_VERSION
+++ b/ELECTRON_VERSION
@@ -1 +1 @@
-10.4.4
\ No newline at end of file
+10.4.5
\ No newline at end of file
diff --git a/package.json b/package.json
index 8664f9e471725..aef9fc3372268 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "10.4.4",
+  "version": "10.4.5",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
diff --git a/shell/browser/resources/win/electron.rc b/shell/browser/resources/win/electron.rc
index 5710814f96bbe..04353f4f0517f 100644
--- a/shell/browser/resources/win/electron.rc
+++ b/shell/browser/resources/win/electron.rc
@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 10,4,4,0
- PRODUCTVERSION 10,4,4,0
+ FILEVERSION 10,4,5,0
+ PRODUCTVERSION 10,4,5,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "10.4.4"
+            VALUE "FileVersion", "10.4.5"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "10.4.4"
+            VALUE "ProductVersion", "10.4.5"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

From 29d8cf54231b7bb200437798f93157f248ab5592 Mon Sep 17 00:00:00 2001
From: Milan Burda <milan.burda@gmail.com>
Date: Fri, 7 May 2021 04:15:45 +0200
Subject: [PATCH 43/48] fix: <webview> focus / blur events don't work with
 contextIsolation enabled (#29004) (#29026)

---
 lib/renderer/web-view/web-view-impl.ts |  2 +-
 spec-main/webview-spec.ts              | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/lib/renderer/web-view/web-view-impl.ts b/lib/renderer/web-view/web-view-impl.ts
index c5a5c9269089f..8a141c39c9ad9 100644
--- a/lib/renderer/web-view/web-view-impl.ts
+++ b/lib/renderer/web-view/web-view-impl.ts
@@ -158,7 +158,7 @@ export class WebViewImpl {
 
   // Emits focus/blur events.
   onFocusChange () {
-    const hasFocus = document.activeElement === this.webviewNode;
+    const hasFocus = this.webviewNode.ownerDocument!.activeElement === this.webviewNode;
     if (hasFocus !== this.hasFocus) {
       this.hasFocus = hasFocus;
       this.dispatchEvent(new Event(hasFocus ? 'focus' : 'blur'));
diff --git a/spec-main/webview-spec.ts b/spec-main/webview-spec.ts
index 8bf015c03e1d5..fedaf2ff82b73 100644
--- a/spec-main/webview-spec.ts
+++ b/spec-main/webview-spec.ts
@@ -659,4 +659,29 @@ describe('<webview> tag', function () {
     generateSpecs('without sandbox', false);
     generateSpecs('with sandbox', true);
   });
+
+  describe('DOM events', () => {
+    afterEach(closeAllWindows);
+    it('emits focus event when contextIsolation is enabled', async () => {
+      const w = new BrowserWindow({
+        show: false,
+        webPreferences: {
+          webviewTag: true,
+          contextIsolation: true
+        }
+      });
+      await w.loadURL('about:blank');
+      await w.webContents.executeJavaScript(`new Promise((resolve, reject) => {
+        const webview = new WebView()
+        webview.setAttribute('src', 'about:blank')
+        webview.addEventListener('dom-ready', () => {
+          webview.focus()
+        })
+        webview.addEventListener('focus', () => {
+          resolve();
+        })
+        document.body.appendChild(webview)
+      })`);
+    });
+  });
 });

From ab3e65ae34784483b87baec2a24033e4856ed880 Mon Sep 17 00:00:00 2001
From: Milan Burda <milan.burda@gmail.com>
Date: Thu, 13 May 2021 23:39:16 +0200
Subject: [PATCH 44/48] fix: [webview] fix missing properties on events when
 contextIsolation: true (#29143)

Co-authored-by: Jeremy Rose <jeremya@chromium.org>
---
 lib/renderer/web-view/guest-view-internal.ts | 19 ++++++----------
 lib/renderer/web-view/web-view-element.ts    |  8 ++++++-
 lib/renderer/web-view/web-view-impl.ts       | 23 +++++++++++---------
 spec-main/webview-spec.ts                    | 20 +++++++++++++++++
 typings/internal-electron.d.ts               | 10 ---------
 5 files changed, 47 insertions(+), 33 deletions(-)

diff --git a/lib/renderer/web-view/guest-view-internal.ts b/lib/renderer/web-view/guest-view-internal.ts
index f84f46e4e6d40..ccdc53f9c1060 100644
--- a/lib/renderer/web-view/guest-view-internal.ts
+++ b/lib/renderer/web-view/guest-view-internal.ts
@@ -1,4 +1,4 @@
-import { webFrame, IpcMessageEvent } from 'electron';
+import { webFrame } from 'electron';
 import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
 import * as ipcRendererUtils from '@electron/internal/renderer/ipc-renderer-internal-utils';
 
@@ -52,15 +52,15 @@ const dispatchEvent = function (
     dispatchEvent(webView, DEPRECATED_EVENTS[eventName], eventKey, ...args);
   }
 
-  const domEvent = new Event(eventName) as ElectronInternal.WebViewEvent;
+  const props: Record<string, any> = {};
   WEB_VIEW_EVENTS[eventKey].forEach((prop, index) => {
-    (domEvent as any)[prop] = args[index];
+    props[prop] = args[index];
   });
 
-  webView.dispatchEvent(domEvent);
+  webView.dispatchEvent(eventName, props);
 
   if (eventName === 'load-commit') {
-    webView.onLoadCommit(domEvent);
+    webView.onLoadCommit(props);
   } else if (eventName === 'focus-change') {
     webView.onFocusChange();
   }
@@ -70,8 +70,7 @@ export function registerEvents (webView: WebViewImpl, viewInstanceId: number) {
   ipcRendererInternal.onMessageFromMain(`ELECTRON_GUEST_VIEW_INTERNAL_DESTROY_GUEST-${viewInstanceId}`, function () {
     webView.guestInstanceId = undefined;
     webView.reset();
-    const domEvent = new Event('destroyed');
-    webView.dispatchEvent(domEvent);
+    webView.dispatchEvent('destroyed');
   });
 
   ipcRendererInternal.onMessageFromMain(`ELECTRON_GUEST_VIEW_INTERNAL_DISPATCH_EVENT-${viewInstanceId}`, function (event, eventName, ...args) {
@@ -79,11 +78,7 @@ export function registerEvents (webView: WebViewImpl, viewInstanceId: number) {
   });
 
   ipcRendererInternal.onMessageFromMain(`ELECTRON_GUEST_VIEW_INTERNAL_IPC_MESSAGE-${viewInstanceId}`, function (event, channel, ...args) {
-    const domEvent = new Event('ipc-message') as IpcMessageEvent;
-    domEvent.channel = channel;
-    domEvent.args = args;
-
-    webView.dispatchEvent(domEvent);
+    webView.dispatchEvent('ipc-message', { channel, args });
   });
 }
 
diff --git a/lib/renderer/web-view/web-view-element.ts b/lib/renderer/web-view/web-view-element.ts
index e723ebbbe1076..c63748456abad 100644
--- a/lib/renderer/web-view/web-view-element.ts
+++ b/lib/renderer/web-view/web-view-element.ts
@@ -39,7 +39,13 @@ const defineWebViewElement = (v8Util: NodeJS.V8UtilBinding, webViewImpl: typeof
 
     constructor () {
       super();
-      v8Util.setHiddenValue(this, 'internal', new WebViewImpl(this));
+      const internal = new WebViewImpl(this);
+      internal.dispatchEventInMainWorld = (eventName, props) => {
+        const event = new Event(eventName);
+        Object.assign(event, props);
+        return internal.webviewNode.dispatchEvent(event);
+      };
+      v8Util.setHiddenValue(this, 'internal', internal);
     }
 
     connectedCallback () {
diff --git a/lib/renderer/web-view/web-view-impl.ts b/lib/renderer/web-view/web-view-impl.ts
index 8a141c39c9ad9..0cac4986f79b3 100644
--- a/lib/renderer/web-view/web-view-impl.ts
+++ b/lib/renderer/web-view/web-view-impl.ts
@@ -37,6 +37,8 @@ export class WebViewImpl {
   public attributes = new Map<string, WebViewAttribute>();
   public setupWebViewAttributes (): void {}
 
+  public dispatchEventInMainWorld?: (eventName: string, props: any) => boolean;
+
   constructor (public webviewNode: HTMLElement) {
     // Create internal iframe element.
     this.internalElement = this.createInternalElement();
@@ -107,10 +109,11 @@ export class WebViewImpl {
   }
 
   onElementResize () {
-    const resizeEvent = new Event('resize') as ElectronInternal.WebFrameResizeEvent;
-    resizeEvent.newWidth = this.webviewNode.clientWidth;
-    resizeEvent.newHeight = this.webviewNode.clientHeight;
-    this.dispatchEvent(resizeEvent);
+    const props = {
+      newWidth: this.webviewNode.clientWidth,
+      newHeight: this.webviewNode.clientHeight
+    };
+    this.dispatchEvent('resize', props);
   }
 
   createGuest () {
@@ -119,8 +122,8 @@ export class WebViewImpl {
     });
   }
 
-  dispatchEvent (webViewEvent: Electron.Event) {
-    this.webviewNode.dispatchEvent(webViewEvent);
+  dispatchEvent (eventName: string, props: Record<string, any> = {}) {
+    this.dispatchEventInMainWorld!(eventName, props);
   }
 
   // Adds an 'on<event>' property on the webview, which can be used to set/unset
@@ -145,10 +148,10 @@ export class WebViewImpl {
   }
 
   // Updates state upon loadcommit.
-  onLoadCommit (webViewEvent: ElectronInternal.WebViewEvent) {
+  onLoadCommit (props: Record<string, any>) {
     const oldValue = this.webviewNode.getAttribute(WEB_VIEW_CONSTANTS.ATTRIBUTE_SRC);
-    const newValue = webViewEvent.url;
-    if (webViewEvent.isMainFrame && (oldValue !== newValue)) {
+    const newValue = props.url;
+    if (props.isMainFrame && (oldValue !== newValue)) {
       // Touching the src attribute triggers a navigation. To avoid
       // triggering a page reload on every guest-initiated navigation,
       // we do not handle this mutation.
@@ -161,7 +164,7 @@ export class WebViewImpl {
     const hasFocus = this.webviewNode.ownerDocument!.activeElement === this.webviewNode;
     if (hasFocus !== this.hasFocus) {
       this.hasFocus = hasFocus;
-      this.dispatchEvent(new Event(hasFocus ? 'focus' : 'blur'));
+      this.dispatchEvent(hasFocus ? 'focus' : 'blur');
     }
   }
 
diff --git a/spec-main/webview-spec.ts b/spec-main/webview-spec.ts
index fedaf2ff82b73..434895b6e55f6 100644
--- a/spec-main/webview-spec.ts
+++ b/spec-main/webview-spec.ts
@@ -662,6 +662,26 @@ describe('<webview> tag', function () {
 
   describe('DOM events', () => {
     afterEach(closeAllWindows);
+    it('receives extra properties on DOM events when contextIsolation is enabled', async () => {
+      const w = new BrowserWindow({
+        show: false,
+        webPreferences: {
+          webviewTag: true,
+          contextIsolation: true
+        }
+      });
+      await w.loadURL('about:blank');
+      const message = await w.webContents.executeJavaScript(`new Promise((resolve, reject) => {
+        const webview = new WebView()
+        webview.setAttribute('src', 'data:text/html,<script>console.log("hi")</script>')
+        webview.addEventListener('console-message', (e) => {
+          resolve(e.message)
+        })
+        document.body.appendChild(webview)
+      })`);
+      expect(message).to.equal('hi');
+    });
+
     it('emits focus event when contextIsolation is enabled', async () => {
       const w = new BrowserWindow({
         show: false,
diff --git a/typings/internal-electron.d.ts b/typings/internal-electron.d.ts
index 99ccb44d9b681..41172a10d46f5 100644
--- a/typings/internal-electron.d.ts
+++ b/typings/internal-electron.d.ts
@@ -166,16 +166,6 @@ declare namespace ElectronInternal {
     allowGuestViewElementDefinition(window: Window, context: any): void;
   }
 
-  interface WebFrameResizeEvent extends Electron.Event {
-    newWidth: number;
-    newHeight: number;
-  }
-
-  interface WebViewEvent extends Event {
-    url: string;
-    isMainFrame: boolean;
-  }
-
   class WebViewElement extends HTMLElement {
     static observedAttributes: Array<string>;
 

From ebe509d24ff79ff4d9390926a3de408632db8f9f Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Mon, 17 May 2021 14:47:19 -0400
Subject: [PATCH 45/48] build: make patch auto fixes come from PatchUp rather
 than Electron Bot (#29154)

Co-authored-by: Samuel Attard <sattard@slack-corp.com>
---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 7098fa8b66360..723b74b6b974a 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -238,7 +238,7 @@ step-gclient-sync: &step-gclient-sync
           if ! git diff-index --quiet HEAD --; then
             # There are changes to the patches. Make a git commit with the updated patches
             git add patches
-            GIT_COMMITTER_NAME="Electron Bot" GIT_COMMITTER_EMAIL="electron@github.com" git commit -m "update patches" --author="Electron Bot <electron@github.com>"
+            GIT_COMMITTER_NAME="PatchUp" GIT_COMMITTER_EMAIL="73610968+patchup[bot]@users.noreply.github.com" git commit -m "chore: update patches" --author="PatchUp <73610968+patchup[bot]@users.noreply.github.com>"
             # Export it
             mkdir -p ../../patches
             git format-patch -1 --stdout --keep-subject --no-stat --full-index > ../../patches/update-patches.patch

From faa1655880ac1b2ede2d356a19009989cf1cac41 Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Tue, 18 May 2021 14:04:21 -0700
Subject: [PATCH 46/48] Bump v10.4.6

---
 ELECTRON_VERSION                        | 2 +-
 package.json                            | 2 +-
 shell/browser/resources/win/electron.rc | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ELECTRON_VERSION b/ELECTRON_VERSION
index 9dd5407ec81c5..d1d23e60aa74d 100644
--- a/ELECTRON_VERSION
+++ b/ELECTRON_VERSION
@@ -1 +1 @@
-10.4.5
\ No newline at end of file
+10.4.6
\ No newline at end of file
diff --git a/package.json b/package.json
index aef9fc3372268..adb74c706debc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "10.4.5",
+  "version": "10.4.6",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
diff --git a/shell/browser/resources/win/electron.rc b/shell/browser/resources/win/electron.rc
index 04353f4f0517f..249418bd6679d 100644
--- a/shell/browser/resources/win/electron.rc
+++ b/shell/browser/resources/win/electron.rc
@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 10,4,5,0
- PRODUCTVERSION 10,4,5,0
+ FILEVERSION 10,4,6,0
+ PRODUCTVERSION 10,4,6,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "10.4.5"
+            VALUE "FileVersion", "10.4.6"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "10.4.5"
+            VALUE "ProductVersion", "10.4.6"
             VALUE "SquirrelAwareVersion", "1"
         END
     END

From fcdd18074f1c41f89c2376171a9eb170ee32226d Mon Sep 17 00:00:00 2001
From: Andrey Belenko <andrey.belenko@gmail.com>
Date: Thu, 20 May 2021 19:49:40 +0200
Subject: [PATCH 47/48] chore: backport the security fixes from Chromium
 release M90-3 (#29249)

* Backports of security fixes in Chromium release M90-3
https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html

Includes backports for the following Chromium issues:
https://crbug.com/1204071
https://crbug.com/1203590 (CVE-2021-30518)
https://crbug.com/1201446 (CVE-2021-30516)
https://crbug.com/1201073 (CVE-2021-30515)
https://crbug.com/1200490 (CVE-2021-30513)
https://crbug.com/1200019 (CVE-2021-30512)
https://crbug.com/1197436 (CVE-2021-30510)
https://crbug.com/1195340 (CVE-2021-30508)
https://crbug.com/1180126
https://crbug.com/1203667

* chore: update patches

Co-authored-by: Andrey Belenko <anbelen@microsoft.com>
Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
---
 patches/chromium/.patches                     |   8 +
 ...utofill_fixed_refill_of_changed_form.patch |  41 ++++
 ...der_before_dispatching_onabort_event.patch |  58 +++++
 ...loadimage_against_malformed_renderer.patch | 231 ++++++++++++++++++
 ...ble_media_feeds_and_related_features.patch |  30 +++
 ...oper_action_icons_sent_from_renderer.patch | 148 +++++++++++
 ...le_deletion_when_toggling_fullscreen.patch | 149 +++++++++++
 ...ks_from_the_middle_of_app_names_when.patch |  50 ++++
 ...se_observerlist_to_support_container.patch | 144 +++++++++++
 patches/v8/.patches                           |   2 +
 ...2_fix_f64x2_min_max_to_use_registers.patch |  40 +++
 ...runcation_bugs_in_simplifiedlowering.patch | 137 +++++++++++
 12 files changed, 1038 insertions(+)
 create mode 100644 patches/chromium/autofill_fixed_refill_of_changed_form.patch
 create mode 100644 patches/chromium/fileapi_terminate_filereaderloader_before_dispatching_onabort_event.patch
 create mode 100644 patches/chromium/guard_webcontents_downloadimage_against_malformed_renderer.patch
 create mode 100644 patches/chromium/media_feeds_disable_media_feeds_and_related_features.patch
 create mode 100644 patches/chromium/notifications_crash_if_improper_action_icons_sent_from_renderer.patch
 create mode 100644 patches/chromium/reland_views_handle_deletion_when_toggling_fullscreen.patch
 create mode 100644 patches/chromium/remove_tabs_and_line_breaks_from_the_middle_of_app_names_when.patch
 create mode 100644 patches/chromium/replace_std_vector_with_base_observerlist_to_support_container.patch
 create mode 100644 patches/v8/merged_wasm-simd_ia32_fix_f64x2_min_max_to_use_registers.patch
 create mode 100644 patches/v8/reland_compiler_fix_more_truncation_bugs_in_simplifiedlowering.patch

diff --git a/patches/chromium/.patches b/patches/chromium/.patches
index 90aaa1a2bd17e..6da7ce572c8d8 100644
--- a/patches/chromium/.patches
+++ b/patches/chromium/.patches
@@ -178,3 +178,11 @@ cherry-pick-5745eaf16077.patch
 cherry-pick-02f5ef8c88d7.patch
 cherry-pick-668cf831e912.patch
 cherry-pick-f37149c4434f.patch
+replace_std_vector_with_base_observerlist_to_support_container.patch
+guard_webcontents_downloadimage_against_malformed_renderer.patch
+fileapi_terminate_filereaderloader_before_dispatching_onabort_event.patch
+notifications_crash_if_improper_action_icons_sent_from_renderer.patch
+reland_views_handle_deletion_when_toggling_fullscreen.patch
+media_feeds_disable_media_feeds_and_related_features.patch
+remove_tabs_and_line_breaks_from_the_middle_of_app_names_when.patch
+autofill_fixed_refill_of_changed_form.patch
diff --git a/patches/chromium/autofill_fixed_refill_of_changed_form.patch b/patches/chromium/autofill_fixed_refill_of_changed_form.patch
new file mode 100644
index 0000000000000..521b4d1ee0c8f
--- /dev/null
+++ b/patches/chromium/autofill_fixed_refill_of_changed_form.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Wed, 19 May 2021 17:24:48 +0200
+Subject: Fixed refill of changed form.
+
+(cherry picked from commit 533bb3adcfe3499f90e2646fc60312f303b963ac)
+
+Bug: 1203667
+Change-Id: I2693a024531775e0e60cc330107d77d10558f466
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2867655
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2874611
+
+diff --git a/components/autofill/core/browser/autofill_manager.cc b/components/autofill/core/browser/autofill_manager.cc
+index ded9c514894eee34a34eb562b08e7484673dfc4a..ca3b53835c2cacfeab893128a75e4d427d7993e8 100644
+--- a/components/autofill/core/browser/autofill_manager.cc
++++ b/components/autofill/core/browser/autofill_manager.cc
+@@ -1740,7 +1740,10 @@ void AutofillManager::FillOrPreviewDataModelForm(
+   form_structure->RationalizePhoneNumbersInSection(autofill_field->section);
+ 
+   FormData result = form;
+-  DCHECK_EQ(form_structure->field_count(), form.fields.size());
++  // TODO(crbug/1203667#c9): Skip if the form has changed in the meantime, which
++  // may happen with refills.
++  if (form_structure->field_count() != form.fields.size())
++    return;
+ 
+   if (action == AutofillDriver::FORM_DATA_ACTION_FILL && !is_refill) {
+     filling_contexts_map_[form_structure->GetIdentifierForRefill()] =
+@@ -1784,8 +1787,10 @@ void AutofillManager::FillOrPreviewDataModelForm(
+       continue;
+     }
+ 
+-    // The field order should be the same in |form_structure| and |result|.
+-    DCHECK(form_structure->field(i)->SameFieldAs(result.fields[i]));
++    // TODO(crbug/1203667#c9): Skip if the form has changed in the meantime,
++    // which may happen with refills.
++    if (!form_structure->field(i)->SameFieldAs(result.fields[i]))
++      continue;
+ 
+     AutofillField* cached_field = form_structure->field(i);
+     FieldTypeGroup field_group_type = cached_field->Type().group();
diff --git a/patches/chromium/fileapi_terminate_filereaderloader_before_dispatching_onabort_event.patch b/patches/chromium/fileapi_terminate_filereaderloader_before_dispatching_onabort_event.patch
new file mode 100644
index 0000000000000..7adfba2e0c069
--- /dev/null
+++ b/patches/chromium/fileapi_terminate_filereaderloader_before_dispatching_onabort_event.patch
@@ -0,0 +1,58 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Wed, 19 May 2021 12:29:29 +0200
+Subject: FileAPI: Terminate FileReaderLoader before dispatching onabort event.
+
+Otherwise FileReader could end up in an inconsistent state where a load
+is still in progress while the state was set to done.
+
+(cherry picked from commit a74c980df61dd7367ad1b11e6a735be82d2696f0)
+
+Bug: 1201073
+Change-Id: Ib2c833537e1badc57d125568d5d35f53f12582a8
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2860442
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2871355
+
+diff --git a/third_party/blink/renderer/core/fileapi/file_reader.cc b/third_party/blink/renderer/core/fileapi/file_reader.cc
+index 978d71510a5a0a790ea86dcd5413665ff624619c..8549fbef76a79cc4eff0fdc262e39720bfff40ba 100644
+--- a/third_party/blink/renderer/core/fileapi/file_reader.cc
++++ b/third_party/blink/renderer/core/fileapi/file_reader.cc
+@@ -337,7 +337,10 @@ void FileReader::abort() {
+   loading_state_ = kLoadingStateAborted;
+ 
+   DCHECK_NE(kDone, state_);
+-  state_ = kDone;
++  // Synchronously cancel the loader before dispatching events. This way we make
++  // sure the FileReader internal state stays consistent even if another load
++  // is started from one of the event handlers, or right after abort returns.
++  Terminate();
+ 
+   base::AutoReset<bool> firing_events(&still_firing_events_, true);
+ 
+@@ -349,15 +352,12 @@ void FileReader::abort() {
+       ThrottlingController::RemoveReader(GetExecutionContext(), this);
+ 
+   FireEvent(event_type_names::kAbort);
++  // TODO(https://crbug.com/1204139): Only fire loadend event if no new load was
++  // started from the abort event handler.
+   FireEvent(event_type_names::kLoadend);
+ 
+   // All possible events have fired and we're done, no more pending activity.
+   ThrottlingController::FinishReader(GetExecutionContext(), this, final_step);
+-
+-  // Also synchronously cancel the loader, as script might initiate a new load
+-  // right after this method returns, in which case an async termination would
+-  // terminate the wrong loader.
+-  Terminate();
+ }
+ 
+ void FileReader::result(ScriptState* state,
+@@ -429,6 +429,8 @@ void FileReader::DidFinishLoading() {
+       ThrottlingController::RemoveReader(GetExecutionContext(), this);
+ 
+   FireEvent(event_type_names::kLoad);
++  // TODO(https://crbug.com/1204139): Only fire loadend event if no new load was
++  // started from the abort event handler.
+   FireEvent(event_type_names::kLoadend);
+ 
+   // All possible events have fired and we're done, no more pending activity.
diff --git a/patches/chromium/guard_webcontents_downloadimage_against_malformed_renderer.patch b/patches/chromium/guard_webcontents_downloadimage_against_malformed_renderer.patch
new file mode 100644
index 0000000000000..278e0b8c6a5e3
--- /dev/null
+++ b/patches/chromium/guard_webcontents_downloadimage_against_malformed_renderer.patch
@@ -0,0 +1,231 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Wed, 19 May 2021 12:19:16 +0200
+Subject: Guard WebContents::DownloadImage() against malformed renderer
+ response
+
+Callers expect that ImageDownloadCallback gets invoked with two vectors
+having the same number of elements (one containing the bitmaps and the
+other one the corresponding sizes).
+
+However, these vectors are populated directly from the Mojo response,
+so there needs to be some browser-process sanitization to protect
+against buggy or compromised renderers.
+
+In this patch, WebContentsImpl::OnDidDownloadImage() mimics a 400 error
+if the response is malformed, similarly to how it's done in other edge
+cases (renderer process dead upon download). Because this scenario is
+a violation of the Mojo API contract, the browser process also issues
+a bad message log (newly-introduced WCI_INVALID_DOWNLOAD_IMAGE_RESULT)
+and shuts down the renderer process.
+
+(cherry picked from commit 034ba14e44f08e8ca84b42350f3238f847e08e5f)
+
+Change-Id: Ic0843e10efc26809fabd8f1bbe506ba1703d1486
+Fixed: 1201446
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2871796
+
+diff --git a/components/favicon/core/favicon_handler.cc b/components/favicon/core/favicon_handler.cc
+index 64eab051de73b0b259c1f31e93f750d352724521..410ffc64e8f70a29a39cc4fb228dfd720bfe04d7 100644
+--- a/components/favicon/core/favicon_handler.cc
++++ b/components/favicon/core/favicon_handler.cc
+@@ -492,6 +492,8 @@ void FaviconHandler::OnDidDownloadFavicon(
+     const GURL& image_url,
+     const std::vector<SkBitmap>& bitmaps,
+     const std::vector<gfx::Size>& original_bitmap_sizes) {
++  DCHECK_EQ(bitmaps.size(), original_bitmap_sizes.size());
++  
+   // Mark download as finished.
+   image_download_request_.Cancel();
+ 
+diff --git a/components/favicon/core/favicon_handler.h b/components/favicon/core/favicon_handler.h
+index 8a1cf2ef85745711e94ec6e7f6f27acb1482cbd6..4192138711de470eee713fc1fb200cc29d333342 100644
+--- a/components/favicon/core/favicon_handler.h
++++ b/components/favicon/core/favicon_handler.h
+@@ -237,7 +237,9 @@ class FaviconHandler {
+   void ScheduleImageDownload(const GURL& image_url,
+                              favicon_base::IconType icon_type);
+ 
+-  // Triggered when a download of an image has finished.
++  // Triggered when a download of an image has finished. |bitmaps| and
++  // |original_bitmap_sizes| must contain the same number of elements (i.e. same
++  // vector size).
+   void OnDidDownloadFavicon(
+       favicon_base::IconType icon_type,
+       int id,
+diff --git a/components/favicon/ios/web_favicon_driver.mm b/components/favicon/ios/web_favicon_driver.mm
+index 6efaf651bdf939d83e1a7f9df339f714410565ad..71ae020efd8862d2b33cb91df9180ef63df1f6f9 100644
+--- a/components/favicon/ios/web_favicon_driver.mm
++++ b/components/favicon/ios/web_favicon_driver.mm
+@@ -75,6 +75,7 @@ int WebFaviconDriver::DownloadImage(const GURL& url,
+           for (const auto& frame : frames) {
+             sizes.push_back(gfx::Size(frame.width(), frame.height()));
+           }
++          DCHECK_EQ(frames.size(), sizes.size());
+         }
+         std::move(local_callback)
+             .Run(local_download_id, metadata.http_response_code, local_url,
+diff --git a/components/favicon_base/select_favicon_frames.cc b/components/favicon_base/select_favicon_frames.cc
+index 90b58e621492d0e503f7965de91581c0a451d163..73cd7dd5331a818f413d831b4ae596bc88805a8a 100644
+--- a/components/favicon_base/select_favicon_frames.cc
++++ b/components/favicon_base/select_favicon_frames.cc
+@@ -216,6 +216,7 @@ gfx::ImageSkia CreateFaviconImageSkia(
+     const std::vector<gfx::Size>& original_sizes,
+     int desired_size_in_dip,
+     float* score) {
++  DCHECK_EQ(bitmaps.size(), original_sizes.size());
+ 
+   const std::vector<float>& favicon_scales = favicon_base::GetFaviconScales();
+   std::vector<int> desired_sizes;
+diff --git a/components/favicon_base/select_favicon_frames.h b/components/favicon_base/select_favicon_frames.h
+index 573a38c79cddf839622488589b71b4d19fbdfba6..eab1e54466763e5a6a6069a29e877da054972fa8 100644
+--- a/components/favicon_base/select_favicon_frames.h
++++ b/components/favicon_base/select_favicon_frames.h
+@@ -38,6 +38,8 @@ extern const float kSelectFaviconFramesInvalidScore;
+ // it inspired by this method.
+ // If an unsupported scale (not in the favicon_base::GetFaviconScales())
+ // is requested, the ImageSkia will automatically scales using lancoz3.
++// |original_sizes| represents the pixel sizes of the favicon bitmaps in
++// |bitmaps|, which also means both vectors must have the same size.
+ gfx::ImageSkia CreateFaviconImageSkia(
+     const std::vector<SkBitmap>& bitmaps,
+     const std::vector<gfx::Size>& original_sizes,
+diff --git a/content/browser/bad_message.h b/content/browser/bad_message.h
+index ab0a195c2da772ea5825bb97e54743318bd06841..efc803efe24f61012882399035f6d96aed799595 100644
+--- a/content/browser/bad_message.h
++++ b/content/browser/bad_message.h
+@@ -256,6 +256,15 @@ enum BadMessageReason {
+   INPUT_ROUTER_INVALID_EVENT_SOURCE = 228,
+   RWH_CLOSE_PORTAL = 233,
+   MSDH_INVALID_STREAM_TYPE = 234,
++  RFH_CREATE_CHILD_FRAME_TOKENS_NOT_FOUND = 235,
++  ASGH_ASSOCIATED_INTERFACE_REQUEST = 236,
++  ASGH_RECEIVED_CONTROL_MESSAGE = 237,
++  CSDH_BAD_OWNER = 238,
++  SYNC_COMPOSITOR_NO_LOCAL_SURFACE_ID = 239,
++  WCI_INVALID_FULLSCREEN_OPTIONS = 240,
++  PAYMENTS_WITHOUT_PERMISSION = 241,
++  WEB_BUNDLE_INVALID_NAVIGATION_URL = 242,
++  WCI_INVALID_DOWNLOAD_IMAGE_RESULT = 243,
+ 
+   // Please add new elements here. The naming convention is abbreviated class
+   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
+diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
+index a7c76413b86fac18f6f1f54c87e67218f094e6b2..67deba5a7ab4265c76fe18990ede82c2705efe70 100644
+--- a/content/browser/web_contents/web_contents_impl.cc
++++ b/content/browser/web_contents/web_contents_impl.cc
+@@ -160,6 +160,7 @@
+ #include "third_party/blink/public/common/security/security_style.h"
+ #include "third_party/blink/public/mojom/frame/frame.mojom.h"
+ #include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
++#include "third_party/blink/public/mojom/image_downloader/image_downloader.mojom.h"
+ #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom.h"
+ #include "third_party/blink/public/mojom/mediastream/media_stream.mojom-shared.h"
+ #include "third_party/skia/include/core/SkBitmap.h"
+@@ -4295,18 +4296,18 @@ int WebContentsImpl::DownloadImageInFrame(
+     // respond with a 400 HTTP error code to indicate that something went wrong.
+     GetUIThreadTaskRunner({})->PostTask(
+         FROM_HERE,
+-        base::BindOnce(&WebContentsImpl::OnDidDownloadImage,
+-                       weak_factory_.GetWeakPtr(), std::move(callback),
+-                       download_id, url, 400, std::vector<SkBitmap>(),
+-                       std::vector<gfx::Size>()));
++        base::BindOnce(
++            &WebContentsImpl::OnDidDownloadImage, weak_factory_.GetWeakPtr(),
++            initiator_frame->GetWeakPtr(), std::move(callback), download_id,
++            url, 400, std::vector<SkBitmap>(), std::vector<gfx::Size>()));
+     return download_id;
+   }
+ 
+   mojo_image_downloader->DownloadImage(
+       url, is_favicon, preferred_size, max_bitmap_size, bypass_cache,
+       base::BindOnce(&WebContentsImpl::OnDidDownloadImage,
+-                     weak_factory_.GetWeakPtr(), std::move(callback),
+-                     download_id, url));
++                     weak_factory_.GetWeakPtr(), initiator_frame->GetWeakPtr(),
++                     std::move(callback), download_id, url));
+   return download_id;
+ }
+ 
+@@ -6829,12 +6830,28 @@ bool WebContentsImpl::CompletedFirstVisuallyNonEmptyPaint() {
+ }
+ 
+ void WebContentsImpl::OnDidDownloadImage(
++    base::WeakPtr<RenderFrameHostImpl> rfh,
+     ImageDownloadCallback callback,
+     int id,
+     const GURL& image_url,
+     int32_t http_status_code,
+     const std::vector<SkBitmap>& images,
+     const std::vector<gfx::Size>& original_image_sizes) {
++
++  // Guard against buggy or compromised renderers that could violate the API
++  // contract that |images| and |original_image_sizes| must have the same
++  // length.
++  if (images.size() != original_image_sizes.size()) {
++    if (rfh) {
++      ReceivedBadMessage(rfh->GetProcess(),
++                         bad_message::WCI_INVALID_DOWNLOAD_IMAGE_RESULT);
++    }
++    // Respond with a 400 to indicate that something went wrong.
++    std::move(callback).Run(id, 400, image_url, std::vector<SkBitmap>(),
++                            std::vector<gfx::Size>());
++    return;
++  }
++
+   std::move(callback).Run(id, http_status_code, image_url, images,
+                           original_image_sizes);
+ }
+diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
+index 14586316aedab1e99f1b700ecc0e092c86414ee3..ffd53b3dc3ef0553711106f302e9f69b76b49081 100644
+--- a/content/browser/web_contents/web_contents_impl.h
++++ b/content/browser/web_contents/web_contents_impl.h
+@@ -1403,7 +1403,8 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
+       std::set<RenderWidgetHostView*>& result);
+ 
+   // Called with the result of a DownloadImage() request.
+-  void OnDidDownloadImage(ImageDownloadCallback callback,
++  void OnDidDownloadImage(base::WeakPtr<RenderFrameHostImpl> rfh,
++                          ImageDownloadCallback callback,
+                           int id,
+                           const GURL& image_url,
+                           int32_t http_status_code,
+diff --git a/content/public/browser/web_contents.h b/content/public/browser/web_contents.h
+index ca7651246f812259e43d5dbc429ae4a95ed60e94..a4572de2ee43ef0c2bb3a785f29974ebb8c1362c 100644
+--- a/content/public/browser/web_contents.h
++++ b/content/public/browser/web_contents.h
+@@ -896,8 +896,9 @@ class WebContents : public PageNavigator,
+   // |bitmaps| will be empty on download failure.
+   // |sizes| are the sizes in pixels of the bitmaps before they were resized due
+   // to the max bitmap size passed to DownloadImage(). Each entry in the bitmaps
+-  // vector corresponds to an entry in the sizes vector. If a bitmap was
+-  // resized, there should be a single returned bitmap.
++  // vector corresponds to an entry in the sizes vector (both vector sizes are
++  // guaranteed to be equal). If a bitmap was resized, there should be a single
++  // returned bitmap.
+   using ImageDownloadCallback =
+       base::OnceCallback<void(int id,
+                               int http_status_code,
+diff --git a/third_party/blink/renderer/modules/image_downloader/image_downloader_impl.cc b/third_party/blink/renderer/modules/image_downloader/image_downloader_impl.cc
+index fb0fc97d689c8c6b1f6f9fa27d250e0438550725..740c6c01318a1d9d2914ddef9949db9ced559d14 100644
+--- a/third_party/blink/renderer/modules/image_downloader/image_downloader_impl.cc
++++ b/third_party/blink/renderer/modules/image_downloader/image_downloader_impl.cc
+@@ -79,7 +79,8 @@ SkBitmap ResizeImage(const SkBitmap& image, uint32_t max_image_size) {
+ // size |max_image_size|. Returns the result if it is not empty. Otherwise,
+ // find the smallest image in the array and resize it proportionally to fit
+ // in a box of size |max_image_size|.
+-// Sets |original_image_sizes| to the sizes of |images| before resizing.
++// Sets |original_image_sizes| to the sizes of |images| before resizing. Both
++// output vectors are guaranteed to have the same size.
+ void FilterAndResizeImagesForMaximalSize(
+     const WTF::Vector<SkBitmap>& unfiltered,
+     uint32_t max_image_size,
+@@ -202,6 +203,8 @@ void ImageDownloaderImpl::DidDownloadImage(
+   FilterAndResizeImagesForMaximalSize(images, max_image_size, &result_images,
+                                       &result_original_image_sizes);
+ 
++  DCHECK_EQ(result_images.size(), result_original_image_sizes.size());
++
+   std::move(callback).Run(http_status_code, result_images,
+                           result_original_image_sizes);
+ }
diff --git a/patches/chromium/media_feeds_disable_media_feeds_and_related_features.patch b/patches/chromium/media_feeds_disable_media_feeds_and_related_features.patch
new file mode 100644
index 0000000000000..639577b439c28
--- /dev/null
+++ b/patches/chromium/media_feeds_disable_media_feeds_and_related_features.patch
@@ -0,0 +1,30 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Wed, 19 May 2021 14:17:10 +0200
+Subject: Media Feeds: Disable Media Feeds and related features
+
+Media Feeds is deleted in M91 and later and is unused in previous
+versions as well. There is a security issue with Media Feeds though, so
+we'd like to force it to be disabled in previous versions, so this CL
+turns it off for M90.
+
+(cherry picked from commit b064a73431541e520d273c227e762983c2f177b7)
+
+Bug: 1195340
+Change-Id: I29e18be2abe4c1b4560d6324af3b6da93a97d947
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2847504
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2883741
+
+diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
+index 162d2e2991aa34c8fc6acb14f8cbad5af27b12b9..e7b5ea2103bdca2faebac1d8d0a86b42418eed6b 100644
+--- a/media/base/media_switches.cc
++++ b/media/base/media_switches.cc
+@@ -676,7 +676,7 @@ const base::Feature kMediaFeedsBackgroundFetching{
+ 
+ // Enables checking Media Feeds against safe search to prevent adult content.
+ const base::Feature kMediaFeedsSafeSearch{"MediaFeedsSafeSearch",
+-                                          base::FEATURE_ENABLED_BY_DEFAULT};
++                                          base::FEATURE_DISABLED_BY_DEFAULT};
+ 
+ // Send events to devtools rather than to chrome://media-internals
+ const base::Feature kMediaInspectorLogging{"MediaInspectorLogging",
diff --git a/patches/chromium/notifications_crash_if_improper_action_icons_sent_from_renderer.patch b/patches/chromium/notifications_crash_if_improper_action_icons_sent_from_renderer.patch
new file mode 100644
index 0000000000000..f161a8adef2a2
--- /dev/null
+++ b/patches/chromium/notifications_crash_if_improper_action_icons_sent_from_renderer.patch
@@ -0,0 +1,148 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Wed, 19 May 2021 12:59:35 +0200
+Subject: Notifications: crash if improper action icons sent from renderer.
+
+Previously, the code only called DCHECK but as this data is from a
+renderer we should probably crash the browser.
+
+(cherry picked from commit 3b28dc50187b22e080ad9c1e4e6c4f3b08f3136d)
+
+Bug: 1200019
+Change-Id: If4d9d48c8e18a3ed9c8bb3a50b952591259e0db5
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2838205
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2872493
+
+diff --git a/chrome/browser/notifications/platform_notification_service_impl.cc b/chrome/browser/notifications/platform_notification_service_impl.cc
+index 9071744d4093180850f2a5d7cf3fccd098138192..4fccc612e3cc761b72b629b5e0bd5da5cb29f71e 100644
+--- a/chrome/browser/notifications/platform_notification_service_impl.cc
++++ b/chrome/browser/notifications/platform_notification_service_impl.cc
+@@ -401,8 +401,10 @@ PlatformNotificationServiceImpl::CreateNotificationFromData(
+     const std::string& notification_id,
+     const blink::PlatformNotificationData& notification_data,
+     const blink::NotificationResources& notification_resources) const {
+-  DCHECK_EQ(notification_data.actions.size(),
+-            notification_resources.action_icons.size());
++  // Blink always populates action icons to match the actions, even if no icon
++  // was fetched, so this indicates a compromised renderer.
++  CHECK_EQ(notification_data.actions.size(),
++           notification_resources.action_icons.size());
+ 
+   message_center::RichNotificationData optional_fields;
+ 
+diff --git a/content/browser/notifications/blink_notification_service_impl.cc b/content/browser/notifications/blink_notification_service_impl.cc
+index 7105781e0019b456f287fd0ebb6e309efe2cecad..575017c41e72df1686471b104ccfd06913314e25 100644
+--- a/content/browser/notifications/blink_notification_service_impl.cc
++++ b/content/browser/notifications/blink_notification_service_impl.cc
+@@ -39,6 +39,9 @@ const char kBadMessageImproperNotificationImage[] =
+     "disabled.";
+ const char kBadMessageInvalidNotificationTriggerTimestamp[] =
+     "Received an invalid notification trigger timestamp.";
++const char kBadMessageInvalidNotificationActionButtons[] =
++    "Received a notification with a number of action images that does not "
++    "match the number of actions.";
+ 
+ // Returns the implementation of the PlatformNotificationService. May be NULL.
+ PlatformNotificationService* GetNotificationService(
+@@ -134,7 +137,8 @@ void BlinkNotificationServiceImpl::DisplayNonPersistentNotification(
+     mojo::PendingRemote<blink::mojom::NonPersistentNotificationListener>
+         event_listener_remote) {
+   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+-  if (!ValidateNotificationResources(notification_resources))
++  if (!ValidateNotificationDataAndResources(platform_notification_data,
++                                            notification_resources))
+     return;
+ 
+   if (!GetNotificationService(browser_context_))
+@@ -190,28 +194,31 @@ BlinkNotificationServiceImpl::CheckPermissionStatus() {
+                             origin_.GetURL());
+ }
+ 
+-bool BlinkNotificationServiceImpl::ValidateNotificationResources(
++bool BlinkNotificationServiceImpl::ValidateNotificationDataAndResources(
++    const blink::PlatformNotificationData& platform_notification_data,
+     const blink::NotificationResources& notification_resources) {
+-  if (notification_resources.image.drawsNothing() ||
+-      base::FeatureList::IsEnabled(features::kNotificationContentImage))
+-    return true;
+-  receiver_.ReportBadMessage(kBadMessageImproperNotificationImage);
+-  // The above ReportBadMessage() closes |binding_| but does not trigger its
+-  // connection error handler, so we need to call the error handler explicitly
+-  // here to do some necessary work.
+-  OnConnectionError();
+-  return false;
+-}
++  if (platform_notification_data.actions.size() !=
++      notification_resources.action_icons.size()) {
++    receiver_.ReportBadMessage(kBadMessageInvalidNotificationActionButtons);
++    OnConnectionError();
++    return false;
++  }
+ 
+-// Checks if this notification has a valid trigger.
+-bool BlinkNotificationServiceImpl::ValidateNotificationData(
+-    const blink::PlatformNotificationData& notification_data) {
+-  if (!CheckNotificationTriggerRange(notification_data)) {
++  if (!CheckNotificationTriggerRange(platform_notification_data)) {
+     receiver_.ReportBadMessage(kBadMessageInvalidNotificationTriggerTimestamp);
+     OnConnectionError();
+     return false;
+   }
+ 
++  if (!notification_resources.image.drawsNothing() &&
++      !base::FeatureList::IsEnabled(features::kNotificationContentImage)) {
++    receiver_.ReportBadMessage(kBadMessageImproperNotificationImage);
++    // The above ReportBadMessage() closes |binding_| but does not trigger its
++    // connection error handler, so we need to call the error handler explicitly
++    // here to do some necessary work.
++    OnConnectionError();
++    return false;
++  }
+   return true;
+ }
+ 
+@@ -221,10 +228,8 @@ void BlinkNotificationServiceImpl::DisplayPersistentNotification(
+     const blink::NotificationResources& notification_resources,
+     DisplayPersistentNotificationCallback callback) {
+   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+-  if (!ValidateNotificationResources(notification_resources))
+-    return;
+-
+-  if (!ValidateNotificationData(platform_notification_data))
++  if (!ValidateNotificationDataAndResources(platform_notification_data,
++                                            notification_resources))
+     return;
+ 
+   if (!GetNotificationService(browser_context_)) {
+diff --git a/content/browser/notifications/blink_notification_service_impl.h b/content/browser/notifications/blink_notification_service_impl.h
+index dc5307e6500b0bfb5da83e8d8ff8886b91133522..fe1abadd2bc196914cb7b6d9fe29a75435f08988 100644
+--- a/content/browser/notifications/blink_notification_service_impl.h
++++ b/content/browser/notifications/blink_notification_service_impl.h
+@@ -72,20 +72,15 @@ class CONTENT_EXPORT BlinkNotificationServiceImpl
+   // Check the permission status for the current |origin_|.
+   blink::mojom::PermissionStatus CheckPermissionStatus();
+ 
+-  // Validate |notification_resources| received in a Mojo IPC message.
+-  // If the validation failed, we'd close the Mojo connection |binding_| and
+-  // destroy |this| by calling OnConnectionError() directly, then return false.
+-  // So, please do not touch |this| again after you got a false return value.
+-  bool ValidateNotificationResources(
++  // Validate |notification_data| and |notification_resources| received in a
++  // Mojo IPC message. If the validation failed, we'd close the Mojo connection
++  // |binding_| and destroy |this| by calling OnConnectionError() directly, then
++  // return false. So, please do not touch |this| again after you got a false
++  // return value.
++  bool ValidateNotificationDataAndResources(
++      const blink::PlatformNotificationData& notification_data,
+       const blink::NotificationResources& notification_resources);
+ 
+-  // Validate |notification_data| received in a Mojo IPC message.
+-  // If the validation failed, we'd close the Mojo connection |binding_| and
+-  // destroy |this| by calling OnConnectionError() directly, then return false.
+-  // So, please do not touch |this| again after you got a false return value.
+-  bool ValidateNotificationData(
+-      const blink::PlatformNotificationData& notification_data);
+-
+   void DidWriteNotificationData(DisplayPersistentNotificationCallback callback,
+                                 bool success,
+                                 const std::string& notification_id);
diff --git a/patches/chromium/reland_views_handle_deletion_when_toggling_fullscreen.patch b/patches/chromium/reland_views_handle_deletion_when_toggling_fullscreen.patch
new file mode 100644
index 0000000000000..55fa67c3ea449
--- /dev/null
+++ b/patches/chromium/reland_views_handle_deletion_when_toggling_fullscreen.patch
@@ -0,0 +1,149 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Wed, 19 May 2021 13:26:14 +0200
+Subject: views: handle deletion when toggling fullscreen
+
+This differs from the first in so far as needing to add more early
+outs in the windows side if destroyed. This was caught by the asan
+bot.
+
+Toggling fullscreen means the bounds change. There are some
+code paths that may delete the Widget when the bounds changes.
+This patch ensures the right thing happens if the Widget is
+deleted when this happens.
+
+BUG=1197436
+
+(cherry picked from commit 60fe7a686c0620855c28a60721f668a99e409ee4)
+
+Change-Id: I8ce8f2045878b6f6de530f58e386149189900498
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2857227
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2868317
+
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
+index aaf1b482f71a9fbf047ce8bd37cefd31d6947770..da6ba0505bbf99c0c7c58e28019c28332b31e490 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
+@@ -585,7 +585,10 @@ void DesktopWindowTreeHostPlatform::SetFullscreen(bool fullscreen) {
+   if (IsFullscreen() == fullscreen)
+     return;
+ 
++  auto weak_ptr = GetWeakPtr();
+   platform_window()->ToggleFullscreen();
++  if (!weak_ptr)
++    return;
+ 
+   // The state must change synchronously to let media react on fullscreen
+   // changes.
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+index b5430b871cfcc8c9aa54ac1f5aa9ec699c7aac86..1de1f16f61b16966a8a79efc055132804192829d 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+@@ -462,7 +462,10 @@ void DesktopWindowTreeHostWin::FrameTypeChanged() {
+ }
+ 
+ void DesktopWindowTreeHostWin::SetFullscreen(bool fullscreen) {
++  auto weak_ptr = GetWeakPtr();
+   message_handler_->SetFullscreen(fullscreen);
++  if (!weak_ptr)
++    return;
+   // TODO(sky): workaround for ScopedFullscreenVisibility showing window
+   // directly. Instead of this should listen for visibility changes and then
+   // update window.
+diff --git a/ui/views/widget/widget.cc b/ui/views/widget/widget.cc
+index a06ebe82c33f11fb2cd90382029cb0b5c20ce6de..b590396343e12d92016103720461805372319639 100644
+--- a/ui/views/widget/widget.cc
++++ b/ui/views/widget/widget.cc
+@@ -722,7 +722,10 @@ void Widget::SetFullscreen(bool fullscreen) {
+   if (IsFullscreen() == fullscreen)
+     return;
+ 
++  auto weak_ptr = GetWeakPtr();
+   native_widget_->SetFullscreen(fullscreen);
++  if (!weak_ptr)
++    return;
+ 
+   if (non_client_view_)
+     non_client_view_->InvalidateLayout();
+diff --git a/ui/views/win/fullscreen_handler.cc b/ui/views/win/fullscreen_handler.cc
+index 8791362556fcd7544b79982dd6535d55ecd25a50..708d28f45028ee10459c7973d51caecfe0d09097 100644
+--- a/ui/views/win/fullscreen_handler.cc
++++ b/ui/views/win/fullscreen_handler.cc
+@@ -70,6 +70,7 @@ void FullscreenHandler::SetFullscreenImpl(bool fullscreen) {
+ 
+   fullscreen_ = fullscreen;
+ 
++  auto ref = weak_ptr_factory_.GetWeakPtr();
+   if (fullscreen_) {
+     // Set new window style and size.
+     SetWindowLong(hwnd_, GWL_STYLE,
+@@ -102,6 +103,8 @@ void FullscreenHandler::SetFullscreenImpl(bool fullscreen) {
+                  new_rect.height(),
+                  SWP_NOZORDER | SWP_NOACTIVATE | SWP_FRAMECHANGED);
+   }
++  if (!ref)
++    return;
+ 
+   MarkFullscreen(fullscreen);
+ }
+diff --git a/ui/views/win/fullscreen_handler.h b/ui/views/win/fullscreen_handler.h
+index fe17c7f0368b1dd35a37006033ddf34d35ea3982..c76ef18a6f59e9239d5a281d26c6e34646b68ee3 100644
+--- a/ui/views/win/fullscreen_handler.h
++++ b/ui/views/win/fullscreen_handler.h
+@@ -11,6 +11,7 @@
+ #include <map>
+ 
+ #include "base/macros.h"
++#include "base/memory/weak_ptr.h"
+ 
+ namespace gfx {
+ class Rect;
+@@ -54,6 +55,8 @@ class FullscreenHandler {
+   // Used to mark a window as fullscreen.
+   Microsoft::WRL::ComPtr<ITaskbarList2> task_bar_list_;
+ 
++  base::WeakPtrFactory<FullscreenHandler> weak_ptr_factory_{this};
++
+   DISALLOW_COPY_AND_ASSIGN(FullscreenHandler);
+ };
+ 
+diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
+index 39518ac65d091bc52a26cf84b89fa350459e874b..68ed019d5cf6d2af084ce6ec7745b8814ea14a39 100644
+--- a/ui/views/win/hwnd_message_handler.cc
++++ b/ui/views/win/hwnd_message_handler.cc
+@@ -900,7 +900,10 @@ void HWNDMessageHandler::SetWindowIcons(const gfx::ImageSkia& window_icon,
+ 
+ void HWNDMessageHandler::SetFullscreen(bool fullscreen) {
+   background_fullscreen_hack_ = false;
++  auto ref = msg_handler_weak_factory_.GetWeakPtr();
+   fullscreen_handler()->SetFullscreen(fullscreen);
++  if (!ref)
++    return;
+ 
+   // Add the fullscreen window to the fullscreen window map which is used to
+   // handle window activations.
+@@ -1401,8 +1404,10 @@ void HWNDMessageHandler::ClientAreaSizeChanged() {
+   // Ignore size changes due to fullscreen windows losing activation.
+   if (background_fullscreen_hack_ && !sent_window_size_changing_)
+     return;
+-  gfx::Size s = GetClientAreaBounds().size();
+-  delegate_->HandleClientSizeChanged(s);
++  auto ref = msg_handler_weak_factory_.GetWeakPtr();
++  delegate_->HandleClientSizeChanged(GetClientAreaBounds().size());
++  if (!ref)
++    return;
+ 
+   current_window_size_message_++;
+   sent_window_size_changing_ = false;
+@@ -2925,8 +2930,11 @@ void HWNDMessageHandler::OnWindowPosChanging(WINDOWPOS* window_pos) {
+ void HWNDMessageHandler::OnWindowPosChanged(WINDOWPOS* window_pos) {
+   TRACE_EVENT0("ui", "HWNDMessageHandler::OnWindowPosChanged");
+ 
++  base::WeakPtr<HWNDMessageHandler> ref(msg_handler_weak_factory_.GetWeakPtr());
+   if (DidClientAreaSizeChange(window_pos))
+     ClientAreaSizeChanged();
++  if (!ref)
++    return;
+   if (window_pos->flags & SWP_FRAMECHANGED)
+     SetDwmFrameExtension(DwmFrameState::kOn);
+   if (window_pos->flags & SWP_SHOWWINDOW) {
diff --git a/patches/chromium/remove_tabs_and_line_breaks_from_the_middle_of_app_names_when.patch b/patches/chromium/remove_tabs_and_line_breaks_from_the_middle_of_app_names_when.patch
new file mode 100644
index 0000000000000..ccc1a3b450b8f
--- /dev/null
+++ b/patches/chromium/remove_tabs_and_line_breaks_from_the_middle_of_app_names_when.patch
@@ -0,0 +1,50 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Wed, 19 May 2021 17:13:11 +0200
+Subject: Remove tabs and line breaks from the middle of app names when
+ parsing.
+
+(cherry picked from commit f9b0a09d60acabadfcb9ddeacc9d943cc9811199)
+
+Bug: 1180126
+Change-Id: Ie6f08d45f97214c4f1ab766aa8af001b8fb8599c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821876
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2877715
+
+diff --git a/third_party/blink/renderer/modules/manifest/manifest_parser.cc b/third_party/blink/renderer/modules/manifest/manifest_parser.cc
+index 8a80176fb4626f2e916176412ba0a8a518de80e6..0cf2d9e04cabbd69af7a7a66c5a07e69508e6d24 100644
+--- a/third_party/blink/renderer/modules/manifest/manifest_parser.cc
++++ b/third_party/blink/renderer/modules/manifest/manifest_parser.cc
+@@ -40,6 +40,10 @@ bool VerifyFiles(const Vector<mojom::blink::ManifestFileFilterPtr>& files) {
+   return true;
+ }
+ 
++static bool IsCrLfOrTabChar(UChar c) {
++  return c == '\n' || c == '\r' || c == '\t';
++}
++
+ }  // anonymous namespace
+ 
+ ManifestParser::ManifestParser(const String& data,
+@@ -238,11 +242,21 @@ KURL ManifestParser::ParseURL(const JSONObject* object,
+ 
+ String ManifestParser::ParseName(const JSONObject* object) {
+   base::Optional<String> name = ParseString(object, "name", Trim);
++  if (name.has_value()) {
++    name = name->RemoveCharacters(IsCrLfOrTabChar);
++    if (name->length() == 0)
++      name = base::nullopt;
++  }
+   return name.has_value() ? *name : String();
+ }
+ 
+ String ManifestParser::ParseShortName(const JSONObject* object) {
+   base::Optional<String> short_name = ParseString(object, "short_name", Trim);
++  if (short_name.has_value()) {
++    short_name = short_name->RemoveCharacters(IsCrLfOrTabChar);
++    if (short_name->length() == 0)
++      short_name = base::nullopt;
++  }
+   return short_name.has_value() ? *short_name : String();
+ }
+ 
diff --git a/patches/chromium/replace_std_vector_with_base_observerlist_to_support_container.patch b/patches/chromium/replace_std_vector_with_base_observerlist_to_support_container.patch
new file mode 100644
index 0000000000000..d7edab9e08864
--- /dev/null
+++ b/patches/chromium/replace_std_vector_with_base_observerlist_to_support_container.patch
@@ -0,0 +1,144 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Tue, 18 May 2021 23:22:53 +0200
+Subject: Replace std::vector with base::ObserverList to support container
+ modification while iterating
+
+TaskTracker saves list of viewers in vector, that needs to be notified
+when distillation is completed. At the time of notifying the viewers,
+we are indirectly erasing viewers from vector while iterating.
+
+This is causing container-overflow in asan build when vector has more
+than one viewer while notifying.
+
+This change is to replace vector with ObserverList that can be modified
+during iteration without invalidating the iterator.
+
+(cherry picked from commit be19f42dab0706d5fdd74acd6eaa424e9277e9c4)
+
+Bug: 1203590
+Change-Id: I7c7b8237584c48c9ebc2639b9268a6a78c2db4b2
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2856118
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2883743
+
+diff --git a/base/observer_list.h b/base/observer_list.h
+index 52c8fad0d2a0a24e4daa52ec5659906085660b77..536e0bcd846e3cb9f38e28e61865aad7b7e04a25 100644
+--- a/base/observer_list.h
++++ b/base/observer_list.h
+@@ -272,6 +272,7 @@ class ObserverList {
+       NOTREACHED() << "Observers can only be added once!";
+       return;
+     }
++    observers_count_++;
+     observers_.emplace_back(ObserverStorageType(obs));
+   }
+ 
+@@ -284,7 +285,8 @@ class ObserverList {
+                      [obs](const auto& o) { return o.IsEqual(obs); });
+     if (it == observers_.end())
+       return;
+-
++    if (!it->IsMarkedForRemoval())
++      observers_count_--;
+     if (live_iterators_.empty()) {
+       observers_.erase(it);
+     } else {
+@@ -314,8 +316,12 @@ class ObserverList {
+       for (auto& observer : observers_)
+         observer.MarkForRemoval();
+     }
++
++    observers_count_ = 0;
+   }
+ 
++  bool empty() const { return !observers_count_; }
++
+   bool might_have_observers() const { return !observers_.empty(); }
+ 
+  private:
+@@ -334,6 +340,8 @@ class ObserverList {
+ 
+   base::LinkedList<internal::WeakLinkNode<ObserverList>> live_iterators_;
+ 
++  size_t observers_count_{0};
++
+   const ObserverListPolicy policy_;
+ 
+   SEQUENCE_CHECKER(iteration_sequence_checker_);
+diff --git a/components/dom_distiller/core/task_tracker.cc b/components/dom_distiller/core/task_tracker.cc
+index e66a62c4091e44183253ba7221db6dedcca4a1a2..f22c88967bc7d7b1a32339657b5fc2bf8248bbde 100644
+--- a/components/dom_distiller/core/task_tracker.cc
++++ b/components/dom_distiller/core/task_tracker.cc
+@@ -85,7 +85,7 @@ void TaskTracker::AddSaveCallback(SaveCallback callback) {
+ 
+ std::unique_ptr<ViewerHandle> TaskTracker::AddViewer(
+     ViewRequestDelegate* delegate) {
+-  viewers_.push_back(delegate);
++  viewers_.AddObserver(delegate);
+   if (content_ready_) {
+     // Distillation for this task has already completed, and so the delegate can
+     // be immediately told of the result.
+@@ -115,7 +115,7 @@ bool TaskTracker::HasUrl(const GURL& url) const {
+ }
+ 
+ void TaskTracker::RemoveViewer(ViewRequestDelegate* delegate) {
+-  base::Erase(viewers_, delegate);
++  viewers_.RemoveObserver(delegate);
+   if (viewers_.empty()) {
+     MaybeCancel();
+   }
+@@ -219,8 +219,8 @@ void TaskTracker::DistilledArticleReady(
+ }
+ 
+ void TaskTracker::NotifyViewersAndCallbacks() {
+-  for (auto* viewer : viewers_) {
+-    NotifyViewer(viewer);
++  for (auto& viewer : viewers_) {
++    NotifyViewer(&viewer);
+   }
+ 
+   // Already inside a callback run SaveCallbacks directly.
+@@ -242,8 +242,8 @@ void TaskTracker::DoSaveCallbacks(bool success) {
+ 
+ void TaskTracker::OnArticleDistillationUpdated(
+     const ArticleDistillationUpdate& article_update) {
+-  for (auto* viewer : viewers_) {
+-    viewer->OnArticleUpdated(article_update);
++  for (auto& viewer : viewers_) {
++    viewer.OnArticleUpdated(article_update);
+   }
+ }
+ 
+diff --git a/components/dom_distiller/core/task_tracker.h b/components/dom_distiller/core/task_tracker.h
+index 484145cf7d176fd0c3f2fa73da4cf94c23cc0bda..cc13e7272923ec3de52bcea186fdc30391c8cd2b 100644
+--- a/components/dom_distiller/core/task_tracker.h
++++ b/components/dom_distiller/core/task_tracker.h
+@@ -11,6 +11,7 @@
+ #include "base/bind.h"
+ #include "base/callback.h"
+ #include "base/memory/weak_ptr.h"
++#include "base/observer_list.h"
+ #include "components/dom_distiller/core/article_distillation_update.h"
+ #include "components/dom_distiller/core/article_entry.h"
+ #include "components/dom_distiller/core/distiller.h"
+@@ -40,9 +41,9 @@ class ViewerHandle {
+ 
+ // Interface for a DOM distiller entry viewer. Implement this to make a view
+ // request and receive the data for an entry when it becomes available.
+-class ViewRequestDelegate {
++class ViewRequestDelegate : public base::CheckedObserver {
+  public:
+-  virtual ~ViewRequestDelegate() = default;
++  ~ViewRequestDelegate() override = default;
+ 
+   // Called when the distilled article contents are available. The
+   // DistilledArticleProto is owned by a TaskTracker instance and is invalidated
+@@ -140,7 +141,7 @@ class TaskTracker {
+   std::vector<SaveCallback> save_callbacks_;
+   // A ViewRequestDelegate will be added to this list when a view request is
+   // made and removed when the corresponding ViewerHandle is destroyed.
+-  std::vector<ViewRequestDelegate*> viewers_;
++  base::ObserverList<ViewRequestDelegate> viewers_;
+ 
+   std::unique_ptr<Distiller> distiller_;
+   bool blob_fetcher_running_;
diff --git a/patches/v8/.patches b/patches/v8/.patches
index 16c1e2ed92040..06243fedc3888 100644
--- a/patches/v8/.patches
+++ b/patches/v8/.patches
@@ -34,3 +34,5 @@ merged_squashed_multiple_commits.patch
 merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch
 merged_turbofan_harden_arrayprototypepop_and_arrayprototypeshift.patch
 m86-lts_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch
+merged_wasm-simd_ia32_fix_f64x2_min_max_to_use_registers.patch
+reland_compiler_fix_more_truncation_bugs_in_simplifiedlowering.patch
diff --git a/patches/v8/merged_wasm-simd_ia32_fix_f64x2_min_max_to_use_registers.patch b/patches/v8/merged_wasm-simd_ia32_fix_f64x2_min_max_to_use_registers.patch
new file mode 100644
index 0000000000000..cdb18dbe35a80
--- /dev/null
+++ b/patches/v8/merged_wasm-simd_ia32_fix_f64x2_min_max_to_use_registers.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Tue, 18 May 2021 17:58:48 +0200
+Subject: Merged: [wasm-simd][ia32] Fix f64x2 min max to use registers
+
+We don't have memory alignment yet, so using memory operands will cause
+segv if we try to access the unaligned operands (on non-AVX systems).
+
+The fix here is kept simple (the logic can be cleaned up a bit and
+optimized to not use unique registers), in order to keep the cherry-pick
+and back-merge as small and safe as possible.
+
+(cherry picked from commit 7f2d41fa3748ecc8fc888d93f82d77718b1dd6b0)
+
+Bug: chromium:1204071
+Change-Id: I7d7d177ff096ebd3de399fcf1ec7d9ac57bbb80b
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2872565
+
+diff --git a/src/compiler/backend/ia32/instruction-selector-ia32.cc b/src/compiler/backend/ia32/instruction-selector-ia32.cc
+index 5ed7c24e6bf4d955f126d96b8b4cd467b81ec94b..618a171d834c3e9ac3e2352877a7dfd0c1799431 100644
+--- a/src/compiler/backend/ia32/instruction-selector-ia32.cc
++++ b/src/compiler/backend/ia32/instruction-selector-ia32.cc
+@@ -2181,7 +2181,7 @@ void InstructionSelector::VisitF64x2Min(Node* node) {
+   IA32OperandGenerator g(this);
+   InstructionOperand temps[] = {g.TempSimd128Register()};
+   InstructionOperand operand0 = g.UseUniqueRegister(node->InputAt(0));
+-  InstructionOperand operand1 = g.UseUnique(node->InputAt(1));
++  InstructionOperand operand1 = g.UseUniqueRegister(node->InputAt(1));
+ 
+   if (IsSupported(AVX)) {
+     Emit(kIA32F64x2Min, g.DefineAsRegister(node), operand0, operand1,
+@@ -2196,7 +2196,7 @@ void InstructionSelector::VisitF64x2Max(Node* node) {
+   IA32OperandGenerator g(this);
+   InstructionOperand temps[] = {g.TempSimd128Register()};
+   InstructionOperand operand0 = g.UseUniqueRegister(node->InputAt(0));
+-  InstructionOperand operand1 = g.UseUnique(node->InputAt(1));
++  InstructionOperand operand1 = g.UseUniqueRegister(node->InputAt(1));
+   if (IsSupported(AVX)) {
+     Emit(kIA32F64x2Max, g.DefineAsRegister(node), operand0, operand1,
+          arraysize(temps), temps);
diff --git a/patches/v8/reland_compiler_fix_more_truncation_bugs_in_simplifiedlowering.patch b/patches/v8/reland_compiler_fix_more_truncation_bugs_in_simplifiedlowering.patch
new file mode 100644
index 0000000000000..3ab5ef71910cd
--- /dev/null
+++ b/patches/v8/reland_compiler_fix_more_truncation_bugs_in_simplifiedlowering.patch
@@ -0,0 +1,137 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrey Belenko <andrey.belenko@gmail.com>
+Date: Tue, 18 May 2021 22:03:37 +0200
+Subject: Reland "[compiler] Fix more truncation bugs in SimplifiedLowering"
+
+This is a reland of 47077d94492cb604e3a7f02c0d7c3c495ff6b713 without
+changes. The revert was false alarm.
+
+Original change's description:
+> [compiler] Fix more truncation bugs in SimplifiedLowering
+>
+> Bug: chromium:1200490
+> Change-Id: I3555b6d99bdb4b4e7c302a43a82c17e8bff84ebe
+> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840452
+
+Bug: chromium:1200490
+Change-Id: I75cac59050bc393d157a1ee5bed776c8986a7bbe
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843817
+
+diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc
+index 97bd328c28e24d25e1813399b798ecdb8a248cfd..df050006ebe07ce263445d0160038c31f19a562c 100644
+--- a/src/compiler/simplified-lowering.cc
++++ b/src/compiler/simplified-lowering.cc
+@@ -1401,17 +1401,32 @@ class RepresentationSelector {
+     return jsgraph_->simplified();
+   }
+ 
+-  void LowerToCheckedInt32Mul(Node* node, Truncation truncation,
+-                              Type input0_type, Type input1_type) {
+-    // If one of the inputs is positive and/or truncation is being applied,
+-    // there is no need to return -0.
+-    CheckForMinusZeroMode mz_mode =
+-        truncation.IdentifiesZeroAndMinusZero() ||
+-                IsSomePositiveOrderedNumber(input0_type) ||
+-                IsSomePositiveOrderedNumber(input1_type)
+-            ? CheckForMinusZeroMode::kDontCheckForMinusZero
+-            : CheckForMinusZeroMode::kCheckForMinusZero;
+-    NodeProperties::ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
++  template <Phase T>
++  void VisitForCheckedInt32Mul(Node* node, Truncation truncation,
++                               Type input0_type, Type input1_type,
++                               UseInfo input_use) {
++    DCHECK_EQ(node->opcode(), IrOpcode::kSpeculativeNumberMultiply);
++    // A -0 input is impossible or will cause a deopt.
++    DCHECK(BothInputsAre(node, Type::Signed32()) ||
++           !input_use.truncation().IdentifiesZeroAndMinusZero());
++
++    CheckForMinusZeroMode mz_mode;
++    Type restriction;
++    if (IsSomePositiveOrderedNumber(input0_type) ||
++        IsSomePositiveOrderedNumber(input1_type)) {
++      mz_mode = CheckForMinusZeroMode::kDontCheckForMinusZero;
++      restriction = Type::Signed32();
++    } else if (truncation.IdentifiesZeroAndMinusZero()) {
++      mz_mode = CheckForMinusZeroMode::kDontCheckForMinusZero;
++      restriction = Type::Signed32OrMinusZero();
++    } else {
++      mz_mode = CheckForMinusZeroMode::kCheckForMinusZero;
++      restriction = Type::Signed32();
++    }
++
++    VisitBinop<T>(node, input_use, MachineRepresentation::kWord32, restriction);
++    if (lower<T>())
++      NodeProperties::ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
+   }
+ 
+   void ChangeToInt32OverflowOp(Node* node) {
+@@ -1603,12 +1618,22 @@ class RepresentationSelector {
+         VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32);
+         if (lower<T>()) DeferReplacement(node, lowering->Int32Mod(node));
+       } else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
++        Type const restriction =
++            truncation.IdentifiesZeroAndMinusZero() &&
++                    TypeOf(node->InputAt(0)).Maybe(Type::MinusZero())
++                ? Type::Unsigned32OrMinusZero()
++                : Type::Unsigned32();
+         VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
+-                      Type::Unsigned32());
++                      restriction);
+         if (lower<T>()) ChangeToUint32OverflowOp(node);
+       } else {
++        Type const restriction =
++            truncation.IdentifiesZeroAndMinusZero() &&
++                    TypeOf(node->InputAt(0)).Maybe(Type::MinusZero())
++                ? Type::Signed32OrMinusZero()
++                : Type::Signed32();
+         VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
+-                      Type::Signed32());
++                      restriction);
+         if (lower<T>()) ChangeToInt32OverflowOp(node);
+       }
+       return;
+@@ -2172,23 +2197,17 @@ class RepresentationSelector {
+           // If both inputs and feedback are int32, use the overflow op.
+           if (hint == NumberOperationHint::kSignedSmall ||
+               hint == NumberOperationHint::kSigned32) {
+-            VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+-                          MachineRepresentation::kWord32, Type::Signed32());
+-            if (lower<T>()) {
+-              LowerToCheckedInt32Mul(node, truncation, input0_type,
+-                                     input1_type);
+-            }
++            VisitForCheckedInt32Mul<T>(node, truncation, input0_type,
++                                       input1_type,
++                                       UseInfo::TruncatingWord32());
+             return;
+           }
+         }
+ 
+         if (hint == NumberOperationHint::kSignedSmall ||
+             hint == NumberOperationHint::kSigned32) {
+-          VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+-                        MachineRepresentation::kWord32, Type::Signed32());
+-          if (lower<T>()) {
+-            LowerToCheckedInt32Mul(node, truncation, input0_type, input1_type);
+-          }
++          VisitForCheckedInt32Mul<T>(node, truncation, input0_type, input1_type,
++                                     CheckedUseInfoAsWord32FromHint(hint));
+           return;
+         }
+ 
+@@ -3895,7 +3914,6 @@ template <>
+ void RepresentationSelector::SetOutput<RETYPE>(
+     Node* node, MachineRepresentation representation, Type restriction_type) {
+   NodeInfo* const info = GetInfo(node);
+-  DCHECK(info->restriction_type().Is(restriction_type));
+   DCHECK(restriction_type.Is(info->restriction_type()));
+   info->set_output(representation);
+ }
+@@ -3905,7 +3923,6 @@ void RepresentationSelector::SetOutput<LOWER>(
+     Node* node, MachineRepresentation representation, Type restriction_type) {
+   NodeInfo* const info = GetInfo(node);
+   DCHECK_EQ(info->representation(), representation);
+-  DCHECK(info->restriction_type().Is(restriction_type));
+   DCHECK(restriction_type.Is(info->restriction_type()));
+   USE(info);
+ }

From 9fc28e2296b99a970cc58cdcbf17b0f2a743617a Mon Sep 17 00:00:00 2001
From: Electron Bot <electron@github.com>
Date: Mon, 24 May 2021 08:50:38 -0700
Subject: [PATCH 48/48] Bump v10.4.7

---
 ELECTRON_VERSION                        | 2 +-
 package.json                            | 2 +-
 shell/browser/resources/win/electron.rc | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ELECTRON_VERSION b/ELECTRON_VERSION
index d1d23e60aa74d..4ab9d20ad3e80 100644
--- a/ELECTRON_VERSION
+++ b/ELECTRON_VERSION
@@ -1 +1 @@
-10.4.6
\ No newline at end of file
+10.4.7
\ No newline at end of file
diff --git a/package.json b/package.json
index adb74c706debc..8752e7dc3bb41 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron",
-  "version": "10.4.6",
+  "version": "10.4.7",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
diff --git a/shell/browser/resources/win/electron.rc b/shell/browser/resources/win/electron.rc
index 249418bd6679d..680ea2ad56c18 100644
--- a/shell/browser/resources/win/electron.rc
+++ b/shell/browser/resources/win/electron.rc
@@ -50,8 +50,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 10,4,6,0
- PRODUCTVERSION 10,4,6,0
+ FILEVERSION 10,4,7,0
+ PRODUCTVERSION 10,4,7,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -68,12 +68,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "GitHub, Inc."
             VALUE "FileDescription", "Electron"
-            VALUE "FileVersion", "10.4.6"
+            VALUE "FileVersion", "10.4.7"
             VALUE "InternalName", "electron.exe"
             VALUE "LegalCopyright", "Copyright (C) 2015 GitHub, Inc. All rights reserved."
             VALUE "OriginalFilename", "electron.exe"
             VALUE "ProductName", "Electron"
-            VALUE "ProductVersion", "10.4.6"
+            VALUE "ProductVersion", "10.4.7"
             VALUE "SquirrelAwareVersion", "1"
         END
     END