In CEF dcheck_always_on=true builds on Windows, the network process
crashes with reentrant malloc on first allocation. Outer trigger:
CheckedLockImpl::Acquire (DCHECK-only) allocates on PostTask -> enters
PartitionAlloc -> ThreadCache::Get; on this path the `static
thread_local MetricsSubSampler g_shared_subsampler` (added by
https://crrev.com/c/6202281) is constructed, and its ctor seeds
InsecureRandomGenerator via base::RandUint64() -> BoringSSL RAND_bytes
-> OPENSSL_malloc, tripping ScopedDisallowAllocations.
Defer seeding to the first RandUint64() call. (0, 0) is XorShift128+'s
unique fixed point, so it doubles as the unseeded sentinel without a
flag (no size change). ReseedForTesting(0) now CHECKs; no caller
passes 0. Tactical fix: any other dynamic-init thread_local in
libcef.dll whose ctor allocates could crash similarly in DCHECK
builds.
Recent Windows 11 SDK installs (10.0.26100.7xxx+) no longer duplicate
dxil.dll into bin/<ver>/<arch>/; only the canonical Redist/D3D/<arch>/
copy is present. Switch Dawn's copy_dxil_dll and copy_dxc_binary GN
rules to use the Redist path, matching what ANGLE already does for
d3dcompiler_47.dll.
Chromium 1624993 (https://crrev.com/c/7810279, "Fix FileSelectHelper
double-release Use-After-Free") migrated FileSelectHelper from manual
AddRef/Release to a WebContents-scoped ActiveHelpers manager, and in
the process removed the listener_->FileSelectionCanceled() notification
from RunFileChooserEnd(). FileSelectHelper::FileSelectionCanceled() now
just calls RunFileChooserEnd(), which unregisters from ActiveHelpers
without ever telling the wrapped content::FileSelectListener. The CEF
listener's callback never fires, and DialogTest.FileOpenCancelSkipFirstCallback
and DialogTest.FileOpenAsyncCancelSkipFirstCallback time out waiting for
OnFileDialogDismissed.
This was already reverted upstream as https://crrev.com/c/7836491 in
149.0.7827.11. Carry the revert in chrome_browser_dialogs_native.patch
for branches pinned before that point. Restores manual AddRef/Release,
the listener_->FileSelectionCanceled() call in RunFileChooserEnd(), the
CleanUp() helper, and the WebContentsDestroyed() cleanup path. The
file_select_helper_unittest.cc parts of the upstream revert are
intentionally skipped.
Chromium 491783215 (https://crrev.com/c/7617635, cherry-picked to the
M148.40 branch) removed Blink's SetHTTPOriginToMatchReferrerPolicyIfNeeded
call on navigation requests, on the premise that the browser process
would add the Origin header in AddAdditionalRequestHeaders() in
content/browser/renderer_host/navigation_request.cc. That premise holds
for http(s) but not for embedder-registered schemes, because the
function early-returns on !SchemeIsHTTPOrHTTPS(). As a result, form
POSTs from custom standard schemes (SECURE/CORS_ENABLED) no longer had
an Origin header, and POSTs from non-standard schemes no longer had
Origin: null. CorsTest.RedirectPost* was failing in 30 configurations.
Drop the early-return so the Origin / User-Agent / referrer-policy
logic runs uniformly; each inner block is already guarded by its own
condition (enable_do_not_track, SetHeaderIfMissing, NeedsHTTPOrigin,
feature flags, prerender/preview state) and is a no-op for schemes
that don't need it.
Update the CorsTest.RedirectPost* expectations to stop treating
CUSTOM_STANDARD_SCHEME as an always-null-origin scheme; its actual
origin is now sent (matching http(s)), while truly non-standard
schemes still serialize to "null" via their opaque origin.
Forward-port of 68aa5a908 from the M148 stable branch.
CipdDependency.__init__ unconditionally reads version_file from disk,
even for deps excluded by condition (e.g. checkout_android). When
building from a source tarball that prunes android_webview, this causes
a FileNotFoundError. Skip reading the version_file when should_process
is False since the dep won't be fetched anyway.
Adds role-aware collapsing of off-screen nodes to CDP accessibility tree
serialization (Accessibility.getFullAXTree). When enabled, off-screen
landmarks and headings are serialized as summaries (role + name only)
and other off-screen nodes are pruned. Position:fixed/sticky descendants
of off-screen parents are still discovered and fully serialized.
Reduces snapshot size for AI agents using Playwright ariaSnapshot().
Platform screen readers are unaffected — they use a separate code path.
CDP nodesUpdated events are suppressed when active.
The setting is a per-browser CefBrowserSettings field threaded through
WebPreferences, with a runtime override via SetAxViewportCollapse().
Both APIs are guarded with CEF_API_ADDED(CEF_EXPERIMENTAL).
When BrowserWidgetCacheThemeService is enabled via field trials,
GetThemeService() returns cached theme_service_ which may be null
if SetBrowserView() was called before browser_view->browser() was
valid. Add null check to fall back to direct lookup.
When using chrome://inspect to inspect a remote debugging target,
both opener and inspected_web_contents may be null because the
DevTools window is not inspecting the WebContents that launched it.
Add null check before calling GetBrowserForContents to prevent
DCHECK failure.
Also update the patch for devtools_window.cc to check for null
inspected_web_contents before calling FindBrowserWithTab.
Exclude menu windows from the child window bounds modification that
sets origin to (0,0). This was causing submenus to appear in the
top-left corner of the screen on subsequent showings.
The Init function already excluded TYPE_MENU from this treatment, but
SetBoundsInDIP did not. Added is_menu_ member to track the widget type
and apply consistent exclusion in both locations.
Context menus were being clipped to the parent window bounds and
positioned incorrectly.
The fix has two parts:
1. X11 window creation (via patch): Menu windows are now parented to the
root window instead of the parent_widget to prevent clipping. Other
window types maintain their normal parent relationship.
2. Coordinate conversion: GetScreenPoint returns coordinates relative to
the parent window, so convert to screen coordinates by adding the
parent window's screen origin. The translation accounts for display
scale factor since X11 TranslateCoordinates returns pixel coordinates
while the menu system expects DIP coordinates.
TPM metrics collection via MaybeMeasureTpmOperations() can crash on
some Windows machines due to a null pointer dereference in the Windows
TPM Platform Crypto Provider (PCPKsp.dll) when calling
NCryptIsAlgSupported().
During browser window closing, the ToolbarView is destroyed before
BrowserView, causing views in the toolbar to be freed while
WebUIBubbleManagerImpl and TabSearchBubbleHost still hold raw_ptr
references to them. When BrowserView is later destroyed, these
classes trigger dangling pointer errors.
Replace raw_ptr with views::ViewTracker in both classes:
- WebUIBubbleManagerImpl::anchor_view_ -> anchor_view_tracker_
- TabSearchBubbleHost::button_ -> button_tracker_
ViewTracker safely clears its internal pointer when the tracked
view is destroyed, preventing the dangling pointer situation.
When BrowserViewLayoutImpl::Layout is called before the frame view
has been laid out, GetBrowserLayoutParams returns empty params.
The early return allowed View::Layout's for-loop to trigger child
layouts with 0x0 bounds, causing ContentsLayoutManager to receive
invalid size. Fall back to using the host's local bounds as
visual_client_area when frame params are empty, allowing layout to
proceed with valid bounds.
Call UpdateDialogTopInsetInBrowserView in GetDialogTop() to match
the behavior of BrowserViewLayoutImplOld::GetDialogTopY(), allowing
CEF to adjust dialog positioning.
Update Browser::GetCurrentPageIcon() to use the favicon from the opener
WebContents for document picture-in-picture windows, instead of the PiP
window's own WebContents. This ensures the correct icon is displayed in
the Windows taskbar preview and matches the existing behavior for
window titles, where PiP windows use the opener's title.
Usage:
documentPictureInPicture.requestWindow({
width: 400,
height: 300,
cefOptions: { position: { x: 100, y: 200 } }
});
The feature is gated by Blink RuntimeEnabled flag and must be
explicitly enabled with:
--enable-blink-features=DocumentPictureInPictureCefOptions
Approved-by: Marshall Greenblatt
cef-spotify