Preserve existing opaque origins in the custom-scheme security policy
patch instead of deriving a new origin. This keeps srcdoc frames'
inherited origins consistent between the browser and renderer while
retaining distinct origins for sandboxed frames.
Add regression coverage for data URLs, document-written about:blank,
HTTPS, and nested data frames, including sandbox isolation. Disable
the sandboxed initial about:blank case pending resolution of
https://crbug.com/570981950.
With multi-threaded-message-loop there is no GTK-backed LinuxUi, so
Views windows use the fallback FrameViewLinux with client-drawn
shadows. DesktopWindowTreeHostLinux only updates the opaque region from
OnBoundsChanged(), which runs before the FrameView exists. The surface
keeps its initial full-size opaque region, shadow included, so the
compositor leaves trails behind the window when it moves.
Call UpdateFrameRegions() from OnWidgetInitDone() so that the opaque and
input regions are set once the FrameView exists.
Skip ListAccounts when browser sign-in is disabled, default new
profiles to sign-in disabled, and disable the sign-in promo on the
avatar button by default. Embedders can still opt in via
OnRegisterCustomPreferences.
Register CEF profile preferences after Chromium keyed-service
preferences. Add GetDefaultPreference and SetDefaultPreference
to CefPreferenceRegistrar so applications can inspect, override,
and restore registered defaults.
Preserve the preview WebContents in the file-selection policy so
CEF can resolve the originating browser when saving a PDF.
Use the hosted BrowserView bounds for dialog sizing, and let AppKit
handle native resize edges without child-modal input blocking.
Restore focus to the topmost visible child-modal dialog after
resizing, provided the app is active and the parent still owns
keyboard focus.
Always complete oracle bookkeeping for failed copies and obsolete
capture versions so pending captures cannot block refresh retries.
Reject cached frames from obsolete capture versions and allow newer
versions to replace them.
Add regression coverage for refresh recovery after copy failures
and capture-version changes.
BrowserWebContentsDelegate was split from Browser in recent
refactoring and can now be extended instead of patched. This
change is strictly structural.
Keep CEF-created unique OTR profiles when resolving the DevTools
profile so Inspect Element does not create the popup with the parent
profile. Add coverage for a non-global request context and verify that
the DevTools popup shares it.
Guard the owning-window lookup in FileSelectHelper::RunFileChooserOnUIThread.
Add ceftests DialogTest.FileInputOSR test for triggering and canceling a file
input in OSR mode.
Chrome-style browsers with a native parent use TYPE_CONTROL widgets,
which have no NonClientView, so client_view() returns nullptr. Guard
that InvalidateLayout call; the earlier non_client_view() check alone
was insufficient.
Disable creation of GtkUi on Wayland when using multi-threaded-message-loop,
matching the existing X11 behavior (see #3610). GtkUi connects GDK signals
(e.g. GdkMonitor notify::scale-factor) on the CEF UI thread, but GDK sources
run on the default GMainContext owned by the application's main thread, so
signal emission fails a ScopedGSignal sequence checker DCHECK.
With an external parent window owned by a different thread the OS may
deliver WM_DESTROY multiple times for the same HWND during
DestroyWindow. Guard DesktopWindowTreeHostWin::HandleDestroying so that
Widget::OnNativeWidgetDestroying is only called once, matching the
equivalent upstream guard added for Mac. Otherwise the new
CHECK(!widget_destroying_handled_) in Widget::HandleWidgetDestroying
(https://crrev.com/41b2d8f9dd821) fails when closing a browser window
with `--use-native --multi-threaded-message-loop`.
In CEF dcheck_always_on=true builds on Windows, the network process
crashes with reentrant malloc on first allocation. Outer trigger:
CheckedLockImpl::Acquire (DCHECK-only) allocates on PostTask -> enters
PartitionAlloc -> ThreadCache::Get; on this path the `static
thread_local MetricsSubSampler g_shared_subsampler` (added by
https://crrev.com/c/6202281) is constructed, and its ctor seeds
InsecureRandomGenerator via base::RandUint64() -> BoringSSL RAND_bytes
-> OPENSSL_malloc, tripping ScopedDisallowAllocations.
Defer seeding to the first RandUint64() call. (0, 0) is XorShift128+'s
unique fixed point, so it doubles as the unseeded sentinel without a
flag (no size change). ReseedForTesting(0) now CHECKs; no caller
passes 0. Tactical fix: any other dynamic-init thread_local in
libcef.dll whose ctor allocates could crash similarly in DCHECK
builds.
Recent Windows 11 SDK installs (10.0.26100.7xxx+) no longer duplicate
dxil.dll into bin/<ver>/<arch>/; only the canonical Redist/D3D/<arch>/
copy is present. Switch Dawn's copy_dxil_dll and copy_dxc_binary GN
rules to use the Redist path, matching what ANGLE already does for
d3dcompiler_47.dll.
Chromium 1624993 (https://crrev.com/c/7810279, "Fix FileSelectHelper
double-release Use-After-Free") migrated FileSelectHelper from manual
AddRef/Release to a WebContents-scoped ActiveHelpers manager, and in
the process removed the listener_->FileSelectionCanceled() notification
from RunFileChooserEnd(). FileSelectHelper::FileSelectionCanceled() now
just calls RunFileChooserEnd(), which unregisters from ActiveHelpers
without ever telling the wrapped content::FileSelectListener. The CEF
listener's callback never fires, and DialogTest.FileOpenCancelSkipFirstCallback
and DialogTest.FileOpenAsyncCancelSkipFirstCallback time out waiting for
OnFileDialogDismissed.
This was already reverted upstream as https://crrev.com/c/7836491 in
149.0.7827.11. Carry the revert in chrome_browser_dialogs_native.patch
for branches pinned before that point. Restores manual AddRef/Release,
the listener_->FileSelectionCanceled() call in RunFileChooserEnd(), the
CleanUp() helper, and the WebContentsDestroyed() cleanup path. The
file_select_helper_unittest.cc parts of the upstream revert are
intentionally skipped.
Chromium 491783215 (https://crrev.com/c/7617635, cherry-picked to the
M148.40 branch) removed Blink's SetHTTPOriginToMatchReferrerPolicyIfNeeded
call on navigation requests, on the premise that the browser process
would add the Origin header in AddAdditionalRequestHeaders() in
content/browser/renderer_host/navigation_request.cc. That premise holds
for http(s) but not for embedder-registered schemes, because the
function early-returns on !SchemeIsHTTPOrHTTPS(). As a result, form
POSTs from custom standard schemes (SECURE/CORS_ENABLED) no longer had
an Origin header, and POSTs from non-standard schemes no longer had
Origin: null. CorsTest.RedirectPost* was failing in 30 configurations.
Drop the early-return so the Origin / User-Agent / referrer-policy
logic runs uniformly; each inner block is already guarded by its own
condition (enable_do_not_track, SetHeaderIfMissing, NeedsHTTPOrigin,
feature flags, prerender/preview state) and is a no-op for schemes
that don't need it.
Update the CorsTest.RedirectPost* expectations to stop treating
CUSTOM_STANDARD_SCHEME as an always-null-origin scheme; its actual
origin is now sent (matching http(s)), while truly non-standard
schemes still serialize to "null" via their opaque origin.
Forward-port of 68aa5a908 from the M148 stable branch.
CipdDependency.__init__ unconditionally reads version_file from disk,
even for deps excluded by condition (e.g. checkout_android). When
building from a source tarball that prunes android_webview, this causes
a FileNotFoundError. Skip reading the version_file when should_process
is False since the dep won't be fetched anyway.
Adds role-aware collapsing of off-screen nodes to CDP accessibility tree
serialization (Accessibility.getFullAXTree). When enabled, off-screen
landmarks and headings are serialized as summaries (role + name only)
and other off-screen nodes are pruned. Position:fixed/sticky descendants
of off-screen parents are still discovered and fully serialized.
Reduces snapshot size for AI agents using Playwright ariaSnapshot().
Platform screen readers are unaffected — they use a separate code path.
CDP nodesUpdated events are suppressed when active.
The setting is a per-browser CefBrowserSettings field threaded through
WebPreferences, with a runtime override via SetAxViewportCollapse().
Both APIs are guarded with CEF_API_ADDED(CEF_EXPERIMENTAL).
When BrowserWidgetCacheThemeService is enabled via field trials,
GetThemeService() returns cached theme_service_ which may be null
if SetBrowserView() was called before browser_view->browser() was
valid. Add null check to fall back to direct lookup.
When using chrome://inspect to inspect a remote debugging target,
both opener and inspected_web_contents may be null because the
DevTools window is not inspecting the WebContents that launched it.
Add null check before calling GetBrowserForContents to prevent
DCHECK failure.
Also update the patch for devtools_window.cc to check for null
inspected_web_contents before calling FindBrowserWithTab.
Exclude menu windows from the child window bounds modification that
sets origin to (0,0). This was causing submenus to appear in the
top-left corner of the screen on subsequent showings.
The Init function already excluded TYPE_MENU from this treatment, but
SetBoundsInDIP did not. Added is_menu_ member to track the widget type
and apply consistent exclusion in both locations.
Context menus were being clipped to the parent window bounds and
positioned incorrectly.
The fix has two parts:
1. X11 window creation (via patch): Menu windows are now parented to the
root window instead of the parent_widget to prevent clipping. Other
window types maintain their normal parent relationship.
2. Coordinate conversion: GetScreenPoint returns coordinates relative to
the parent window, so convert to screen coordinates by adding the
parent window's screen origin. The translation accounts for display
scale factor since X11 TranslateCoordinates returns pixel coordinates
while the menu system expects DIP coordinates.
TPM metrics collection via MaybeMeasureTpmOperations() can crash on
some Windows machines due to a null pointer dereference in the Windows
TPM Platform Crypto Provider (PCPKsp.dll) when calling
NCryptIsAlgSupported().
Marshall Greenblatt