- Support OnPaint uploads and copy shared textures into owned storage
before OnAcceleratedPaint returns.
- Redraw the last frame on resize/expose.
- Remove the legacy OpenGL renderer and Windows GL handler.
- Preserve cached images on allocation failure and validate bounds.
- Add OsrRendererD3D11Test unit tests, ported from the Metal/EGL tests.
Tested on Windows 11 x64:
- cefclient resize and select popups work in all eight combinations
of software/shared textures, internal/external begin frames, and
single/multi-threaded message loops.
- ceftests: 37 renderer tests pass on hardware/WARP; one allocation
failure test skips after the driver accepts its oversized descriptor
The GTK OSR window enabled external BeginFrames but never called
CefBrowserHost::SendExternalBeginFrame, so nothing was painted. Add a
UI thread timer at the windowless frame rate, matching the Windows and
macOS implementations.
- Add OsrRendererGl, a shared OpenGL 3.3 renderer with DMA-BUF import,
and load EGL/GL at runtime with no new build dependencies.
- Render via GtkGLArea on Wayland and an EGL window surface on X11.
- Redraw the last frame on resize/expose, matching the Metal renderer.
- Exit at startup if OSR is enabled and EGL is unavailable.
- Add OsrRendererGlTest unit tests, ported from the Metal tests.
Tested on a Linux VM (VMware SVGA3D, Mesa 23.2, GNOME Wayland/Xwayland):
- cefclient OSR software and shared-texture (DMA-BUF) rendering on
Wayland (GtkGLArea) and X11 (EGL window surface), including resize,
select popups, cursors, --multi-threaded-message-loop and
--transparent-painting-enabled. Shared texture runs use
--ignore-gpu-blocklist (VMware is blocklisted).
- ceftests: new OsrRendererGlTest (12 tests, using GBM DMA-BUFs) and
all existing OSRTest tests pass.
- Missing libEGL: cefclient exits at startup with an error and
OsrRendererGlTest skips.
- Fail at startup when --use-native is used with Wayland
(unsupported, see #2804).
- Remove X11 runtime dependencies from the OSR path.
- Match the GDK backend to the Ozone platform.
- Keep GDK OpenGL enabled with OSR by presetting GDK_GL (see
https://crrev.com/7c29ce9003d87).
- Share IsRunningOnWayland() between cefclient and ceftests and
match Chromium detection logic.
Suppress the opening release when a popup overlaps the pointer, even
when cefclient has not repositioned it. Previously, that release could
select an option and immediately close the menu.
Report the widget's actual focus state and route focus requests through
CefBrowserHost::SetFocus so client callbacks can accept or cancel them.
This allows select popups to open after cross-site link navigation.
Add regression coverage for main-frame and cross-origin iframe popups
and client focus cancellation, with BFCache enabled and disabled.
Set should_disable_external_popups in web preferences instead of
configuring the renderer WebView directly. This prevents preference
updates from restoring native menus after history navigation.
Remove the obsolete renderer override and add regression coverage for
main-frame and cross-origin iframe select popups with BFCache enabled
and disabled, plus client cancellation of focus requests.
Preserve existing opaque origins in the custom-scheme security policy
patch instead of deriving a new origin. This keeps srcdoc frames'
inherited origins consistent between the browser and renderer while
retaining distinct origins for sandboxed frames.
Add regression coverage for data URLs, document-written about:blank,
HTTPS, and nested data frames, including sandbox isolation. Disable
the sandboxed initial about:blank case pending resolution of
https://crbug.com/570981950.
Initialize the process command-line singleton before sandbox setup,
logging, and installer dispatch, and reuse it for argument parsing.
Early initialization is required by content::InitializeSandboxInfo
starting in M156.
Scope an AtExitManager around client execution so verbose startup
metrics can register shutdown callbacks without overlapping
installer managers.
With multi-threaded-message-loop there is no GTK-backed LinuxUi, so
Views windows use the fallback FrameViewLinux with client-drawn
shadows. DesktopWindowTreeHostLinux only updates the opaque region from
OnBoundsChanged(), which runs before the FrameView exists. The surface
keeps its initial full-size opaque region, shadow included, so the
compositor leaves trails behind the window when it moves.
Call UpdateFrameRegions() from OnWidgetInitDone() so that the opaque and
input regions are set once the FrameView exists.
The owned menu window could be created before the main window was
activated. When the main window became active later, the menu was
dismissed (e.g. Wayland popups), so owned_window_ was null by the
time CloseMainWindow ran. This happened reliably on repeat
iterations, where cached loads make OnLoadEnd fire sooner.
Forward CefWindowDelegate::OnWindowActivationChanged from
TestWindowDelegate to a new TestHandler::OnWindowActivationChanged
hook, and wait until the load has ended and the main window is
active before creating the owned window.
Skip ListAccounts when browser sign-in is disabled, default new
profiles to sign-in disabled, and disable the sign-in promo on the
avatar button by default. Embedders can still opt in via
OnRegisterCustomPreferences.
Register CEF profile preferences after Chromium keyed-service
preferences. Add GetDefaultPreference and SetDefaultPreference
to CefPreferenceRegistrar so applications can inspect, override,
and restore registered defaults.
Ignore element bounds queries for paint-only OSR tests. These tests
can start from OnPaint before the asynchronous bounds query arrives,
causing a false started-state assertion failure.
Chromium changed desktop builds to link ANGLE statically in
https://crrev.com/f78f92beeb (M151). The remaining libEGL and
libGLESv2 binaries are stubs (no exports, never loaded by
Chromium) and should no longer be distributed.
Log the connection ID, method, and path when an HTTP request has no
peer address, before the generated handler wrapper asserts.
Inline the URLRequestTest favicon to suppress incidental network
requests that may race with browser teardown.
Synchronize visual properties before showing an OSR view, even when
its surface ID remains valid. Cached views can miss resize
notifications while another view is active. Preserve software popup
initialization before the browser is attached.
Add a regression that confirms BFCache restoration and verifies
viewport and paint dimensions after resizing another page. Verified
failure before the fix and 30 passing executions across GPU and
software rendering on Windows 11.
Cancel pending downloads before cleanup and retry directory deletion
up to ten times at 100 ms intervals. Guard teardown against reentry
and late download callbacks.
Disable Chrome's automatic download bubble during download tests,
restoring the previous preference afterward. Across repeats, this UI
work increasingly delays teardown.
Disable preflight caching so repeated tests receive the expected
OPTIONS requests. Route timeout destruction through server observer
removal and cookie cleanup to prevent stale cookies and stack-use-
after-return crashes. Guard cookie verification against an
unexpected cookie count.
Load a static page and issue WasResized followed by exactly one
SendExternalBeginFrame after OnLoadEnd. Verify all bitmap pixels at
1x and 2x scale without a repeating frame timer.
Preserve the preview WebContents in the file-selection policy so
CEF can resolve the originating browser when saving a PDF.
Use the hosted BrowserView bounds for dialog sizing, and let AppKit
handle native resize edges without child-modal input blocking.
Restore focus to the topmost visible child-modal dialog after
resizing, provided the app is active and the parent still owns
keyboard focus.
Use an available handler from the same browser context when worker
requests have no matching frame or process handler, for example
after page navigation or close.
Always complete oracle bookkeeping for failed copies and obsolete
capture versions so pending captures cannot block refresh retries.
Reject cached frames from obsolete capture versions and allow newer
versions to replace them.
Add regression coverage for refresh recovery after copy failures
and capture-version changes.
BrowserWebContentsDelegate was split from Browser in recent
refactoring and can now be extended instead of patched. This
change is strictly structural.
Exclude Chrome UI contents using WebUIContentsPreloadState. These
contents have no owning CefBrowserHost, so allow excluded requests
to complete without browser info instead of waiting for a timeout.
ChromeBrowserWidget closes owned widgets before the parent WindowClosing
callback can detach overlay contents. Closing an overlay widget with
CloseNow therefore deletes its contents View and invalidates the CefView
retained by the client.
Extract CefWindowView::CloseOverlayViews and call it from both
WindowClosing and ChromeBrowserWidget::CloseOwnedWidgets. This detaches
overlay contents and restores CEF ownership before owned widgets are
destroyed. Direct overlay widget closure retains its destruction behavior,
which Alloy overlay browsers need to complete browser shutdown.
Add an explicit IsValid assertion to the overlay destruction tests.
To test:
ceftests --gtest_filter=ChromeChildWindowTest.*:OwnedWidgetShutdownTest.*:ViewsBrowserViewTest.*
Browser closure and native window destruction may occur in either order.
Subscribe ChromeBrowserWidget to BrowserDidClose so owned widgets are closed
synchronously before the Browser deletion task is posted. Retain the existing
OnNativeWidgetDestroying cleanup for the reverse ordering.
This prevents password and other Browser-owned bubbles from dereferencing
Browser state after it has been destroyed.
Keep CEF-created unique OTR profiles when resolving the DevTools
profile so Inspect Element does not create the popup with the parent
profile. Add coverage for a non-global request context and verify that
the DevTools popup shares it.
Close widgets owned by ChromeBrowserWidget from
OnNativeWidgetDestroying while the native ownership graph is still
available. This prevents popup widgets from outliving Browser state during
native-window-driven shutdown.
Add Chrome-style ceftests for JavaScript, password-save, and synthetic owned
widgets. Confirm that each widget exists before closing the main window and
verify deterministic destruction ordering for the synthetic case. Reset the
password dismissal statistics before loading the password form so repeated
test runs continue to exercise the save-password widget.
BrowserContext cleanup can delete proxy factories while URL loaders
are still active, leaving request handler state populated during
destruction.
Add a shutdown hook that reuses the existing cancellation path
before erasing proxies. Handle pending initialization and repeated
shutdown safely.
Guard the owning-window lookup in FileSelectHelper::RunFileChooserOnUIThread.
Add ceftests DialogTest.FileInputOSR test for triggering and canceling a file
input in OSR mode.
Replace cefclient's separate launch-health and update timers with a single
health-first task. Start the update only after launch_success returns structured
success so the running version becomes a confirmed fallback before a newer
version is installed.
Keep older confirmed launch records until the selected version's health is
durably confirmed. A normal exit remains neutral in explicit mode, while
exit-code and health-off modes retain their clean-exit pruning behavior.
Reconcile valid indexes under the installer lock by quarantining canonical
version directories absent from the index. Defer loaded-DLL cleanup through
.trash for later writers, and avoid emergency-recovery warnings for an empty
fresh store while preserving warnings for meaningful recovery attempts.
Expand unit and Windows E2E coverage for update ordering, confirmation and
persistence failures, fallback retention, pruning modes, loaded-version
quarantine, lock contention, and recovery. Update the installer documentation
to describe the combined behavior.
New behavior confirmed with cefclient:
1. Launch cefclient. After 60 seconds, 'launch_success' confirms the old
version and 'update' installs the new version.
2. Exit and relaunch cefclient. Second run uses the new version. After 60
seconds, 'launch_success' confirms the new version. Upon clean exit the
old version loses fallback protection and is pruned.
Avoid tempfile.NamedTemporaryFile's effectively unbounded Windows retry.
Restricted sandboxes can deny YAPF grammar-cache writes. Write each cache
to a unique file, close it, and atomically replace it. Clean up failures
to prevent orphaned pickle files.
Upstream issue: https://github.com/google/yapf/issues/1311
Clear the parser notification context in a finally block for both CppToC
and CToCpp implementation writers, including when generation raises.
Update failure-path regressions to require context restoration while
preserving successful output behavior.
Merge generated and manually maintained GYPI variables with copy and update
so the CLI works on Python 3 while preserving manual override precedence.
Add a hermetic CLI regression for exact output, progress diagnostics, and
unchanged repeated generation.
Unpack the CppToC and CToCpp generator results before writing generated
content to stdout. This preserves the existing generator return contracts.
Add successful CLI regressions that verify exact output, empty stderr, and
unchanged input files.
Return a nonzero status when distribution option validation fails so callers
do not interpret rejected invocations as successful.
Replace the existing characterization with regressions that verify the status,
diagnostics, and absence of partial output artifacts.
Return the combined header and include write result from make_pack_header.
This ensures callers observe repairs that modify only the generated include.
Replace the existing bug characterization with a regression test for the
correct return contract. Generated file contents remain unchanged.
Add deterministic fixtures, goldens, and matching tests for all 18
make_* generators. Refactor make_distrib orchestration behind an
importable main entry point while preserving generated output. Add
passing characterizations for existing generator issues.
Add tools for analyzing code coverage of CEF installer tests:
- analyze_coverage_output.py: Parse llvm-cov JSON summaries, filter by
path, and report uncovered functions and line ranges.
- CLAUDE_COVERAGE_INSTRUCTIONS.md: One-time setup and usage guide for
generating coverage reports with llvm-profdata/llvm-cov.
- Unit tests for the analysis script.
When building a client DLL loaded by bootstrap.exe, default to the last
released API version instead of the experimental (unversioned) API. The
experimental API is not back/forward compatible across CEF versions and
does not bump the version number, so the installer's vmin-based version
selection cannot work safely against it. Building with
CEF_API_VERSION=CEF_API_VERSION_LAST makes the client forward-compatible
with newer libcef.dll binaries (via API backwards compatibility).
Add a shared CEF installer that downloads, verifies, and manages CEF
binary distributions on Windows. The installer is embedded in
application bootstrap binaries and resolves the correct CEF version
from a CDN manifest based on each application's version and ABI
compatibility requirements.
Key components:
- CDN manifest parsing and version resolution
- WinHTTP-based download with SHA-1/SHA-256 integrity verification
- Authenticode catalog (.cat) signature verification
- Parallel XZ decompression for fast archive extraction
- Per-version metadata (cef_version.json) with full version tracking
- Shared installation database for multi-app version management
- Version pruning to reclaim disk space from unused versions
- Revocation list support (compiled-in baseline + CDN delta)
- Progress UI with WM_COPYDATA-based cancellation
- Bundled CEF fallback for offline/CDN-failure scenarios
Add cef_installer_builder.py to generate per-milestone and per-platform
JSON manifests consumed by the CEF bootstrap installer. Extend
cef_json_builder.py with abi_hash, signed archive tracking, and
revocation list (revoked.json) support. Includes unit tests.
Allow size-prefixed structures passed by newer libcef versions to exceed
the client wrapper's local structure size. The wrapper already limits
copies to known fields, so rejecting larger structures breaks API forward
compatibility.
Add coverage using an older wrapper view of a newer structure.
Marshall Greenblatt