Replace cefclient's separate launch-health and update timers with a single
health-first task. Start the update only after launch_success returns structured
success so the running version becomes a confirmed fallback before a newer
version is installed.
Keep older confirmed launch records until the selected version's health is
durably confirmed. A normal exit remains neutral in explicit mode, while
exit-code and health-off modes retain their clean-exit pruning behavior.
Reconcile valid indexes under the installer lock by quarantining canonical
version directories absent from the index. Defer loaded-DLL cleanup through
.trash for later writers, and avoid emergency-recovery warnings for an empty
fresh store while preserving warnings for meaningful recovery attempts.
Expand unit and Windows E2E coverage for update ordering, confirmation and
persistence failures, fallback retention, pruning modes, loaded-version
quarantine, lock contention, and recovery. Update the installer documentation
to describe the combined behavior.
New behavior confirmed with cefclient:
1. Launch cefclient. After 60 seconds, 'launch_success' confirms the old
version and 'update' installs the new version.
2. Exit and relaunch cefclient. Second run uses the new version. After 60
seconds, 'launch_success' confirms the new version. Upon clean exit the
old version loses fallback protection and is pruned.
Avoid tempfile.NamedTemporaryFile's effectively unbounded Windows retry.
Restricted sandboxes can deny YAPF grammar-cache writes. Write each cache
to a unique file, close it, and atomically replace it. Clean up failures
to prevent orphaned pickle files.
Upstream issue: https://github.com/google/yapf/issues/1311
Clear the parser notification context in a finally block for both CppToC
and CToCpp implementation writers, including when generation raises.
Update failure-path regressions to require context restoration while
preserving successful output behavior.
Merge generated and manually maintained GYPI variables with copy and update
so the CLI works on Python 3 while preserving manual override precedence.
Add a hermetic CLI regression for exact output, progress diagnostics, and
unchanged repeated generation.
Unpack the CppToC and CToCpp generator results before writing generated
content to stdout. This preserves the existing generator return contracts.
Add successful CLI regressions that verify exact output, empty stderr, and
unchanged input files.
Return a nonzero status when distribution option validation fails so callers
do not interpret rejected invocations as successful.
Replace the existing characterization with regressions that verify the status,
diagnostics, and absence of partial output artifacts.
Return the combined header and include write result from make_pack_header.
This ensures callers observe repairs that modify only the generated include.
Replace the existing bug characterization with a regression test for the
correct return contract. Generated file contents remain unchanged.
Add deterministic fixtures, goldens, and matching tests for all 18
make_* generators. Refactor make_distrib orchestration behind an
importable main entry point while preserving generated output. Add
passing characterizations for existing generator issues.
Add tools for analyzing code coverage of CEF installer tests:
- analyze_coverage_output.py: Parse llvm-cov JSON summaries, filter by
path, and report uncovered functions and line ranges.
- CLAUDE_COVERAGE_INSTRUCTIONS.md: One-time setup and usage guide for
generating coverage reports with llvm-profdata/llvm-cov.
- Unit tests for the analysis script.
When building a client DLL loaded by bootstrap.exe, default to the last
released API version instead of the experimental (unversioned) API. The
experimental API is not back/forward compatible across CEF versions and
does not bump the version number, so the installer's vmin-based version
selection cannot work safely against it. Building with
CEF_API_VERSION=CEF_API_VERSION_LAST makes the client forward-compatible
with newer libcef.dll binaries (via API backwards compatibility).
Add a shared CEF installer that downloads, verifies, and manages CEF
binary distributions on Windows. The installer is embedded in
application bootstrap binaries and resolves the correct CEF version
from a CDN manifest based on each application's version and ABI
compatibility requirements.
Key components:
- CDN manifest parsing and version resolution
- WinHTTP-based download with SHA-1/SHA-256 integrity verification
- Authenticode catalog (.cat) signature verification
- Parallel XZ decompression for fast archive extraction
- Per-version metadata (cef_version.json) with full version tracking
- Shared installation database for multi-app version management
- Version pruning to reclaim disk space from unused versions
- Revocation list support (compiled-in baseline + CDN delta)
- Progress UI with WM_COPYDATA-based cancellation
- Bundled CEF fallback for offline/CDN-failure scenarios
Add cef_installer_builder.py to generate per-milestone and per-platform
JSON manifests consumed by the CEF bootstrap installer. Extend
cef_json_builder.py with abi_hash, signed archive tracking, and
revocation list (revoked.json) support. Includes unit tests.
Allow size-prefixed structures passed by newer libcef versions to exceed
the client wrapper's local structure size. The wrapper already limits
copies to known fields, so rejecting larger structures breaks API forward
compatibility.
Add coverage using an older wrapper view of a newer structure.
Disable creation of GtkUi on Wayland when using multi-threaded-message-loop,
matching the existing X11 behavior (see #3610). GtkUi connects GDK signals
(e.g. GdkMonitor notify::scale-factor) on the CEF UI thread, but GDK sources
run on the default GMainContext owned by the application's main thread, so
signal emission fails a ScopedGSignal sequence checker DCHECK.
With Alloy style there is no Chrome Browser object, so falling through
to the Chrome permission prompt factory crashes when anchoring the
Views bubble (null BrowserWindowInterface dereference in
BrowserView::GetBrowserViewForBrowser). Older Chromium bailed out of
CreatePermissionPrompt when the WebContents had no attached Browser,
which provided the implicit IGNORE behavior for Alloy style; that
bail-out was removed in the 7922 rebase.
Make the IGNORE behavior explicit by returning with
default_handling=false for Alloy style when the client does not handle
the prompt in OnShowPermissionPrompt. Chrome style behavior is
unchanged.
With an external parent window owned by a different thread the OS may
deliver WM_DESTROY multiple times for the same HWND during
DestroyWindow. Guard DesktopWindowTreeHostWin::HandleDestroying so that
Widget::OnNativeWidgetDestroying is only called once, matching the
equivalent upstream guard added for Mac. Otherwise the new
CHECK(!widget_destroying_handled_) in Widget::HandleWidgetDestroying
(https://crrev.com/41b2d8f9dd821) fails when closing a browser window
with `--use-native --multi-threaded-message-loop`.
Fixes two teardown-ordering hazards for Chrome style browsers created with
a native parent window (CefWindowInfo::SetAsChild):
- ChromeBrowserHostImpl::DestroyBrowser() may destroy the platform delegate
before Widget teardown destroys the ChildWindowDelegate, leaving its
raw_ptr dangling (SIGTRAP with PartitionAllocDanglingPtr). The pointer
was only cleared in OnWindowDestroyed on Windows, and only if that ran
first. Store a base::WeakPtr from the existing
CefBrowserPlatformDelegateNativeAura factory instead, which
auto-invalidates on delegate destruction on all Aura platforms.
- In the reverse order on Windows, the client may destroy the parent window
(and thereby the browser's Widget) while the browser is still alive,
leaving the Widget pointer cached by set_widget() dangling. SetFocus,
NotifyMoveOrResizeStarted and root window bounds queries could then
dereference the deleted Widget. Reuse the existing WidgetDeleted
mechanism (already wired up for the non-Views-hosted code path in
CreateHostWindow) by executing the delete callback from
ChildWindowDelegate::OnWindowDestroyed. The callback is bound with a
WeakPtr, so it no-ops safely when the delegate is destroyed first.
Adds ceftests coverage for both teardown orders (Windows and Linux X11).
Dangling pointer regressions are detected when running with
--enable-features=PartitionAllocBackupRefPtr,PartitionAllocDanglingPtr or
in an ASAN build. Chrome style is not supported with a native parent on
MacOS (see issue #3294).
Prefer the charset declared in the Content-Type response header, falling
back to the intl.charset_default preference. Adds the experimental
CefTestServerConnection::SendHttpResponseWithRawHeaders API so tests can
send raw non-UTF-8 header bytes, with coverage for both charset sources
and the new API.
Advance the provider iterator when DeleteProvider encounters an entry
that is already pending deletion.
Add ResourceManagerTest.ProviderRemoveThenRemoveAll to cover
RemoveProviders followed by RemoveAllProviders before queued cleanup
runs.
Fixes a Client Hints metadata leak on HTTP redirects of
renderer-initiated subresource requests.
On redirect, CEF restarts the request through the URLLoaderFactory
(InterceptedRequest::FollowRedirect -> Restart ->
ContinueToBeforeRedirect) instead of following it on the existing
loader. Stock Chromium's in-place path calls
network::MaybeRemoveSecHeaders in URLLoader::FollowRedirect, which
strips sec-ch-* (and sec-fetch-*) prefixed headers when the redirect
goes from a potentially trustworthy URL to an untrustworthy one, so
that Client Hints attached on the prior hop are not disclosed to a
destination that would never have received them directly. CEF's
restart path skipped that step and re-submitted the carried-over
Sec-CH-* headers.
The fix strips the Sec-CH- header family by prefix before the restart,
conditional on the same trustworthiness downgrade check
(network::IsUrlPotentiallyTrustworthy). Unlike Sec-Fetch-* (see #4190),
Sec-CH-* headers are not re-derived downstream, so they must be
preserved on all other redirects.
Two redirect shapes bypass CEF's restart path entirely and behave
identically in stock Chromium (out of scope here): redirects out of the
network service's URL space (e.g. to a custom scheme), which the
renderer re-issues itself via
ThrottlingURLLoader::FollowRedirectForcingRestart with blink-level
headers; and mode "cors" requests whose CORS flag flips on redirect,
which CorsURLLoader::StartRequest re-issues from its own header copy.
Adds CorsTest.ScriptRedirectSubresourceSecHeaders* regression tests
covering the same-trust, cross-origin-trustworthy and downgrade cases,
asserting Sec-CH-*/Sec-Fetch-* presence on both the redirecting hop and
the target.
Fixes a network-service / renderer process kill on HTTP redirects of
renderer-initiated subresource requests.
On redirect, CEF restarts the request through the URLLoaderFactory
(InterceptedRequest::FollowRedirect -> Restart ->
ContinueToBeforeRedirect) instead of following it on the existing
loader. The restart re-submits the network-service-managed Sec-Fetch-*
headers that were populated on the prior hop. With
kRestrictForbiddenSecurityHeaders now enabled by default in Chromium,
CorsURLLoaderFactory::IsValidRequest ->
ContainsForbiddenSecurityHeader rejects those renderer-forbidden headers
via mojo::ReportBadMessage, tearing down the network service.
Only renderer-initiated subresources (fetch/XHR/img/script) trigger
this; browser-initiated top-level navigations skip the check, which is
why a top-level redirect doesn't reproduce it.
The fix strips the Sec-Fetch- header family by prefix (mirroring
Chromium's own network::MaybeRemoveSecHeaders) from remove_headers
before the restart, so new members like Sec-Fetch-Frame-Top /
Sec-Fetch-Frame-Ancestors are covered without maintaining an explicit
list. URLLoader re-derives them downstream (SetFetchMetadataHeaders), so
this is lossless and mirrors CorsURLLoader's normal redirect path.
Adds CorsTest.XhrRedirectSubresource and
CorsTest.FetchRedirectSubresource regression tests.
Unified system modules require a sysroot path. Disable when not using
a sysroot to avoid empty path errors in //build/modules/BUILD.gn.
Enabled on Linux by default after https://crrev.com/1da08484a2c35
After https://crrev.com/d5706ff4b1f47 the cxx tool in
//build/toolchain/win/toolchain.gni now unconditionally passes
-fmodule-name to every C++ compilation. On Windows, precompiled
headers work by compiling build/precompile.cc with the /Yc flag.
The combination of -fmodule-name + /Yc in C++23 mode causes LLVM
23's clang-cl to treat precompile.cc as a C++20 module interface
unit, which then fails because the file has no export module
declaration.
This is a no-op for Mac, Linux and Official Windows builds where
precompiled headers are already effectively disabled by default.
Extract contribution guidelines from README.md into a standalone
CONTRIBUTING.md so GitHub surfaces them when opening PRs and issues.
Add AI_POLICY.md declaring permissive-but-accountable rules for AI tool
usage in contributions. Trim the README "Helping Out" section to a short
summary pointing to CONTRIBUTING.md.
In CEF dcheck_always_on=true builds on Windows, the network process
crashes with reentrant malloc on first allocation. Outer trigger:
CheckedLockImpl::Acquire (DCHECK-only) allocates on PostTask -> enters
PartitionAlloc -> ThreadCache::Get; on this path the `static
thread_local MetricsSubSampler g_shared_subsampler` (added by
https://crrev.com/c/6202281) is constructed, and its ctor seeds
InsecureRandomGenerator via base::RandUint64() -> BoringSSL RAND_bytes
-> OPENSSL_malloc, tripping ScopedDisallowAllocations.
Defer seeding to the first RandUint64() call. (0, 0) is XorShift128+'s
unique fixed point, so it doubles as the unseeded sentinel without a
flag (no size change). ReseedForTesting(0) now CHECKs; no caller
passes 0. Tactical fix: any other dynamic-init thread_local in
libcef.dll whose ctor allocates could crash similarly in DCHECK
builds.
Marshall Greenblatt