Before this change, an isolated world (e.g. extension content script,
but also others) could dynamically import a script from an accessible
resource (for extensions this is possible with web accessible
resources and a matching site). When this occurs a web service worker
could intercept that request and respond with arbitrary content.

After this change, isolated world module requests skip triggering the
worker fetch handler. This includes extension content scripts, but also
includes any other scripts that execute in the isolated world context.

(cherry picked from commit 2c501634)

Bug: 371011220
Change-Id: I37eda47324b6933a93d2a44792a06ff91399981f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5917013
Auto-Submit: Justin Lulejian <jlulejian@chromium.org>
Commit-Queue: Justin Lulejian <jlulejian@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1365918}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5962436


Commit-Queue: Dan Clark <daniec@microsoft.com>
Auto-Submit: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Reviewed-by: Dan Clark <daniec@microsoft.com>
Reviewed-by: Justin Lulejian <jlulejian@chromium.org>
Reviewed-by: Mohamed Omar <mohamedaomar@google.com>
Owners-Override: Mohamed Omar <mohamedaomar@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1991}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

This CL adds `ScopedDisallowPictureInPicture`, which can be used to
close any existing picture-in-picture windows and prevent new ones from
opening. This is used in the `FileSelectHelper` to prevent
picture-in-picture windows from occluding file dialogs.

(cherry picked from commit 47617c1e)

Bug: 40076120
Change-Id: I5b8eb02003370cf14d5968a39f62a13e925b112a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5753110


Commit-Queue: Tommy Steimel <steimel@chromium.org>
Reviewed-by: Frank Liberato <liberato@chromium.org>
Reviewed-by: Evan Liu <evliu@google.com>
Reviewed-by: Scott Violet <sky@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1351716}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5981649


Commit-Queue: Mohamed Omar <mohamedaomar@google.com>
Owners-Override: Mohamed Omar <mohamedaomar@google.com>
Reviewed-by: Mohamed Omar <mohamedaomar@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1990}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/third_party/dawn in M126 from c9815acd5a88 to 1eaa73d0f73a
Commits rolled:
https://dawn.googlesource.com/dawn.git/+log/c9815acd5a88..1eaa73d0f73a

Generated by: http://go/bbid/8732466706623023809

Change-Id: Ia9917e8c2703d6d9ad9147235190accdfd0a6706
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5984616
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1989}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/v8 in M126 from 759df2cbac96 to f45d9551fce9
Commits rolled:
https://chromium.googlesource.com/v8/v8.git/+log/759df2cbac96..f45d9551fce9

Generated by: http://go/bbid/8732819659080506673

Change-Id: Ic3e485a9ecca1c810981b6bec00e83589c70f3ec
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5970524
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1988}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/v8 in M126 from 3cd9e256385b to 759df2cbac96
Commits rolled:
https://chromium.googlesource.com/v8/v8.git/+log/3cd9e256385b..759df2cbac96

Generated by: http://go/bbid/8733183933844302417

Change-Id: I9a7a9e4324cb1d7b735f05ff47a642abb90764dd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5962636
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1987}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Uploaded by https://ci.chromium.org/b/8733340375939500241

Change-Id: I010ce569bb0644d40bc2f026c3f9091a66782892
CrOS-LKGM: 15886.81.0
Cr-Original-Build-Id: 8733340375939500241
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5953638
Bot-Commit: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Commit-Queue: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1986}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Change-Id: Ia96bf9522438a453d0129f7d3844d22ad6da3592
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5952870
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1985}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/v8 in M126 from c36b4f9856f7 to 3cd9e256385b
Commits rolled:
https://chromium.googlesource.com/v8/v8.git/+log/c36b4f9856f7..3cd9e256385b

Generated by: http://go/bbid/8733744502329200465

Change-Id: I9841672404db332759e70f2baccc191cabd2cc13
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5942674
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1984}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

(cherry picked from commit c333ed99)

Fixed: 368208152
Change-Id: I0e2ece4b0857b225d229134b2e55abc3e08348ee
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5876623


Commit-Queue: Ken Rockot <rockot@google.com>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1358968}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5901253


Owners-Override: Artem Sumaneev <asumaneev@google.com>
Reviewed-by: Artem Sumaneev <asumaneev@google.com>
Commit-Queue: Gyuyoung Kim (xWF) <qkim@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1983}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Uploaded by https://ci.chromium.org/b/8734410844625026161

Change-Id: I10defb98d5bfcf30faa180b9919ff2aeaa69dac7
CrOS-LKGM: 15886.80.0
Cr-Original-Build-Id: 8734410844625026161
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5925498
Commit-Queue: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Bot-Commit: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1982}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Change-Id: I17d22a61e929ec040969b696d42faee41918453c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5921029
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1981}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/v8 in M126 from e4d80ab56762 to c36b4f9856f7
Commits rolled:
https://chromium.googlesource.com/v8/v8.git/+log/e4d80ab56762..c36b4f9856f7

Generated by: http://go/bbid/8734478715662874657

Change-Id: I15d89e64724c2a0b7a35c0ca9b02c349a9c8c35f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5923433
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1980}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/third_party/angle in M126 from efca5c3874f3 to 1eb6afe32f70
Commits rolled:
https://chromium.googlesource.com/angle/angle.git/+log/efca5c3874f3..1eb6afe32f70

Generated by: http://go/bbid/8734624045953429361

Change-Id: I4c67edc133f75ac4d8c67d76dfeeb5eb11da7a99
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5916946
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1979}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/internal in M126 from 826068a89d28 to 13a6bad1a34c
Commits rolled:
https://chrome-internal.googlesource.com/chrome/src-internal.git/+log/826068a89d28..13a6bad1a34c

Generated by: http://go/bbid/8734971336901250241

Change-Id: I4b503f48fc586a97d1b9570b0c84c47d6d1fbfe2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5909252
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1978}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

As agreed with Fleet, we will remove all DUTs on chrome pool, and switch
internal testing to chromeos pool.

The changes have been landed in trunk in August but branched builders
also need such changes so we can remove DUTs as early as possible.

This CL does a spiritual cherry-pick [1] of
https://chromium-review.googlesource.com/c/chromium/src/+/5802735
https://chromium-review.googlesource.com/c/chromium/src/+/5803388
https://chromium-review.googlesource.com/c/chromium/src/+/5837958

[1] Some files are moved between m126 and trunk, spiritual cherry-picks
ensures minimum changes to m126.

Bug: b/370411570
Change-Id: Ibafa74229746b31a1f5cdb0af36b33179f96ebef
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5903237


Reviewed-by: Yoshiki Iguchi <yoshiki@chromium.org>
Reviewed-by: Takuto Ikuta <tikuta@chromium.org>
Commit-Queue: Qijiang Fan <fqj@chromium.org>
Cr-Commit-Position: refs/branch-heads/6478@{#1977}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/v8 in M126 from 6f67c44a3ccb to e4d80ab56762
Commits rolled:
https://chromium.googlesource.com/v8/v8.git/+log/6f67c44a3ccb..e4d80ab56762

Generated by: http://go/bbid/8735307300054348849

Change-Id: I7547acf79e6afc6b894f3d805633650bf6edab5a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5899002
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1976}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/v8 in M126 from efaa0ffbcd1e to 6f67c44a3ccb
Commits rolled:
https://chromium.googlesource.com/v8/v8.git/+log/efaa0ffbcd1e..6f67c44a3ccb

Generated by: http://go/bbid/8735316737514517521

Change-Id: I3f7117fac0a50932ee07f51df6a68b3cbe8156a4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5901259
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1975}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

ParsePseudoType crashes on ASAN when given non-ASCII characters,
so returning early if those are present.

(cherry picked from commit f50b84cf)

Bug: 350779647
Change-Id: Ic77351a1c95437a226dce66c7826b7b8481b8d91
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5686295


Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1346768}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5872266


Owners-Override: Victor Gabriel Savu <vsavu@google.com>
Reviewed-by: Victor Gabriel Savu <vsavu@google.com>
Commit-Queue: Gyuyoung Kim (xWF) <qkim@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1974}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/third_party/skia in M126 from b5bb998be272 to 234e3d4b37e9
Commits rolled:
https://skia.googlesource.com/skia.git/+log/b5bb998be272..234e3d4b37e9

Generated by: http://go/bbid/8735360149256442257

Change-Id: Icb358661f164c8c1c5f2a60aa4beeb33e84a1f1e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5898485
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1973}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Uploaded by https://ci.chromium.org/b/8735679546801912241

Change-Id: Iebade4122b1905771725952a6758518151da225a
CrOS-LKGM: 15886.79.0
Cr-Original-Build-Id: 8735679546801912241
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5896133
Commit-Queue: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Bot-Commit: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1972}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Change-Id: I27dc004ec92491f697bd964d5ba61875c6c2df6c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5893460
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1971}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/internal in M126 from 33b7ac433b8c to 826068a89d28
Commits rolled:
https://chrome-internal.googlesource.com/chrome/src-internal.git/+log/33b7ac433b8c..826068a89d28

Generated by: http://go/bbid/8735882968219954913

Change-Id: I5521d31a9167b04a393c51bd2be88c1c7e968a3c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5888008
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1970}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Uploaded by https://ci.chromium.org/b/8736423114990160033

Change-Id: Ieed59a90a14b61c669dd92799046012494fd138b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5873429
Commit-Queue: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Bot-Commit: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1969}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Change-Id: Ibbfd19aaed46d04e1b0c4c7d34592c237d92c380
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5874780
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1968}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/internal in M126 from cbc9e894790c to 33b7ac433b8c
Commits rolled:
https://chrome-internal.googlesource.com/chrome/src-internal.git/+log/cbc9e894790c..33b7ac433b8c

Generated by: http://go/bbid/8736426550229318129

Change-Id: I948384f01c18bd4f658d3cee1e4e7ee59c7f9021
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5874441
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1967}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

M126 is only being pushed for CrOS LTS at this point.

Change-Id: I9788fa3047e2c3b317afd2f44c5fcb49cb1a5071
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5873994


Reviewed-by: Erik Staab <estaab@chromium.org>
Commit-Queue: Garrett Beaty <gbeaty@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1966}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

(cherry picked from commit 3db62259)

Fixed: b:348445406
Change-Id: I5346f7e6a89d54403ca8a80c6b967238b9a0f04b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5735615
Auto-Submit: Daniel Murphy <dmurph@chromium.org>
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1331905}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5807208


Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
Cr-Commit-Position: refs/branch-heads/6478@{#1965}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Theoretically `ThrottlingURLLoader` can be deleted during
throttle calls and some call sites have already protection
for such cases. This CL adds the protection for more call sites.

This CL also adds more unit tests for cancelling/deleting
`ThrottlingURLLoader` during throttle calls.

(cherry picked from commit c40f8866)

Bug: 349342289
Change-Id: I80d64be9ba1a3ac920315f5b4012b29c9737e414
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5665925
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1323986}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5845051


Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Reviewed-by: Giovanni Pezzino <giovax@google.com>
Commit-Queue: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1964}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/third_party/skia in M126 from 8618b9f741ce to b5bb998be272
Commits rolled:
https://skia.googlesource.com/skia.git/+log/8618b9f741ce..b5bb998be272

Generated by: http://go/bbid/8736520921494854881

Change-Id: Id1ea1f05f7aafbe58ad9e957fcb49a6cef03596d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5870057
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1963}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

This CL fixes non-deterministic (racy) data change on
AudioParamHandler::automation_rate_. It also revises incorrect logic
in the DelayHandler's process function; the process function
needs to process all the channels in the delay kernel in the same
rate. However, the previous code allowed the automation rate to
change any time even in the middle of processing.

This fix is locally confirmed with the provided repro case,
and also a test was added to verify other related API surfaces.

(cherry picked from commit ec85a32b)

Bug: 357391257
Change-Id: I7ce953837edd818e435e3a1b917f6b3c6147d95b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5767447
Commit-Queue: Hongchan Choi <hongchan@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1345091}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5854511


Reviewed-by: Giovanni Pezzino <giovax@google.com>
Reviewed-by: Hongchan Choi <hongchan@chromium.org>
Reviewed-by: Michael Wilson <mjwilson@chromium.org>
Commit-Queue: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1962}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

(cherry picked from commit 19fac6ad)

Bug: 339654392
Change-Id: I97c105276c4442d80b9f506d0ae111aa13837f31
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5721458


Reviewed-by: Yi Gu <yigu@chromium.org>
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1331313}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5849128


Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Owners-Override: Artem Sumaneev <asumaneev@google.com>
Commit-Queue: Gyuyoung Kim (xWF) <qkim@google.com>
Reviewed-by: Artem Sumaneev <asumaneev@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1961}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

This is a reland of commit ba40b993

The original change failed on mac11-arm64-rel and reverted at
crrev.com/c/5776005. This is because the unit tests assumed
that the `SECURITY_DCHECK` is always enabled, but it's
actually enabled only for DCHECK-enabled builds.

This patch fixes it by wrapping the unit tests by `#if`.

Original change's description:
> Fix `StringView` to crash when `offset + length` overflows
>
> This patch fixes `SECURITY_DCHECK` in `StringView` for when
> `offset + length` overflows the `unsigned`.
>
> Bug: 357622693, 355731798
> Change-Id: I5a7a7979192fe132496661b1272c5902cdbdb09a
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5775486
> Auto-Submit: Koji Ishii <kojii@chromium.org>
> Commit-Queue: Kent Tamura <tkent@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1340005}

(cherry picked from commit 5fe8d131)

Bug: 357622693, 355731798
Change-Id: I5402234a5fe54bf8dec2c986ab0ab388e1bc783d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5782718
Commit-Queue: Koji Ishii <kojii@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1340817}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5807454


Auto-Submit: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Fahad Mansoor <fahadmansoor@google.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/branch-heads/6478@{#1960}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

crrev.com/c/5776342 fixed a range `CHECK` in
`CollectFallbackHintChars`, but depends on the CSS and font
configurations, it's possible that the code doesn't go to
`CollectFallbackHintChars` and the following code may hit
the same issue.

This patch adds another `CHECK` for the case.

(cherry picked from commit ef6f7b45)

Bug: 355731798, 357622693
Change-Id: Ieb4ada7699c80564e8a4b866cb6a6ffbc665ebc7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5776204
Commit-Queue: Kent Tamura <tkent@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1340006}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5806849


Auto-Submit: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Fahad Mansoor <fahadmansoor@google.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/branch-heads/6478@{#1959}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

This patch fixes a `CHECK` for a range of a string when
`offset + length` overflows the `unsigned`.

(cherry picked from commit 59c286e8)

Bug: 355731798
Change-Id: If04222f10f2b73b6dcd6b412cf4d82fa5b71bbe2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5776342
Commit-Queue: Kent Tamura <tkent@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1339526}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5804713


Reviewed-by: Koji Ishii <kojii@chromium.org>
Reviewed-by: Fahad Mansoor <fahadmansoor@google.com>
Auto-Submit: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1958}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

All other methods that use Path2D use path2d_use_paint_cache_ except
for clip() which was always enabled. This could allow for situations
where a DCHECK was triggered in the paint op buffer. See attached
bug.

(cherry picked from commit 2658f941)

Bug: 349903568
Change-Id: I179037bdd15d474cb2ef182e041f2b47b0ee868c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5716900
Commit-Queue: Aaron Krajeski <aaronhk@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1329058}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5834804


Reviewed-by: Fernando Serboncini <fserb@chromium.org>
Owners-Override: Artem Sumaneev <asumaneev@google.com>
Auto-Submit: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Reviewed-by: Artem Sumaneev <asumaneev@google.com>
Reviewed-by: Yi Xu <yiyix@chromium.org>
Commit-Queue: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1957}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

This CL avoid use-after-free around
`EmbeddedWorkerInstance::ReleaseProcess()`:

1. During `ReleaseProcess()`:
This CL protects `ServiceWorkerVersion` and its
`EmbeddedWorkerInstance` from deletion.

2. In the direct callers of `ReleaseProcess()`:
This CL early returns if `this` is deleted during `ReleaseProcess()`.
Skipping `listener_list_` should be fine because `listener_list_`
is the `owner_version_` (at least in non-test) that is already
deleted if `this` is deleted.
This CL also adds explicit comments that the methods calling
`ReleaseProcess()` may delete `this`.

3. In the callers of 2.:
As far as I checked, the callers should work even in the case of
deletion of `ServiceWorkerVersion`.

(cherry picked from commit 76ce1fe9)

Bug: 350407902
Change-Id: If59e8354ae9832009b62408a8f0058cb6f6e803f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5685760


Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1324689}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5806117


Auto-Submit: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Shunya Shishido <sisidovski@chromium.org>
Commit-Queue: Roger Felipe Zanoni da Silva (xWF) <rzanoni@google.com>
Owners-Override: Artem Sumaneev <asumaneev@google.com>
Reviewed-by: Artem Sumaneev <asumaneev@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1956}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Roll src/third_party/skia in M126 from be621ea04206 to 8618b9f741ce
Commits rolled:
https://skia.googlesource.com/skia.git/+log/be621ea04206..8618b9f741ce

Generated by: http://go/bbid/8737079603465219137

Change-Id: If940b0ddbcd84715931aaf7834994b49f88ad995
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5854939
Bot-Commit: Chrome Release Bot (LUCI) <chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1955}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

For managed guest session (MSG), as long as the policy permits, user
should be able to update the timezone settings. Instead of using the
function `IsGuestModeActive` to determine whether or not to disable
timezone settings, using  `CanSetSystemTimezone`.

Screenshots:
- Before fix:
    https://screenshot.googleplex.com/B6HfGfrgkQqGkfo

- After fix:
    https://screenshot.googleplex.com/ApQPDZYC77GZf24
    https://screencast.googleplex.com/cast/NTM1NTQ5ODQxNjExMTYxNnxkMmNkMzhiOC1lYQ


(cherry picked from commit 045f2e90)

Bug: b/349819718
Change-Id: I695818ac4465fd925d0e6340862a21d567267bd6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5709714


Reviewed-by: Wes Okuhara <wesokuhara@google.com>
Commit-Queue: Connie Xu <conniekxu@chromium.org>
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1328518}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5838136
Cr-Commit-Position: refs/branch-heads/6478@{#1954}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Partial Merge: Fails on M126 linux-chromeos-rel as well

The test DynamicColorSystemWebAppBrowserTest.Colors runs only on
ChromeOS so there is no need for an extra guard.

(cherry picked from commit 60f165cb)

Bug: 364148340
Change-Id: Ieb401e9df4f304e584e3bc2d66c7aa14bb2e4ae0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5829010


Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Auto-Submit: Jiacheng Guo <gjc@google.com>
Owners-Override: Jiacheng Guo <gjc@google.com>
Commit-Queue: Jiacheng Guo <gjc@google.com>
Cr-Original-Commit-Position: refs/heads/main@{#1350010}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5836167


Commit-Queue: Robert Liao <robliao@chromium.org>
Auto-Submit: Robert Liao <robliao@chromium.org>
Commit-Queue: Osama Fathy <osamafathy@google.com>
Reviewed-by: Osama Fathy <osamafathy@google.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1953}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}

Uploaded by https://ci.chromium.org/b/8737682121726242353

Change-Id: Ie97230a48fc0a219a256eb22aa6343da19e1b64e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5838913
Bot-Commit: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Commit-Queue: ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6478@{#1952}
Cr-Branched-From: e6143acc-refs/heads/main@{#1300313}