Skip to content

Commit

Permalink
chore: update patches
Browse files Browse the repository at this point in the history
  • Loading branch information
patchup[bot] authored and VerteDinde committed May 18, 2023
1 parent 70b78c6 commit 21ea816
Show file tree
Hide file tree
Showing 8 changed files with 78 additions and 427 deletions.
24 changes: 13 additions & 11 deletions patches/chromium/cherry-pick-48785f698b1c.patch
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
From 48785f698b1cefcd0cf265001cd36a564abacf07 Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arthur Sonzogni <arthursonzogni@chromium.org>
Date: Tue, 02 May 2023 09:40:37 +0000
Subject: [PATCH] Avoid buffer overflow read in HFSReadNextNonIgnorableCodePoint
Date: Tue, 2 May 2023 09:40:37 +0000
Subject: Avoid buffer overflow read in HFSReadNextNonIgnorableCodePoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unicode codepoints goes beyond 0xFFFF.

Expand All @@ -19,13 +22,12 @@ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4481260
Reviewed-by: Alexander Timin <altimin@chromium.org>
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1138234}
---

diff --git a/base/files/file_path.cc b/base/files/file_path.cc
index 12c684b..59bbc6e 100644
index 12c684bed273721bb5b36f5441ed833485a1fe15..59bbc6e15da4b6cb531003fa6ec1fb197f985447 100644
--- a/base/files/file_path.cc
+++ b/base/files/file_path.cc
@@ -789,7 +789,7 @@
@@ -789,7 +789,7 @@ int FilePath::CompareIgnoreCase(StringPieceType string1,
#elif BUILDFLAG(IS_APPLE)
// Mac OS X specific implementation of file string comparisons.

Expand All @@ -34,7 +36,7 @@ index 12c684b..59bbc6e 100644
//
// "When using CreateTextEncoding to create a text encoding, you should set
// the TextEncodingBase to kTextEncodingUnicodeV2_0, set the
@@ -815,11 +815,12 @@
@@ -815,11 +815,12 @@ int FilePath::CompareIgnoreCase(StringPieceType string1,
// Ignored characters are mapped to zero.
//
// cf. downloadable file linked in
Expand All @@ -49,7 +51,7 @@ index 12c684b..59bbc6e 100644
// High-byte indices ( == 0 iff no case mapping and no ignorables )

/* 0 */ 0x0100, 0x0200, 0x0000, 0x0300, 0x0400, 0x0500, 0x0000, 0x0000,
@@ -1205,11 +1206,12 @@
@@ -1205,11 +1206,12 @@ const UInt16 lower_case_table[] = {
/* F */ 0xFFF0, 0xFFF1, 0xFFF2, 0xFFF3, 0xFFF4, 0xFFF5, 0xFFF6, 0xFFF7,
0xFFF8, 0xFFF9, 0xFFFA, 0xFFFB, 0xFFFC, 0xFFFD, 0xFFFE, 0xFFFF,
};
Expand All @@ -66,7 +68,7 @@ index 12c684b..59bbc6e 100644
inline base_icu::UChar32 HFSReadNextNonIgnorableCodepoint(const char* string,
size_t length,
size_t* index) {
@@ -1220,12 +1222,16 @@
@@ -1220,12 +1222,16 @@ inline base_icu::UChar32 HFSReadNextNonIgnorableCodepoint(const char* string,
CBU8_NEXT(reinterpret_cast<const uint8_t*>(string), *index, length,
codepoint);
DCHECK_GT(codepoint, 0);
Expand All @@ -86,10 +88,10 @@ index 12c684b..59bbc6e 100644
}
}
diff --git a/base/files/file_path_unittest.cc b/base/files/file_path_unittest.cc
index 7b30b15..9673a48 100644
index 7b30b15b87f1349c85e5c2e36c6a8d96873d7567..9673a48bc30274e579a8ec454c1f97a2a48eb70a 100644
--- a/base/files/file_path_unittest.cc
+++ b/base/files/file_path_unittest.cc
@@ -1203,6 +1203,13 @@
@@ -1203,6 +1203,13 @@ TEST_F(FilePathTest, CompareIgnoreCase) {
{{FPL("K\u0301U\u032DO\u0304\u0301N"), FPL("\u1E31\u1E77\u1E53n")}, 0},
{{FPL("k\u0301u\u032Do\u0304\u0301n"), FPL("\u1E30\u1E76\u1E52n")}, 0},
{{FPL("k\u0301u\u032Do\u0304\u0302n"), FPL("\u1E30\u1E76\u1E52n")}, 1},
Expand Down
14 changes: 7 additions & 7 deletions patches/chromium/cherry-pick-675562695049.patch
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
From 6755626950491fac28d6631b19e16a5733435070 Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Rakina Zata Amni <rakina@chromium.org>
Date: Mon, 15 May 2023 03:21:49 +0000
Subject: [PATCH] [M114] Return after ReadyCommitNavigation call in CommitErrorPage if it deletes NavigationRequest
Subject: Return after ReadyCommitNavigation call in CommitErrorPage if it
deletes NavigationRequest

NavigationRequest::ReadyToCommitNavigation() can cause deletion of the
NavigationRequest, so callers should check for that possibility after
Expand All @@ -23,13 +24,12 @@ Commit-Queue: Prudhvikumar Bommana <pbommana@google.com>
Owners-Override: Prudhvikumar Bommana <pbommana@google.com>
Cr-Commit-Position: refs/branch-heads/5735@{#607}
Cr-Branched-From: 2f562e4ddbaf79a3f3cb338b4d1bd4398d49eb67-refs/heads/main@{#1135570}
---

diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
index c7cc3b84..a2530d4 100644
index d0f07ecdc9fae8d7c38a34ef071b79b97c080e5b..40c2dd985007a4b4b408814391834eec6e3bc123 100644
--- a/content/browser/renderer_host/navigation_request.cc
+++ b/content/browser/renderer_host/navigation_request.cc
@@ -5453,7 +5453,13 @@
@@ -5453,7 +5453,13 @@ void NavigationRequest::CommitErrorPage(
topics_eligible_ = false;
}

Expand All @@ -44,7 +44,7 @@ index c7cc3b84..a2530d4 100644
PopulateDocumentTokenForCrossDocumentNavigation();
// Use a separate cache shard, and no cookies, for error pages.
diff --git a/content/browser/renderer_host/navigation_request_browsertest.cc b/content/browser/renderer_host/navigation_request_browsertest.cc
index f55e3f4..58f3526 100644
index f55e3f4f96181d92ad768e431a4844ae774a7c9e..58f3526fe0a60b499fd06943b0577a52210338fb 100644
--- a/content/browser/renderer_host/navigation_request_browsertest.cc
+++ b/content/browser/renderer_host/navigation_request_browsertest.cc
@@ -46,6 +46,7 @@
Expand All @@ -55,7 +55,7 @@ index f55e3f4..58f3526 100644
#include "content/public/test/test_utils.h"
#include "content/public/test/url_loader_interceptor.h"
#include "content/shell/browser/shell.h"
@@ -4384,4 +4385,84 @@
@@ -4384,4 +4385,84 @@ IN_PROC_BROWSER_TEST_P(NavigationRequestMPArchBrowserTest,
}
}

Expand Down
37 changes: 18 additions & 19 deletions patches/chromium/cherry-pick-9b6ca211234b.patch
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
From 9b6ca211234b057a9ce4184a3315741dc040ecbf Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Kevin McNee <mcnee@chromium.org>
Date: Fri, 12 May 2023 19:53:19 +0000
Subject: [PATCH] M114: Store BrowserPluginGuestDelegate as a weak ptr
Subject: M114: Store BrowserPluginGuestDelegate as a weak ptr

Store BrowserPluginGuestDelegate as a weak ptr

Expand All @@ -28,10 +28,9 @@ Auto-Submit: Kevin McNee <mcnee@chromium.org>
Commit-Queue: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/branch-heads/5735@{#540}
Cr-Branched-From: 2f562e4ddbaf79a3f3cb338b4d1bd4398d49eb67-refs/heads/main@{#1135570}
---

diff --git a/chrome/browser/apps/guest_view/web_view_browsertest.cc b/chrome/browser/apps/guest_view/web_view_browsertest.cc
index 7cd25c75..014e41d1 100644
index 7cd25c756975cc073b9c2211f98ac1f483b5d8de..014e41d120ad17f54d89d1dd74f70b8b51ae8445 100644
--- a/chrome/browser/apps/guest_view/web_view_browsertest.cc
+++ b/chrome/browser/apps/guest_view/web_view_browsertest.cc
@@ -48,6 +48,7 @@
Expand All @@ -42,7 +41,7 @@ index 7cd25c75..014e41d1 100644
#include "chrome/test/base/ui_test_utils.h"
#include "components/download/public/common/download_task_runner.h"
#include "components/find_in_page/find_tab_helper.h"
@@ -5554,6 +5555,63 @@
@@ -5554,6 +5555,63 @@ IN_PROC_BROWSER_TEST_F(WebViewTest, LoadDisallowedExtensionURLInSubframe) {
entry->metrics.begin()->second);
}

Expand Down Expand Up @@ -107,10 +106,10 @@ index 7cd25c75..014e41d1 100644
TestHelper("testInsertIntoDetachedIframe", "web_view/shim",
NEEDS_TEST_SERVER);
diff --git a/components/guest_view/browser/guest_view_base.cc b/components/guest_view/browser/guest_view_base.cc
index 4ef55d1c..ba2fac2 100644
index 4ef55d1c5e49a23240916c891f84f142a42a9160..ba2fac244ddbbabfd36cd3f4e0f39e29994fc86b 100644
--- a/components/guest_view/browser/guest_view_base.cc
+++ b/components/guest_view/browser/guest_view_base.cc
@@ -124,6 +124,9 @@
@@ -124,6 +124,9 @@ class GuestViewBase::OpenerLifetimeObserver : public WebContentsObserver {
void WebContentsDestroyed() override {
// If the opener is destroyed and the guest has not been attached, then
// destroy the guest.
Expand All @@ -120,7 +119,7 @@ index 4ef55d1c..ba2fac2 100644
// Destroys `this`.
DestroyGuestIfUnattached(guest_);
}
@@ -915,4 +918,9 @@
@@ -915,4 +918,9 @@ content::RenderFrameHost* GuestViewBase::GetGuestMainFrame() const {
return web_contents()->GetPrimaryMainFrame();
}

Expand All @@ -131,10 +130,10 @@ index 4ef55d1c..ba2fac2 100644
+
} // namespace guest_view
diff --git a/components/guest_view/browser/guest_view_base.h b/components/guest_view/browser/guest_view_base.h
index dccb7fcf..a15c73f 100644
index dccb7fcf6e21260081f4c4a32878faf5ed482de8..a15c73fb116586bfd578d562d3164b38d290ee41 100644
--- a/components/guest_view/browser/guest_view_base.h
+++ b/components/guest_view/browser/guest_view_base.h
@@ -353,6 +353,8 @@
@@ -353,6 +353,8 @@ class GuestViewBase : public content::BrowserPluginGuestDelegate,
std::unique_ptr<content::WebContents> CreateNewGuestWindow(
const content::WebContents::CreateParams& create_params) final;
content::WebContents* GetOwnerWebContents() final;
Expand All @@ -144,10 +143,10 @@ index dccb7fcf..a15c73f 100644
// WebContentsDelegate implementation.
void ActivateContents(content::WebContents* contents) final;
diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index a7501a5..2e47c12 100644
index a7501a57c5149448c0fa467af9f8ba1f4d0ccc90..2e47c128f4d5c0fa2f22f98340f2ba1863d36fad 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -25,9 +25,10 @@
@@ -25,9 +25,10 @@ namespace content {

BrowserPluginGuest::BrowserPluginGuest(WebContentsImpl* web_contents,
BrowserPluginGuestDelegate* delegate)
Expand All @@ -161,7 +160,7 @@ index a7501a5..2e47c12 100644
RecordAction(base::UserMetricsAction("BrowserPlugin.Guest.Create"));
}

@@ -97,6 +98,11 @@
@@ -97,6 +98,11 @@ WebContentsImpl* BrowserPluginGuest::GetWebContents() const {
}

RenderFrameHostImpl* BrowserPluginGuest::GetProspectiveOuterDocument() {
Expand All @@ -174,7 +173,7 @@ index a7501a5..2e47c12 100644
delegate_->GetProspectiveOuterDocument());
}
diff --git a/content/browser/browser_plugin/browser_plugin_guest.h b/content/browser/browser_plugin/browser_plugin_guest.h
index 17e98b6..7f308302 100644
index 17e98b60e8f7e5066cdbe115adcdd813cc581403..7f3083029d45e7a0d45b989a07013709a7be2f1d 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.h
+++ b/content/browser/browser_plugin/browser_plugin_guest.h
@@ -7,7 +7,7 @@
Expand All @@ -186,7 +185,7 @@ index 17e98b6..7f308302 100644
#include "build/build_config.h"
#include "content/public/browser/browser_plugin_guest_delegate.h"
#include "content/public/browser/web_contents_observer.h"
@@ -78,7 +78,8 @@
@@ -78,7 +78,8 @@ class BrowserPluginGuest : public WebContentsObserver {

void InitInternal(WebContentsImpl* owner_web_contents);

Expand All @@ -197,10 +196,10 @@ index 17e98b6..7f308302 100644

} // namespace content
diff --git a/content/public/browser/browser_plugin_guest_delegate.cc b/content/public/browser/browser_plugin_guest_delegate.cc
index 62cbad1..040d36a 100644
index 62cbad1500229efeba44e467778e3fdfaf1f4ace..040d36ae694412f06243581984d048a877cfd59b 100644
--- a/content/public/browser/browser_plugin_guest_delegate.cc
+++ b/content/public/browser/browser_plugin_guest_delegate.cc
@@ -20,4 +20,10 @@
@@ -20,4 +20,10 @@ RenderFrameHost* BrowserPluginGuestDelegate::GetProspectiveOuterDocument() {
return nullptr;
}

Expand All @@ -212,7 +211,7 @@ index 62cbad1..040d36a 100644
+
} // namespace content
diff --git a/content/public/browser/browser_plugin_guest_delegate.h b/content/public/browser/browser_plugin_guest_delegate.h
index 51a4efa8..d588b4d3 100644
index 51a4efa8163208a5cf9468c8ba72afa89fe79e5d..d588b4d39933b8cada1007699f5cc8e4b1e3e505 100644
--- a/content/public/browser/browser_plugin_guest_delegate.h
+++ b/content/public/browser/browser_plugin_guest_delegate.h
@@ -5,6 +5,7 @@
Expand All @@ -223,7 +222,7 @@ index 51a4efa8..d588b4d3 100644
#include "content/common/content_export.h"
#include "content/public/browser/web_contents.h"

@@ -28,6 +29,8 @@
@@ -28,6 +29,8 @@ class CONTENT_EXPORT BrowserPluginGuestDelegate {
// TODO(crbug.com/769461): Have all guest types return the specific owner
// RenderFrameHost and not assume it's the owner's main frame.
virtual RenderFrameHost* GetProspectiveOuterDocument();
Expand Down
20 changes: 11 additions & 9 deletions patches/chromium/cherry-pick-d6272b794cbb.patch
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
From d6272b794cbbb146303c3acb48713244a92cce48 Mon Sep 17 00:00:00 2001
From: Simon Zünd <szuend@chromium.org>
Date: Tue, 02 May 2023 06:05:35 +0000
Subject: [PATCH] [devtools] Delete PendingRequest first in DevToolsDataSource
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20Z=C3=BCnd?= <szuend@chromium.org>
Date: Tue, 2 May 2023 06:05:35 +0000
Subject: Delete PendingRequest first in DevToolsDataSource
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The way URLDataSources are used in Chromium, it can happen that the
"content::URLDataSource::GotDataCallback" closure is the last shared
Expand All @@ -21,13 +24,12 @@ Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Danil Somsikov <dsv@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1138173}
---

diff --git a/chrome/browser/ui/webui/devtools_ui_data_source.cc b/chrome/browser/ui/webui/devtools_ui_data_source.cc
index c60d70f..991599d 100644
index c60d70fb3271e2459634709f015901b70db5b64c..991599d11df139173b356d50d3027c38a356eeb8 100644
--- a/chrome/browser/ui/webui/devtools_ui_data_source.cc
+++ b/chrome/browser/ui/webui/devtools_ui_data_source.cc
@@ -365,11 +365,13 @@
@@ -365,11 +365,13 @@ void DevToolsDataSource::StartFileRequest(const std::string& path,
void DevToolsDataSource::OnLoadComplete(
std::list<PendingRequest>::iterator request_iter,
std::unique_ptr<std::string> response_body) {
Expand All @@ -46,7 +48,7 @@ index c60d70f..991599d 100644

DevToolsDataSource::PendingRequest::PendingRequest() = default;
diff --git a/chrome/browser/ui/webui/devtools_ui_data_source_unittest.cc b/chrome/browser/ui/webui/devtools_ui_data_source_unittest.cc
index b4f41411..c07c43b 100644
index b4f41411c578b0a0c1b3fcd65e170744b4e62ee3..c07c43b6a139bfbdbe4a0bbaa7e4dfb425442d99 100644
--- a/chrome/browser/ui/webui/devtools_ui_data_source_unittest.cc
+++ b/chrome/browser/ui/webui/devtools_ui_data_source_unittest.cc
@@ -9,13 +9,17 @@
Expand All @@ -67,7 +69,7 @@ index b4f41411..c07c43b 100644
#include "testing/gtest/include/gtest/gtest.h"

namespace {
@@ -356,3 +360,36 @@
@@ -356,3 +360,36 @@ TEST_F(DevToolsUIDataSourceTest, TestDevToolsNoRouteWithSwitch) {
ASSERT_TRUE(base::StartsWith(data(), kDevToolsUITest404Response,
base::CompareCase::SENSITIVE));
}
Expand Down
2 changes: 0 additions & 2 deletions patches/v8/.patches
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,4 @@ fix_disable_implies_dcheck_for_node_stream_array_buffers.patch
force_cppheapcreateparams_to_be_noncopyable.patch
chore_allow_customizing_microtask_policy_per_context.patch
build_revert_builtins_pgo.patch
cherry-pick-91fce3345668.patch
cherry-pick-2c8a019f39d2.patch
cherry-pick-b8020e1973d7.patch

0 comments on commit 21ea816

Please sign in to comment.