fix: crash when saving edited PDF files

patches/chromium/.patches

@@ -113,3 +113,4 @@ load_v8_snapshot_in_browser_process.patch
 fix_patch_out_permissions_checks_in_exclusive_access.patch
 fix_aspect_ratio_with_max_size.patch
 revert_do_not_display_grammar_error_if_there_it_overlaps_with_spell.patch
+fix_crash_when_saving_edited_pdf_files.patch

patches/chromium/fix_crash_when_saving_edited_pdf_files.patch

@@ -0,0 +1,85 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shelley Vohr <shelley.vohr@gmail.com>
+Date: Mon, 17 Jan 2022 23:47:54 +0100
+Subject: fix: crash when saving edited PDF files
+
+This commit fixes a crash that persists any time a user attempts to
+download an edited PDF. This was happening because the logic flow for
+downloading of any edited PDF triggers a call to
+chrome.fileSystem.chooseEntry, which we do not support and which
+therefore causes unmapped page access crashes.
+
+This patch can be removed should we choose to support chrome.fileSystem
+or support it enough to fix the crash.
+
+diff --git a/chrome/browser/resources/pdf/pdf_viewer.js b/chrome/browser/resources/pdf/pdf_viewer.js
+index 64308b73b70940187451f0475e4717def9f89cce..1888061bb7a5a6ae778d701aa554191288f20c87 100644
+--- a/chrome/browser/resources/pdf/pdf_viewer.js
++++ b/chrome/browser/resources/pdf/pdf_viewer.js
+@@ -976,25 +976,12 @@ export class PDFViewerElement extends PDFViewerBaseElement {
+       dataArray = [result.dataToSave];
+     }
+
++    const a = document.createElement('a');
++    a.download = this.attachments_[index].name;
+     const blob = new Blob(dataArray);
+-    const fileName = this.attachments_[index].name;
+-    chrome.fileSystem.chooseEntry(
+-        {type: 'saveFile', suggestedName: fileName}, entry => {
+-          if (chrome.runtime.lastError) {
+-            if (chrome.runtime.lastError.message !== 'User cancelled') {
+-              console.error(
+-                  'chrome.fileSystem.chooseEntry failed: ' +
+-                  chrome.runtime.lastError.message);
+-            }
+-            return;
+-          }
+-          entry.createWriter(writer => {
+-            writer.write(blob);
+-            // Unblock closing the window now that the user has saved
+-            // successfully.
+-            chrome.mimeHandlerPrivate.setShowBeforeUnloadDialog(false);
+-          });
+-        });
++    a.href = URL.createObjectURL(blob);
++    a.click();
++    URL.revokeObjectURL(a.href);
+   }
+
+   /**
+@@ -1122,29 +1109,12 @@ export class PDFViewerElement extends PDFViewerBaseElement {
+       fileName = fileName + '.pdf';
+     }
+
+-    chrome.fileSystem.chooseEntry(
+-        {
+-          type: 'saveFile',
+-          accepts: [{description: '*.pdf', extensions: ['pdf']}],
+-          suggestedName: fileName
+-        },
+-        entry => {
+-          if (chrome.runtime.lastError) {
+-            if (chrome.runtime.lastError.message !== 'User cancelled') {
+-              console.error(
+-                  'chrome.fileSystem.chooseEntry failed: ' +
+-                  chrome.runtime.lastError.message);
+-            }
+-            return;
+-          }
+-          entry.createWriter(writer => {
+-            writer.write(
+-                new Blob([result.dataToSave], {type: 'application/pdf'}));
+-            // Unblock closing the window now that the user has saved
+-            // successfully.
+-            chrome.mimeHandlerPrivate.setShowBeforeUnloadDialog(false);
+-          });
+-        });
++    const a = document.createElement('a');
++    a.download = fileName;
++    const blob = new Blob([result.dataToSave], {type: 'application/pdf'});
++    a.href = URL.createObjectURL(blob);
++    a.click();
++    URL.revokeObjectURL(a.href);
+
+     // <if expr="enable_ink">
+     // Saving in Annotation mode is destructive: crbug.com/919364