Update to 83.0.4103.97-1

12 files changed, 586 insertions, 201 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 280d4dbf347a..df14a08b9f24 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = chromium-no-extras
 	pkgdesc = Chromium without hangout services, widevine, pipewire, or chromedriver
-	pkgver = 81.0.4044.138
-	pkgrel = 2
+	pkgver = 83.0.4103.97
+	pkgrel = 1
 	url = https://www.chromium.org/Home
 	install = chromium.install
 	arch = x86_64
@@ -18,6 +18,7 @@ pkgbase = chromium-no-extras
 	makedepends = lld
 	makedepends = gn
 	makedepends = java-runtime-headless
+	makedepends = python2-setuptools
 	depends = gtk3
 	depends = nss
 	depends = alsa-lib
@@ -52,21 +53,31 @@ pkgbase = chromium-no-extras
 	optdepends = kdialog: needed for file dialogs in KDE
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME / Xfce
 	optdepends = kwallet: for storing passwords in KWallet on KDE desktops
-	provides = chromium=81.0.4044.138
+	provides = chromium=83.0.4103.97
 	conflicts = chromium
-	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-81.0.4044.138.tar.xz
+	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-83.0.4103.97.tar.xz
 	source = chromium-launcher-6.tar.gz::https://github.com/foutrelis/chromium-launcher/archive/v6.tar.gz
-	source = rename-Relayout-in-DesktopWindowTreeHostPlatform.patch
-	source = rebuild-Linux-frame-button-cache-when-activation.patch
 	source = clean-up-a-call-to-set_utf8.patch
-	source = icu67.patch
+	source = iwyu-std-numeric_limits-is-defined-in-limits.patch
+	source = add-missing-algorithm-header-in-crx_install_error.cc.patch
+	source = libstdc-fix-incomplete-type-in-AXTree-for-NodeSetSiz.patch
+	source = include-memory-header-to-get-the-definition-of-std-u.patch
+	source = make-some-of-blink-custom-iterators-STL-compatible.patch
+	source = avoid-double-destruction-of-ServiceWorkerObjectHost.patch
+	source = v8-remove-soon-to-be-removed-getAllFieldPositions.patch
+	source = chromium-83-gcc-10.patch
 	source = chromium-skia-harmony.patch
-	sha256sums = f478f28b8111cb70231df4c36e754d812ad7a94b7c844e9d0515345a71fd77a6
+	sha256sums = 12c405f61284cfc78f8c2b6600f3c1ae61a83b639c41087bb4f74fcaab036f83
 	sha256sums = 04917e3cd4307d8e31bfb0027a5dce6d086edb10ff8a716024fbb8bb0c7dccf1
-	sha256sums = ae3bf107834bd8eda9a3ec7899fe35fde62e6111062e5def7d24bf49b53db3db
-	sha256sums = 46f7fc9768730c460b27681ccf3dc2685c7e1fd22d70d3a82d9e57e3389bb014
 	sha256sums = 58c41713eb6fb33b6eef120f4324fa1fb8123b1fbc4ecbe5662f1f9779b9b6af
-	sha256sums = 5315977307e69d20b3e856d3f8724835b08e02085a4444a5c5cefea83fd7d006
+	sha256sums = 675fb3d6276cce569a641436465f58d5709d1d4a5f62b7052989479fd4aaea24
+	sha256sums = 0e2a78e4aa7272ab0ff4a4c467750e01bad692a026ad9828aaf06d2a9418b9d8
+	sha256sums = 50687079426094f2056d1f4806dc30fc8d6bad16190520e57ba087ec5db1d778
+	sha256sums = 071326135bc25226aa165639dff80a03670a17548f2d2ff5cc4f40982b39c52a
+	sha256sums = 3d7f20e1d2ee7d73ed25e708c0d59a0cb215fcce10a379e3d48a856533c4b0b7
+	sha256sums = d793842e9584bf75e3779918297ba0ffa6dd05394ef5b2bf5fb73aa9c86a7e2f
+	sha256sums = e042024423027ad3ef729a7e4709bdf9714aea49d64cfbbf46a645a05703abc2
+	sha256sums = 3e5ba8c0a70a4bc673deec0c61eb2b58f05a4c784cbdb7c8118be1eb6580db6d
 	sha256sums = 771292942c0901092a402cc60ee883877a99fb804cb54d568c8c6c94565a48e1
 
 pkgname = chromium-no-extras
diff --git a/PKGBUILD b/PKGBUILD
index 0b136ae480ed..143e14887488 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -5,8 +5,8 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=chromium-no-extras
-pkgver=81.0.4044.138
-pkgrel=2
+pkgver=83.0.4103.97
+pkgrel=1
 _pkgname=chromium
 _launcher_ver=6
 pkgdesc="Chromium without hangout services, widevine, pipewire, or chromedriver"
@@ -19,7 +19,8 @@ depends=('gtk3' 'nss' 'alsa-lib' 'xdg-utils' 'libxss' 'libcups' 'libgcrypt'
          'ttf-liberation' 'systemd' 'dbus' 'libpulse' 'pciutils' 'json-glib'
          'desktop-file-utils' 'hicolor-icon-theme')
 makedepends=('python' 'python2' 'gperf' 'yasm' 'mesa' 'ninja' 'nodejs' 'git'
-                             'clang' 'lld' 'gn' 'java-runtime-headless')
+                             'clang' 'lld' 'gn' 'java-runtime-headless'
+             'python2-setuptools')
 optdepends=('pepper-flash: support for Flash content'
             'kdialog: needed for file dialogs in KDE'
             'org.freedesktop.secrets: password storage backend on GNOME / Xfce'
@@ -27,17 +28,27 @@ optdepends=('pepper-flash: support for Flash content'
 install=chromium.install
 source=(https://commondatastorage.googleapis.com/chromium-browser-official/$_pkgname-$pkgver.tar.xz
         chromium-launcher-$_launcher_ver.tar.gz::https://github.com/foutrelis/chromium-launcher/archive/v$_launcher_ver.tar.gz
-        rename-Relayout-in-DesktopWindowTreeHostPlatform.patch
-        rebuild-Linux-frame-button-cache-when-activation.patch
         clean-up-a-call-to-set_utf8.patch
-        icu67.patch
+        iwyu-std-numeric_limits-is-defined-in-limits.patch
+        add-missing-algorithm-header-in-crx_install_error.cc.patch
+        libstdc-fix-incomplete-type-in-AXTree-for-NodeSetSiz.patch
+        include-memory-header-to-get-the-definition-of-std-u.patch
+        make-some-of-blink-custom-iterators-STL-compatible.patch
+        avoid-double-destruction-of-ServiceWorkerObjectHost.patch
+        v8-remove-soon-to-be-removed-getAllFieldPositions.patch
+        chromium-83-gcc-10.patch
         chromium-skia-harmony.patch)
-sha256sums=('f478f28b8111cb70231df4c36e754d812ad7a94b7c844e9d0515345a71fd77a6'
+sha256sums=('12c405f61284cfc78f8c2b6600f3c1ae61a83b639c41087bb4f74fcaab036f83'
             '04917e3cd4307d8e31bfb0027a5dce6d086edb10ff8a716024fbb8bb0c7dccf1'
-            'ae3bf107834bd8eda9a3ec7899fe35fde62e6111062e5def7d24bf49b53db3db'
-            '46f7fc9768730c460b27681ccf3dc2685c7e1fd22d70d3a82d9e57e3389bb014'
             '58c41713eb6fb33b6eef120f4324fa1fb8123b1fbc4ecbe5662f1f9779b9b6af'
-            '5315977307e69d20b3e856d3f8724835b08e02085a4444a5c5cefea83fd7d006'
+            '675fb3d6276cce569a641436465f58d5709d1d4a5f62b7052989479fd4aaea24'
+            '0e2a78e4aa7272ab0ff4a4c467750e01bad692a026ad9828aaf06d2a9418b9d8'
+            '50687079426094f2056d1f4806dc30fc8d6bad16190520e57ba087ec5db1d778'
+            '071326135bc25226aa165639dff80a03670a17548f2d2ff5cc4f40982b39c52a'
+            '3d7f20e1d2ee7d73ed25e708c0d59a0cb215fcce10a379e3d48a856533c4b0b7'
+            'd793842e9584bf75e3779918297ba0ffa6dd05394ef5b2bf5fb73aa9c86a7e2f'
+            'e042024423027ad3ef729a7e4709bdf9714aea49d64cfbbf46a645a05703abc2'
+            '3e5ba8c0a70a4bc673deec0c61eb2b58f05a4c784cbdb7c8118be1eb6580db6d'
             '771292942c0901092a402cc60ee883877a99fb804cb54d568c8c6c94565a48e1')
 
 # Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
@@ -87,15 +98,32 @@ prepare() {
     third_party/blink/renderer/core/xml/parser/xml_document_parser.cc \
     third_party/libxml/chromium/*.cc
 
-  # https://crbug.com/1049258
-  patch -Np1 -i ../rename-Relayout-in-DesktopWindowTreeHostPlatform.patch
-  patch -Np1 -i ../rebuild-Linux-frame-button-cache-when-activation.patch
-
   # https://chromium-review.googlesource.com/c/chromium/src/+/2145261
   patch -Np1 -i ../clean-up-a-call-to-set_utf8.patch
 
+  # https://chromium-review.googlesource.com/c/chromium/src/+/2153111
+  patch -Np1 -F3 -i ../iwyu-std-numeric_limits-is-defined-in-limits.patch
+
+  # https://chromium-review.googlesource.com/c/chromium/src/+/2152333
+  patch -Np1 -i ../add-missing-algorithm-header-in-crx_install_error.cc.patch
+
+  # https://chromium-review.googlesource.com/c/chromium/src/+/2132403
+  patch -Np1 -i ../libstdc-fix-incomplete-type-in-AXTree-for-NodeSetSiz.patch
+
+  # https://chromium-review.googlesource.com/c/chromium/src/+/2164645
+  patch -Np1 -i ../include-memory-header-to-get-the-definition-of-std-u.patch
+
+  # https://chromium-review.googlesource.com/c/chromium/src/+/2174199
+  patch -Np1 -i ../make-some-of-blink-custom-iterators-STL-compatible.patch
+
+  # https://chromium-review.googlesource.com/c/chromium/src/+/2094496
+  patch -Np1 -i ../avoid-double-destruction-of-ServiceWorkerObjectHost.patch
+
   # https://crbug.com/v8/10393
-  patch -Np3 -d v8 <../icu67.patch
+  patch -Np1 -d v8 <../v8-remove-soon-to-be-removed-getAllFieldPositions.patch
+
+  # Fixes from Gentoo
+  patch -Np1 -i ../chromium-83-gcc-10.patch
 
   # https://crbug.com/skia/6663#c10
   patch -Np0 -i ../chromium-skia-harmony.patch
@@ -114,6 +142,7 @@ prepare() {
     find "third_party/$_lib" -type f \
       \! -path "third_party/$_lib/chromium/*" \
       \! -path "third_party/$_lib/google/*" \
+      \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
       \! -path 'third_party/yasm/run_yasm.py' \
       \! -regex '.*\.\(gn\|gni\|isolate\)' \
       -delete
@@ -157,7 +186,6 @@ build() {
     'enable_hangout_services_extension=false'
     'enable_widevine=false'
     'enable_nacl=false'
-    'enable_swiftshader=false'
     "google_api_key=\"${_google_api_key}\""
     "google_default_client_id=\"${_google_default_client_id}\""
     "google_default_client_secret=\"${_google_default_client_secret}\""
@@ -194,28 +222,48 @@ package() {
 
   install -D out/Release/chrome "$pkgdir/usr/lib/chromium/chromium"
   install -Dm4755 out/Release/chrome_sandbox "$pkgdir/usr/lib/chromium/chrome-sandbox"
+  #ln -s /usr/lib/chromium/chromedriver "$pkgdir/usr/bin/chromedriver"
 
   install -Dm644 chrome/installer/linux/common/desktop.template \
     "$pkgdir/usr/share/applications/chromium.desktop"
   install -Dm644 chrome/app/resources/manpage.1.in \
     "$pkgdir/usr/share/man/man1/chromium.1"
   sed -i \
-    -e "s/@@MENUNAME@@/Chromium/g" \
-    -e "s/@@PACKAGE@@/chromium/g" \
-    -e "s/@@USR_BIN_SYMLINK_NAME@@/chromium/g" \
+    -e 's/@@MENUNAME@@/Chromium/g' \
+    -e 's/@@PACKAGE@@/chromium/g' \
+    -e 's/@@USR_BIN_SYMLINK_NAME@@/chromium/g' \
     "$pkgdir/usr/share/applications/chromium.desktop" \
     "$pkgdir/usr/share/man/man1/chromium.1"
 
-  cp \
-    out/Release/{chrome_{100,200}_percent,resources}.pak \
-    out/Release/*.bin \
-    "$pkgdir/usr/lib/chromium/"
-  install -Dm644 -t "$pkgdir/usr/lib/chromium/locales" out/Release/locales/*.pak
+  install -Dm644 chrome/installer/linux/common/chromium-browser/chromium-browser.appdata.xml \
+    "$pkgdir/usr/share/metainfo/chromium.appdata.xml"
+  sed -i \
+    -e 's/chromium-browser\.desktop/chromium.desktop/' \
+    -e '/<update_contact>/d' \
+    -e '/<p>/N;/<p>\n.*\(We invite\|Chromium supports Vorbis\)/,/<\/p>/d' \
+    "$pkgdir/usr/share/metainfo/chromium.appdata.xml"
+
+  local toplevel_files=(
+    chrome_100_percent.pak
+    chrome_200_percent.pak
+    resources.pak
+    v8_context_snapshot.bin
+
+    # ANGLE
+    libEGL.so
+    libGLESv2.so
+
+    #chromedriver
+  )
 
   if [[ -z ${_system_libs[icu]+set} ]]; then
-    cp out/Release/icudtl.dat "$pkgdir/usr/lib/chromium/"
+    toplevel_files+=(icudtl.dat)
   fi
 
+  cp "${toplevel_files[@]/#/out/Release/}" "$pkgdir/usr/lib/chromium/"
+  install -Dm644 -t "$pkgdir/usr/lib/chromium/locales" out/Release/locales/*.pak
+  install -Dm755 -t "$pkgdir/usr/lib/chromium/swiftshader" out/Release/swiftshader/*.so
+
   for size in 24 48 64 128 256; do
     install -Dm644 "chrome/app/theme/chromium/product_logo_$size.png" \
       "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/chromium.png"
diff --git a/add-missing-algorithm-header-in-crx_install_error.cc.patch b/add-missing-algorithm-header-in-crx_install_error.cc.patch
new file mode 100644
index 000000000000..570f7b319534
--- /dev/null
+++ b/add-missing-algorithm-header-in-crx_install_error.cc.patch
@@ -0,0 +1,29 @@
+From 2b9d6daa0ab5ce45ec5555466d5a5a583a020ea8 Mon Sep 17 00:00:00 2001
+From: Daniel Playfair Cal <daniel.playfair.cal@gmail.com>
+Date: Sat, 18 Apr 2020 00:27:38 +0000
+Subject: [PATCH] Add missing algorithm header in crx_install_error.cc
+
+This is needed for the use of std::find.
+
+Change-Id: I2dc43b3887c467986c5346be5a9e27a987e1e5b3
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2152333
+Reviewed-by: Ken Rockot <rockot@google.com>
+Commit-Queue: Ken Rockot <rockot@google.com>
+Cr-Commit-Position: refs/heads/master@{#760272}
+---
+ extensions/browser/install/crx_install_error.cc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/extensions/browser/install/crx_install_error.cc b/extensions/browser/install/crx_install_error.cc
+index a9765bb0a5a..bd0d3e35a16 100644
+--- a/extensions/browser/install/crx_install_error.cc
++++ b/extensions/browser/install/crx_install_error.cc
+@@ -4,6 +4,8 @@
+ 
+ #include "extensions/browser/install/crx_install_error.h"
+ 
++#include <algorithm>
++
+ #include "base/logging.h"
+ #include "extensions/browser/install/sandboxed_unpacker_failure_reason.h"
+ 
diff --git a/avoid-double-destruction-of-ServiceWorkerObjectHost.patch b/avoid-double-destruction-of-ServiceWorkerObjectHost.patch
new file mode 100644
index 000000000000..5e1df005c961
--- /dev/null
+++ b/avoid-double-destruction-of-ServiceWorkerObjectHost.patch
@@ -0,0 +1,138 @@
+From bd59ce32629ef684624821419c43967b73d2989e Mon Sep 17 00:00:00 2001
+From: Hiroki Nakagawa <nhiroki@chromium.org>
+Date: Fri, 8 May 2020 08:25:31 +0000
+Subject: [PATCH] ServiceWorker: Avoid double destruction of
+ ServiceWorkerObjectHost on connection error
+
+This CL avoids the case where ServiceWorkerObjectHost is destroyed twice
+on ServiceWorkerObjectHost::OnConnectionError() when Chromium is built
+with the GCC build toolchain.
+
+> How does the issue happen?
+
+ServiceWorkerObjectHost has a cyclic reference like this:
+
+ServiceWorkerObjectHost
+  --([1] scoped_refptr)--> ServiceWorkerVersion
+    --([2] std::unique_ptr)--> ServiceWorkerProviderHost
+      --([3] std::unique_ptr)--> ServiceWorkerContainerHost
+        --([4] std::unique_ptr)--> ServiceWorkerObjectHost
+
+Note that ServiceWorkerContainerHost manages ServiceWorkerObjectHost in
+map<int64_t version_id, std::unique_ptr<ServiceWorkerObjectHost>>.
+
+When ServiceWorkerObjectHost::OnConnectionError() is called, the
+function removes the reference [4] from the map, and destroys
+ServiceWorkerObjectHost. If the object host has the last reference [1]
+to ServiceWorkerVersion, the destruction also cuts off the references
+[2] and [3], and destroys ServiceWorkerProviderHost and
+ServiceWorkerContainerHost.
+
+This seems to work well on the Chromium's default toolchain, but not
+work on the GCC toolchain. According to the report, destruction of
+ServiceWorkerContainerHost happens while the map owned by the container
+host is erasing the ServiceWorkerObjectHost, and this results in crash
+due to double destruction of the object host.
+
+I don't know the reason why this happens only on the GCC toolchain, but
+I suspect the order of object destruction on std::map::erase() could be
+different depending on the toolchains.
+
+> How does this CL fix this?
+
+The ideal fix is to redesign the ownership model of
+ServiceWorkerVersion, but it's not feasible in the short term.
+
+Instead, this CL avoids destruction of ServiceWorkerObjectHost on
+std::map::erase(). The new code takes the ownership of the object host
+from the map first, and then erases the entry from the map. This
+separates timings to erase the map entry and to destroy the object host,
+so the crash should no longer happen.
+
+Bug: 1056598
+Change-Id: Id30654cb575bc557c42044d6f0c6f1f9bfaed613
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2094496
+Reviewed-by: Makoto Shimazu <shimazu@chromium.org>
+Commit-Queue: Hiroki Nakagawa <nhiroki@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#766770}
+---
+ .../service_worker_container_host.cc          | 10 +++++
+ .../service_worker_object_host_unittest.cc    | 38 +++++++++++++++++++
+ 2 files changed, 48 insertions(+)
+
+diff --git a/content/browser/service_worker/service_worker_container_host.cc b/content/browser/service_worker/service_worker_container_host.cc
+index ec7fb1449af..98c62093b0e 100644
+--- a/content/browser/service_worker/service_worker_container_host.cc
++++ b/content/browser/service_worker/service_worker_container_host.cc
+@@ -669,6 +669,16 @@ void ServiceWorkerContainerHost::RemoveServiceWorkerObjectHost(
+     int64_t version_id) {
+   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+   DCHECK(base::Contains(service_worker_object_hosts_, version_id));
++
++  // ServiceWorkerObjectHost to be deleted may have the last reference to
++  // ServiceWorkerVersion that indirectly owns this ServiceWorkerContainerHost.
++  // If we erase the object host directly from the map, |this| could be deleted
++  // during the map operation and may crash. To avoid the case, we take the
++  // ownership of the object host from the map first, and then erase the entry
++  // from the map. See https://crbug.com/1056598 for details.
++  std::unique_ptr<ServiceWorkerObjectHost> to_be_deleted =
++      std::move(service_worker_object_hosts_[version_id]);
++  DCHECK(to_be_deleted);
+   service_worker_object_hosts_.erase(version_id);
+ }
+ 
+diff --git a/content/browser/service_worker/service_worker_object_host_unittest.cc b/content/browser/service_worker/service_worker_object_host_unittest.cc
+index 408d7c1f9d1..6eab59040ab 100644
+--- a/content/browser/service_worker/service_worker_object_host_unittest.cc
++++ b/content/browser/service_worker/service_worker_object_host_unittest.cc
+@@ -200,6 +200,19 @@ class ServiceWorkerObjectHostTest : public testing::Test {
+     return registration_info;
+   }
+ 
++  void CallOnConnectionError(ServiceWorkerContainerHost* container_host,
++                             int64_t version_id) {
++    // ServiceWorkerObjectHost has the last reference to the version.
++    ServiceWorkerObjectHost* object_host =
++        GetServiceWorkerObjectHost(container_host, version_id);
++    EXPECT_TRUE(object_host->version_->HasOneRef());
++
++    // Make sure that OnConnectionError induces destruction of the version and
++    // the object host.
++    object_host->receivers_.Clear();
++    object_host->OnConnectionError();
++  }
++
+   BrowserTaskEnvironment task_environment_;
+   std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
+   scoped_refptr<ServiceWorkerRegistration> registration_;
+@@ -409,5 +422,30 @@ TEST_F(ServiceWorkerObjectHostTest, DispatchExtendableMessageEvent_FromClient) {
+             events[0]->source_info_for_client->client_type);
+ }
+ 
++// This is a regression test for https://crbug.com/1056598.
++TEST_F(ServiceWorkerObjectHostTest, OnConnectionError) {
++  const GURL scope("https://www.example.com/");
++  const GURL script_url("https://www.example.com/service_worker.js");
++  Initialize(std::make_unique<EmbeddedWorkerTestHelper>(base::FilePath()));
++  SetUpRegistration(scope, script_url);
++
++  // Create the provider host.
++  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
++            StartServiceWorker(version_.get()));
++
++  // Set up the case where the last reference to the version is owned by the
++  // service worker object host.
++  ServiceWorkerContainerHost* container_host =
++      version_->provider_host()->container_host();
++  ServiceWorkerVersion* version_rawptr = version_.get();
++  version_ = nullptr;
++  ASSERT_TRUE(version_rawptr->HasOneRef());
++
++  // Simulate the connection error that induces the object host destruction.
++  // This shouldn't crash.
++  CallOnConnectionError(container_host, version_rawptr->version_id());
++  base::RunLoop().RunUntilIdle();
++}
++
+ }  // namespace service_worker_object_host_unittest
+ }  // namespace content
diff --git a/chromium-83-gcc-10.patch b/chromium-83-gcc-10.patch
new file mode 100644
index 000000000000..974b49cde703
--- /dev/null
+++ b/chromium-83-gcc-10.patch
@@ -0,0 +1,64 @@
+From e473f41284ccc8fa4bc4622d087194b18a1ec23a Mon Sep 17 00:00:00 2001
+From: Stephan Hartmann <stha09@googlemail.com>
+Date: Tue, 7 Apr 2020 16:37:10 +0000
+Subject: [PATCH] GCC: fix includes for gcc-10
+
+---
+ chrome/browser/search/background/ntp_backgrounds.h              | 1 +
+ third_party/webrtc/call/rtx_receive_stream.h                    | 1 +
+ .../webrtc/modules/audio_processing/aec3/clockdrift_detector.h  | 1 +
+ ui/gfx/linux/drm_util_linux.h                                   | 2 ++
+ 5 files changed, 6 insertions(+)
+
+diff --git a/chrome/browser/search/background/ntp_backgrounds.h b/chrome/browser/search/background/ntp_backgrounds.h
+index 7afc0a2..ea5818e 100644
+--- a/chrome/browser/search/background/ntp_backgrounds.h
++++ b/chrome/browser/search/background/ntp_backgrounds.h
+@@ -6,6 +6,7 @@
+ #define CHROME_BROWSER_SEARCH_BACKGROUND_NTP_BACKGROUNDS_H_
+ 
+ #include <array>
++#include <cstddef>
+ 
+ class GURL;
+ 
+diff --git a/third_party/webrtc/call/rtx_receive_stream.h b/third_party/webrtc/call/rtx_receive_stream.h
+index 8ffa440..113a816 100644
+--- a/third_party/webrtc/call/rtx_receive_stream.h
++++ b/third_party/webrtc/call/rtx_receive_stream.h
+@@ -12,6 +12,7 @@
+ #define CALL_RTX_RECEIVE_STREAM_H_
+ 
+ #include <map>
++#include <cstdint>
+ 
+ #include "call/rtp_packet_sink_interface.h"
+ 
+diff --git a/third_party/webrtc/modules/audio_processing/aec3/clockdrift_detector.h b/third_party/webrtc/modules/audio_processing/aec3/clockdrift_detector.h
+index 22528c9..69e624e 100644
+--- a/third_party/webrtc/modules/audio_processing/aec3/clockdrift_detector.h
++++ b/third_party/webrtc/modules/audio_processing/aec3/clockdrift_detector.h
+@@ -12,6 +12,7 @@
+ #define MODULES_AUDIO_PROCESSING_AEC3_CLOCKDRIFT_DETECTOR_H_
+ 
+ #include <array>
++#include <cstddef>
+ 
+ namespace webrtc {
+ 
+diff --git a/ui/gfx/linux/drm_util_linux.h b/ui/gfx/linux/drm_util_linux.h
+index 86ff2eb..990f12c 100644
+--- a/ui/gfx/linux/drm_util_linux.h
++++ b/ui/gfx/linux/drm_util_linux.h
+@@ -7,6 +7,8 @@
+ 
+ #include "ui/gfx/buffer_types.h"
+ 
++#include <cstdint>
++
+ namespace ui {
+ 
+ int GetFourCCFormatFromBufferFormat(gfx::BufferFormat format);
+-- 
+2.24.1
+
diff --git a/include-memory-header-to-get-the-definition-of-std-u.patch b/include-memory-header-to-get-the-definition-of-std-u.patch
new file mode 100644
index 000000000000..eb30ad2437f1
--- /dev/null
+++ b/include-memory-header-to-get-the-definition-of-std-u.patch
@@ -0,0 +1,32 @@
+From 40d994e4aa2e4d5077c1810e4623549618a19c05 Mon Sep 17 00:00:00 2001
+From: Piotr Tworek <ptworek@vewd.com>
+Date: Mon, 27 Apr 2020 16:31:46 +0000
+Subject: [PATCH] Include "memory" header to get the definition of
+ std::unique_ptr.
+
+Right now the code im the affected fails to build when using libstdc++
+instead of bundled libcxx. Apparently libcxx pulls the necessary header
+indirectly.
+
+Change-Id: Ie5e86f228434ab16d622ae7a912d9ce607258931
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2164645
+Reviewed-by: Jochen Eisinger <jochen@chromium.org>
+Commit-Queue: Jochen Eisinger <jochen@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#762881}
+---
+ .../blink/renderer/core/html/trust_token_attribute_parsing.h    | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/third_party/blink/renderer/core/html/trust_token_attribute_parsing.h b/third_party/blink/renderer/core/html/trust_token_attribute_parsing.h
+index f5a7ab03892..ef19cfaf680 100644
+--- a/third_party/blink/renderer/core/html/trust_token_attribute_parsing.h
++++ b/third_party/blink/renderer/core/html/trust_token_attribute_parsing.h
+@@ -5,6 +5,8 @@
+ #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_HTML_TRUST_TOKEN_ATTRIBUTE_PARSING_H_
+ #define THIRD_PARTY_BLINK_RENDERER_CORE_HTML_TRUST_TOKEN_ATTRIBUTE_PARSING_H_
+ 
++#include <memory>
++
+ #include "base/optional.h"
+ #include "services/network/public/mojom/trust_tokens.mojom-blink-forward.h"
+ #include "third_party/blink/renderer/core/core_export.h"
diff --git a/iwyu-std-numeric_limits-is-defined-in-limits.patch b/iwyu-std-numeric_limits-is-defined-in-limits.patch
new file mode 100644
index 000000000000..e270242afd86
--- /dev/null
+++ b/iwyu-std-numeric_limits-is-defined-in-limits.patch
@@ -0,0 +1,29 @@
+From 74f76a6be385ef056b0be2362c32c728141cca16 Mon Sep 17 00:00:00 2001
+From: Stephan Hartmann <stha09@googlemail.com>
+Date: Fri, 17 Apr 2020 16:04:12 +0000
+Subject: [PATCH] IWYU: std::numeric_limits is defined in limits
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: Ifbc379adc5bb7242c21e7da0bcfc28f49e4dd06f
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2153111
+Reviewed-by: François Doray <fdoray@chromium.org>
+Commit-Queue: François Doray <fdoray@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#760075}
+---
+ .../graph/policies/background_tab_loading_policy_helpers.cc      | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/chrome/browser/performance_manager/graph/policies/background_tab_loading_policy_helpers.cc b/chrome/browser/performance_manager/graph/policies/background_tab_loading_policy_helpers.cc
+index 4881c010bb9..593501d16a7 100644
+--- a/chrome/browser/performance_manager/graph/policies/background_tab_loading_policy_helpers.cc
++++ b/chrome/browser/performance_manager/graph/policies/background_tab_loading_policy_helpers.cc
+@@ -5,6 +5,7 @@
+ #include "chrome/browser/performance_manager/graph/policies/background_tab_loading_policy_helpers.h"
+ 
+ #include <math.h>
++#include <limits>
+ 
+ #include "base/logging.h"
+ 
diff --git a/libstdc-fix-incomplete-type-in-AXTree-for-NodeSetSiz.patch b/libstdc-fix-incomplete-type-in-AXTree-for-NodeSetSiz.patch
new file mode 100644
index 000000000000..5e9d37aae54f
--- /dev/null
+++ b/libstdc-fix-incomplete-type-in-AXTree-for-NodeSetSiz.patch
@@ -0,0 +1,62 @@
+From aeef68888d4c00b69facead2b934095a8cd17329 Mon Sep 17 00:00:00 2001
+From: Stephan Hartmann <stha09@googlemail.com>
+Date: Mon, 20 Apr 2020 18:21:43 +0000
+Subject: [PATCH] libstdc++: fix incomplete-type in AXTree for
+ NodeSetSizePosInSetInfo
+
+has only forward declaration of NodeSetSizePosInSetInfo. Therefore,
+move declaration from ax_tree.cc.
+
+std: :unordered_map<T, U> requires U to be fully declared. ax_tree.h
+Bug: 957519
+Change-Id: Ic1f4bf3ebfea229ece84251e46d4461b31873868
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2132403
+Reviewed-by: David Tseng <dtseng@chromium.org>
+Commit-Queue: David Tseng <dtseng@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#760588}
+---
+ ui/accessibility/ax_tree.cc | 10 ++--------
+ ui/accessibility/ax_tree.h  |  9 ++++++++-
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/ui/accessibility/ax_tree.cc b/ui/accessibility/ax_tree.cc
+index 7b8d9b1b161..e9154028d66 100644
+--- a/ui/accessibility/ax_tree.cc
++++ b/ui/accessibility/ax_tree.cc
+@@ -567,14 +567,8 @@ struct AXTreeUpdateState {
+   const AXTree& tree;
+ };
+ 
+-struct AXTree::NodeSetSizePosInSetInfo {
+-  NodeSetSizePosInSetInfo() = default;
+-  ~NodeSetSizePosInSetInfo() = default;
+-
+-  int32_t pos_in_set = 0;
+-  int32_t set_size = 0;
+-  base::Optional<int> lowest_hierarchical_level;
+-};
++AXTree::NodeSetSizePosInSetInfo::NodeSetSizePosInSetInfo() = default;
++AXTree::NodeSetSizePosInSetInfo::~NodeSetSizePosInSetInfo() = default;
+ 
+ struct AXTree::OrderedSetContent {
+   explicit OrderedSetContent(const AXNode* ordered_set = nullptr)
+diff --git a/ui/accessibility/ax_tree.h b/ui/accessibility/ax_tree.h
+index a51ca8de4c8..8c1c57517ac 100644
+--- a/ui/accessibility/ax_tree.h
++++ b/ui/accessibility/ax_tree.h
+@@ -328,7 +328,14 @@ class AX_EXPORT AXTree : public AXNode::OwnerTree {
+   bool enable_extra_mac_nodes_ = false;
+ 
+   // Contains pos_in_set and set_size data for an AXNode.
+-  struct NodeSetSizePosInSetInfo;
++  struct NodeSetSizePosInSetInfo {
++    NodeSetSizePosInSetInfo();
++    ~NodeSetSizePosInSetInfo();
++
++    int32_t pos_in_set = 0;
++    int32_t set_size = 0;
++    base::Optional<int> lowest_hierarchical_level;
++  };
+ 
+   // Represents the content of an ordered set which includes the ordered set
+   // items and the ordered set container if it exists.
diff --git a/make-some-of-blink-custom-iterators-STL-compatible.patch b/make-some-of-blink-custom-iterators-STL-compatible.patch
new file mode 100644
index 000000000000..30cbdefcc65f
--- /dev/null
+++ b/make-some-of-blink-custom-iterators-STL-compatible.patch
@@ -0,0 +1,95 @@
+From d3cabbc7321d349a9bffda482df5afc0d4df1ac2 Mon Sep 17 00:00:00 2001
+From: Piotr Tworek <ptworek@vewd.com>
+Date: Thu, 30 Apr 2020 21:33:47 +0000
+Subject: [PATCH] Make some of blink custom iterators STL compatible.
+
+Blink has recently started using functions like std::any_of with some of
+the custom iterators it provides. On Linux this works in the default
+setup using libcxx, but fails with even the most recent versions of
+libstdc++. In all cases the error message (text in bug report) complains
+about lack of matching std::__iterator_category definition.
+
+From what I understand the error message is basically saying those
+iterators are not STL compatible due to missing traits as described
+in https://en.cppreference.com/w/cpp/iterator/iterator_traits. Such
+traits are provided by custom iterators defined in //base, or //cc.
+
+This patch adds the necessary traits to iterators that are currently
+affected by this problem.
+
+Bug: 1076869
+Change-Id: I9950a7100c32499ba96647317fa70b87dc22eaf9
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2174199
+Reviewed-by: Kentaro Hara <haraken@chromium.org>
+Commit-Queue: Piotr Tworek <ptworek@vewd.com>
+Cr-Commit-Position: refs/heads/master@{#764426}
+---
+ .../core/layout/ng/ng_physical_container_fragment.h  |  6 ++++++
+ .../blink/renderer/platform/wtf/hash_iterators.h     | 12 ++++++++++++
+ third_party/blink/renderer/platform/wtf/hash_table.h |  6 ++++++
+ 3 files changed, 24 insertions(+)
+
+diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h b/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h
+index 1256e77c146..8b93107f2fc 100644
+--- a/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h
++++ b/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h
+@@ -38,6 +38,12 @@ class CORE_EXPORT NGPhysicalContainerFragment : public NGPhysicalFragment {
+       STACK_ALLOCATED();
+ 
+      public:
++      using iterator_category = std::bidirectional_iterator_tag;
++      using value_type = NGLink;
++      using difference_type = ptrdiff_t;
++      using pointer = value_type*;
++      using reference = value_type&;
++
+       ConstIterator(const NGLink* current) : current_(current) {}
+ 
+       const NGLink& operator*() const { return *PostLayoutOrCurrent(); }
+diff --git a/third_party/blink/renderer/platform/wtf/hash_iterators.h b/third_party/blink/renderer/platform/wtf/hash_iterators.h
+index f8e66e6be85..6003d02c509 100644
+--- a/third_party/blink/renderer/platform/wtf/hash_iterators.h
++++ b/third_party/blink/renderer/platform/wtf/hash_iterators.h
+@@ -53,6 +53,12 @@ struct HashTableConstIteratorAdapter<HashTableType,
+   typedef HashTableConstValuesIterator<HashTableType, KeyType, MappedType>
+       ValuesIterator;
+ 
++  using iterator_category = std::bidirectional_iterator_tag;
++  using value_type = HashTableType;
++  using difference_type = ptrdiff_t;
++  using pointer = value_type*;
++  using reference = value_type&;
++
+   HashTableConstIteratorAdapter() = default;
+   HashTableConstIteratorAdapter(
+       const typename HashTableType::const_iterator& impl)
+@@ -94,6 +100,12 @@ struct HashTableIteratorAdapter<HashTableType,
+   typedef HashTableValuesIterator<HashTableType, KeyType, MappedType>
+       ValuesIterator;
+ 
++  using iterator_category = std::bidirectional_iterator_tag;
++  using value_type = HashTableType;
++  using difference_type = ptrdiff_t;
++  using pointer = value_type*;
++  using reference = value_type&;
++
+   HashTableIteratorAdapter() = default;
+   HashTableIteratorAdapter(const typename HashTableType::iterator& impl)
+       : impl_(impl) {}
+diff --git a/third_party/blink/renderer/platform/wtf/hash_table.h b/third_party/blink/renderer/platform/wtf/hash_table.h
+index f596fb5d41e..5a4468d6bd1 100644
+--- a/third_party/blink/renderer/platform/wtf/hash_table.h
++++ b/third_party/blink/renderer/platform/wtf/hash_table.h
+@@ -2204,6 +2204,12 @@ struct HashTableConstIteratorAdapter {
+   STACK_ALLOCATED();
+ 
+  public:
++  using iterator_category = std::bidirectional_iterator_tag;
++  using value_type = HashTableType;
++  using difference_type = ptrdiff_t;
++  using pointer = value_type*;
++  using reference = value_type&;
++
+   HashTableConstIteratorAdapter() = default;
+   HashTableConstIteratorAdapter(
+       const typename HashTableType::const_iterator& impl)
diff --git a/rebuild-Linux-frame-button-cache-when-activation.patch b/rebuild-Linux-frame-button-cache-when-activation.patch
deleted file mode 100644
index 40764b3ba7ab..000000000000
--- a/rebuild-Linux-frame-button-cache-when-activation.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From d10f885b9327399be9348b780967ebd6b7f2c4bc Mon Sep 17 00:00:00 2001
-From: Tom Anderson <thomasanderson@chromium.org>
-Date: Fri, 7 Feb 2020 22:44:54 +0000
-Subject: [PATCH] Rebuild Linux frame button cache when activation state
- changes
-
-This fixes an issue where the frame buttons would always render in an
-inactive state on Linux (see repro steps in bug 1049258).
-
-Bug: 1049258
-R=sky
-CC=pkasting
-
-Change-Id: Ic5af33199003e1d1cdf6cedf506e32388ea11fa9
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2044538
-Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
-Commit-Queue: Scott Violet <sky@chromium.org>
-Reviewed-by: Scott Violet <sky@chromium.org>
-Cr-Commit-Position: refs/heads/master@{#739585}
----
- .../ui/views/frame/desktop_linux_browser_frame_view.cc      | 6 +++---
- .../desktop_aura/desktop_window_tree_host_platform.cc       | 3 +++
- 2 files changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/chrome/browser/ui/views/frame/desktop_linux_browser_frame_view.cc b/chrome/browser/ui/views/frame/desktop_linux_browser_frame_view.cc
-index 954e776057f..4f579955675 100644
---- a/chrome/browser/ui/views/frame/desktop_linux_browser_frame_view.cc
-+++ b/chrome/browser/ui/views/frame/desktop_linux_browser_frame_view.cc
-@@ -22,13 +22,13 @@ DesktopLinuxBrowserFrameView::DesktopLinuxBrowserFrameView(
-     : OpaqueBrowserFrameView(frame, browser_view, layout),
-       nav_button_provider_(std::move(nav_button_provider)) {}
- 
--DesktopLinuxBrowserFrameView::~DesktopLinuxBrowserFrameView() {}
-+DesktopLinuxBrowserFrameView::~DesktopLinuxBrowserFrameView() = default;
- 
- void DesktopLinuxBrowserFrameView::Layout() {
-   // Calling MaybeUpdateCachedFrameButtonImages() from Layout() is sufficient to
-   // catch all cases that could update the appearance, since
--  // DesktopWindowTreeHostPlatform::OnWindowStateChanged() does a layout any
--  // time any properties change.
-+  // DesktopWindowTreeHostPlatform::On{Window,Activation}StateChanged() does a
-+  // layout any time the maximized and activation state changes, respectively.
-   MaybeUpdateCachedFrameButtonImages();
-   OpaqueBrowserFrameView::Layout();
- }
-diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
-index 9c695d8e5b1..9662f19aa90 100644
---- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
-+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
-@@ -677,9 +677,12 @@ void DesktopWindowTreeHostPlatform::OnCloseRequest() {
- }
- 
- void DesktopWindowTreeHostPlatform::OnActivationChanged(bool active) {
-+  if (is_active_ == active)
-+    return;
-   is_active_ = active;
-   aura::WindowTreeHostPlatform::OnActivationChanged(active);
-   desktop_native_widget_aura_->HandleActivationChanged(active);
-+  ScheduleRelayout();
- }
- 
- base::Optional<gfx::Size>
diff --git a/rename-Relayout-in-DesktopWindowTreeHostPlatform.patch b/rename-Relayout-in-DesktopWindowTreeHostPlatform.patch
deleted file mode 100644
index eda3cbdbaaf3..000000000000
--- a/rename-Relayout-in-DesktopWindowTreeHostPlatform.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 5a2cd2409c7d65c019ad9f4595a4e85315857ac4 Mon Sep 17 00:00:00 2001
-From: Tom Anderson <thomasanderson@chromium.org>
-Date: Mon, 3 Feb 2020 23:18:46 +0000
-Subject: [PATCH] Rename Relayout() in DesktopWindowTreeHostPlatform to
- ScheduleRelayout()
-
-R=sky
-
-Bug: None
-Change-Id: I680cafd25935e59a280e3b2baac754d3d5f13a35
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2036553
-Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
-Reviewed-by: Scott Violet <sky@chromium.org>
-Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
-Cr-Commit-Position: refs/heads/master@{#737974}
----
- .../desktop_aura/desktop_window_tree_host_platform.cc       | 6 +++---
- .../widget/desktop_aura/desktop_window_tree_host_platform.h | 2 +-
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
-index 6c00d49eb3f..9c695d8e5b1 100644
---- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
-+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
-@@ -556,7 +556,7 @@ void DesktopWindowTreeHostPlatform::SetFullscreen(bool fullscreen) {
-   DCHECK_EQ(fullscreen, IsFullscreen());
- 
-   if (IsFullscreen() == fullscreen)
--    Relayout();
-+    ScheduleRelayout();
-   // Else: the widget will be relaid out either when the window bounds change
-   // or when |platform_window|'s fullscreen state changes.
- }
-@@ -669,7 +669,7 @@ void DesktopWindowTreeHostPlatform::OnWindowStateChanged(
-   // Now that we have different window properties, we may need to relayout the
-   // window. (The windows code doesn't need this because their window change is
-   // synchronous.)
--  Relayout();
-+  ScheduleRelayout();
- }
- 
- void DesktopWindowTreeHostPlatform::OnCloseRequest() {
-@@ -712,7 +712,7 @@ gfx::Rect DesktopWindowTreeHostPlatform::ToPixelRect(
-   return gfx::ToEnclosingRect(rect_in_pixels);
- }
- 
--void DesktopWindowTreeHostPlatform::Relayout() {
-+void DesktopWindowTreeHostPlatform::ScheduleRelayout() {
-   Widget* widget = native_widget_delegate_->AsWidget();
-   NonClientView* non_client_view = widget->non_client_view();
-   // non_client_view may be NULL, especially during creation.
-diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
-index 89beb8d2245..75a401e02a7 100644
---- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
-+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
-@@ -129,7 +129,7 @@ class VIEWS_EXPORT DesktopWindowTreeHostPlatform
-   gfx::Rect ToPixelRect(const gfx::Rect& rect_in_dip) const;
- 
-  private:
--  void Relayout();
-+  void ScheduleRelayout();
- 
-   Widget* GetWidget();
-   const Widget* GetWidget() const;
diff --git a/icu67.patch b/v8-remove-soon-to-be-removed-getAllFieldPositions.patch
index bcfcb187b3bd..41d1aced2607 100644
--- a/icu67.patch
+++ b/v8-remove-soon-to-be-removed-getAllFieldPositions.patch
@@ -1,32 +1,25 @@
-From 2b107e7670ffb43719a66ee4a55ab408a5dcf2a5 Mon Sep 17 00:00:00 2001
-From: Ujjwal Sharma <ryzokuken@disroot.org>
-Date: Wed, 22 Apr 2020 12:20:17 +0530
-Subject: [PATCH] deps: V8: backport 3f8dc4b2e5ba
+From 3f8dc4b2e5baf77b463334c769af85b79d8c1463 Mon Sep 17 00:00:00 2001
+From: Frank Tang <ftang@chromium.org>
+Date: Fri, 3 Apr 2020 23:13:54 -0700
+Subject: [PATCH] [intl] Remove soon-to-be removed getAllFieldPositions
 
-Original commit message:
+Needed to land ICU67.1 soon.
 
-    [intl] Remove soon-to-be removed getAllFieldPositions
-
-    Needed to land ICU67.1 soon.
-
-    Bug: v8:10393
-    Change-Id: I3c7737ca600d6ccfdc46ffaddfb318ce60bc7618
-    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2136489
-    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
-    Commit-Queue: Frank Tang <ftang@chromium.org>
-    Cr-Commit-Position: refs/heads/master@{#67027}
-
-Refs: https://github.com/v8/v8/commit/3f8dc4b2e5baf77b463334c769af85b79d8c1463
+Bug: v8:10393
+Change-Id: I3c7737ca600d6ccfdc46ffaddfb318ce60bc7618
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2136489
+Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
+Commit-Queue: Frank Tang <ftang@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#67027}
 ---
- common.gypi                             |  2 +-
- deps/v8/src/objects/js-number-format.cc | 72 +++++++++++++------------
- 2 files changed, 38 insertions(+), 36 deletions(-)
+ src/objects/js-number-format.cc | 77 +++++++++++++++++----------------
+ 1 file changed, 39 insertions(+), 38 deletions(-)
 
-diff --git a/deps/v8/src/objects/js-number-format.cc b/deps/v8/src/objects/js-number-format.cc
-index 92d3e2fb82e..ced408aa173 100644
---- a/deps/v8/src/objects/js-number-format.cc
-+++ b/deps/v8/src/objects/js-number-format.cc
-@@ -1197,42 +1197,31 @@ MaybeHandle<JSNumberFormat> JSNumberFormat::New(Isolate* isolate,
+diff --git a/src/objects/js-number-format.cc b/src/objects/js-number-format.cc
+index ad831c5c36..bcd44031d5 100644
+--- a/src/objects/js-number-format.cc
++++ b/src/objects/js-number-format.cc
+@@ -1241,44 +1241,33 @@ MaybeHandle<JSNumberFormat> JSNumberFormat::New(Isolate* isolate,
  }
  
  namespace {
@@ -50,7 +43,9 @@ index 92d3e2fb82e..ced408aa173 100644
 +    *formatted = number_format.formatDecimal(
          {big_int_string->ToCString().get(), big_int_string->length()}, status);
    } else {
-     double number = numeric_obj->Number();
+     double number = numeric_obj->IsNaN()
+                         ? std::numeric_limits<double>::quiet_NaN()
+                         : numeric_obj->Number();
 -    formatted = number_format.formatDouble(number, status);
 +    *formatted = number_format.formatDouble(number, status);
    }
@@ -63,21 +58,21 @@ index 92d3e2fb82e..ced408aa173 100644
 -  }
 -  if (fp_iter) {
 -    formatted.getAllFieldPositions(*fp_iter, status);
-+    THROW_NEW_ERROR_RETURN_VALUE(
-+        isolate, NewTypeError(MessageTemplate::kIcuError), Nothing<bool>());
-   }
+-  }
 -  icu::UnicodeString result = formatted.toString(status);
 -  if (U_FAILURE(status)) {
 -    THROW_NEW_ERROR_RETURN_VALUE(isolate,
 -                                 NewTypeError(MessageTemplate::kIcuError),
 -                                 Nothing<icu::UnicodeString>());
--  }
++    THROW_NEW_ERROR_RETURN_VALUE(
++        isolate, NewTypeError(MessageTemplate::kIcuError), Nothing<bool>());
+   }
 -  return Just(result);
 +  return Just(true);
  }
  
  }  // namespace
-@@ -1243,10 +1232,16 @@ MaybeHandle<String> JSNumberFormat::FormatNumeric(
+@@ -1289,10 +1278,16 @@ MaybeHandle<String> JSNumberFormat::FormatNumeric(
      Handle<Object> numeric_obj) {
    DCHECK(numeric_obj->IsNumeric());
  
@@ -97,7 +92,7 @@ index 92d3e2fb82e..ced408aa173 100644
  }
  
  namespace {
-@@ -1359,12 +1354,18 @@ std::vector<NumberFormatSpan> FlattenRegionsToParts(
+@@ -1405,12 +1400,18 @@ std::vector<NumberFormatSpan> FlattenRegionsToParts(
  }
  
  namespace {
@@ -119,7 +114,7 @@ index 92d3e2fb82e..ced408aa173 100644
    int index = start_index;
    if (length == 0) return Just(index);
  
-@@ -1373,13 +1374,14 @@ Maybe<int> ConstructParts(Isolate* isolate, const icu::UnicodeString& formatted,
+@@ -1419,13 +1420,14 @@ Maybe<int> ConstructParts(Isolate* isolate, const icu::UnicodeString& formatted,
    // other region covers some part of the formatted string. It's possible
    // there's another field with exactly the same begin and end as this backdrop,
    // in which case the backdrop's field_id of -1 will give it lower priority.
@@ -139,7 +134,7 @@ index 92d3e2fb82e..ced408aa173 100644
      }
    }
  
-@@ -1401,7 +1403,7 @@ Maybe<int> ConstructParts(Isolate* isolate, const icu::UnicodeString& formatted,
+@@ -1447,7 +1449,7 @@ Maybe<int> ConstructParts(Isolate* isolate, const icu::UnicodeString& formatted,
      Handle<String> substring;
      ASSIGN_RETURN_ON_EXCEPTION_VALUE(
          isolate, substring,
@@ -148,7 +143,7 @@ index 92d3e2fb82e..ced408aa173 100644
          Nothing<int>());
      Intl::AddElement(isolate, result, index, field_type_string, substring);
      ++index;
-@@ -1421,14 +1423,14 @@ MaybeHandle<JSArray> JSNumberFormat::FormatToParts(
+@@ -1467,20 +1469,19 @@ MaybeHandle<JSArray> JSNumberFormat::FormatToParts(
        number_format->icu_number_formatter().raw();
    CHECK_NOT_NULL(fmt);
  
@@ -159,11 +154,19 @@ index 92d3e2fb82e..ced408aa173 100644
 +  Maybe<bool> maybe_format =
 +      IcuFormatNumber(isolate, *fmt, numeric_obj, &formatted);
    MAYBE_RETURN(maybe_format, Handle<JSArray>());
+-
+   UErrorCode status = U_ZERO_ERROR;
++
+   bool style_is_unit =
+       Style::UNIT == StyleFromSkeleton(fmt->toSkeleton(status));
+   CHECK(U_SUCCESS(status));
  
    Handle<JSArray> result = factory->NewJSArray(0);
-   Maybe<int> maybe_format_to_parts = ConstructParts(
--      isolate, maybe_format.FromJust(), &fp_iter, result, 0, numeric_obj,
-+      isolate, &formatted, result, 0, numeric_obj,
-       number_format->style() == JSNumberFormat::Style::UNIT);
+-  Maybe<int> maybe_format_to_parts =
+-      ConstructParts(isolate, maybe_format.FromJust(), &fp_iter, result, 0,
+-                     numeric_obj, style_is_unit);
++  Maybe<int> maybe_format_to_parts = ConstructParts(
++      isolate, &formatted, result, 0, numeric_obj, style_is_unit);
    MAYBE_RETURN(maybe_format_to_parts, Handle<JSArray>());
  
+   return result;